Ore Nevada Consumer Health Data Privacy Policy

Effective date: October 11, 2026

This policy describes how 0xdesigner LLC, doing business as Ore ("Ore"), processes consumer health data subject to Nevada Revised Statutes 603A.400 through 603A.550. Ore's general Privacy Policy describes its other personal-information practices.

Consumer health data collected and how it is used

Ore may collect and use these categories of consumer health data:

• Meal and dietary information: meal descriptions, voice recordings (sent for transcription and not stored), voice transcripts, selected meal photos, foods, portions, eating times, saved or usual foods, calories, macronutrients, corrections, and dietary patterns. Ore uses this information to provide meal logging, nutrition estimates, the diary, saved foods, drafts, and trends requested by the consumer.
• Body and plan inputs: sex, age, height, weight, activity level, training frequency, goals, and time zone, plus optional body-fat estimates or target weights retained from earlier app versions if the consumer previously provided them. Ore uses this information to provide and personalize requested nutrition-plan features.
• Derived or inferred information: nutrition estimates, energy needs, calorie and macronutrient targets, plans, trends, and inferences about dietary habits or physical-health goals. Ore uses this information to provide requested estimates, plans, and progress features.
• Optional Apple Health information: when the consumer chooses to connect HealthKit, Ore reads available body mass, steps, Active Energy, daily Activity Summary information, and workouts on the consumer's device to suggest confirmable onboarding answers, show steps, and calculate a bounded positive Calorie credit (internally called Activity Fuel). If comparable full-day energy history is not available, Ore may use steps and the consumer's confirmed program weight to make a conservative walking-energy estimate. Raw HealthKit samples, individual workout and Active Energy records, Activity Summary information, and source details remain on the device. If a Health weight seeds the editable weight question, Ore stores it only after the consumer confirms it as a program answer. Ore also stores the derived daily step total for each synced day, plus the local date, derived Calorie credit amount and carbohydrate grams, calculation version, and timing of the Calorie credit. For program creation with Apple Health connected, Ore also collects derived summaries of typical steps, recorded workout days, weight-measurement availability, and typical active calories with the count of qualified observed days. If the consumer separately turns on Export data to Apple Health, Ore writes the calories, protein, carbohydrates and fat of meals logged afterwards to HealthKit on the device and, while the switch stays on, updates or removes them when the meal is edited or deleted. Entries already written stay in Apple Health after the switch is turned off or the Ore account is deleted, until the consumer deletes them in the Health app. This happens on the device and sends nothing new to Ore's servers.
• Health-feature activity: pending drafts and technical or usage records linked to the use, performance, security, or reliability of Ore's meal and nutrition features. Ore uses this information to operate, secure, troubleshoot, and support those features.
• Identifiers associated with health data: internal account and request identifiers, Apple account identifier and email or relay address, IP address, and device, app, operating-system, and technical information linked to the consumer's use of Ore's health features. Ore uses these identifiers to associate requested features with the account, authenticate and secure the service, prevent abuse, and troubleshoot or support the service.
• Support information: consumer health data that a consumer voluntarily includes in a support request or attachment. Ore uses this information to respond, investigate an issue, protect the service, maintain appropriate business records, and comply with law.

Ore may also process these categories as reasonably necessary to authenticate and secure an account, prevent fraud or abuse, comply with law, or establish, exercise, or defend legal claims. Ore does not sell consumer health data.

Sources of consumer health data

Ore obtains consumer health data:

• Directly from the consumer through text, speech, selected photos, corrections, plan answers, settings, and support communications.
• From the consumer's device when the consumer chooses to use camera, photo, or speech features.
• From Apple Health on the consumer's device when the consumer affirmatively connects HealthKit. Each available data type is used independently, and the consumer can change access in Apple's Health or Settings app.
• From Sign in with Apple for the account identifier and any name or email the consumer chooses to share.
• Automatically from the app, device, and Ore's servers when the consumer uses a meal, nutrition, plan, security, or support feature.
• By deriving estimates, targets, plans, trends, or other outputs from consumer submissions.
• From service providers that return requested AI analysis, speech transcripts, or nutrition information.

Consumer health data shared and recipients

As needed for the purposes described above, Ore may share:

• Meal text, voice transcripts, selected meal photos, and prior draft or logged-meal items when the consumer requests a revision with AI routing and inference providers. For a morning Insight, Ore also shares the consumer's nutrition goal and daily calorie, protein, carbohydrate, fat, and fiber targets; up to the last 28 days of confirmed meals, including titles, confirmed ingredients and portions, and calories, protein, carbohydrates, fat, and fiber per meal; dietary restrictions entered in onboarding; and the headlines and suggested actions from Ore's recent Insights. When Apple Health is connected, Ore also shares the daily step total and derived Activity Fuel calorie credit for each of those days. Ore does not share raw HealthKit samples, workouts, Active Energy, Activity Summary details, source details, the consumer's name or email, Apple identifiers, sex, age, height, weight, or payment information for Insights. Direct target adjustments use software calculations. The model returns a headline, a short paragraph, and one "Try this" suggestion. Ore checks the text against fixed rules for medical claims, diagnoses, medication guidance, dietary restrictions, and data or system language, and does not show it if a check fails. Providers include OpenRouter, Inc. and inference providers selected through its routing, or a directly configured inference provider, to process the feature requested by the consumer. Configured model families are listed at oreapp.fit/subprocessors, but a model-family name does not necessarily identify the recipient of a dynamically routed request.
• For optional Health-informed program creation, separate expanded permission allows structured profile answers and compact summaries from up to 28 completed days to be sent to Google Gemini through OpenRouter. Summaries cover weight and weight-measurement availability, steps, active calories and recording coverage, and workout types, durations and counts. Gemini generates one provisional maintenance estimate, calorie target, macro targets and short explanations. Software validates the returned structure, arithmetic and supported storage limits before presentation. There is no separate AI writer call. Raw HealthKit samples, source identifiers, account identifiers, body-fat estimates and time zone are excluded. Declining uses a standard non-AI estimate, which may have different targets. Existing programs change only after review and acceptance.
• If the consumer enables helpful notifications and separately permits background AI decisions, computed logging and app-activity aggregates are sent directly to TypeSafe Jev to choose a first-log, routine, return, or no notification. This request excludes meal text, photos, Apple Health data and account identifiers. Fixed notification copy is delivered through Apple Push Notification service; the consumer can turn off each notification category in Ore Settings.
• Food-search terms with nutrition-information providers, including USDA FoodData Central and FatSecret when configured, to retrieve nutrition-reference information.
• When a meal request names a brand or restaurant without nutrition evidence, only the public brand and product name, or restaurant and dish name, with Exa through OpenRouter for a bounded search of public nutrition information. The query does not include account information, the nutrition plan, diary history, Apple Health data, or saved-food contents.
• Account-linked meal, plan, draft, derived, and health-feature activity data with Railway Corp., Ore's hosting and database processor, to host, secure, and operate Ore.
• Ordinary web-request information, such as an IP address and browser or device information, with Vercel Inc. when the consumer visits oreapp.fit or a policy page, to host and secure the public website.
• Voice recordings, when the consumer records a meal by voice and has granted Ore's AI permission, with AI routing and inference providers (OpenRouter and AI speech-to-text models, currently OpenAI and Mistral transcription models) to turn the recording into text. These requests are limited to inference endpoints that do not use the content for training and do not retain it, and Ore does not store the recording.
• Audio with Apple Inc. when Apple's speech-recognition service processes a voice-logging request; Apple also provides device and account services.
• Consumer health data included in support correspondence with Google LLC through Google Workspace and the personnel handling the request.
• Consumer health data with professional advisers, transaction counterparties, and authorities when reasonably necessary to obtain advice, complete a corporate transaction subject to appropriate protections, comply with law, enforce Ore's terms, or protect rights, safety, and security.

Ore has no affiliates with which it shares consumer health data as of the effective date above.

How Ore processes consumer health data

Ore processes consumer health data through automated and, where support, security, or legal review requires it, manual operations. Ore stores account-linked app data in its hosted production database; transmits requested content to configured AI, speech, or nutrition processors; applies deterministic software to create plans and software or model operations to create meal estimates, drafts, insights, and trends; and processes support correspondence through its support-email provider. Ore uses access controls intended to limit access to people and processors that need it for an authorized purpose.

Ore does not permit a third party to collect consumer health data over time and across different Internet websites or online services when a consumer uses Ore's app or website.

Review and correction

Consumers can review their diary and saved foods in Ore and use the app's available editing and deletion controls. To review or request correction of other consumer health data linked to an account, email support@oreapp.fit with the subject Nevada Consumer Health Data Request. Ore may take reasonable steps to authenticate the request.

Nevada consumer rights and requests

Subject to Nevada law, a consumer may ask Ore to:

• Confirm whether Ore is collecting, sharing, or selling consumer health data concerning the consumer.
• Provide a list of third parties with which Ore has shared or sold the consumer's consumer health data.
• Stop collecting, sharing, or selling the consumer's consumer health data.
• Delete the consumer's consumer health data.
• Review or correct consumer health data through the process described above.

Consumers may use Settings → Delete Account for an authenticated account- deletion request or email support@oreapp.fit with the subject Nevada Consumer Health Data Request. Ore may request additional information reasonably necessary to authenticate a request.

Ore will respond without undue delay and no later than 45 days after authenticating a request, subject to one additional 45-day extension when reasonably necessary and permitted by law. Ore will carry out an authenticated deletion request within 30 days, notify applicable processors and other recipients, and address backup copies within the period permitted by Nevada law.

Ore will not unlawfully discriminate against a consumer for exercising these rights.

Appeals

A consumer may appeal a refusal to act by emailing support@oreapp.fit with the subject Nevada Consumer Health Data Appeal. Within 45 days after receiving an appeal, Ore will provide a written decision, the reasons for it, and, if the appeal is denied, contact information for the Nevada Attorney General.

Changes to this policy

Ore will post an updated policy with a new effective date when this policy changes. If a change is material, Ore will provide additional notice through the app, website, email, or another appropriate method as required by law.

For program estimation, a qualified typical-step summary includes its observed-day count. Ore may use sufficiently covered walking history to raise the starting activity estimate; it does not add wearable calories to that estimate or treat missing or low step counts as proof of inactivity. Existing saved targets are not automatically rewritten.

Health-informed program summaries and retention

For optional program creation, Ore receives derived summaries from up to 28 completed days: available weight measurements, daily steps, active calories and recording coverage, and deduplicated workouts by type, duration and count. Raw HealthKit samples and source identifiers remain on-device. Expanded, explicit AI permission is required before compact summaries and profile answers are sent to Google Gemini through OpenRouter. Declining uses a standard non-AI estimate. When a program is accepted, its inputs, derived Health evidence and decision metadata are stored with the account-linked program and document history. They are covered by the account-deletion process in the general Privacy Policy. Existing targets change only after review and acceptance.