Consumer Health Data Privacy Policy

Last updated: August 19, 2026

This policy is separate from our Privacy Policy and sits alongside it. It exists because some of what you tell Kessa is consumer health data under Washington's My Health My Data Act and Nevada's consumer health data law, and those laws require us to describe that data on its own, in its own document. Where this policy and the general Privacy Policy differ on consumer health data, this one governs.

It applies to everyone. We have not limited it to residents of Washington or Nevada, because writing one honest description of what we do is simpler than maintaining two and hoping the right one is shown to the right person.

1. What we mean by consumer health data

These laws define consumer health data broadly. It covers information that identifies your past, present or future physical or mental health status — and, importantly, information from which such a status can be inferred. That second part is why an app about nutrition is covered even though we are not a medical service.

Kessa is built for people taking GLP-1 medication. The fact that you are using Kessa at all is capable of supporting an inference about you. We treat it that way.

2. The categories of consumer health data we collect, and why

All of it comes from you, and all of it is used to run the features you asked for. We do not buy health data, we do not infer it from your browsing, and we do not obtain it from data brokers.

• Body and profile information — age, sex at birth, height, weight, and a body-composition band you select. Used to calculate your protein target. Without it there is no product.
• Medication context — the type of GLP-1 medication you take and which phase you are in. Used to adjust guidance to the phase you are in. Kessa never asks for, stores, or gives guidance on a dose.
• Two health flags — whether you have a kidney condition, and whether you are pregnant or breastfeeding. Used only to hold back a protein recommendation and direct you to your clinician instead. They exist to make the product decline to answer, not to personalise it.
• Food and meal logs — what you record eating, and the protein and calorie figures derived from it. Used to show your day and your history.
• Meal photographs — images you choose to upload for the photo reader. Used to identify the food and estimate its protein.
• Coach conversations — what you type to the nutrition coach and what it replies. Used to answer you, and retained so the conversation has continuity.
• Day markers — days you mark as a medication day, and days you mark as a hard day. Used to show patterns alongside your log.

We also collect account and billing information — your email address, and payment details handled entirely by Stripe. Kessa never sees or stores your card number.

3. Where it comes from

One source: you. Everything in section 2 is entered by you, in the app, on purpose. We do not collect consumer health data from any other person, company, public record or third-party source, and we do not derive it from tracking your activity elsewhere on the internet.

4. How we use it

• To provide the features you signed up for — your protein target, your log, your history, the photo reader, and the coach.
• To send you the service and billing messages the law requires and that you would expect.
• To keep the service working and secure, and to investigate faults.
• To comply with legal obligations, including keeping records of consent that consumer-protection law requires us to retain.

We do not use consumer health data for advertising. Not to target ads, not to measure ads, not to build audiences, and not to profile you. Our public marketing pages carry a Meta advertising pixel, described in section 5 of our Privacy Policy. It records that a page was viewed and that a button was pressed. It is not present in the app, on the quiz, on your results, or at checkout, and it is never given your weight, your GLP-1 phase, your protein target, your email address, or any answer you have typed into Kessa. No consumer health data reaches it.

We do not use your data to train anyone's general-purpose AI models.

5. Who we share it with

We share consumer health data only with service providers that process it on our behalf, under contract, for the purposes we specify. We do not share it with advertisers, data brokers, analytics networks, social platforms, or anyone building a profile of you.

We may also disclose information if the law requires it, or to protect rights and safety, or in connection with a merger or sale of the business — in which case this policy travels with it.

6. We do not sell your consumer health data

We have never sold consumer health data and we do not intend to. Selling it would require your separate, signed authorization under these laws, and we have never sought one. If that ever changes, we will ask you first, in a separate document, and you will be free to say no and keep using Kessa.

7. Your rights, and how to use them

You have the right to:

• Confirm whether we are collecting, sharing or selling your consumer health data, and access it — including a list of everyone we have shared it with.
• Withdraw your consent to our collection and sharing of it.
• Delete it. When you ask us to delete, we delete it from our own systems and we notify the service providers in section 5 to do the same.

How to ask: email hello@kessahealth.com from the address on your account, and say what you want. A person reads that inbox. We will confirm we have received your request, and we will respond within 45 days — and if we genuinely need longer, we will tell you why before that period runs out, and take no more than 45 further days.

We may need to verify that the request is yours. We will not make that harder than it needs to be, and we will never charge you for a request.

If we refuse: we will tell you why in writing, and how to appeal. To appeal, reply to that message. We will decide the appeal within 45 days and explain the outcome in writing. If we deny the appeal, we will give you a link to submit a complaint to the Washington State Attorney General, or to the Nevada Attorney General, as applicable.

We will not retaliate. Using any of these rights will never cost you access, features, or a different price.

8. How long we keep it

We keep consumer health data for as long as you have an account, and then delete it when you ask, or within a reasonable period after you close your account.

One narrow exception, and we would rather state it than bury it. Consumer-protection law requires us to keep proof that you agreed to a subscription's renewal terms, for years after the subscription ends. Those consent records are kept on that legal basis and are deliberately carved out of deletion requests. They contain no health data at all — they hold the date, the price you were shown, the wording you agreed to, and your account identifier. Nothing about your body, your medication, your meals or your conversations is retained that way.

9. How we protect it

Access to member data is restricted at the database level so that you can read your own records and nobody else's. Administrative access is limited, and the most sensitive tables are reachable only by the server, never by a browser. We use encryption in transit throughout. No system is perfect, and we do not claim ours is.

10. Children

Kessa is for adults. It is not directed to anyone under 18 and we do not knowingly collect consumer health data from anyone under 18. If you believe a child has given us information, email hello@kessahealth.com and we will delete it.

11. Changes to this policy

If we make a material change to how we handle consumer health data, we will update this page, change the date at the top, and — where the law requires it — ask for your consent before the change applies to data we already hold. We keep dated copies of previous versions and will provide one on request.

12. Contact

hello@kessahealth.com · Nectar Gummies, LLC, 2305 Spanish Trail, Rocklin, CA 95765.

Nectar Gummies, LLC is the entity responsible for the consumer health data described here. Kessa is its product.