Consumer Health Data Privacy Policy

Last updated: October 27, 2026

This policy is separate from our Privacy Policy and sits alongside it. It exists because some of what you tell Kessa is consumer health data under Washington's My Health My Data Act and Nevada's consumer health data law, and those laws require us to describe that data on its own, in its own document. Where this policy and the general Privacy Policy differ on consumer health data, this one governs.

It applies to everyone. We have not limited it to residents of Washington or Nevada, because writing one honest description of what we do is simpler than maintaining two and hoping the right one is shown to the right person.

1. What we mean by consumer health data

These laws define consumer health data broadly. It covers information that identifies your past, present or future physical or mental health status — and, importantly, information from which such a status can be inferred. That second part is why an app about nutrition is covered even though we are not a medical service.

Kessa is built for people taking GLP-1 medication. The fact that you are using Kessa at all is capable of supporting an inference about you. We treat it that way.

2. The categories of consumer health data we collect, and why

All of it comes from you. All of it is used to run the features you asked for, except the app ad measurement events, which are used to measure our ads (see section 4). We do not buy health data, we do not infer it from your browsing, and we do not obtain it from data brokers.

• Body and profile information — age, sex at birth, height, weight, and a body-composition band you select. Used to calculate your protein target. Without it there is no product.
• Medication context — the type of GLP-1 medication you take and which phase you are in. Used to adjust guidance to the phase you are in. Kessa stores a dose only if you enter one in Shots, exactly as you enter it, and never suggests, changes or gives guidance on a dose.
• Two health flags — whether you have a kidney condition, and whether you are pregnant or breastfeeding. Used only to hold back a protein recommendation and direct you to your clinician instead. They exist to make the product decline to answer, not to personalise it.
• Food and meal logs — what you record eating, including any food you add yourself from its label, and the protein and calorie figures derived from it. Used to show your day and your history.
• Meal photographs — images you choose to upload for the photo reader. Used to identify the food and estimate its protein.
• Coach conversations — what you type to the nutrition coach and what it replies. Used to answer you, and retained so the conversation has continuity.
• Day markers — days you mark as a hard day. Used to show patterns alongside your log.
• Shot log — if you turn on Shots: the date of each shot and, if you keep them, the time, the medication by generic name, the dose exactly as you enter it, the injection site, and the shot schedule you set.
• Weekly goals and milestones — how many protein days you aim for each week, how each finished week went, and the milestones you reach. Used to show your rhythm in the app.
• Buy-again answers (visible only to you) — whether you would buy a food from the Protein Board again, and up to two tags you choose. Used to build your private buy-again list.
• App ad measurement events — that you installed and opened the iPhone or Android app, created or signed in to an account, and started a free trial or paid membership, with its price and currency. Used to measure our ads on Meta (see section 4).

We also collect account and billing information — your email address, and payment details handled entirely by Stripe, or by Apple or Google Play if you join in the iPhone or Android app. Kessa never sees or stores your card number.

3. Where it comes from

One source: you. Everything in section 2 is entered by you, in the app, on purpose, except the app ad measurement events, which the iPhone and Android apps record as you use them. We do not collect consumer health data from any other person, company, public record or third-party source, and we do not derive it from tracking your activity elsewhere on the internet.

Before Shots keeps anything, it shows you what it keeps and asks you to choose; we record when you chose. Your shot-day reminder is scheduled on your phone, and nothing about it is sent to us.

4. How we use it

• To provide the features you signed up for — your protein target, your log, your history, the photo reader, and the coach.
• To send you the service and billing messages the law requires and that you would expect.
• To keep the service working and secure, and to investigate faults.
• To comply with legal obligations, including keeping records of consent that consumer-protection law requires us to retain.

Ad measurement. Our public marketing pages carry a Meta advertising pixel, described in section 5 of our Privacy Policy. It records that a page was viewed and that a button was pressed, and it is not present in the web app, on the quiz, on your results, or at checkout.

Our iPhone and Android apps include Meta’s app software (the Meta SDK). It tells Meta that the app was installed and opened, that an account was created or signed in to, and that a free trial or paid membership started, with its price and currency, along with device information, your IP address and identifiers it uses to recognise the device. Because Kessa is an app for people taking GLP-1 medication, those facts can support an inference about your health, so we count them as consumer health data and say so here. We use them only to measure our ads on Meta. Meta is never given your weight, your GLP-1 phase, your protein target, your shots, your meals, your coach conversations, your email address, or any answer you have typed into Kessa. We do not use consumer health data to target ads to you, to build audiences, or to profile you.

We do not use your data to train anyone's general-purpose AI models.

5. Who we share it with

We share consumer health data with service providers that process it on our behalf, under contract, for the purposes we specify, and — only if you turn it on — with one buddy you choose, as described below. We also share with Meta the app ad measurement events described in section 4. Apart from those events, we do not share it with advertisers, data brokers, analytics networks, social platforms, or anyone building a profile of you.

With a buddy you choose. Only if you turn it on. Kessa shows the one person you pair with whether you checked in today and how many days in a row you've both checked in — never your name, food, numbers, target, weight, medication or answers. You turn it on by sending or accepting an invite and confirming on a screen that lists exactly this. You can stop at any time with Remove buddy in the app; sharing ends at once.

We may also disclose information if the law requires it, or to protect rights and safety, or in connection with a merger or sale of the business — in which case this policy travels with it.

6. We do not sell your consumer health data

We have never sold consumer health data and we do not intend to. Selling it would require your separate, signed authorization under these laws, and we have never sought one. If that ever changes, we will ask you first, in a separate document, and you will be free to say no and keep using Kessa.

7. Your rights, and how to use them

You have the right to:

• Confirm whether we are collecting, sharing or selling your consumer health data, and access it — including a list of everyone we have shared it with.
• Withdraw your consent to our collection and sharing of it. Remove buddy in the app stops buddy sharing immediately. Our apps do not yet have a switch that turns off their Meta ad measurement events; until they do, Kessa on the web at app.kessahealth.com does not send them.
• Delete it. When you ask us to delete, we delete it from our own systems and we notify the service providers in section 5 to do the same.

How to ask: email hello@kessahealth.com from the address on your account, and say what you want. A person reads that inbox. We will confirm we have received your request, and we will respond within 45 days — and if we genuinely need longer, we will tell you why before that period runs out, and take no more than 45 further days.

We may need to verify that the request is yours. We will not make that harder than it needs to be, and we will never charge you for a request.

If we refuse: we will tell you why in writing, and how to appeal. To appeal, reply to that message. We will decide the appeal within 45 days and explain the outcome in writing. If we deny the appeal, we will give you a link to submit a complaint to the Washington State Attorney General, or to the Nevada Attorney General, as applicable.

We will not retaliate. Using any of these rights will never cost you access, features, or a different price.

8. How long we keep it

We keep consumer health data for as long as you have an account, and then delete it when you ask, or within a reasonable period after you close your account.

One narrow exception, and we would rather state it than bury it. Consumer-protection law requires us to keep proof that you agreed to a subscription's renewal terms, for years after the subscription ends. Those consent records are kept on that legal basis and are deliberately carved out of deletion requests. They contain no health data at all — they hold the date, the price you were shown, the wording you agreed to, and your account identifier. Nothing about your body, your medication, your meals or your conversations is retained that way.

9. How we protect it

Access to member data is restricted at the database level so that you can read your own records and nobody else's. Administrative access is limited, and the most sensitive tables are reachable only by the server, never by a browser. We use encryption in transit throughout. No system is perfect, and we do not claim ours is.

10. Children

Kessa is for adults. It is not directed to anyone under 18 and we do not knowingly collect consumer health data from anyone under 18. If you believe a child has given us information, email hello@kessahealth.com and we will delete it.

11. Changes to this policy

If we make a material change to how we handle consumer health data, we will update this page, change the date at the top, and — where the law requires it — ask for your consent before the change applies to data we already hold. We keep dated copies of previous versions and will provide one on request.

12. Contact

hello@kessahealth.com · Nectar Gummies, LLC, 2305 Spanish Trail, Rocklin, CA 95765.

Nectar Gummies, LLC is the entity responsible for the consumer health data described here. Kessa is its product.