This policy applies to “consumer health data” as defined by the Washington My Health My Data Act, Nevada’s consumer health data law (NRS Chapter 603A, as amended by SB 370) and the Connecticut Data Privacy Act. We apply it to every Calsa user, wherever you live. It supplements our Privacy Policy.
Calsa is operated by Genio Group, Inc., 1470 Civic Ct Ste 309, Concord, CA 94520-5230, United States.
1. What health data we collect and why
| Category | Examples | Why we use it |
|---|---|---|
| Body measurements | Date of birth, sex used for the calorie formula, height, weight and its history, body fat | Calculating your calorie and nutrient goals, showing your trend, checking you are 18+ |
| Goals and activity | Weight goal, pace, calorie and nutrient goals, activity level, steps and active energy | Setting and adjusting your goal, showing your energy balance |
| Food diary | Foods, grams, meals, times, nutrients, water, meal photos, logging phrases, your own foods and recipes | Keeping your diary and totals |
| Dietary needs | Allergies, foods you avoid, foods you watch | Warnings and better suggestions |
| AI chat | Messages, chat memory | Answering your questions about food and your diary |
| Safety signs | Whether a sign that tracking may be harmful is active, without weight or calorie values | Offering support (see our Health & Wellness Notice) |
| Support and reports | Health details you mention when you write to us or report an answer | Helping you and fixing problems |
We use consumer health data only to provide the Calsa features you ask for, to keep the service safe and working, and to meet legal obligations. We don’t use it for advertising, we don’t sell it, and we don’t use it to train AI models.
We don’t ask about diagnoses, medicines, pregnancy or medical conditions. Allergies and foods you avoid are lists you choose to fill in. We don’t collect precise location, and we don’t use geofencing around places where health services are provided.
2. Where it comes from
- From you, when you answer the setup questions, log food, take photos, type or speak a phrase, set goals or write to the chat or to us. In the Calsa apps your device turns voice into text, and the recording never reaches us.
- From Apple Health or Health Connect, if you connect them: weight, body fat, steps and active energy, and, once, height and date of birth.
- From a file you import, if you choose to bring your history from another app. Only the rows you confirm reach our servers.
- Created by Calsa from the data above: goals, totals, trends and safety signs.
3. Your consent
We collect consumer health data only after you consent on a separate screen, before the first question about your body, except health details you choose to include when you write to us, which we use only to answer you. This consent is not part of our Terms of Use. We ask for separate consent before we send any of it to an AI provider, and again before chat answers use your Apple Health or Health Connect values. You can withdraw any of these consents in Settings at any time.
4. What we share and with whom
We share consumer health data only with the service providers (processors) below, who act on our instructions under contracts that forbid them from using it for anything else.
| Category shared | Recipient | Why |
|---|---|---|
| All data stored in Calsa | OVH US (hosting), Cloudflare (network, storage of meal photos and export files, encrypted backups) | Running and backing up the service |
| Meal, label, recipe, menu and fridge photos, logging phrases; chat answers for safety checks; and, only when Anthropic is unavailable, the same chat context Anthropic receives | OpenAI | Recognising food, safety checks, backup chat answers |
| Chat messages, the diary context for your plan, chat memory, and Health values only if you allow it | Anthropic | Answering your chat questions |
| Health details you include in a support email | Google Workspace | Receiving and answering support email |
We have no affiliates that receive consumer health data. We don’t share it with advertisers, data brokers or social networks, or with Apple or Google, except Google Workspace as our email provider and what you send to Apple Health or Health Connect yourself. We don’t sell consumer health data, and we would never do so without your signed authorisation as the law requires.
5. How long we keep it
We keep consumer health data while your account exists, or until you delete it. Label, recipe, menu and fridge photos are deleted after 24 hours. Safety signs expire 28 days after the last one. When you delete your account, its consumer health data is deleted: live data is removed when deletion completes, and we send deletion requests to our service providers the same day. Backup copies expire within 35 days, and restoring a backup never brings back a deleted account. Our AI providers may not use Calsa data to train their models. They delete it within 30 days, unless the law requires them to keep it longer or they need it to investigate a specific breach of their usage rules. Where a provider offers to keep nothing, we’ve asked it to. Full details are in our Privacy Policy.
6. Your rights
You have the right to:
- confirm whether we collect, share or sell your consumer health data;
- access it, including a list of all third parties and affiliates we shared it with, and their contact details;
- delete it, including from backups;
- withdraw your consent to its collection or sharing.
Most of this you can do yourself in the app: export everything, delete entries, photos, chats or memory, delete your account, or withdraw consent in Settings. You can also delete your account at calsa.app/delete-account.
To make a request by email, write to [email protected] with the subject “Health data request”. We confirm within 10 business days and respond within 28 days, free of charge. We may need to confirm the request comes from the account holder. We won’t treat you differently for using these rights.
7. How to appeal
If we deny your request in whole or in part, you can appeal by replying with the subject “Appeal”. We answer within 45 days and explain our decision in writing. If you are not satisfied, you can contact the Washington State Office of the Attorney General at atg.wa.gov/file-complaint, the Nevada Attorney General at ag.nv.gov/Complaints/File_Complaint, or the Connecticut Attorney General at portal.ct.gov/ag.
8. Changes
We update the date at the top when this policy changes, and tell you by email and in the app at least 30 days before a material change takes effect. We will ask for your consent again before using consumer health data for a new purpose or sharing it with a new kind of recipient.
Contact
[email protected] · Genio Group, Inc., 1470 Civic Ct Ste 309, Concord, CA 94520-5230, United States