Consumer Health Data Privacy Policy

What consumer health data means

Saura is a nutrition and food-tracking service, not a medical provider or clinical service. Some U.S. state laws nevertheless define consumer health data broadly enough to cover nutrition, wellness, body, goal, allergy, and inferred information.

Consumer health data is personal information that identifies you, or can reasonably be linked to you, and identifies your past, present, or future physical or mental health status. It includes information inferred from other data. Saura treats the nutrition and wellness information described below as consumer health data when applicable law covers it.

Age eligibility

The Saura app and consumer account are intended only for people aged 16 or older. Saura does not offer an under-16 guardian-consent flow. If you believe a child under 16 has provided consumer health data to Saura, contact privacy@saura.health.

Consumer health data we collect

Depending on the features you choose, we may collect:

• account, device, and app identifiers linked to consumer health data;
• age, sex, height, weight, activity level, and related body or lifestyle measurements;
• nutrition, weight-management, muscle-building, cholesterol, dietary, health, and wellness goals;
• meal photos and descriptions, meal times, ingredients, nutrition estimates, corrections, preferences, restrictions, and allergies;
• nutrition targets, scores, trends, recommendations, and other information derived or inferred from the data above;
• messages and feedback about meals, nutrition, health, or wellness; and
• product-use information when it reveals or is linked to your use of nutrition or health features.

Sources of consumer health data

• you, including information and images you submit;
• your interactions with Saura's app and services;
• processors and service providers acting for Saura, including providers supporting your account or purchase; and
• Saura's calculations and inferences, such as nutrition estimates, targets, trends, and recommendations.

Why we collect and use consumer health data

We collect and use consumer health data to:

• provide the meal-analysis, nutrition-tracking, goal-setting, recommendation, memory, and subscription features you request;
• personalize targets, analysis, feedback, and app experiences;
• save your history and synchronize it across devices;
• respond to support requests, diagnose errors, prevent fraud, and secure Saura;
• operate subscriptions and determine feature access; and
• understand and improve Saura using appropriately protected, aggregated, or deidentified information.

We collect consumer health data with your consent when required, or where collection is necessary to provide a product or service you requested. We do not use consumer health data for a materially different purpose without first updating this policy and obtaining consent when required.

Consumer health data we share

We disclose only the categories reasonably necessary for the relevant feature or purpose. Recipients may include:

• Account, database, and storage providers: Supabase may process account identifiers, submitted profile and health-related data, meal records, images, and derived results.
• Cloud, AI, and vector providers: Google Cloud and Vertex AI, Anthropic, OpenAI, and Turbopuffer may process submitted meal information, images, prompts, corrections, derived text, and per-user embeddings when needed for the feature you request.
• Subscription providers: Apple and RevenueCat may process account or device identifiers, product, transaction, entitlement, and subscription status. They do not need meal content or body measurements to operate a subscription.
• Analytics and reliability providers: PostHog may process your user ID, email, product goal, meal-count milestones, and app interactions. Sentry may process a user ID, device diagnostics, crash context, and errors. Google/Firebase may process consented device, attribution, conversion, and product-use data. We do not intentionally send meal photos or descriptions, nutrition values, body measurements, allergy or restriction values, or laboratory results to advertising networks for personalized advertising.
• Legal and corporate recipients: professional advisers, regulators, courts, law enforcement, or a successor in a corporate transaction where permitted or required by law.

Saura Health Oy has no affiliates with which it shares consumer health data as of the effective date. We do not sell consumer health data. We do not use consumer health data for targeted advertising, and we do not geofence health-care facilities to identify, track, collect data from, or send messages to consumers.

Apple, Google/Firebase, and other platform providers may collect non-health device or interaction information over time and across apps or websites for attribution or advertising measurement when you permit it. Saura does not authorize those providers to use Saura consumer health data for that purpose.

Your consumer health data rights

Subject to applicable law, you may ask us to:

• confirm whether we collect, share, or sell your consumer health data and access that data;
• identify the third parties and affiliates with which your consumer health data has been shared, including contact information where the law requires it;
• correct inaccurate consumer health data;
• withdraw consent to future collection or sharing; or
• delete consumer health data from our active systems and direct processors and other recipients to honor the deletion request. Deletion from archived or backup systems may take up to six months where permitted by law.

Submit a request through our Privacy Choices page or email privacy@saura.health with the subject “Consumer Health Data Request.” We may take reasonable steps to authenticate your request. We do not charge for a request except where applicable law allows it.

We will respond within 45 days. When reasonably necessary and permitted by law, we may extend that period once by up to 45 additional days and will explain the extension. If we deny your request, appeal by replying with the subject “Consumer Health Data Appeal.” We will decide the appeal within 45 days. If an appeal is denied, Washington consumers may contact the Washington Attorney General.

Security and access controls

We restrict access to consumer health data to personnel and processors that need it for the purposes described above. We use administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of consumer health data.

Changes to this policy

We will post material changes before they take effect. When required, we will notify affected consumers and obtain affirmative consent before collecting additional categories of consumer health data or using it for additional purposes.

Contact

Saura Health Oy
Privacy contact: Tatu Koivisto
Email: privacy@saura.health