Ore Washington Consumer Health Data Privacy Policy

Effective date: July 14, 2026

This separate Consumer Health Data Privacy Policy describes how 0xdesigner LLC, doing business as Ore ("Ore"), processes consumer health data subject to the Washington My Health My Data Act. Ore's general Privacy Policy describes its other personal-information practices.

Categories of consumer health data collected

Ore may collect the following categories of consumer health data:

• Meal and dietary information: meal descriptions, voice transcripts, selected meal photos, foods, portions, eating times, saved or usual foods, calories, macronutrients, corrections, and dietary patterns.
• Body and plan inputs: sex, age, height, weight, optional body-fat estimate, activity level, training frequency, goals, target weight, and time zone.
• Derived or inferred information: nutrition estimates, energy needs, calorie and macronutrient targets, plans, trends, and inferences about dietary habits or physical-health goals.
• Health-feature activity: pending drafts and technical or usage records linked to the use, performance, security, or reliability of Ore's meal and nutrition features.
• Identifiers associated with health data: internal account and request identifiers, Apple account identifier and email or relay address, IP address, and device, app, operating-system, and technical information linked to the consumer's use of Ore's health features.
• Support information: consumer health data that a consumer voluntarily includes in a support request or attachment.

Purposes for collection and use

Ore collects and uses these categories to provide the meal logging, nutrition estimation, diary, saved-food, trend, and nutrition-plan services requested by the consumer; personalize and maintain those services; authenticate and secure the account; process and troubleshoot requested features; provide support; prevent fraud or abuse; comply with law; and establish, exercise, or defend legal claims.

Ore does not sell consumer health data.

Categories of sources

Ore obtains consumer health data:

• Directly from the consumer through text, speech, selected photos, corrections, plan answers, settings, and support communications.
• From the consumer's device when the consumer chooses to use camera, photo, or speech features.
• From Sign in with Apple for the account identifier and any name or email the consumer chooses to share.
• Automatically from the app, device, and Ore's servers when the consumer uses a meal, nutrition, plan, security, or support feature.
• By deriving estimates, targets, plans, trends, or other outputs from consumer submissions.
• From service providers that return requested AI analysis, speech transcripts, or nutrition information.

Categories of consumer health data disclosed

As needed to provide requested services, operate Ore, or comply with law, Ore may disclose:

• Meal text, voice transcripts, selected meal photos, prior draft or logged-meal items when the consumer requests a revision, plan inputs, and derived planning values to AI routing and inference providers.
• Food-search terms to nutrition-information providers.
• Account-linked meal, plan, draft, derived, and health-feature activity data to hosting, database, security, and technical-service providers.
• Ordinary web-request identifiers and technical information to the public-website host when a consumer visits oreapp.fit or a policy page.
• Audio to Apple's speech-recognition service when speech recognition is not performed entirely on the device.
• Consumer health data included in support correspondence to the support-email provider and personnel handling the request.
• Consumer health data relevant to a request, dispute, security incident, legal obligation, or qualifying corporate transaction to professional advisers, transaction counterparties subject to appropriate protections, and authorities when reasonably necessary and permitted by law.

Categories of third parties and specific affiliates

Ore may disclose consumer health data to these categories of recipients:

• Hosting and database processors: Railway Corp.
• Public website hosting: Vercel Inc. may process ordinary web-request information, such as an IP address and browser or device information, when a consumer visits oreapp.fit or a policy page.
• AI routing and inference providers: OpenRouter, Inc. and AI inference providers selected through its routing, or a directly configured inference provider. Configured model families are listed at oreapp.fit/subprocessors, but a model-family name does not necessarily identify the recipient of a dynamically routed request.
• Nutrition-information providers: USDA FoodData Central and FatSecret when configured.
• Device and speech provider: Apple Inc.
• Support-email provider: Google LLC through Google Workspace.
• Professional advisers, transaction counterparties, and authorities: these recipients may receive consumer health data when reasonably necessary to obtain advice, complete a corporate transaction subject to appropriate protections, comply with law, enforce Ore's terms, or protect rights, safety, and security.

Ore has no affiliates with which it shares consumer health data as of the effective date above.

Consumer health data rights

Subject to applicable law, a consumer may:

• Confirm whether Ore collects, shares, or sells consumer health data concerning the consumer and access that data, including a list of recipients and an active email address or other online contact mechanism for each recipient.
• Withdraw consent to future collection or sharing of consumer health data.
• Request deletion of consumer health data from Ore's network, including required deletion from archived or backup systems, and require Ore to notify applicable processors and other recipients of the deletion request.
• Appeal Ore's refusal to act on a request.

Ore will not unlawfully discriminate against a consumer for exercising these rights. Ore does not require a consumer to create a new account to submit a request, although Ore may require use of an existing account or additional information when reasonably necessary to authenticate the request.

How to exercise rights or appeal

Consumers may use Settings → Delete Account for an authenticated account- deletion request or email support@oreapp.fit with the subject Consumer Health Data Request. An appeal may be submitted to the same address with the subject Consumer Health Data Appeal.

Ore will respond without undue delay and within 45 days after receiving a request, subject to one additional 45-day extension when reasonably necessary and permitted by law. If Ore denies an appeal, the response will explain the decision and provide a method to contact the Washington Attorney General.