Consumer Health Data Privacy Policy

This policy covers the allergy and diet information recorded in Bunch. Washington's My Health My Data Act, Nevada's consumer health data law and Connecticut's law treat information like this as "consumer health data". We apply this policy to everyone who uses Bunch, wherever they live.

Bunch is offered by Dioteck LLC, an Alabama limited liability company doing business as Bunch. Our Privacy Policy covers everything else we collect.

What we collect

• Allergies: milk, egg, fish, crustacean shellfish, tree nuts, peanuts, wheat, soy, sesame and molluscs, each marked "never include" or "prefer to avoid", and whether even traces (cross-contact) matter.
• Diets: vegetarian, vegan, pescatarian, gluten-free, no pork, no alcohol, halal and kosher, each marked the same way. Some of these can reflect religious belief; we protect them the same way.
• What we work out from them: whether a recipe or a planned meal suits each person, needs a check, or conflicts with someone's needs, and the warnings we show you.

Dislikes ("prefer to avoid mushrooms") aren't health information, but we protect them the same way.

We don't collect any other health information: no medical conditions, symptoms, medications, weight, biometric data or precise location.

Where it comes from

• From you, for yourself.
• From the Owner or an Admin of your household, for people without their own Bunch account, such as children. If that person later joins Bunch and claims their place in the household, the allergies and diets recorded for them move to their own account, where only they can change them.

Why we use it

Only to plan meals that work for everyone: to show which recipes and meals suit each person, to keep conflicting meals out of suggestions, to warn you about them, and to let you review and change what's recorded.

We never use it for advertising, never sell it, and never use it to make decisions about you outside meal planning. We never send it to AI models: Bunch's own code checks every AI suggestion against everyone's allergies and diets, after the suggestion is made.

Your consent

We ask for your consent, separately and before you record any allergies or diets, for yourself or for the people you add. The consent request tells you what we collect, why, who it's shared with, and how to withdraw. We record the date you agreed and the version of this policy.

You can withdraw consent at any time: Your account → Allergies and diets → Withdraw consent. After that, Bunch records no new allergies or diets from you until you agree again. What's already saved stays until you remove it, unless you ask us to delete it.

We'll ask for your consent again before collecting new kinds of health information or using it in a new way.

Who we share it with

• The people in your household. Members of a household can see the allergies and diets recorded there, so they can cook safely for everyone. Your own are visible to every household you belong to. You choose who's in your household; you can leave it, or remove people from it if you're its Owner or an Admin.
• Service providers that store it for us: Supabase (our database) and Vercel (our app's hosting), and GitHub, which holds our encrypted backups and can't read them. They process it only on our instructions, to provide their service.

That's everyone. We have no affiliates that receive it. We don't share it with advertisers, data brokers or AI providers, we don't sell it, and we'd ask for your separate consent before sharing it with anyone new. We don't use geofencing.

Your rights

You can:

• Find out whether we have your health information, and see it: it's all in the app, and Your account → Download your data gives you a copy. You can also ask us for the list of everyone we've shared it with and how to contact them.
• Withdraw your consent, as above.
• Delete it: remove entries on a person's page in Household, or delete your account (Your account → Delete your account), or email us. We delete it from our systems, and it leaves our backups within 7 days.

To make a request by email, write to privacy@bunchmeals.com. We'll confirm it's you, usually by a code sent to your account's email address; you won't need to create an account to ask. We'll respond within 45 days. If we need more time, we'll tell you why within those 45 days and take at most 45 more. Requests are free, up to twice a year.

Appeals. If we decline your request, reply to our answer with "Appeal". We'll answer in writing within 45 days, with our reasons. If we still decline, we'll tell you how to complain to your state's attorney general: in Washington, at atg.wa.gov/file-complaint; in Nevada, at ag.nv.gov; in Connecticut, at portal.ct.gov/ag.

We won't treat you differently for using any of these rights.

How we protect it

Allergy and diet information is stored in our database, encrypted at rest and in transit, and walled off by household, so only the people described above can read it. It never appears in our server records or error reports. Only the people who run Bunch can reach production systems, under strong authentication, and they don't look at it except to fix a problem you've reported or when the law requires.

Changes

If we change this policy, we'll post the new version here with a new date and tell you in Bunch before it takes effect. A change that collects or uses health information in a new way waits for your consent.

Contact

Dioteck LLC, doing business as Bunch, Alabama, USA. Email privacy@bunchmeals.com.