CarnAIvore Consumer Health Data Privacy Policy

Effective date: 9 November 2026 · Last updated: 9 November 2026

CarnAIvore's AI service isn't open yet. This policy describes how it will work when it opens. If anything changes, we'll update this page first.

This separate policy describes consumer health data in the CarnAIvore Mac and iPhone app. CarnAIvore LLC, 1209 Mountain Road Pl NE #13707, Albuquerque, NM 87110, support@carnaivore.ai, is responsible. The App Privacy Policy explains other app information.

1. Categories, sources and purposes

Meals and other personal logs stay on your device unless you choose to send them with an AI request or enter them into a helper. Record categories start unselected in chat. An unticked category excludes newly assembled saved-record context, but details you typed earlier may remain in chat history or a summary. Your question itself is sent when you ask, even if you select no records. Meal, trial and pattern helpers send their separately disclosed inputs regardless of chat-category choices. In this version, photos aren't included in an AI request. Please don't put your name or other identifying details in a chat; CarnAIvore doesn't need them.

2. How and where the data is processed

After permission, the service hosted by Amazon Web Services (AWS) in the US passes an AI request to OpenAI's API, which runs the OpenAI model chosen in the app, and returns the answer. The service asks OpenAI not to store responses. OpenAI says it does not use API content to train its models by default; it may keep request and response content in abuse-monitoring logs for up to 30 days, subject to exceptions such as legal requirements, may briefly cache repeated parts of requests, and may process requests outside the United States. We send these requests to OpenAI as a business customer of its API. Our service does not store question, selected-record or answer text in its record store or application logs; it does keep coded job and plan metadata, and a one-way check value that recognizes a repeated request but can't be read back. A crisis response adds only to a yearly count without question content or account ID. AWS processes technical connection and audit information separately.

3. Categories shared and recipients

For CarnAIvore's AI route, we share the question, prior chat or helper input and any selected health content with OpenAI, which runs the AI model, after it passes through Amazon Web Services, which hosts our service. The coded service record is stored on AWS; OpenAI does not receive it. Apple independently handles purchases and attestation; our service does not pass it the health content selected for an AI question. We have no affiliates receiving health data and do not sell it or share it for targeted advertising. The app contains no tracker that collects your health data over time across other websites or services. The website waitlist has its own health-data notice.

4. Permission and withdrawal

Before first use you accept the CarnAIvore Terms in their own step; that isn't your permission for health data. The app then presents two separate, initially off boxes. One asks whether you agree to send your question, prior chat context, helper inputs and selected saved records to CarnAIvore's server; the other asks whether you agree to our passing them to OpenAI for the answer. Both must be selected to use CarnAIvore's AI. The sheet names the recipients, purposes and possible categories, and says that CarnAIvore isn't a healthcare provider, that HIPAA generally doesn't protect what you send, and that OpenAI handles it as a business service. Chat record categories start unselected. The permission lasts 12 months and is stored on each device. Turn it off in Settings › AI on every device you use; new requests stop there, but earlier transmissions cannot be recalled. If we change our AI provider, the app asks again before sending anything to the new one.

5. Your rights

You may ask whether we collect, share or sell consumer health data; ask for access and a list of recipients; withdraw permission; request correction or deletion; and appeal a decision. In the app, Settings › AI lets you see and save the coded server record, withdraw permission and choose “delete my history, keep my plan” or “delete everything.” The first retains the current plan and its necessary counters and device security keys. The second leaves limited coded records for plan fulfilment, refund/abuse prevention and terms proof: a 13-month deletion note; purchase and subscription markers for up to two years after the relevant event; terms acceptance for three years; and an active paid period until it ends. Delete everything also keeps, for the same 13 months: your devices' security keys (public keys, with their use counts), which gift codes you redeemed, whether you've ever paid, and when you had the free look, a gift week, Lifetime or a paid plan (Lifetime only while unrefunded, as a coded mark, not its ID). These prevent abuse and keep a Lifetime purchase working, and hold no questions, answers or health records. Earlier record versions may last up to 30 days. Content already sent to OpenAI may remain in its abuse-monitoring logs for up to 30 days, subject to exceptions. Deleting app data on one device does not erase exports or backups and does not cancel an Apple subscription.

Email support@carnaivore.ai with “Health data request.” Because the server has no name or email tied to your coded record, we may guide you to the in-app proof before accessing or changing it. We answer within 45 days, with notice of any permitted extension, and respond to appeals within 45 days. We will notify relevant processors of a verified deletion request as required. If an appeal is denied, you may contact the Washington Attorney General, Nevada Attorney General or Connecticut Attorney General. Requests are free; we will not discriminate against you for using these rights.

6. Changes

We will disclose additional health-data categories, uses or recipient categories and obtain any required permission before adding them. The date above will show the policy version.