Consumer Health Data Privacy Policy
Last updated: 23 June 2026
About this policy
This Consumer Health Data Privacy Policy explains how CLICKMIX LLC ("Nourvo") collects, uses, shares, and protects consumer health data. It supplements our Privacy Policy and applies specifically to residents of Washington, Nevada, and Connecticut, and to other consumers whose health data is protected by similar laws; where it conflicts with the general Privacy Policy as to consumer health data, this policy controls. Nourvo is not a HIPAA covered entity and your entries are not HIPAA protected health information — but they are consumer health data under state law, and we treat them as sensitive.
What "consumer health data" means
Consumer health data is information linked or reasonably linkable to you that identifies your health status. For Nourvo this includes your GLP-1 medication (active ingredient and brand), dose, schedule, treatment start date and dose log; your height, current and goal weight and weight history; the side effects and moods you record; the foods, meals and activity you log; and the fact that you use Nourvo at all. It does not include de-identified or aggregated data that can no longer be linked to you.
What we collect and our sources
We collect consumer health data directly from you, exactly as you enter it into the app's tracking features — there is no third-party or passive collection. We do not collect health data from data brokers, advertising partners, or location sources, and we do not use any technology to track your presence at health-care facilities.
How we use it
We use your consumer health data only to provide the tracking features you ask for, to maintain, secure and troubleshoot the Services, to respond to your requests and honor your privacy choices, and to comply with legal obligations. We do not use consumer health data for advertising, and we do not use it to train AI models.
How we share it — and how we do not
We do not sell your consumer health data. We share it only with processors that host and operate the Services under contract and on our instructions: Supabase (database, authentication, account deletion), Vercel (hosting), and Sentry (error monitoring with identifiers stripped), all in the United States. When you use the optional barcode scanner, the decoded barcode number — not your identity or health data, and never an image — is sent to USDA FoodData Central and the FatSecret Platform API only to look up that product. Our analytics provider (PostHog) is consent-gated and receives only limited page-view events, not your health entries. We will not otherwise share your consumer health data without your affirmative, opt-in consent, except where required by law.
Consent
You consent to the collection of consumer health data when you choose to enter it into the app's tracking features, and we collect only what you choose to log. We will obtain your separate, affirmative opt-in consent before sharing your consumer health data with anyone other than the processors described above. You may withdraw consent at any time by deleting the relevant entries or your account, or by emailing us; withdrawal stops future processing but does not undo processing already completed.
Your rights
If you are a Washington, Nevada, or Connecticut resident (and others where applicable), you have the right to confirm and access the consumer health data we hold, to know the third parties with whom we have shared it, to delete it, to withdraw consent to its collection and sharing, and to appeal a denied request. To exercise these rights, delete your account and data in the app (Settings → Delete Account) or email legal@nourvo.app with the subject "Health Data Request"; we respond within the time required by law (generally 45 days). We do not charge for a first, non-excessive request and will not discriminate against you for exercising your rights. You may also complain to the Washington, Nevada, or Connecticut Attorney General. Washington's My Health My Data Act includes a private right of action, so Washington consumers may also be able to bring their own claims.
Camera and barcode scanning
The app includes an optional barcode scanner. It reads a product barcode on your device and sends only the decoded barcode number to USDA FoodData Central and the FatSecret Platform API to look up the product's nutrition facts; no consumer health data and no image are shared with those services. Camera-based food photo scanning and AI food recognition are not part of the Services today; if we add them, any consumer health data involved will be collected and shared only with your separate, affirmative opt-in consent, and we will update this policy to name the providers, the data sent, and retention periods before the feature launches.
Security
Consumer health data is protected with encryption in transit and at rest, row-level security so each account can access only its own records, hashed passwords, and personal-data scrubbing in error monitoring. We limit access to authorized personnel and processors who need it to operate the Services. See our Privacy Policy for our breach-notification commitment, including the FTC Health Breach Notification Rule.
No geofencing of health facilities
Consistent with the My Health My Data Act, we do not implement any geofence around any health-care facility, and we do not use location to identify or track consumers seeking health services.
Changes and contact
We will update this policy as needed and revise the "last updated" date; material changes affecting consumer health data will be announced in the app or by email. Contact us at legal@nourvo.app with the subject "Health Data Request". CLICKMIX LLC (Nourvo), Florida, USA.