Consumer Health Data Privacy Policy

Last updated: July 2026

This notice is provided specifically under Washington's My Health My Data Act (and comparable consumer health data laws in Nevada and Connecticut). It describes how Hygeia, operated by Boulder Nutrition, handles consumer health data only. General privacy practices are covered separately in our Privacy Policy.

1. Categories of consumer health data we collect

When you use Hygeia, we may collect health-related information you choose to share, including:

• Information about your relationship with food, eating patterns, and emotional or stress eating.
• Body-related and wellbeing information you describe (for example, energy, cravings, digestion, sleep, mood, or body image).
• Metabolic-typing quiz responses, journal entries, and meal descriptions or meal photos you submit.
• Wellness insights that Hygeia's AI derives from the above to personalize your guidance.
• General location (country and time zone only), inferred in real time from your IP address to personalize seasonal and regional guidance. We do not collect precise geolocation, and neither your IP address nor this inferred location is stored.

2. Sources of this health data

We collect this data from two sources: (a) directly from you — the messages, entries, quiz answers, and photos you provide — and (b) generated by Hygeia's AI as inferences or "memories" drawn from what you share.

3. Categories of third parties and affiliates we share it with

We do not sell your consumer health data. We share it only with categories of service providers that make the app function: cloud hosting and storage infrastructure, and the AI language-model providers that generate Hygeia's responses. It may also be handled by Boulder Nutrition as the operator of the service.

4. Specific third parties and affiliates who receive this data

• Cloudflare — stores your health data in encrypted form (database, file storage, and AI infrastructure).
• OpenRouter — transmits your messages to the AI language-model providers that generate responses.
• Anthropic, Google, DeepSeek, and Moonshot AI — the AI providers that process your messages to generate a response. They are configured for Zero Data Retention and do not retain your data beyond generating that response, and do not use it to train their models.
• Boulder Nutrition — the operator of Hygeia.

We do not share consumer health data with advertisers, data brokers, or any party for targeted advertising.

5. How your consumer health data is protected

All consumer health data is transmitted over encrypted connections (HTTPS/TLS) and stored on encrypted infrastructure. The most sensitive categories — your conversations with Hygeia (message content and chat titles), AI-derived memories and summaries, and any photos or files you upload — carry an additional layer of application-level AES-256 (AES-GCM) encryption at rest using keys we manage. The AI providers that generate responses are configured for Zero Data Retention. Your consumer health data is permanently deleted when you delete your account.

6. How to exercise your rights

You have the right to access your consumer health data, to have it deleted, and to withdraw your consent to its collection and sharing. You can:

• Access your data via Profile → Your data → Download my data.
• Delete your data by deleting your account via Profile → Account Settings → Delete account, which permanently purges your health data.
• Withdraw consent at any time by deleting your account or by contacting us.

To submit any of these requests directly, or to appeal a decision, email sue@bouldernutrition.com.