Consumer Health Data Privacy Notice

1. What this Notice covers

"Consumer Health Data" means Personal Information that identifies or could reasonably be linked to a person or baby and that relates to or could be used to infer physical health, symptoms, feeding conditions, allergies, reactions, development, or healthcare. This may be broader than information people ordinarily think of as a medical record.

This is the same information our Privacy Policy calls "Health-Related Information." We use the term "Consumer Health Data" in this Notice to match the language of consumer health-data laws such as the Washington My Health My Data Act.

Consumer Health Data may include information about the adult user, a baby or child, another caretaker, or a family or household.

YummyYucky is not a healthcare provider and does not provide medical advice. However, some laws may still regulate health-related information maintained by a consumer app.

2. Consumer Health Data we may collect

Depending on the features you use, we may collect:

Feeding and nutrition information

• Foods and ingredients offered.
• Feeding dates and times.
• Preparation methods.
• Bottle and nursing information.
• Feeding preferences or difficulties.
• Notes about eating patterns.
• Food acceptance or rejection.

Allergen information

• Allergens introduced.
• Dates and times of introduction.
• Foods associated with an allergen.
• Allergen histories.
• Watch-window information.
• Caretaker notes about allergens.

Reaction and symptom information

• Possible symptoms or reactions.
• Date and time of a possible reaction.
• Description of severity.
• Photographs of a possible reaction.
• Vomiting, swelling, rash, unusual sleepiness, or other observations entered by a user.
• Notes about actions taken following a reaction.

Care and development information

Depending on how broadly applicable law defines health information, Consumer Health Data may also include sleep logs, diaper logs, milestones, nursing and bottle logs, growth or development notes, caretaker observations, information about medical or feeding concerns, and information intended to be shared with a healthcare professional.

Reports and inferences

We may create or display food histories, feeding summaries, allergen histories, reaction histories, watch windows, caretaker handoffs, shareable feeding and reaction summaries, suggestions based on logged foods, and other summaries generated from user-entered information. A summary or suggestion may itself be Consumer Health Data when it relates to an identifiable baby or person.

Technical information linked to health activity

Consumer Health Data may include technical information when it is linked with health-related activity, such as an account or device identifier linked to a reaction log, the date and time a health-related feature was used, or information showing that an identifiable user uses an allergen or reaction feature. We configure analytics not to receive private baby logs or Health-Related Information.

3. Sources of Consumer Health Data

We may collect Consumer Health Data from you, a Profile Owner, an invited caretaker, information generated from logs entered by users, a report or photograph uploaded by a user, a third party a user intentionally connects to YummyYucky in the future after appropriate notice, or a Service Provider acting on our behalf.

We do not purchase Consumer Health Data from data brokers. We do not collect Consumer Health Data by creating geofences around healthcare facilities.

4. Why we collect and use Consumer Health Data

We collect and use Consumer Health Data to provide the features requested by users, including saving feeding, allergen, reaction, and care logs; displaying information to authorized Profile Owners and caretakers; creating requested histories, reports, and summaries; providing watch-window and organizational reminders; supporting caretaker handoffs; personalizing food ideas and relevant app features; responding to support requests; correcting technical errors; securing accounts and baby profiles; investigating unauthorized access or misuse; complying with applicable law; and protecting users, babies, caretakers, and the Service.

We may use Deidentified Information to measure reliability, improve usability, evaluate safety and quality, understand general non-identifiable use, and develop general insights. We do not attempt to reidentify information that we treat as deidentified except to test whether our deidentification protections are effective or as permitted by law.

5. Consumer Health Data we share

Depending on how a law defines "share," we may share feeding and nutrition information, allergen information, reaction and symptom information, care and development information, reports and summaries, and account and technical information necessary to store, secure, transmit, or display the information.

We share Consumer Health Data only at a user's direction, with authorized Profile Owners or caretakers, with Service Providers necessary to provide a requested product or service, for security, fraud prevention, or support, when required or permitted by applicable law, or with additional affirmative consent where required.

6. Who may receive Consumer Health Data

Authorized Profile Owners and caretakers

Consumer Health Data may be visible to the people authorized to access the baby profile. A user may also intentionally share a report, screenshot, export, or message with a pediatrician or other healthcare professional, a daycare or childcare provider, a family member, another caretaker, or another person chosen by the user. YummyYucky cannot control a copy after it is shared outside the Service.

Service Providers

We use Service Providers to operate YummyYucky, including database and hosting providers, authentication providers, email and notification providers, security and infrastructure providers, and providers that help with data exports or user requests. Current providers include Supabase (database and authentication), Netlify (hosting and infrastructure), and Resend (email delivery). Push notifications are delivered through Apple (APNs), Google (FCM), or your browser's own web-push service. These providers may process Consumer Health Data only as needed to provide their services to us.

Stripe, Apple, and Google may receive subscription and payment information. We do not intentionally send them private feeding, allergen, reaction, or care logs as part of payment processing. Plausible provides limited analytics and is configured not to receive private Consumer Health Data.

Affiliates

YummyYucky has no affiliated companies, so we do not share Consumer Health Data with affiliates. If that changes, we will update this Notice and obtain any consent required by law.

Legal or safety recipients

Consumer Health Data may be disclosed to courts, government agencies, law-enforcement agencies, attorneys, security specialists, or other recipients when required or permitted by applicable law. We seek to limit legal and safety disclosures to what is reasonably necessary.

7. Consumer Health Data we sell

YummyYucky does not sell Consumer Health Data. We do not require you to authorize a sale of Consumer Health Data to receive the Service.

If YummyYucky ever proposes to sell Consumer Health Data, we will not rely on this Notice or acceptance of our Terms as permission. We would first provide a separate authorization that meets applicable legal requirements, identifying the information, buyer, purpose, expiration, revocation rights, and other legally required details.

8. Consent and requested services

We may collect or share Consumer Health Data when it is reasonably necessary to provide a product or feature you requested, or when you provide the consent required by applicable law.

Where we request consent, the request will explain the categories of Consumer Health Data involved, why the information is collected or shared, how it will be used, the categories of recipients, and how you may withdraw consent. Consent to share Consumer Health Data for an optional purpose will be separate from consent to collect it where applicable law requires separate consent.

We will not add a materially new category, purpose, or recipient and quietly apply it to existing Consumer Health Data when the law requires new consent.

9. Your Consumer Health Data rights

Depending on where you live, you may have the following rights.

Confirm and access

You may ask whether YummyYucky collects, uses, shares, or sells Consumer Health Data concerning you or a baby you are authorized to represent, and request access to that information.

Recipient list

You may request a list of third parties and affiliates with which YummyYucky shared or sold covered Consumer Health Data. Where required, we will provide available contact information for those recipients.

Withdraw consent

You may withdraw consent for future collection or sharing of Consumer Health Data. Withdrawing consent does not make earlier lawful processing unlawful, and it may prevent us from continuing to provide a feature that depends on the information.

Delete Consumer Health Data

You may request deletion of Consumer Health Data. Where required, we will delete covered information from active systems, notify relevant processors, contractors, affiliates, and third parties, direct those recipients to honor the deletion request, and delete information from backups within the period required by applicable law. Deletion may be limited where information must be preserved for security, fraud prevention, legal compliance, a legal claim, or another applicable exception.

Correct information

You may correct information using available account and profile tools or by contacting us. Because many logs are entered by users, you should review them for accuracy before relying on or sharing them.

Appeal

If we refuse to act on all or part of a request, you may appeal the decision.

10. How to exercise a right

You may submit a request through available account, profile, export, or deletion controls, or by emailing hello@yummyyuc.ky with the subject line "Consumer Health Data Request." Please include the email address connected to the account, the baby profile involved if applicable, the right you want to exercise, and enough information for us to understand the request.

We may verify your identity and your authority to act for a baby profile. We will not ask for more verification information than reasonably necessary.

We respond within the period required by applicable law. Where permitted, we may extend the response period and will explain the extension. We generally do not charge a fee, but may charge a reasonable fee or decline a request where applicable law allows because a request is manifestly unfounded, excessive, or repetitive.

11. Appeals

To appeal a refusal, email hello@yummyyuc.ky with the subject line "Consumer Health Data Appeal" and an explanation of why you believe the decision should be reconsidered.

The appeal will be reviewed by a person who was not solely responsible for the original decision where reasonably practicable. We will provide a written decision within the period required by applicable law. If we deny an appeal, we will explain how to contact the appropriate attorney general or regulator where required.

12. Deletion and shared profiles

A deletion request must account for the user's role. If you are a Profile Owner, you may be able to request deletion of a profile and its logs.

If another authorized Profile Owner continues to manage the same profile, we may need to verify the request, notify the other Profile Owner, resolve conflicting instructions, delete only the requesting person's information, or preserve limited records where legally necessary.

If you are an invited caretaker, deleting your account normally removes your access but does not automatically delete a baby profile owned by another person. We cannot delete copies another person previously exported, printed, photographed, or shared outside YummyYucky.

13. Security and access limits

We limit access to Consumer Health Data to personnel and Service Providers that reasonably need access to provide a requested service, support a user, secure the Service, investigate misuse, or meet a legal obligation.

We maintain reasonable administrative, technical, and physical safeguards appropriate to the nature and amount of Consumer Health Data. No system can be guaranteed perfectly secure.

14. Changes to this Notice

We may update this Notice as the Service or applicable law changes. We will not collect, use, or share an undisclosed category of Consumer Health Data for a materially new purpose without first providing additional notice and obtaining affirmative consent where required. The effective date appears at the top.

15. Contact us

Questions and Consumer Health Data requests may be sent to:

YummyYucky LLC
United States

• Email: hello@yummyyuc.ky
• Telephone: (323) 986-6948

Please do not send detailed reaction photographs, medical records, or other sensitive information through ordinary email unless we specifically request them through an appropriate method.

See also our Privacy Policy and Terms.