Pantry

Consumer Health Data Privacy Policy

Effective and last updated: September 22, 2026

This policy is for residents of Washington, Nevada and Connecticut and explains how Koba Labs LLC ("we") handles consumer health data in the Pantry app, as required by Washington's My Health My Data Act, Nevada law (NRS 603A) and the Connecticut Data Privacy Act. Our full Privacy Policy covers everything else.

---

1. Health Data We Collect

• Body information: age, sex, height, weight and weight entries, target weight
• Activity level and fitness goal (lose, maintain or gain weight)
• Calorie, protein, carbohydrate and fat targets, including the targets we calculate from the information above
• Diet style, dietary restrictions and allergies, and foods you dislike
• Your food diary: meals you log and their calories and macros, and meal ratings with the reasons you give
• Photos of your meals, fridge or pantry, which can reveal what you eat

2. Where It Comes From

From you, when you set up and use the app, and from our own calculations, such as the calorie and macro targets we work out from your answers.

3. Why We Collect and Use It

Only to provide the Pantry features you ask for: setting your targets, suggesting meals that fit them and your diet, reading your photos, estimating nutrition and keeping your food diary. We do not use it for advertising or marketing, we do not sell it, and we do not send it to our analytics provider.

4. Who We Share It With

• Supabase, Inc. stores it for us as our database provider.
• OpenAI and Google (Gemini) receive your dietary restrictions and allergies, food dislikes, calorie and protein targets, pantry items and scan photos to generate meals and read photos, and only after you give permission in the app (Profile → AI Data Processing).
• FatSecret and Open Food Facts receive the food names and barcodes you search or log, to look up nutrition. They do not receive your name, email or account details.

We share it with no one else, except when required by law. On request we will give you the contact details for each of these companies.

5. Consent

We collect consumer health data only as necessary to provide the features you request. We ask for your separate permission before sharing it with our AI providers, and you can withdraw that permission at any time under Profile → AI Data Processing; AI features stop until you allow them again. We do not use your data to train AI models; how our AI providers handle the data they receive is described in section 3 of our Privacy Policy.

6. Your Rights

You have the right to:

• confirm whether we collect, share or sell your consumer health data, and get a copy of it, including a list of every third party and affiliate we shared it with and how to contact them
• have it deleted from our systems, from our service providers' systems and, within six months, from backups (you can delete your account instantly in the app under Profile → Delete Account)
• withdraw your consent to its collection and sharing
• appeal if we decline your request

We do not sell consumer health data, so there is nothing to opt out of.

7. How to Make a Request

Email privacy@heypantry.app with "Consumer Health Data Request" in the subject line, from the email on your Pantry account so we can verify you. Requests are free, up to twice a year. We respond within 45 days, and if we need more time (up to 45 more days) we will tell you why. Nevada deletion requests are completed within 30 days.

Appeals. If we decline your request, reply with "Appeal" in the subject line and we will answer within 45 days. If you disagree with the outcome, you can contact your attorney general:

• Washington: www.atg.wa.gov/file-complaint
• Nevada: ag.nv.gov
• Connecticut: portal.ct.gov/ag

---