Elio — Consumer Health Data Privacy Notice (Washington State)

Document version: 1.0 Effective date: 6 June 2026 Last updated: 6 June 2026

This is a standalone notice required by Washington State's My Health My Data Act ("MHMDA", RCW 19.373). It supplements, but is independent of, our general Privacy Policy and Terms of Service.

1. Who provides this notice

Studio Eyespy LLC (the maker of Elio) 2754 NE 103rd St, Seattle, WA 98125, USA Email: support@eliochef.com

This notice is provided by the entity above (the "regulated entity" under MHMDA) and applies to all Washington State residents and to any consumer health data we process while we are physically present in Washington.

2. What is "consumer health data" in Elio's context?

We treat the following data as consumer health data under RCW 19.373.010:

Dietary requirements you tell us (e.g. vegetarian, vegan, gluten-free, dairy-free, low-FODMAP, diabetic-friendly, kosher, halal);
Allergies and intolerances you tell us (e.g. peanut allergy, lactose intolerance, shellfish allergy);
The dietary requirements you provide for household members you've added to your account.

We treat this as health data because allergies and dietary requirements can reveal a consumer's "past, present, or future physical or mental health status" within the meaning of RCW 19.373.010(8)(b)(viii).

We do not knowingly collect any other category of consumer health data. Specifically, we do not collect: symptoms, diagnoses, medications, biometric measurements, reproductive or sexual-health information, mental-health information, gender-affirming-care information, treatment history, lab results, or precise geolocation data near healthcare facilities.

3. How we collect this data (sources)

You provide consumer health data directly by:

Answering dietary/allergy questions during onboarding;
Editing your profile in the app;
Adding or editing household members' dietary requirements.

We do not infer dietary or health data from your usage, purchase history, or any third-party source.

4. Why we collect it (purposes)

We process consumer health data only for the following purposes:

To personalise the AI's recipe and meal-plan suggestions to your dietary needs and to avoid ingredients you've told us you can't or don't want to eat.
To display your profile back to you in the app so you can review and change your selections.

We do not process consumer health data for analytics, advertising, marketing, profiling for behavioural purposes, training AI models, research beyond delivering the service to you, or any other purpose not listed above.

5. Who receives consumer health data (sub-processors)

Consumer health data is shared only with the following sub-processors, and only for the purposes listed in §4:

Sub-processor	Role	Why they receive consumer health data
Google LLC / Google Cloud / Firebase (Cloud Firestore)	Database hosting	To store your profile and household-member records securely so they sync across your devices
Google LLC (Generative AI / Gemini API)	AI model	To generate recipes that respect your dietary requirements; the dietary list (without your name or any directly identifying information) is included in each prompt

These sub-processors process the data under contractual confidentiality and security obligations. We do not allow them to use consumer health data for their own purposes, training of their general AI models, or marketing.

6. We do NOT sell consumer health data

We do not sell consumer health data as "sale" is defined under RCW 19.373.010(20). We have not done so in the past, and we have no plans to do so. We do not exchange consumer health data for monetary or any other valuable consideration.

We do not disclose consumer health data to advertisers, data brokers, or any third party for advertising or marketing purposes.

7. Your rights under MHMDA

You have the following rights with respect to your consumer health data:

Right	What it means
Right to confirm	Confirm whether we are processing your consumer health data.
Right to access	Receive a copy of the consumer health data we hold about you, plus a list of all third parties (including affiliates) with whom we have shared it.
Right to delete	Have your consumer health data deleted. We will instruct our sub-processors to delete it as well.
Right to withdraw consent	Withdraw any consent you previously gave us for collection, use, or sharing of consumer health data. The withdrawal mechanism is at least as easy as the original consent.

You have the right to exercise these rights without facing discrimination in the Service.

8. How to exercise your rights

To exercise any of the rights in §7, email us at:

Email: support@eliochef.com Subject line: "Washington health data request"

Please include:

Your account email address;
Which right(s) you want to exercise;
For deletion or access requests, any specific data categories you want covered.

8.1 Our response timeline

We will respond to your request within 45 days.
If we need more time, we may extend by a further 45 days, and we will notify you of the extension and the reasons for it within the original 45-day period.
We will provide our response free of charge, except where requests are manifestly unfounded, excessive, or repetitive — in which case we may charge a reasonable administrative fee or refuse the request, and we will explain why.

8.2 Verification

To protect your data, we will verify your identity by matching the email address you contact us from against the email on your account. For deletion or access requests involving sensitive data, we may request one additional verification data point (for example, your account creation date or last sign-in device).

9. Right to appeal

If we deny your request (in whole or in part), you have the right to appeal.

To appeal: reply to our denial email with the subject line "Washington health data appeal". The appeal mechanism is at least as easy as the original request mechanism.

We will acknowledge your appeal within 5 business days.
We will inform you of our final decision within 45 days of receiving the appeal, with a written explanation of the reasons.

If we deny your appeal, you may file a complaint with the Washington State Attorney General:

Washington State Attorney General — Consumer Protection Division File a complaint online: https://www.atg.wa.gov/file-complaint Or call: 1-800-551-4636

We will provide a working link to the AG's complaint mechanism in our denial email so the path forward is unambiguous.

10. Consent

We collect, use, and share your consumer health data only as necessary to provide the recipe features you ask for — recipe generation, meal plans, photo/URL recipe import, and receipt scanning (the purposes in §4, shared only with the contractually-bound processors in §5). Under RCW 19.373, consent is not required to collect or share consumer health data where doing so is necessary to provide a product or service the consumer has requested, and we rely on that basis: you provide this data when you enter it during onboarding or profile editing in order to power those features, and we share it only with processors (Google) acting solely on our instructions to deliver them.

We do not collect, use, or share consumer health data for any secondary purpose (no analytics, no advertising, no behavioural profiling, no AI-model training), and we do not sell it. Before this notice took effect you were informed, in plain terms in the app and in §2–§5 above, of: the categories we collect (§2), the purposes (§4), and the processors who receive the data (§5).

10.1 Withdrawing consent

You can stop this processing at any time by:

Removing your dietary requirements and allergies in Settings → Household → Dietary & Allergens (and, for household members, in their profiles), which stops them being used or shared;
Deleting your account in Settings → Account → Delete Account, which erases all consumer health data; or
Emailing support@eliochef.com with the subject "Withdraw health data consent".

When you withdraw:

We stop further processing of consumer health data immediately;
We delete the consumer health data we already hold for you (and instruct our sub-processors to do the same), in line with §7's right to delete;
The Service's AI features that depend on dietary data become unavailable, but the rest of the app continues to function.

Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.

11. Children

The Elio app is for users 16 and older. We do not knowingly collect consumer health data from any user under 16. If we learn we have collected consumer health data from a user under 16, we will delete that data and the associated account.

12. Security

We protect consumer health data using:

TLS encryption for all data in transit between the app, our servers, and our sub-processors;
Encryption at rest for data stored in Firebase Cloud Firestore;
Firestore Security Rules that restrict each user's data to that user's own account — no other user can read or write your consumer health data;
Contractual safeguards with each sub-processor listed in §5.

If we ever become aware of a data breach affecting your consumer health data, we will notify you and the Washington State Attorney General within the timelines required by Washington law (RCW 42.56.590 and RCW 19.255).

13. Changes to this notice

If we change this notice, we will update the "Last updated" date above. If the change is material (for example, adding a new sub-processor or a new processing purpose), we will:

Notify you in the app or by email before the change takes effect; and
Where the change introduces a new purpose or recipient that is not necessary to provide the features you've requested, obtain your consent before it applies to data we already hold.

14. Contact

For any question about this notice or how we handle your consumer health data:

Email: support@eliochef.com Subject line: "Washington health data request" or "Washington health data appeal" depending on what you need.

We will respond within 45 days.