← Back to MenuVision

Consumer Health Data Privacy Policy

Effective date: October 2026

This policy explains how MenuVision ("we", "our", or "us") handles consumer health data under Washington's My Health My Data Act. It applies to Washington residents and to anyone whose consumer health data we collect in Washington. Consumer health data is information that is linked, or could reasonably be linked, to you and that identifies your past, present, or future physical or mental health, including what can be inferred about your health. A food preference is not always health data, but allergy information, and warnings based on it, can be.

You can scan menus and read general dish information without saving allergy or diet preferences. MenuVision gives menu information, not medical advice. A warning, or the absence of one, does not establish whether a meal is safe for you.

Health Data We Collect and Why

MenuVision does not use usage analytics in the released app. We do not deliberately attach your MenuVision account ID to the crash and error reports described below.

Where the Information Comes From

Who Receives Health-Related Information

The categories of consumer health data we share, and why:

What each recipient receives depends on the features you use:

Supabase, OpenAI, Sentry, and Google (for our Google Workspace support mailbox and Workspace file sharing) process this information for us only under written terms that limit them to providing their services to us. Expo handles what it receives under its own service terms and privacy policy, not under a data processing agreement with us. Apple, and Google for Google sign-in and the legacy consumer-mail service, also have their own obligations for the services they provide in their own roles.

If you used a test version of the app before its public release, it may also have sent account-linked usage events to Mixpanel, an analytics provider, and crash reports with your account identifier to Sentry. You can ask us to access or delete that information.

MenuVision has no affiliates. We do not sell consumer health data. We do not use geofences around health care facilities or anywhere else.

How We Protect Health Data

We limit access to consumer health data to what the service needs, and use administrative, technical, and physical safeguards to protect it. Each account can read only its own saved data, the app connects to our service over HTTPS, our hosting provider's data centers are physically secured, and within MenuVision only its operator can view the service's records. No method of storage or transmission is completely secure.

Your App Controls

These controls do not cover every right. You can use the request method below for access, withdrawal, deletion, or the list of recipients, including information held by providers.

Your Washington Health Data Rights

You have the right to:

To make a request, email support@menuvisionapp.com, or use Settings > Privacy > Privacy request in the app, and tell us which right you want to use. "Health data request" is a useful subject line, but it is not required. Please do not send passwords, identity documents, or a detailed medical history. To confirm that a request is about your data, we may send a one-time code to the email address on your account and ask you to reply with it. You do not have to create a new account to make a request.

We respond without undue delay and within 45 days of receiving your request. Confirming your identity does not restart that period. When reasonably necessary, we may take one additional 45 days, and if we do, we tell you why within the first 45 days. We answer requests free of charge at least twice a year; the law allows a reasonable fee or a refusal only for requests that are manifestly unfounded, excessive, or repetitive.

When we answer a request to access your data, we also give you the list of every third party and affiliate with which we have shared it, with an email address or other online way to contact each of them.

If we decline to act on a request, you can appeal by replying to our decision or by emailing the same address with your request and why you think it should be reconsidered. "Health data appeal" is a useful subject line. We give you a written decision and our reasons within 45 days of receiving your appeal. If we deny the appeal, we tell you how to contact the Washington Attorney General.

We do not discriminate against you for using these rights. Removing information that a feature needs can stop that feature from working: for example, personalized allergy warnings need your allergy preferences. Removing your preferences never takes away credits you bought.

Deletion and Retained Copies

Deleting a saved menu from History removes its saved record and attempts to remove its photos; that cleanup can fail and leave a photo. It does not by itself remove the scan's job record, which is deleted with your account.

Photos from a scan that does not produce a saved menu (it fails, you cancel it, or it can't start) are not added to your history. They may be deleted automatically when the scan ends, or remain stored until you delete your account; this cleanup is best effort.

Account deletion attempts to revoke stored Apple sign-in authorization and remove uploaded photos before deleting your account and linked records, including preferences, saved menus and stored Apple sign-in tokens. If required Apple revocation or photo removal fails, your account is kept so deletion can be retried. Purchase and credit-history records linked to your account are deleted with it, except the limited purchase-claim and Apple refund records described below. The app's deletion steps do not by themselves confirm completion of deletion from every provider or backup.

TestFlight rollout notice: The automatic deletion-request record and its 37-day retention described below take effect once our server rollout is verified. Until then, the deletion service used by current TestFlight builds may not create that record. For a tracked deletion request or follow-up with the services that hold your data during this transition, email support@menuvisionapp.com.

Deleting your account in the app is a complete deletion request: you do not need to email us as well. When you ask, we first record the request: your account's identifier, the email address on the account, when you asked, and whether and when the deletion finished. It also keeps, from your scans, when your first and last scans were, how many there were, and whether a notification token was found on them (never the photos, the menus or the token itself), so that we can work out which services may still hold your data and ask them to delete it. If our database cannot record a request when it arrives, the app says the account could not be deleted and nothing is deleted; we find that request in our server logs and follow it up by email. If the deletion cannot finish and you do not try again, we follow up by email. Once your account is deleted, we use the email address to delete your support emails and any data export we sent you, and to tell you the deletion is complete. The record also lets us apply the deletion again if our database is ever restored from a backup. We keep the email address only until we finish your request, and we delete the record 37 days after your account is deleted, or 37 days after your last attempt if the deletion did not finish.

Supabase keeps automated backups of our database for 7 days and then deletes them. Before a backup is ever used to restore our database, we apply again every account deletion, and every decision to decline or withdraw consent to use your preferences, recorded since that backup was made, so a deleted account is not restored and withdrawn preferences are not used again. If our live database were ever lost entirely, choices made after the last backup could not be applied again this way; we would tell the people affected wherever we can identify them. Database backups do not include stored photos, so a deleted photo is not brought back by a restore. Deletion from archived or backup systems may be delayed only as the law allows, no longer than six months after we verify that the request is yours.

When you ask us to delete your data, in the app or by email, we delete it from our records, including those Supabase stores for us, and we notify each other processor and third party that holds data we can link to your account, asking them to delete it. OpenAI's copies of your photos and menu text follow OpenAI's API data terms; they do not carry your MenuVision account ID, though a photo or its text can still identify you. Sentry keeps crash reports for 30 days. We delete support emails you sent us once your question or request is closed. These technical limits do not reduce your deletion rights.

Some limited records remain after account deletion. Their link to your account is cleared, but they can remain linkable to you and are not anonymous:

Where any of these records is consumer health data, it stays subject to the deletion rules above unless a specific legal exception allows us to keep it.

If you would like your preferences deleted without deleting your account, use Withdraw and delete my preferences in Settings, or email us.

Children's Privacy

MenuVision is not intended for children under 13. We do not knowingly collect personal information, including consumer health data, from children under 13. If you believe we have collected such information, contact us so we can investigate and address it.

Changes and Contact

Before we collect additional categories of consumer health data, use it for additional purposes, or share it with additional categories of recipients, we update this policy and ask for your affirmative consent. When this policy changes, we post the new version with its effective date.

For health-data questions, requests, or appeals, email support@menuvisionapp.com.

See the Nevada and Connecticut Health Data Supplement for those states' additional health-data disclosures and rights. The general Privacy Policy describes MenuVision's other personal information practices.