Ore Nevada Consumer Health Data Privacy Policy

Effective date: July 14, 2026

This policy describes how 0xdesigner LLC, doing business as Ore ("Ore"), processes consumer health data subject to Nevada Revised Statutes 603A.400 through 603A.550. Ore's general Privacy Policy describes its other personal-information practices.

Consumer health data collected and how it is used

Ore may collect and use these categories of consumer health data:

• Meal and dietary information: meal descriptions, voice transcripts, selected meal photos, foods, portions, eating times, saved or usual foods, calories, macronutrients, corrections, and dietary patterns. Ore uses this information to provide meal logging, nutrition estimates, the diary, saved foods, drafts, and trends requested by the consumer.
• Body and plan inputs: sex, age, height, weight, optional body-fat estimate, activity level, training frequency, goals, target weight, and time zone. Ore uses this information to provide and personalize requested nutrition-plan features.
• Derived or inferred information: nutrition estimates, energy needs, calorie and macronutrient targets, plans, trends, and inferences about dietary habits or physical-health goals. Ore uses this information to provide requested estimates, plans, and progress features.
• Health-feature activity: pending drafts and technical or usage records linked to the use, performance, security, or reliability of Ore's meal and nutrition features. Ore uses this information to operate, secure, troubleshoot, and support those features.
• Identifiers associated with health data: internal account and request identifiers, Apple account identifier and email or relay address, IP address, and device, app, operating-system, and technical information linked to the consumer's use of Ore's health features. Ore uses these identifiers to associate requested features with the account, authenticate and secure the service, prevent abuse, and troubleshoot or support the service.
• Support information: consumer health data that a consumer voluntarily includes in a support request or attachment. Ore uses this information to respond, investigate an issue, protect the service, maintain appropriate business records, and comply with law.

Ore may also process these categories as reasonably necessary to authenticate and secure an account, prevent fraud or abuse, comply with law, or establish, exercise, or defend legal claims. Ore does not sell consumer health data.

Sources of consumer health data

Ore obtains consumer health data:

• Directly from the consumer through text, speech, selected photos, corrections, plan answers, settings, and support communications.
• From the consumer's device when the consumer chooses to use camera, photo, or speech features.
• From Sign in with Apple for the account identifier and any name or email the consumer chooses to share.
• Automatically from the app, device, and Ore's servers when the consumer uses a meal, nutrition, plan, security, or support feature.
• By deriving estimates, targets, plans, trends, or other outputs from consumer submissions.
• From service providers that return requested AI analysis, speech transcripts, or nutrition information.

Consumer health data shared and recipients

As needed for the purposes described above, Ore may share:

• Meal text, voice transcripts, selected meal photos, prior draft or logged-meal items when the consumer requests a revision, plan inputs, and derived planning values with AI routing and inference providers, including OpenRouter, Inc. and inference providers selected through its routing, or a directly configured inference provider, to process the feature requested by the consumer. Configured model families are listed at oreapp.fit/subprocessors, but a model-family name does not necessarily identify the recipient of a dynamically routed request.
• Food-search terms with nutrition-information providers, including USDA FoodData Central and FatSecret when configured, to retrieve nutrition-reference information.
• Account-linked meal, plan, draft, derived, and health-feature activity data with Railway Corp., Ore's hosting and database processor, to host, secure, and operate Ore.
• Ordinary web-request information, such as an IP address and browser or device information, with Vercel Inc. when the consumer visits oreapp.fit or a policy page, to host and secure the public website.
• Audio with Apple Inc. when Apple's speech-recognition service processes a voice-logging request; Apple also provides device and account services.
• Consumer health data included in support correspondence with Google LLC through Google Workspace and the personnel handling the request.
• Consumer health data with professional advisers, transaction counterparties, and authorities when reasonably necessary to obtain advice, complete a corporate transaction subject to appropriate protections, comply with law, enforce Ore's terms, or protect rights, safety, and security.

Ore has no affiliates with which it shares consumer health data as of the effective date above.

How Ore processes consumer health data

Ore processes consumer health data through automated and, where support, security, or legal review requires it, manual operations. Ore stores account-linked app data in its hosted production database; transmits requested content to configured AI, speech, or nutrition processors; applies software and model operations to create estimates, drafts, plans, and trends; and processes support correspondence through its support-email provider. Ore uses access controls intended to limit access to people and processors that need it for an authorized purpose.

Ore does not permit a third party to collect consumer health data over time and across different Internet websites or online services when a consumer uses Ore's app or website.

Review and correction

Consumers can review their diary and saved foods in Ore and use the app's available editing and deletion controls. To review or request correction of other consumer health data linked to an account, email support@oreapp.fit with the subject Nevada Consumer Health Data Request. Ore may take reasonable steps to authenticate the request.

Nevada consumer rights and requests

Subject to Nevada law, a consumer may ask Ore to:

• Confirm whether Ore is collecting, sharing, or selling consumer health data concerning the consumer.
• Provide a list of third parties with which Ore has shared or sold the consumer's consumer health data.
• Stop collecting, sharing, or selling the consumer's consumer health data.
• Delete the consumer's consumer health data.
• Review or correct consumer health data through the process described above.

Consumers may use Settings → Delete Account for an authenticated account- deletion request or email support@oreapp.fit with the subject Nevada Consumer Health Data Request. Ore may request additional information reasonably necessary to authenticate a request.

Ore will respond without undue delay and no later than 45 days after authenticating a request, subject to one additional 45-day extension when reasonably necessary and permitted by law. Ore will carry out an authenticated deletion request within 30 days, notify applicable processors and other recipients, and address backup copies within the period permitted by Nevada law.

Ore will not unlawfully discriminate against a consumer for exercising these rights.

Appeals

A consumer may appeal a refusal to act by emailing support@oreapp.fit with the subject Nevada Consumer Health Data Appeal. Within 45 days after receiving an appeal, Ore will provide a written decision, the reasons for it, and, if the appeal is denied, contact information for the Nevada Attorney General.

Changes to this policy

Ore will post an updated policy with a new effective date when this policy changes. If a change is material, Ore will provide additional notice through the app, website, email, or another appropriate method as required by law.