Consumer Health Data Privacy Policy

Effective date: October 22, 2026

Version: 1.0

This is Aleré's standalone Consumer Health Data Privacy Policy, required by Washington's My Health My Data Act (MHMDA) and similar state consumer-health-data laws. It is separate from — and more detailed than, for health data specifically — Aleré's general Privacy Policy. Aleré is a cash-pay wellness app; because it does not bill insurance, it is not a HIPAA covered entity, so this policy — not HIPAA — is what governs how your health data is handled.

What counts as "consumer health data" here

Under MHMDA, consumer health data is personal information that identifies a consumer's physical or mental health status. In Aleré, that includes the categories in the table below.

Categories, sources, and purposes

Category	Source	Purpose
Health profile — age, sex, height, weight, waist/hip measurements, lab values (e.g. fasting glucose, HbA1c), lifestyle answers, dietary identity, goals	Entered by you during onboarding	Estimate insulin sensitivity and personalize wellness guidance
Health history — steps, sleep, heart-rate variability, resting heart rate, glucose readings, body measurements	Apple Health / Health Connect, if you connect them	Personalize wellness estimates and companion insights
Meal log and photos — meal entries, macros, predicted glucose response, meal photos	Logged or photographed by you	Estimate glucose response to meals; build your meal history
Scans and bio-logs — CGM screenshots, lab-report photos, typed or spoken health notes	Captured by you when you use a scan/log feature	Extract structured health values for your record and analysis (only when AI analysis is enabled and you consent)
Chat content with health context — messages you send the Alis assistant	Typed by you	Answer your questions and give in-context guidance
Calendar-derived stress category — a redacted event category (e.g. "meeting") and time, never the title/notes/location/attendees	Your device calendar, only if you opt in	Notice recurring-event / stress patterns, on-device only
Community progress numbers — streak, points, metabolic-age trend	Derived from your app usage, only if you join Community	Show your progress to friends who accepted your request, while you keep sharing on

Who this data is shared with

Google (Gemini API) — the specific content you submit for a scan or chat (meal photos, CGM/lab images, bio-log text or audio, chat messages) is sent to Google's Gemini API for one-time processing, either directly or by way of Aleré's own backend relay, only after you consent, and only while AI features are enabled. Google processes it under Google's own API terms and privacy policy.
Supabase — Aleré's database and backend host (United States), acting strictly as Aleré's data processor. Supabase stores the encrypted backup of your health profile, health history, meal log, and learned patterns, and (if you join Community) your Community profile and shared stats.
Nobody else. Aleré does not share, disclose, or sell consumer health data to advertisers, data brokers, analytics vendors, or any other third party. There is no "sale" pathway in the app.

Consent

Collecting your health data and sharing specific content with Google for AI analysis are treated as separate consents, never bundled into one blanket agreement:

You are asked to agree before the first AI request that would send your content to Google's Gemini API; you can decline and keep using the app's non-AI features.
Consent can be withdrawn at any time by turning AI features off; no further content is sent to Google after withdrawal.
Using a de-identified copy of your data to improve Aleré's predictions is a separate, optional consent, off by default (see "Research to improve our predictions" below).
Aleré does not sell consumer health data, so there is no separate "sale" consent to give.

Research to improve our predictions (optional)

If you choose to take part (Profile → Your data → Research sharing), we use a de-identified copy of some of your health data, including data recorded since you started using Aleré, to improve the models that power Aleré's predictions for all members. Taking part is optional and separate from your other consents, and Aleré works the same whether or not you take part.

What we use: meal macronutrients and timing; glucose readings and the glucose curves we predicted; sleep, heart rate, heart-rate variability, steps and activity; and your age range, sex, body measurements and lab results in ranges, and your selected goal.
What we do not use: your name, contact details, account or device identifiers, location, calendar dates, photos you upload, your conversations with Alis, or your calendar.
How we protect it: research data is stored separately from your account under a random code, encrypted, and accessible only to the people and systems that need it for this purpose, with access logged. It is processed only by Aleré on our cloud provider's infrastructure (currently Supabase). We do not sell research data, use it for advertising, or share it with outside AI model providers or any other third party.
Your choice: you can stop taking part at any time in Profile → Your data or by contacting us. We will stop using your data for research and delete your research data within 45 days. Models already improved using past data are not retrained, but your data itself is deleted.

Your rights and how to exercise them, in the app

Access / know what we hold — Profile → Export / Download your data produces a file with your health profile, health record, meal log, health history, and learned patterns. (Chat messages and photo files are not included in the export file.)
Delete — Profile → Delete account deletes the server backup of your health data, then permanently erases your account, health profile, meal timeline, and chat history from your device. If you joined Community, contact us (below) to remove that separate Community account.
Withdraw consent — turn AI features off at any time (the setting that governs whether content is sent to Google); turn off Encrypted backup to stop and delete the server backup; leave Community or turn off sharing to stop sharing progress numbers.
Appeal — if you believe a request was not honored, contact us at the address below.

Deletion timing: in the app, Delete Account & Data takes effect immediately. As a backstop commitment consistent with MHMDA, any consumer health data deletion request will be completed within 45 days at the outside.

Health disclaimer

Aleré provides wellness estimates for informational purposes only. Predicted glucose responses and other outputs are estimates, not measurements, and Aleré is not a medical device. Aleré does not provide medical advice, diagnosis, or treatment. Consult a healthcare professional before making health decisions.

Retention

Your health data is retained on your device, and in the server backup described above, for as long as you use the app and keep backup enabled. It is deleted on request as described above, and it is not retained longer than needed for the purposes listed in this policy.

Children

Aleré is for adults 18 and older. It is not directed at anyone under 18 and should not be used by them.

Changes to this policy

If this policy changes materially, we will update the "Effective date" above and, where required, notify you in the app.

Contact

Questions, access, deletion, or consent-withdrawal requests regarding consumer health data: privacy@alerelabs.ai