Consumer Health Data Privacy Policy

• Food allergies and sensitivities you add, such as peanut, shellfish, or gluten.
• Dietary restrictions that may relate to health, such as gluten-free, dairy-free, or low-sodium.
• Inferences we derive from that information, such as allergen warnings on dishes and match scores that take your restrictions into account.

We don't use location to identify visits to health care providers or facilities, and we don't collect medical records, diagnoses, or biometric data.

You give it to us when you set up your taste profile or edit your dietary preferences. We derive inferences from it inside Palytt. We don't buy consumer health data or collect it from other companies.

• Filtering and flagging dishes and restaurants that may not suit your restrictions.
• Showing possible-allergen warnings and calculating personalized match scores.
• Powering AI features you've consented to, such as Pal's notes and dish recommendations.
• Keeping the Service secure and meeting legal obligations.

We don't use consumer health data for advertising, we don't sell it, and we don't include your specific allergies or restrictions in analytics events. We don't show your allergies or restrictions to other users unless you choose to share them in a feature that tells you they'll be visible.

We collect consumer health data only with your consent, which you give when you choose to add allergies or dietary restrictions, and we use it only to provide the features described above. You can withdraw consent at any time by removing that information in the app or by emailing privacy@palytt.com. If you withdraw consent, we'll stop collecting and using it and delete what we have, and features that depend on it will stop working for you.

We share consumer health data only with service providers (processors) that help us run Palytt, under contracts that limit their use of it to providing services to us:

• Data storage and hosting: Convex, our hosted PostgreSQL database, Fly.io, and Redis.
• AI processing (only if you've consented to AI features): OpenRouter, which routes requests to AI model providers (Google Gemini, OpenAI, Anthropic, and xAI). We configure OpenRouter to exclude providers that retain prompts or train on them.

We may also disclose consumer health data when required by law. We don't share it with any other third parties or affiliates, and we'd ask for your separate consent before doing so.

• Confirm whether we collect, share, or sell your consumer health data, and get access to it, including a list of all third parties and affiliates it has been shared with and how to contact them.
• Withdraw your consent to our collection and sharing of it.
• Have it deleted, including from our service providers' systems and, within 90 days, from backups.
• Appeal if we decline your request.

To use these rights, email privacy@palytt.com from the email address on your account (or include your account's phone number). You can also edit or remove allergies and dietary restrictions in the app at any time. We'll verify your request, respond within 45 days, and tell you if we need up to another 45 days. To appeal a decision, reply to it or email privacy@palytt.com with the subject "Health data appeal"; we'll respond within 45 days. If your appeal is denied, you may contact your state attorney general — in Washington, at atg.wa.gov/file-complaint. We won't discriminate against you for exercising these rights.

Access to consumer health data is limited to Palytt personnel and service providers who need it to provide the Service, and it's protected with the safeguards described in our Privacy Policy.

Palytt Inc.
Email: privacy@palytt.com