Consumer Health Data Policy

1. What this document is

Washington’s My Health My Data Act requires a company that handles consumer health data to publish a policy about that data on its own, separate from any other privacy policy, and to link to it separately. This is that document.

It is written to stand alone. You should not have to read anything else to find out what health data we hold, where it came from, why we have it, who else touches it, and how to make us delete it — so all of that is here, in full, even where it repeats something the Privacy Policy also says. Where the two ever appear to disagree about consumer health data, tell us and we will fix the document that is wrong.

It applies to everyone. Washington and Nevada residents have specific statutory rights, set out in §9 and §10; the rest of it — what we collect, from where, why, and who receives it — is simply true of everybody, and it would be strange to describe our own product differently depending on who is reading.

2. Who we are

Codes L.L.C., a limited liability company registered in the Republic of Kosovo at Kodra e Diellit, H 1/2, Nr. 22, Prishtinë, company number 810858003, trading as Eira. We decide what data Eira collects and why.

• Health-data requests and questions: legal@eira.coach, or the contact form.
• Everything else: hello@eira.coach.

A person reads both. We do not run a ticket system that answers you with a robot.

Eira is an iPhone app with an Apple Watch companion, plus this website. Eira is for adults — you must be 18 or over to use it, and we do not knowingly collect health data from anyone younger.

3. What counts as consumer health data here

The statutory definition is broad: personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. It expressly includes things like bodily functions, vital signs, measurements taken about you, use or purchase of medication, and data that identifies you as someone seeking health services.

We are not going to argue about the edges of that, so we take the wide reading:

• Everything you log in the app is consumer health data. A food diary is a record of what you put into your body. So are weight, water, an eating window, a mood tag and a nutrient-floors mode.
• What Eira derives from it is too — the remembered facts, the summaries, the coaching conversation.
• Joining the early-access list counts. An email address on a list whose entire purpose is “tell me when this nutrition and wellness app opens” identifies you as someone looking for a service of that kind. That is a narrow disclosure to have to make about an email address, and we would rather make it than argue we did not have to.
• A message you send us through the contact form counts if it says anything about your health — and people do write to us saying “I have coeliac disease, does Eira handle that”. That message is health data from the moment you send it.

4. The consumer health data we collect

4.1 In the app

• Your food record. Meals and their times, how each was logged (photo, voice, barcode, search, manual, repeat, Watch, widget, Siri), and for each item the food’s name, the nutrition database it matched, the portion in grams, and the resulting energy, protein, carbohydrate, fat and fibre plus eight micronutrients. Recipes you build. Water you log.
• Meal and label photographs, and the structured result of the AI’s reading of them — what it identified, its portion estimate, its confidence, its stated assumptions — together with your corrections to any of it.
• Weight over time, entered by you or read from Apple Health with your permission.
• Body measurements, if you give them: sex, height, and year of birth. These exist because the energy-estimation formula needs them and for no other reason.
• Your date of birth, given once, used to check that you are 18 or over. The check is write-once — a second submission is refused — but the date is not: you can correct it in the app, and clearing your body measurements clears it too. Correcting it does not re-take the check.
• Mood and context of eating, if you turn it on — it is off by default. Up to eight fixed words per meal (hungry, stressed/anxious, tired, bored, sad, social, celebrating, craving) and an optional free-text note. The note is the most sensitive field in the product. No person reads it and no AI model is sent it: it is excluded from every aggregate, every AI prompt and every log line, and the only place it is ever returned is your own export. One automated check does read it, and we ask your consent for it in the app rather than only disclosing it here — as the note is saved, our own server checks its words against a fixed list of phrases that read as distress or as difficulty with eating, so that crisis and eating-disorder support lines can be offered underneath the meal you just saved (§6). It is a list of words rather than a model or a clinician; its outcome is never stored, never added to your record and never sent to anyone, and the only trace it leaves anywhere is a bare count that the check fired at all — not for whom, and not which of the two it was; and it never blocks, delays or changes what you logged. Because it adds nothing beside the note, there is nothing extra to delete: clearing the note, or deleting your account (§8, §9.4), leaves nothing of it behind. The same check reads your coaching chat messages.
• Nutrient-floors mode, if you turn it on: the fact that the mode is on, so Eira leads your day with protein, fluid and fibre minimums for times when your appetite is low. The nutrient-floors feature does not ask for, and does not record, any medication, molecule or diagnosis. While the mode is on you can also tell us, as a single yes-or-no fact, that a clinician has asked you to limit your protein — held so Eira leads with a protein reading rather than a minimum, and cleared when you leave the mode. We store the yes-or-no answer only, never the reason or condition behind it. Until 11 August 2026 the mode also asked which medication you took and stored it; that question was removed and the stored values were erased from our live database on 11 August 2026, though exports issued before then still hold what was kept and copies may persist in backups until they age out (§8).
• A medication you volunteer elsewhere. No feature asks you for one, but you can still write a medication into a coaching chat, a meal note, or your supplement ledger. If you do, we hold what you wrote — as consumer health data, on the same terms as anything else you record there.
• Your supplement ledger, if you keep one: the name of each supplement in your own words, the dose as you wrote it, the times of day you take it, and a log of when you marked it taken. Eira never recommends, sizes, schedules or evaluates any of it; it is a record you author.
• Apple Health activity and sleep, if you connect it: your step count, Apple exercise minutes, stand hours, sleep, and finished workouts (with their walking/running, cycling and swimming distances). We do not read active or basal energy burned.
• Eating window, if you turn it on: your protocol and each timer you run, plus the single yes-or-no fact that you acknowledged the health warning before the first one. We do not store which of the listed conditions, if any, applies to you.
• Goals and targets, including energy targets Eira proposed and whether you accepted them.
• What Eira remembers about you — effective-dated facts about your habits, preferences and constraints; weekly summaries; and numerical embeddings used to retrieve the right memory at the right moment. An embedding derived from health data is still health data and we treat it as such.
• Coaching conversations — the daily message Eira writes, your chat messages and its replies, and the summaries derived from them.

4.2 On the website

• The early-access list, if you join it: your first name, your last name if you gave one, your email address, and the record of your consent — the exact wording you agreed to, its version, and the moment you agreed. Nothing else, and nothing from the app.
• A message you send through the contact form: your first name, your last name, your email address, and what you wrote. Please send only what you need to; but if what you need to say concerns your health, this document covers it.
• Ordinary connection metadata for the two forms — your IP address, your browser’s user-agent, the page you came from, a request identifier, and the country inferred from the connection — held by our host in the course of serving the request. On its own it says nothing about your health; attached to a submission on a nutrition app’s website, we treat it as covered.

4.3 What we never collect

No precise location, ever — we never request the permission, and GPS data is stripped from every photograph before it is stored. No audio: voice logging is transcribed on your device and the recording never leaves it. No contacts, no scanning of your photo library, no advertising identifier, no device fingerprint. No biometric identifiers — no face template, fingerprint, voiceprint or iris scan. No payment credentials: Apple bills you and we never see a card. And no data bought from a broker or added to your record from anywhere else.

5. Where it comes from

• From you, directly: everything you type, photograph, speak, scan, tag or choose. This is the overwhelming majority of it.
• From your device, with your permission, one feature at a time: Apple Health (weight and dietary water, and — if you connect the activity-and-sleep feature — your steps, exercise minutes, stand hours, sleep and finished workouts), the camera, and on-device speech recognition. You can refuse all of them and keep using Eira with less to go on.
• From Apple: your Sign in with Apple identifier and the email address Apple relays to us, which may be a private relay address we cannot resolve to your real one; and your subscription status.
• From us: the remembered facts, summaries, trends and embeddings Eira derives from what you logged. Derived health data is still health data.

We do not buy personal data and we do not enrich your record from data brokers or any other outside source.

6. Why we collect it, and every purpose we use it for

The list is exhaustive. If a purpose is not here, it is not one we have.

• To be your record. Storing what you logged and showing it back to you is the service.
• To produce an estimate. A photograph, voice note or barcode is processed so the app can identify the food and the portion. The AI never originates a nutrition figure — every number comes from a nutrition database and arithmetic.
• To build and maintain the memory — extracting facts, summarising, embedding — because coaching that remembers is the product.
• To write your daily message and answer your coaching chat.
• To answer questions you ask about your own record.
• To keep you safe. Two checks, and both are fixed lists of words rather than a model or a clinician. A deterministic filter checks every coaching output before you see it. And the words you write yourself — a mood note on a meal, a message in coaching chat — are checked automatically for phrases that read as distress or as difficulty with eating, so that crisis and eating-disorder support lines can be offered to you; in chat, that check can also route your message to a different one of our AI models. This is a check on the text and not a finding about you: no verdict is stored, nothing is written to your record, nothing goes to our logs beyond a bare count that the check fired at all — not for whom, and not which of the two it was — nobody is alerted, and nothing you log is blocked, delayed or changed. Because reading your own words for these signs is a more sensitive purpose than the rest of this list, it is named in the consent you give in the app and not disclosed only here.
• To check you are 18 or over, from the date of birth you gave.
• To get better at your food, by learning from your corrections. Keeping a copy of those corrections in our own evaluation set — which benefits us rather than you — is asked for separately and can be declined or withdrawn without changing anything about the service.
• To run and secure the service: authenticating you, rate-limiting, preventing abuse, diagnosing errors. Health values are excluded from these records by design.
• To tell you when Eira opens, if you joined the early-access list, and after that to send only what you ticked the box for.
• To answer your message, if you wrote to us.
• To comply with the law where we are required to.

What we never do with it

We do not sell consumer health data. Not for money, not for anything else of value. Selling it would require a signed authorization from you under the Act; we have never sought one and do not intend to. We show no advertising and run no advertising, attribution or analytics SDK, so none of this data is used for advertising, ad targeting or look-alike audiences. We do not use geofencing around any health facility, or anywhere else — Eira never asks for your location at all. And we do not send your data to an AI provider as training material — our instructions to each of them forbid any purpose of their own, which is what training on it would be. We stop short of telling you their signed terms prohibit it, because those agreements are not yet all executed and verified; the privacy policy §6.3 says where that stands, and no processor receives this data before its agreement is signed.

7. Who receives it, by name

Every recipient below is a processor: it handles the data on our instructions, for us, for no purpose of its own, under a contract that says so. That is why they are named here rather than treated as people we share your data with — and we do not disclose consumer health data to anyone who is not one of them. There are no affiliates: Codes L.L.C. has no parent, subsidiary or sister company.

7.1 The app and its backend

Recipient	What it receives
RecipientHetzner (Germany)	What it receivesHosting for the application and the database — all primary data
RecipientCloudflare R2 (EU bucket; US parent)	What it receivesMeal and label photographs, export bundles, encrypted backups
RecipientSupabase (EU project)	What it receivesAuthentication only — your identity, no health data
RecipientBackblaze B2 (EU region)	What it receivesA second, client-side-encrypted copy of backups
RecipientGoogle (US)	What it receivesAI processing: photo and label reading, coaching, daily messages, summaries, memory extraction
RecipientOpenAI (US)	What it receivesAI processing: embeddings for memory, a fallback if Google is unavailable, and the safety-escalation reply
RecipientSentry (EU region)	What it receivesScrubbed error reports — health values are stripped before the report leaves our server
RecipientLangfuse (EU cloud)	What it receivesMinimised records of AI requests — no photographs, no identifiers
RecipientApple	What it receivesPush delivery (a token and a payload with no health content) and App Store billing
RecipientFatSecret, USDA FoodData Central, Open Food Facts	What it receivesA food name or a barcode. No account identifier and nothing about you goes to a nutrition database

7.2 The website

Recipient	What it receives
RecipientCloudflare (US; served from the network location nearest you)	What it receivesThe site itself and the two forms on it. As the host it terminates the encrypted connection, so it sees a submission in the clear on its way to us, and it holds the connection metadata in §4.2
RecipientResend (US, Delaware)	What it receivesContact-form messages, for delivery: your name, email address and what you wrote
RecipientCloudflare Email Routing (US)	What it receivesMail sent to hello@eira.coach, including every contact-form message after delivery. It receives the message at our domain and forwards it to the mailbox below
RecipientGoogle (US)	What it receivesThe Gmail mailbox behind hello@eira.coach, where a message comes to rest, is read by a person, and is kept for the 24 months in §8
RecipientBrevo (EU)	What it receivesThe early-access list: name, email and the consent record. Nothing from the app

7.3 The only other disclosures we would make

To comply with a valid legal demand, and we will tell you unless we are legally prohibited from doing so. To protect someone’s safety. Or to an acquirer, if the company is bought — in which case we will tell you first, and your health data stays subject to this document or to one no less protective of you.

8. How long we keep it

• Your record lasts as long as your account does. You can delete any item at any time.
• Raw photograph uploads are deleted immediately after processing, with a storage rule removing any remainder within 24 hours. The processed image lives as long as the meal does.
• Records of AI requests and error reports: 90 days.
• Encrypted backups rotate daily for 7 days, weekly for 4 weeks and monthly for 6 months, so a deleted account can persist in an encrypted backup for up to about six months. We do not use a backup to bring a deleted account back: a content-free marker — an identifier and a deletion timestamp, no personal data — is kept so that a restored backup is re-deleted.
• Contact-form messages: 24 months.
• Your early-access entry: until you unsubscribe or ask us to remove it, and in any case no more than 24 months after you joined.

9. Your rights — Washington

If you are a Washington resident, the My Health My Data Act gives you the following. You do not need an Eira account to use any of them, and we will never ask you to create one.

9.1 Confirm and access

You can ask us to confirm whether we hold consumer health data about you, and to give you a copy of it. If you have an account, the fastest route is the export in the app — Settings → Your data → Export — which produces the whole record as a structured file, including your photographs, your mood tags and note, whether nutrient-floors mode is on, and the date of birth from the age check. If you cannot get into the app, or you have no account, ask us and we will produce it.

9.2 Know who received it

You can ask for a list of the third parties and affiliates with whom we have shared your consumer health data, with an active contact for each. §7 is that list, standing today, and we will confirm it against your own record on request. There are no affiliates.

9.3 Withdraw your consent

You can withdraw your consent to our collection of your consumer health data, and to its sharing, at any time and without giving a reason. In practice:

• In the app, turn off the feature — mood capture, nutrient-floors mode, the eating window, Apple Health — or use Settings → About you to clear your body measurements, or delete your account outright to withdraw all of it at once.
• On the mailing list, use the unsubscribe in any message we send. It stops all mail immediately; we then delete your name and address and keep only the record that this address asked not to be written to again, because that is the only way to be sure we honour it.
• Or write to us at legal@eira.coach and say what you want stopped.

Withdrawing consent stops future processing. It does not make unlawful what was already done lawfully before you withdrew.

9.4 Have it deleted — within 30 days

You can ask us to delete your consumer health data, and we will do it within 30 days of receiving the request. In practice we do not wait 30 days: deleting your account in the app runs immediately, and the job ends by counting the remaining rows and stored objects for your account and asserting the answer is zero.

When we delete, we tell every processor holding a copy to delete it too. The one thing that does not vanish on the day is the encrypted backup set described in §8 — it ages out on its rotation, within about six months, and cannot be used to bring your account back because of the deletion marker. We state that plainly rather than describe a deletion that is tidier than the one we perform.

One other thing survives, and it is worth knowing before you contribute it: if you taught Eira a product by scanning an unknown barcode and typing its label, your link to that product is removed but the product row itself is kept, unlinked from you, because that shared catalogue is how Eira covers regional products no commercial database has.

9.5 Appeal

If we refuse a request, we will tell you why and how to appeal it. Appeal to legal@eira.coach; a person who did not make the first decision will look at it, and we will answer within 45 days. If we refuse the appeal, you may complain to the Washington State Attorney General, whose complaint form is at atg.wa.gov/file-complaint.

9.6 How to make a request

Write to legal@eira.coach, or use the contact form. Say what you want and give us enough to find you — if you have an account and cannot get into it, tell us the Apple Account you signed in with and roughly when you signed up. We may ask for more only where we genuinely doubt that the request comes from you, never as a way of making it harder. It is free, we do not treat you differently for asking, and we will not ask you to justify why.

10. Your rights — Nevada

Nevada’s health-data law (SB 370, NRS 603A.400 to 603A.550) is closely modelled on Washington’s, and everything in this document applies to Nevada residents in the same way: the same categories, the same sources, the same purposes, the same named processors, the same right to confirm, access, withdraw consent and have your data deleted, and the same route in §9.6.

Two differences are worth knowing. Nevada’s law is enforced by the Attorney General, and does not give you a private right to sue — so if we get something wrong, the escalation is a complaint to the Nevada Attorney General, at ag.nv.gov. And Nevada, like Washington, prohibits selling health data without a signed authorization; we do not sell it, so there is no authorization to sign.

11. If you are not in Washington or Nevada

The parts of this document that describe what we do — §3 to §8 — are true wherever you live. Rights differ by where you are: the Privacy Policy sets out UK GDPR rights, CCPA/CPRA rights, the Virginia-model state rights, and how to exercise them. Connecticut’s health-data amendments impose consent duties similar to those described here. Wherever you are, if you write to legal@eira.coach and ask for your data or ask us to delete it, we will do it — we have not built a version of ourselves that only answers people with the right postcode.

12. Changes to this document

Every version of this document carries a version number and an effective date, shown together at the top of the page. If we change it in a way that matters we will tell you in the app before the change takes effect, and by email if you are on the mailing list and have no app. Where a change would need your consent — a new purpose, or a new processor of health data — we will ask for it rather than assume it. Previous versions are available on request at legal@eira.coach; quote the version number of the one you want.

What changed in each version, most recent first:

• 1.4 — 23 August 2026, §4.1. Corrected what is said about the date of birth you give at the age check. Version 1.3 said it was write-once and could only be corrected by writing to us; the date can be corrected in the app, and clearing your body measurements clears it. What is taken once is the age check itself, which refuses a second submission. What changed in this version is the description. The behaviour it describes is the behaviour that was already running, and no processing of your health data changed with it. The Privacy Policy carried the same error in more places and is corrected in its version 1.5 of the same date.
• 1.3 — 18 August 2026, §4.1 and §5. Removed resting heart rate from what Eira reads from Apple Health. The app no longer requests it, so version 1.2 disclosed a read that does not happen.

13. Contact

Codes L.L.C. Kodra e Diellit, H 1/2, Nr. 22, 10000 Prishtinë, Republic of Kosovo Company registration 810858003 · Fiscal number 601582184

Health-data requests, and the appeal route in §9.5: legal@eira.coach Everything else: hello@eira.coach, or the contact form

Washington State Attorney General: atg.wa.gov/file-complaint Nevada Attorney General: ag.nv.gov