A specific notice for your most sensitive information.

Scope and definitions

This notice is effective September 3, 2026. “Consumer health data” means personal information that identifies or can reasonably be linked to a consumer and identifies or permits an inference about that consumer's past, present, or future physical or mental health. Read this together with our Privacy Policy, which explains our general practices and contact information.

Consumer health data we collect

• Body and profile data: height, weight, target weight, birth date, formula-related sex, activity level, and associated inferences.
• Nutrition goals and activity: calorie or nutrition targets, meal-reminder choices, active and dietary energy, and workout summaries.
• Meal and nutrition records: meal and label images, timestamps, ingredients, portions, calorie and macronutrient estimates, corrections, and derived trends.
• Capture and analysis data: camera depth maps, metric samples, calibration details, model inputs and outputs, and analysis provenance.
• Health-source data: the specific Apple Health categories you authorize—height, body mass, active energy, dietary energy, and recent workout summaries.
• Health-related communications: information you choose to include in support, feedback, export, or deletion requests.

Sources

We collect consumer health data directly from you; from meal images and depth sensors when you initiate a capture; from estimates and inferences generated by Evo's systems; from corrections you submit; and from Apple Health or another integration only when you authorize it. We do not buy consumer health data from data brokers.

Why we collect and use it

• Provide the meal analysis, nutrition record, personalization, progress, and connected-health features you request.
• Store and synchronize your private account data across devices.
• Maintain safety, prevent abuse, troubleshoot, respond to you, and comply with law.
• Evaluate and improve accuracy, including Evo-owned model development, under the de-identification and consent safeguards in the Privacy Policy.

We collect health data with your consent or to the extent necessary to provide a product or service you requested. We obtain a separate affirmative opt-in before an additional collection or use when applicable law requires it. You can withdraw consent for future collection by disconnecting an integration, stopping use of the feature, or contacting us.

Consumer health data we disclose

We disclose only the categories needed for a requested feature or another purpose stated here. We do not sell consumer health data. The relevant recipients are:

• Cloud infrastructure, storage, and application-hosting providers: account-linked health records, meal records, images, depth artifacts, analysis requests, and related metadata as needed to securely store, transmit, and process them.
• OpenAI: meal and label images, depth and calibration information, and prompts needed to return an analysis; OpenAI receives a pseudonymous safety identifier, not your email or raw Evo user ID.
• Professional advisers: limited information to lawyers, auditors, insurers, or security consultants only when reasonably necessary and subject to confidentiality obligations.
• Government authorities and other legally required recipients: the minimum information required by valid legal process or applicable law, or reasonably necessary to protect safety or legal rights.
• A recipient you choose: the information you specifically direct us to disclose.

PostHog analytics and Sentry diagnostics are configured not to receive health values, meal content, or body metrics. Resend receives email and message-delivery information, not health records. We require processors to follow our instructions and protect the data. We obtain separate consent before sharing health data when applicable law requires it.

We do not disclose identifiable consumer health data to investors or prospective buyers for ordinary diligence. If Evo is involved in a merger, acquisition, or reorganization that requires customer records to transfer, we will limit and protect the information and provide notice or obtain consent when required by law.

Your consumer health data rights

You may request to:

• confirm whether we collect, use, or disclose your consumer health data and access that data;
• receive a list of third parties and affiliates with whom it has been shared, where required;
• withdraw consent from future collection or disclosure;
• delete consumer health data, including by having us notify relevant processors and other recipients where required; and
• appeal our refusal to act on a request.

Email privacy@evo.medfrom your account address with “Consumer health data request” in the subject. Tell us which right you want to exercise. We may verify identity and authority, will respond within the time required by law, and will explain how to appeal any denial. We will not discriminate against you for exercising a right.

Sale, geofencing, security, and changes

Evo does not sell consumer health data and does not use geofences around health care facilities to identify or target people seeking care. We maintain safeguards appropriate to health data, including access controls, encryption in transit, private storage rules, and data minimization.

We will publish changes here before collecting, using, or disclosing a new health-data category or using existing health data for a materially different purpose. We will obtain affirmative consent first when required. Contact Darwin Life Inc. at privacy@evo.med or Attn: Privacy, 927 E Main St STE 67435, Louisville, KY 40206, United States.