Consumer Health Data Privacy Policy

This policy applies to consumer health data collected by DishCal, operated by MediPaid Technologies Inc. It exists as a standalone document because Washington law requires one. It applies to residents of Washington and, where applicable, Nevada; we apply the same practices to everyone.

1. Categories of consumer health data we collect

• Health conditions you select, including diabetes, hypertension, kidney disease, liver disease, cancer or malignancy, thyroid disorders, cardiovascular disease and lung disease.
• Medications, dosages, schedules, and your record of doses taken or missed.
• Allergies and dietary restrictions, including religious dietary observance.
• Bodily characteristics — age, sex, height, weight and activity level.
• Meal and nutrition data — photographs, descriptions, scanned barcodes and the nutritional values derived from them.
• Derived health measures — calculated calorie and nutrient targets, adherence figures, and clinical summaries you generate.

2. Sources of that data

• Directly from you — everything above is entered or submitted by you.
• Derived by us — targets and summaries calculated from what you entered.
• From a third-party database — nutritional facts returned by Open Food Facts when you scan a product barcode.
• We do not buy consumer health data, and we do not obtain it from data brokers, advertising networks or other applications.

3. Why we collect it

Solely to provide the features you requested: calculating your targets, estimating the meals you log, filtering recommendations for your conditions and allergies, running medication reminders, and producing summaries at your request. We do not use consumer health data for advertising, profiling unrelated to these features, or any secondary purpose.

4. Categories we share, and with whom

We do not sell consumer health data. We have never sold it and we do not have a process for selling it. Under Washington law, selling consumer health data requires your signed authorisation; we do not seek one because we do not sell.

We share the following with the following categories of third party:

We do not share consumer health data with advertisers, data brokers, analytics providers or social networks. No advertising or analytics software is present in DishCal.

5. Your rights

You have the right to:

• Confirm whether we are collecting, sharing or selling your consumer health data, and access that data, including a list of all third parties with whom we have shared it.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data. On a deletion request we delete it from our records and notify our processors to do the same.
• Not be discriminated against for exercising any of these rights.

6. How to exercise your rights

Email dpo@medipaid.tech from the address on your account, stating which right you wish to exercise. We will respond within 45 days and may extend once by a further 45 days where reasonably necessary, telling you why.

A limitation we want stated plainly: these requests are currently handled manually by our team rather than through a self-service button in the app. The right is honoured either way; we are building the automated path.

Appeals. If we decline a request you may appeal by replying to our decision. If we deny the appeal, you may complain to the Washington State Attorney General at www.atg.wa.gov/file-complaint.

7. Deletion and our processors

When you ask us to delete consumer health data we remove it from our live database and from backups as those backups cycle, and we instruct each processor listed in section 4 to delete it. Meal photographs are not retained at any point — they are sent for estimation and discarded.

8. Contact

MediPaid Technologies Inc.
117 E. Rodriguez Jr. Ave., C5, Pasig City, Philippines
dpo@medipaid.tech