Consumer Health Data Privacy Policy

Last updated October 16, 2026. This policy explains how CW Frontier Innovations LLC ("Cauli", "we") handles consumer health data in the Cauli app and on getcauli.com. It is written for Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's rules on consumer health data, and we apply it to everyone in the United States. It adds to our Privacy policy, which covers all the information we handle.

What consumer health data we collect

"Consumer health data" means personal information that identifies your past, present or future physical health. In Cauli that is:

• Body measurements: sex, age, height, current weight, goal weight and your Weigh-ins over time.
• Goals and activity: your goal (lose fat, build muscle, recomp or maintain), pace, training days, how active your day is and your calorie and protein targets.
• Diet and allergies: food allergies, the way you eat (for example vegetarian, vegan or halal) and foods you won't eat.
• Eating records: the meals Cauli plans for you, which you mark Ate it or won't eat, and your reactions to them.
• What you tell Cauli: chat messages and the things Cauli learns from them (shown in What Cauli knows), which may include health-related details you choose to share.
• Inferences: your estimated calorie needs, progress toward your goal and the eating patterns Cauli learns.
• On the waitlist: the goal you picked, if you shared it.

We don't collect biometric data, precise location, reproductive or sexual health data, or data from health apps or devices.

Where it comes from

From you: your answers when you set up Cauli, what you change in Settings, your Weigh-ins, chat messages and taps such as Ate it. Some of it is calculated by Cauli from those answers (your targets, for example).

Why we collect and use it

• To provide the service you ask for: set your targets, plan and portion your Week, keep your allergies and foods you won't eat out of it, re-plan when you ask and show your progress.
• To personalise later Weeks from what you liked and skipped.
• To keep Cauli safe and working, for example to check allergy rules in code and to fix problems.

We collect and use consumer health data only as needed to provide Cauli to you, and with your consent, which you give by entering it in the app. We don't use it for advertising, we don't sell it, and we don't use it to track you across other apps or websites.

Who we share it with

We share consumer health data only with processors, companies that handle it for us under contract and only to provide Cauli:

• Neon: stores it in our database.
• Vercel: runs the servers that process it.
• OpenRouter, with AI models from Anthropic, Google and OpenAI: receive the parts needed to plan your Week, answer the chat and read photos, on zero-data-retention settings and without your name or email.
• Cloudflare: stores the photos you add, which may show your food.
• PostHog (analytics): receives that you marked a meal Ate it or reacted to it, under a random account id, but never your weight, goal, allergies, diet or what the meal was. It never receives the goal you try in the website's demo.
• Brevo: stores the goal you shared on the waitlist.

We don't share consumer health data with third parties or affiliates for their own use. We don't have affiliates that receive it. We'll disclose it otherwise only if the law requires it, such as a valid court order.

Your rights

You have the right to:

• Confirm and access: know whether we collect, share or sell your consumer health data, and get a copy of it.
• Know who it's shared with: get a list of the processors and third parties that received it (the list above).
• Withdraw consent: stop us collecting and using it. You can remove details in the app, or delete your account; without this data Cauli can't plan your meals.
• Delete it: have it deleted from our systems, our processors' systems and our backups.
• Not be treated differently for using any of these rights.

How to use your rights

• In the app: Settings › Delete account deletes your account and all its data at once. You can also change or remove details in Settings, What Cauli knows and Progress.
• By email: write to info@cwfrontierinnovations.com with "Health data request" in the subject, saying what you'd like. We'll check the request comes from you (usually by replying to your account email) and answer within 45 days. If we need more time, up to another 45 days, we'll tell you why. Requests are free, up to twice a year.
• Deletion reaches everywhere: when we delete your data, we delete it from our live systems at once, tell our processors to delete it, and our backups are overwritten within 30 days.
• Appeals: if we turn down your request, reply to our answer with "Appeal" in the subject. We'll respond within 45 days and explain our decision. If you're still unhappy, you can contact your state attorney general, for example the Washington State Attorney General at atg.wa.gov/file-complaint.

Security and retention

Consumer health data is encrypted in transit and at rest, and access is limited to the people who need it to run Cauli. We keep it while your account exists and delete it when you delete your account, as described in our Privacy policy.

Changes and contact

If we change this policy we'll update the date above and tell you in the app or by email before any significant change. Questions: email info@cwfrontierinnovations.com or write to CW Frontier Innovations LLC, c/o Registered Agents Inc, 116 Agnes Rd, Ste 200, Knoxville, TN 37919, USA.