The short version: Washington State's My Health My Data Act requires any business that handles a Washington resident's health-related data to publish a separate policy — this page — describing exactly what health data we collect, where it comes from, why, who we share it with, and how you can exercise your rights over it.
whatevr never sells consumer health data, never shares it for advertising, and never runs geofencing around health facilities. Your food, exercise, weight, and Apple Health data stay in your account, are used only to run the app for you, and you can see, export, or permanently delete all of it yourself from Settings at any time.
Washington's My Health My Data Act (RCW 19.373) applies to any business that collects or processes "consumer health data" belonging to a Washington resident (or someone whose data is collected in Washington), regardless of where the business is located. Because whatevr is a food and health logging app, and some of our users may be in Washington, we're publishing this standalone policy as required by RCW 19.373.020 — it isn't just a section of our main Privacy Policy.
"Consumer health data" under MHMDA is defined broadly to include information that identifies a consumer's physical or mental health status — including fitness and wellness information. In whatevr, that includes:
We do not collect precise geolocation, biometric identifiers (e.g. fingerprints, faceprints), genetic data, or reproductive/sexual-health-specific data as part of whatevr's core functionality.
We use consumer health data only to run the app for you:
We do not use consumer health data for advertising. We don't build advertising profiles from it, sell access to it for marketing purposes, or use it for "data mining" outside the purpose you gave it to us for. We don't run geofences around health-care facilities for any purpose, including advertising or tracking who visits them — MHMDA bans this outright and it isn't something whatevr does or has any reason to do.
MHMDA requires your affirmative consent before we collect consumer health data, and a separate affirmative consent before we share it — except where the collection or sharing is necessary to provide a product or service you've specifically requested (RCW 19.373.030(1)).
In whatevr's case, logging a meal is the service you're asking for, and the only way we can turn "grilled chicken and rice" into calories and macros is to process that text (through our AI provider, xAI, and our own systems). We treat your act of creating an account, agreeing to our Terms of Service and Privacy Policy, and using the logging features as your consent to that necessary processing — this policy and the Privacy Policy are how we give you the "clear and conspicuous" disclosure of what's collected and why that the law requires before you consent. Apple Health sync is a separate, explicit opt-in toggle in Settings; nothing is read from or written to Health unless you turn it on.
You can withdraw consent at any time — see Section 7 below. If you withdraw consent to core logging, we may not be able to provide that part of the service, since it depends on the processing you're withdrawing consent for.
We do not sell consumer health data. We do not exchange it for money, and we do not share it with any third party for that third party's own advertising or marketing purposes. The only parties who receive consumer health data are the service providers we rely on to run whatevr, each limited to what they need to do their job:
| Third party | What it receives | Why |
|---|---|---|
| xAI | Food/exercise text, photos, and voice clips you submit for logging | AI parsing into nutrition data; voice transcription |
| Convex | Your account info and everything you log | Database and backend hosting — where your data lives |
| Vercel | Standard web request data | Hosting for the web app |
| Sentry | Error/diagnostic data, may include limited technical context | Crash and bug monitoring |
| Apple | HealthKit data described in Section 2, only if you enable sync | Reading/writing your Apple Health record; also sign-in and subscription billing (not health data) |
These providers are bound by contract to use consumer health data only to perform services for us, not for their own independent purposes, and not to re-sell it. We may also disclose data if required by law (e.g. a valid subpoena), or to protect the rights and safety of our users — MHMDA permits this and we haven't had reason to use it.
If you're a Washington resident (or your data was collected while you were in Washington), you have the following rights under RCW 19.373.040:
Self-service, in the app:
Anything not self-service: email support@trywhatevr.app with your request (confirm/access, withdraw consent, or deletion). We'll act on it without undue delay, and in all cases within 45 days of receiving a verifiable request. If a request is unusually complex, we may extend that once by another 45 days — we'll tell you within the first 45 days if we need to do that, and why.
If we decline to act on your request, you can appeal by emailing support@trywhatevr.app with the subject line "MHMDA appeal", referencing your original request. We'll respond in writing within 45 days of receiving the appeal, explaining our decision and the reasons for it. If we uphold the denial, that response will also explain how you can contact the Washington Attorney General to submit a complaint.
whatevr does not use geofencing around any health care facility, and does not collect location data to identify, track, or target consumers who visit one. This section exists because RCW 19.373.030(4) requires us to say so — it isn't something we do.
If we start collecting new categories of consumer health data or start using or sharing it for a new purpose, we'll update this page and obtain your affirmative consent before doing so, as required by RCW 19.373.020(1)(c)–(d). We'll also update the "last updated" date above whenever this page changes materially.
Toasty Cabin LLC
North Carolina, USA
Consumer health data requests and questions: support@trywhatevr.app