Consumer Health Data Notice

This Consumer Health Data Privacy Notice ("Health Data Notice") describes how Cravin LLC ("Cravin," "we," "us," or "our") collects, uses, processes, discloses, retains, and protects consumer health data through the Cravin mobile application, cravinai.com, and related services.

This Health Data Notice supplements the Cravin Privacy Policy. It applies to information that qualifies as "consumer health data" or similar health-related personal information under applicable law.

Cravin is a food and recipe application. Cravin is not a healthcare provider and is not intended to provide medical diagnosis, treatment, or professional healthcare advice.

1. Contact Information

• Cravin LLC
• 306 W Redwood St, STE #4586
• Baltimore, MD 21201
• United States
• Email: support@cravinai.com
• Website: cravinai.com

2. Consumer Health Data We May Collect

Depending on how you use Cravin and what information you choose to provide, consumer health data may include:

• Food allergies
• Food sensitivities
• Dietary restrictions
• Dietary preferences that reveal or relate to health information
• Food or nutrition-related goals
• Information you provide in prompts or AI conversations that reveals health-related information
• Information we derive or associate with you based on health-related information you provide

For example, if you tell Cravin that you have a peanut allergy so recipes can be personalized, that information may qualify as consumer health data.

We do not ask users to provide detailed medical histories or clinical records in order to use Cravin.

3. Sources of Consumer Health Data

We may collect consumer health data from:

A. You

Most consumer health data is provided directly by you, including during:

• Account onboarding
• Allergy and dietary-preference setup
• Profile or preference changes
• Recipe-generation requests
• AI conversations
• Feedback or support communications
• Other voluntary interactions with Cravin

B. Your Interactions With Cravin

In limited circumstances, health-related information may be derived from how you interact with features or from information you submit to Cravin.

We do not intentionally infer medical diagnoses that you have not provided merely for advertising or profiling purposes.

C. Service Providers

Service providers that process information on our behalf may return results necessary to provide Cravin features. For example, an AI provider may process a prompt containing dietary information and return a personalized recipe.

4. Why We Collect and Use Consumer Health Data

We may collect and use consumer health data to:

• Personalize recipes based on reported allergies
• Personalize recipes based on dietary restrictions or preferences
• Avoid recommending ingredients you have asked us to avoid
• Respond to food- and recipe-related requests
• Operate AI-powered recipe and cooking functionality
• Remember preferences you choose to save
• Provide requested features
• Maintain your account and preferences
• Respond to support requests
• Maintain security and prevent misuse
• Comply with applicable law
• Establish, exercise, or defend legal claims where legally permitted

We do not use individual allergy information to build advertising audiences based on a person's allergy or health status.

5. Consent

Where applicable law requires consent to collect or process consumer health data, Cravin will request that consent before engaging in the applicable processing.

For example, Cravin may ask you to affirmatively consent to the collection and processing of allergy information for purposes of personalizing recipes and recommendations.

Providing allergy information is optional, although certain personalized features may not function in the same manner without it.

Where required by law, consent for a purpose that is materially different from the purpose originally disclosed will be requested separately.

6. How Consumer Health Data Is Processed

Consumer health data may be stored in Cravin's backend systems and processed through application servers and service providers necessary to deliver the Services.

For example:

• You provide an allergy or dietary preference.
• Cravin stores that preference with your account.
• When you request a personalized recipe, relevant preferences may be included in the recipe request.
• A third-party AI processor may process the information to generate the requested result.
• Cravin displays the result to you and may retain appropriate recipe or activity information as described in our Privacy Policy.

Cravin seeks to send service providers only the information reasonably necessary for the applicable task.

7. Categories of Consumer Health Data We May Disclose

Depending on the feature you use, we may disclose:

• Allergy information
• Dietary restrictions
• Dietary preferences
• Food or nutrition-related goals
• Health-related information voluntarily included in prompts or messages

We disclose such information only for purposes described in this Notice, at your direction or with your consent, or as otherwise permitted or required by applicable law.

8. Categories of Third Parties and Service Providers

Consumer health data may be processed by the following categories of recipients:

AI Service Providers

OpenAI may process relevant allergy, dietary, food preference, or health-related prompt information when necessary to generate recipes, respond to AI conversations, plan recipe queries, or perform related AI functionality.

Anthropic may process information necessary for certain ingredient-detection functionality. We seek to avoid sending unrelated personal information when it is unnecessary for the task.

Backend and Cloud Infrastructure Providers

Supabase provides backend infrastructure used for account, database, authentication, and server-side functionality and may store allergy and dietary preference information associated with your account.

Other infrastructure providers may process technical information necessary to securely deliver the Services.

Cravin requires its processors to handle information consistent with their contractual obligations and applicable law.

9. Sale of Consumer Health Data

Cravin does not sell consumer health data.

Cravin does not sell individual allergy information.

Cravin does not condition access to the Services on your authorizing the sale of your consumer health data.

If Cravin ever proposes to sell consumer health data in a manner requiring authorization under applicable law, we would first implement the legally required authorization process. Updating this Notice alone would not constitute your authorization.

10. Targeted Advertising and Health Data

Cravin does not currently share individual consumer health data for cross-context behavioral advertising.

We do not provide a user's individual allergy status to advertising platforms for the purpose of targeting that user based on the allergy.

If our advertising practices materially change, we will update our disclosures and obtain consent or provide opt-out rights where required before engaging in the new processing.

11. Third-Party Collection Over Time

Cravin does not currently authorize third-party advertising companies to collect consumer health data through Cravin over time and across unrelated websites or online services for behavioral advertising purposes.

Service providers may process information as necessary to perform services for Cravin, subject to their contractual and legal obligations.

12. Your Consumer Health Data Rights

Depending on applicable law, you may have the right to:

• Confirm whether Cravin is collecting, sharing, or selling your consumer health data
• Access consumer health data concerning you
• Obtain information about how your consumer health data is collected, used, or disclosed
• Request correction of inaccurate consumer health data
• Request deletion of consumer health data
• Withdraw consent to certain collection or sharing
• Obtain information concerning certain recipients of your consumer health data
• Appeal certain decisions concerning your privacy request where applicable

Cravin will not unlawfully discriminate against you for exercising applicable consumer health privacy rights.

13. How to Exercise Your Rights

You may submit a consumer health data privacy request by contacting:

• support@cravinai.com

Please include enough information for us to understand and process your request.

We may take reasonable steps to verify that you are the person associated with the information before fulfilling a request.

Where applicable law permits an authorized agent to submit a request on your behalf, we may require reasonable evidence of the agent's authority.

If we deny a request in circumstances where applicable law provides a right to appeal, our response will explain how to submit the appeal.

14. Accessing or Changing Your Information

Where Cravin provides account settings for allergy or dietary information, you may use those settings to review, change, or remove information directly.

You may also contact support@cravinai.com if you need assistance accessing, correcting, or deleting applicable consumer health information.

Changing or deleting an allergy preference can affect Cravin's ability to personalize future recipes based on that preference.

15. Withdrawing Consent

Where Cravin relies on your consent to process consumer health data, you may withdraw that consent.

You may do so through available account controls or by contacting:

• support@cravinai.com

Withdrawal does not necessarily affect processing that lawfully occurred before consent was withdrawn.

If the information is necessary to provide a feature you request, withdrawing consent may mean that Cravin can no longer provide that feature in the same manner.

16. Deletion

You may request deletion of your consumer health data, subject to applicable legal exceptions.

Deleting your Cravin account is designed to delete personally linked allergy and dietary preference information maintained as part of your account.

Where applicable law requires deletion to be propagated to processors or other systems, Cravin will take the steps required by that law.

Certain information may be retained where applicable law permits or requires retention, including limited information necessary for security, fraud prevention, legal compliance, dispute resolution, or establishment or defense of legal claims.

Where appropriate, information may instead be permanently de-identified so it can no longer reasonably be associated with you.

17. Data Security

Cravin maintains reasonable administrative, technical, and organizational safeguards designed to protect consumer health data.

These may include:

• Encryption in transit
• Access controls
• Database security controls
• Server-side protection of provider credentials
• Restrictions on access to production information
• Security monitoring and logging

Access to consumer health information should be limited to individuals and service providers with a legitimate need to process it for the applicable purpose.

No information-security system can guarantee absolute security.

18. Food Allergy and Health Safety

Cravin's processing of allergy information is designed to personalize results; it does not transform Cravin into an allergy-safety, medical, or healthcare service.

Artificial intelligence can make mistakes.

Even if you have entered an allergy into Cravin, you must independently check:

• Ingredients
• Product labels
• Allergen statements
• Substitutions
• Cross-contact risks
• Preparation methods
• Whether food is appropriate for you

Never rely solely on Cravin to determine whether a food is safe for a serious allergy or medical condition.

19. Changes to This Health Data Notice

We may update this Notice as the Services, our practices, or applicable laws change.

The "Last Updated" date will identify when this Notice was most recently revised.

Where required, we will provide notice before making a material change to our consumer health data practices.

Where applicable law requires affirmative consent before collecting or using a new category of consumer health data or using existing data for a materially different purpose, Cravin will seek that consent rather than relying solely on an updated privacy notice.

20. Contact Cravin

For questions or requests concerning consumer health data:

• Cravin LLC
• 306 W Redwood St, STE #4586
• Baltimore, MD 21201
• United States
• Email: support@cravinai.com
• Website: cravinai.com