Consumer Health Data Privacy Policy

1. Purpose of this policy

This policy supplements our Privacy Policy and applies to consumer health data under the Washington My Health My Data Act and the Nevada consumer health data law (SB 370). Pepbite is a GLP-1 wellness tracker operated by Daniela Šimková. Contact: privacy@pepbite.com. Pepbite is a wellness tracker, not a medical device, and does not give medical advice.

2. Health data that stays on your device

Your medications and doses, weight and measurements, logged meals, symptoms, notes, progress photos and scan history are stored only on your iPhone. Apple Health data you choose to share is only read on your device. We do not collect or receive these records. See section 2 of the Privacy Policy.

3. Consumer health data that can reach us or our providers

• AI meal photo and result: with your consent, a meal photo (location and other metadata removed) is sent for analysis. It does not include your medications, weight or other records. The analysis result is kept on our server for up to 24 hours so it can be recovered if your connection drops, and a short technical record of each scan (no photo or meal content) is linked to your account; see the Privacy Policy, section 3.
• Account and purchase information: your Sign in with Apple identifier and email address (if you create an account), and subscription status handled through RevenueCat. Because Pepbite is a GLP-1 tracker, the fact that you have an account or subscription may suggest a health context.
• Usage and crash data (optional): only if the "Share usage and crash data" switch is on, product events and technical crash reports as described in section 3 of the Privacy Policy. They exclude health values, meal or food names, medication or dose details, symptoms and Apple Health data.
• Install and subscription events (only if you allow tracking): that the app was installed or opened and that a trial, purchase or renewal happened, with advertising and device identifiers. These events are not health records, but because Pepbite is a GLP-1 tracker they may imply health information about you. See section 5 of the Privacy Policy.

Pepbite never sends Meta your medications, doses, weight, meals, photos, symptoms, Apple Health data, onboarding answers, scan data or email address.

4. Sources

Directly from you through the app (account, purchases, scan photos, your settings and choices), from your device (technical device information and, only if you allow tracking, the advertising identifier), and from Apple's subscription system through RevenueCat.

5. Why we collect and use it

• to provide the app features you ask for — AI meal analysis, account sign-in, and subscriptions and access to paid features;
• to keep the service stable and secure, fix errors, control costs and prevent abuse;
• if you switch it on, to understand how the app is used and fix crashes; and
• if you allow tracking, to measure which Facebook and Instagram ads lead to installs and subscriptions.

6. Who receives it

• AI analysis provider: receives the meal photo you choose to scan, with zero data retention.
• RevenueCat: our subscription provider; receives account and purchase data, and, only if you allow tracking and are signed in, advertising and device identifiers and the Meta anonymous identifier.
• Meta: only if you allow tracking, receives install and open events and subscription events (trial started, trial converted, initial purchase, renewal) as an independent controller under its own privacy policy.
• PostHog and Sentry: only if the "Share usage and crash data" switch is on, receive product events and crash reports.
• Hosting and network providers that carry app traffic, and Apple for sign-in and payments.
• Authorities: where the law requires it.

We do not sell consumer health data, and we do not share it for any other purpose than those described here. Retention is described in the Privacy Policy.

7. Your consent and how to withdraw it

• AI meal scan: we ask for your consent before the first scan. Withdraw it in the app at any time; manual logging keeps working.
• Usage and crash data: turn the "Share usage and crash data" switch off in Profile → Privacy.
• Meta ad measurement: asked once through Apple's tracking prompt; choosing "Ask App Not to Track" sends nothing to Meta. Withdraw at any time in iOS Settings → Privacy & Security → Tracking. RevenueCat learns of the change only the next time you open the app while signed in to the same account with an internet connection; until then, including while you stay signed out, renewals may still be reported. Deleting your account stops these reports.

8. Your rights

As a Washington or Nevada consumer you can ask us to confirm whether we collect your consumer health data and to give you access to it, including a list of third parties and affiliates it has been shared with; to delete it; and to withdraw consent. You can delete your account in the app, which deletes your account data on our servers and at our subscription provider. You can also email privacy@pepbite.com, including to ask us to delete advertising identifiers held in RevenueCat. We will respond within the time required by law. If we refuse a request you may appeal by replying to our answer, and you may contact your state Attorney General.

9. Changes

We will post updates on this page and change the date above.