Consumer Health Data Policy

1. What counts as consumer health data here

We only ever hold health data you typed in or uploaded yourself. Specifically:

• Supplements and medications you enter into the checker, save in a stack, or add to your cabinet
• Health profile: medical conditions, medications, allergies, age range, sex, pregnancy status, and any concerns you type in
• Derived genetic data: the nutrition-relevant variants and genotypes extracted from a raw DNA file you upload. The raw file itself is parsed in memory and never stored.
• Bodily and dietary inputs you give a tool: food in your kitchen, dietary restrictions, eating window
• Supplement label photos you scan. These are processed in the moment and never stored.

We do not collect health data from any other source. We do not buy it, we do not infer it from your browsing, and we do not receive it from third parties.

2. Why we collect it

• To generate the interaction analysis, timing guidance, DNA report and meal plan you asked for
• To warn you about interactions specific to your conditions and medications
• To keep your saved stacks and re-score them when you ask, or on the monthly schedule you opted into

That is the whole list. We do not use health data for advertising, profiling, training our own models, or any purpose you did not ask for.

3. Who we share it with

We do not sell consumer health data. We have never sold it, and we will not — no monetary or other valuable consideration, to anyone. We therefore do not collect the separate written authorizations that a sale would require under MHMDA, because there are no sales to authorize.

We share it only with the processors that run the service:

• Supabase — stores your account, health profile, saved stacks and derived gene results
• OpenAI — receives the items you entered and, when you have saved them, your conditions, medications, allergies, age range, sex and derived gene variants, in order to generate the analysis text. Under OpenAI's API terms that data is not used to train their models. We do not send your name, email or account id.
• Railway — hosts the application and its logs
• Forward Email — sends the emails you opted into, which can name the stacks you saved

These are service providers acting on our instructions, not independent recipients. Google Analytics measures site usage and is described in section 7 of the Privacy Policy, including how to opt out; your health profile and gene results are never sent to it.

We also disclose health data if the law compels us to, or to protect someone from harm. If that ever happens and we are permitted to tell you, we will.

4. How long we keep it

Until you delete it. There is no automatic expiry — your health profile, saved stacks and derived gene results stay in your account until you remove them or delete your account, and then they are gone immediately. Raw DNA files and label photos are never stored at all.

5. Your rights

• Confirm and access. Profile → Account → Export my data gives you everything we hold, including the list of processors above.
• Delete. Profile → Account → Delete my account permanently erases your health profile, gene results, saved stacks, cabinet, kitchen and login — immediately, with no copy kept. To delete only your gene results, use the Delete button on the DNA page. Under MHMDA we also pass a deletion request to our processors.
• Withdraw consent. Deleting the data withdraws the consent you gave when you saved it. You can also withdraw by emailing us, and we will delete it for you.
• Appeal. If we refuse a request, we will tell you why and how to appeal. If we deny the appeal you may complain to the Washington Attorney General at atg.wa.gov/file-complaint, or to your own state's regulator.

To exercise any of these by email, or to ask us to do it for you, write to hello@canistackthis.com. We will verify that the request comes from the account holder, and respond within 45 days. There is no charge, and using these rights never degrades the service you get.

6. Changes

If we change how we handle consumer health data we will update this page and its date, and we will not apply a materially different practice to data we already hold without asking you first.

7. Contact