Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how DNK PROJECT LLC, 2495 S Mason Rd, 1228, Katy, TX 77450, United States ("we", "us", "our"), collects, uses and shares consumer health data through the Kotchi app and website. It is written for the Washington My Health My Data Act, Nevada Senate Bill 370 and the Connecticut Data Privacy Act, but we apply it to all Kotchi users, wherever they live.

"Consumer health data" means personal information that is linked or reasonably linkable to you and identifies your past, present or future physical or mental health status. This policy is part of our Privacy Policy (kotchi.app/en/legal/privacy/), which describes our handling of all other personal data.

• •Body data: sex, date of birth, height, current and target weight, and body measurements such as waist and hips.
• •Food and nutrition: your food diary, meal photos and voice notes, calorie and nutrient intake, allergies and intolerances.
• •Health conditions and treatment: chronic conditions, medications and supplements you choose to tell us about.
• •Wellbeing: the topics you select in the questionnaire, such as energy, sleep, bloating, body confidence or sex life.
• •Reproductive health: menstrual cycle marks (period and PMS days) and, if you choose to tell us, menopause or pregnancy — only if you use the Cycle section.
• •Physical activity: daily steps from Apple Health or Health Connect, activity level and workout progress.
• •Body photos you upload for the goal photo and progress timeline, and the AI-generated goal photo.
• •Health information you share with your coach in the chat, including in voice messages, photos and videos.
• •Inferences we derive from the above: your calorie and nutrition targets, personal plan and progress.

We do not collect biometric data: we do not use your photos or voice to identify you. We do not collect precise location data and do not use geofencing.

• •You — when you answer the questionnaire, log meals and measurements, upload photos or write to your coach.
• •Apple Health or Health Connect on your device — your daily step count, only if you allow it.
• •Your coach — adjustments to your plan based on what you share.
• •Our systems and AI tools — calorie estimates, targets and other inferences from the data above.

We collect and use consumer health data only to provide the Kotchi service you asked for:

• •To build and adjust your personal nutrition plan and calorie targets.
• •To recognize the food you log and keep your diary.
• •To let your coach follow your progress and support you in the chat.
• •To show your progress, daily report and goal photo.
• •To keep the Service secure and fix errors.

We do not use consumer health data for advertising, we do not sell it, and we do not use it to train AI models.

We collect consumer health data only with your consent. When you create an account, you give separate consent to this policy, apart from accepting our Terms of Use and Privacy Policy. Access to Apple Health or Health Connect, the camera, microphone and photos is requested separately by your device, and you can refuse or revoke it at any time.

Your consent covers collecting your health data and sharing it with the service providers listed in section 6 so they can process it for us. We will ask for your separate consent before we use it for any other purpose or share it with anyone else, except where the law requires disclosure.

You can withdraw your consent at any time. Because Kotchi cannot work without health data, withdrawing consent means deleting your account — in the App (Settings → Delete account) or by emailing [email protected]. You can also stop sharing particular data at any time: revoke Apple Health or Health Connect access, hide the Cycle section, or delete individual entries and photos.

Your coach and our support staff, who are part of our team, see the health data they need to work with you. Some of them work outside the United States; they access your data remotely through our admin tools, and the data stays stored on our servers in the United States.

We share consumer health data only with service providers (processors) that process it on our behalf and under our instructions:

• •Vultr — servers and database that store your data (United States, New Jersey).
• •Cloudflare — file storage (Cloudflare R2) for photos and voice recordings, and content delivery.
• •OpenRouter and the AI model providers it routes requests to — food recognition from photos and voice, voice transcription, goal photo checks and generation, chat translation, and chat summaries and draft replies for coaches.
• •OpenAI — embeddings of chat messages used to find relevant articles for coach replies.
• •Google Firebase Cloud Messaging — delivering push notifications, which may include text of messages from your coach.
• •Amazon Web Services (Amazon SES) — emails, such as sign-in codes; these do not contain your health data.

We do not share consumer health data with third parties for their own purposes, and we do not share it with affiliates. We may disclose it if the law requires it, for example under a valid court order.

We do not sell consumer health data, and we do not use geofencing around healthcare facilities.

Whatever state you live in, you can:

• •Confirm whether we collect, share or sell your consumer health data, and access it, including a list of all third parties and processors with whom we have shared it and their contact information.
• •Delete your consumer health data. We delete it from our live systems and ask our processors to delete it as well; copies in our backups are removed as backups are rotated.
• •Withdraw your consent to the collection and sharing of your consumer health data (see section 5).
• •Appeal our decision on your request.

We will not discriminate against you for exercising these rights.

Email [email protected] from your account's email address and tell us what you want to do. To delete everything, you can also delete your account in the App (Settings → Delete account). We verify requests by matching them to your account email and may ask for more information if needed. You can use an authorized agent; we will ask for your signed permission.

We respond within 45 days of receiving your request. If we need more time, we will tell you and may extend this by another 45 days. Requests are free of charge.

If we decline your request, you can appeal by replying to our decision or by emailing [email protected] with the subject "Appeal". We will respond to the appeal within 45 days and explain our decision. If your appeal is denied, you can contact the Attorney General of your state (for example, Washington, Nevada or Connecticut).

Access to consumer health data is limited to the people on our team who need it for their work. We protect it with encrypted connections, access controls and personal staff accounts. We keep it while your account exists and erase it when you delete your account, as described in the Privacy Policy.

We may update this policy. We will change the "Last updated" date, and if the changes are material we will tell you in the App or by email before they take effect. If a change means collecting or sharing consumer health data for a new purpose, we will ask for your consent first.

Questions and requests: [email protected]. DNK PROJECT LLC, 2495 S Mason Rd, 1228, Katy, TX 77450, United States.