Mealisa

Consumer Health Data Privacy Policy

Effective and last updated: October 1, 2026

This policy explains Mealisa's handling of consumer health data, including for consumers protected by Washington's My Health My Data Act and Nevada's consumer health data law. It supplements our Privacy Policy. Reading this page does not provide consent.

1. Who operates Mealisa

Asadullin Akhat, operating Mealisa as a registered Gewerbe in Germany. Business address: Spreeallee 10, 16321 Bernau bei Berlin, Germany. Contact: privacy@mealisa.com.

2. Data and purposes

Depending on what you enter and the features you request, Mealisa processes food allergies and restrictions; age, height, weight, activity and goals; nutrition targets; food diary entries, meal times and nutrition history; selected food images and recipe ingredients; and generated plans or recommendations. These records may constitute consumer health data when they reveal health information and can be linked to you. An account ID or other identifier associated with such records may also be relevant.

We use this information to maintain your diary, calculate nutrition estimates and targets, and provide the analysis, recipes, meal plans or recommendations you request. Optional nutrition-profile processing and AI diary recommendations have the separate choices described below. Mealisa does not diagnose or treat medical conditions.

3. Sources

Information comes from your entries, images you select, optional details you supply about family meal preferences, and app calculations or AI responses generated for your requests. Product nutrition information can come from Mealisa's catalog or Open Food Facts when you request barcode lookup. We do not currently connect to Apple Health or fitness trackers.

4. Device storage and requested processing

Your diary and saved app information are primarily stored on your device. Optional profile details are stored there when you enable nutrition-profile consent. Selected AI inputs travel through the authenticated Mealisa API hosted by Hetzner to OpenAI. A selected task may transmit foods, ingredients, images, preferences, allergens, targets or a diary summary. Age, height and weight are not sent for recipe personalization. Review images before submitting them.

If you create a transfer backup, the selected app data is sent through our API to Google Firestore. The backup can include diary data and, when nutrition-profile consent is enabled, saved body details and allergies. This is optional. One backup is available per account, expires after seven days, and can be replaced or deleted. It is restored only after signing in to the same account.

5. Recipients

The following categories of providers may process information needed for the selected feature:

We do not have affiliated companies to which we disclose this data. Sign-in and purchase services from Apple and Google process account or payment information for their respective services. Open Food Facts can receive a requested barcode and technical connection information; we do not intentionally send your profile or diary for barcode lookup.

The current OpenAI project uses Global residency. Firestore's primary database uses the European region eur3; this does not confine every provider activity to Europe. Our API uses store: false for Responses API requests. This prevents subsequent retrieval of stored responses through that API, but does not eliminate provider security or legally required retention.

6. Choices

Optional nutrition-profile consent controls saved body details and allergies used for personalization. AI diary recommendations require their own consent. You can decline these choices and continue using other app functions, or withdraw them in Profile → Account & usage. Withdrawal removes the relevant saved profile details or recommendation on the device and stops future processing for that optional purpose. Diary entries you entered yourself may remain.

Choosing an AI feature submits the inputs needed for that request. Transfer backups are created only when you request them. For a broader request to stop collection or disclosure of health data, or to delete it across the service, contact privacy@mealisa.com. Withdrawing a profile consent is different from deleting every record you previously supplied.

7. Analytics, sale and advertising

Mealisa does not sell consumer health data or use entered health information for targeted advertising. Optional app analytics receives fixed feature labels and technical information; our custom events exclude diary contents, images, body measurements, allergies and the Firebase account ID. Such labels and identifiers may still reveal use of nutrition features. Optional website analytics records page visits and technical information after consent; Google may link technical identifiers across services under its settings and terms. We do not intentionally provide entered health information for cross-site advertising. You can disable app analytics in Profile → Account & usage, and website analytics through Cookie settings.

We do not use health-facility geofencing. Future materially different health-data uses will be disclosed before they begin, with a new choice where required.

8. Retention and deletion

Local records remain until you remove them, withdraw the applicable consent, delete your account or remove the app. Account-linked server records are generally kept while the account exists. Support records have a twelve-month expiry; mailbox notifications are removed when the request is resolved or the account is deleted. Transfer backups expire after seven days, with expired codes blocked immediately and Firestore TTL removal occurring asynchronously. Mealisa's Nginx and PM2 logs use daily rotation configured for fourteen days. Provider records have their own applicable retention arrangements.

Delete account is available in Profile → Account & usage. It removes local account data and invokes server deletion. A health-data deletion request can also be made without asking to close the entire account. We coordinate applicable downstream deletion requests with recipients; a provider's confirmation and any legally required exception are handled as part of that request. Contact us about records previously sent to a provider or stored on another device.

9. Requests and appeals

Email privacy@mealisa.com to request confirmation, access, a recipient list and contact mechanisms, correction, withdrawal or deletion. Use your account email where possible; do not send a password or unnecessary medical documents. We verify requests proportionately without requiring a new account.

We aim to answer within 30 days and meet applicable statutory deadlines. Washington requests are due within 45 days of receipt; Nevada requests within 45 days of authentication. Where permitted, a necessary extension is explained within the initial deadline. Applicable access requests are free at least twice annually. A refusal includes reasons. Appeal by emailing the same address with “Health data appeal”; we answer within 45 days and provide the relevant regulator's complaint route if denied.

Regulators: Washington Attorney General and Nevada Attorney General. Other applicable privacy rights remain available as described in the main Privacy Policy.

10. Updates and contact

Changes appear with an updated date. We will provide additional notice through the app, website or account contact for material health-data changes and obtain any required new consent before new processing. Questions and requests: privacy@mealisa.com. Support: support@mealisa.com.