Consumer Health Data Privacy Policy

BringWhat ("we", "us", "our") handles one kind of health information: the food allergies and intolerances you choose to add to your profile. This policy explains what we do with them. It is written for Washington's My Health My Data Act and Nevada's consumer health data law, and it applies to everyone, wherever you live. Our Privacy Policy covers all other information.

1. What We Collect and How We Use It

We collect:

• Your food allergies and intolerances, such as peanuts or dairy, and how severe each one is: mild, moderate or severe.
• A record of your consent: when you agreed to let us store them, and when you agreed to let us show them on events.

We use them only to:

• Show them to you on your account page and include them in your data download.
• If you agree to share them, show them without your name on events you host or have said yes or maybe to, and warn anyone adding a dish to one of those events that it may contain one of them.

We don't use them for advertising, analytics, profiling or training AI, we don't infer anything about your health from anything else you do on BringWhat, and we never sell them.

2. Where It Comes From

Only from you, when you add allergies to your profile. Nobody else can add them for you, and we don't get health information from any other source.

Please don't put health details in free-text messages, such as a note to a host. A message goes to whoever it is addressed to, while your allergy list stays under your control.

3. What We Share and With Whom

We share your allergies only if you tick the second box on the Allergens card, and only as each allergy's type and severity. On each event they are merged with other guests' into one list, without anyone's name.

• Who sees them: the hosts of each event you host or have said yes or maybe to, and everyone invited to that event. They see the list on the event page and in the warning shown when adding a dish.
• Who stores them for us: DigitalOcean, which hosts our servers and database in the United States, stores them on our behalf. This is processing for us, not sharing.

We have no affiliates and share them with no one else.

No third party collects health information through BringWhat across websites or over time. If you accept cookies, Google Analytics records which pages you visit, but it never receives your allergies.

4. How We Process and Protect It

• Your allergies are stored in our database in the United States and travel only over encrypted (HTTPS) connections.
• Only the people who run BringWhat can reach the database, and only to keep the Service working.
• When you delete an allergy or withdraw consent, it leaves our live database at once. When you delete your account, your allergies go with the rest of it after the three days you have to change your mind. Our backups lose them within 30 days, when the last backup containing them expires.

5. Your Rights

You can do all of this yourself on the Allergens card of your account:

• See the allergies we hold and whether they are shown on your events.
• Change them: add one, remove one, or remove and re-add it with a different severity.
• Stop showing them on events, at once, while keeping them on your profile.
• Withdraw consent and delete them. One button deletes every allergy and both consents.

Your data download lists your allergies, when you consented, and the events you've said yes or maybe to, which are the events where shared allergies appear. Deleting your account also deletes your allergies.

You can also make any of these requests, or ask whether we hold health data about you and who has seen it, by emailing support@bringwhat.com from the address on your account, or by writing to us at the address below. We may ask you to confirm that the request comes from you. We answer within 45 days. If we need longer, we'll tell you why, and we'll still answer within 90 days. Requests are free.

Appeals. If we turn down a request, reply to our answer with "Appeal" in the subject. We'll reply in writing within 45 days, with our reasons. If we still turn it down, you can complain to your state attorney general, for example in Washington, Nevada or Connecticut.

Using these rights never changes how the rest of BringWhat works for you.

6. Changes to This Policy

The version and publish date at the top show which version this is. Before a material change takes effect, we'll email registered users who have saved allergies. We'll ask for your consent again before using them in any new way.