Consumer Health Data Privacy Policy

1 · The short version

• Likely is a food tracker. The food, nutrition, goal, body, and check-in information you choose to add can be consumer health data.
• We use that data to provide the tracking, estimates, guidance, syncing, export, and account controls you ask us for.
• We do not sell consumer health data or share it for advertising.
• We disclose health data only to providers needed to run Likely, an AI assistant you connect within approved scopes, authorities when legally compelled or needed to protect against fraud or abuse, or a successor bound by this policy.
• Covered consumers can ask us to confirm and provide their consumer health data and actual recipients, correct data, withdraw consent for future collection or sharing, or delete data. Section 6 explains how to make or appeal a request.

This policy is not a request for consent. When consent is required, Likely presents a separate choice before the covered collection or sharing. That choice identifies the data, purpose, recipients, and how to withdraw. A connected AI assistant receives health data only after a separate sharing decision for that connection.

2 · Health data we collect

Depending on what you choose to use and record, Likely collects these categories of consumer health data:

• Food and nutrition records: foods, portions, refinements, custom foods, saved baskets, and the food-log entries you create.
• Goals and preferences: targets, goals, settings, and answers you give to in-app guidance questions.
• Progress and body information: check-ins you choose to record, including body weight, other measurements, and notes.
• Information Likely derives for you: nutrition estimates and ranges, progress summaries, and guidance computed from the information above.
• Support information: health information you choose to include in a support or feedback message or attachment.

Likely's first-party analytics do not record food or log identifiers, nutrition or body values, or free text. Barcode images are decoded on your device and are not uploaded.

3 · Why we collect and use it

• To provide Likely: save and sync your log, custom foods, targets, settings, and check-ins across your devices.
• To calculate what you ask for: produce nutrition ranges, progress summaries, and guidance from your entries and choices.
• To support you: answer a question or investigate feedback you send us.
• To give you control: let you edit, export, or delete the product data tied to your account.
• To protect Likely and comply with law: prevent abuse or fraud and respond when the law genuinely requires us to.

We process these categories by storing them in Likely's hosted account database, receiving them through the authenticated Likely API, calculating the estimates, ranges, progress summaries, and guidance you request, syncing the results to your account, and making the covered account and product data available to edit, export, or delete. A connected AI assistant can process data only through tools and scopes you approve.

We do not use consumer health data to train AI models, build advertising profiles, or show ads.

4 · Where it comes from

• From you: when you log food, set targets and preferences, record a check-in, or contact support.
• From your actions in Likely: we calculate estimates, ranges, progress summaries, and guidance from the information you provide.
• From a connected AI assistant: when a tool you connected writes data to Likely within a scope you approved.

5 · Who receives it

The categories of consumer health data we disclose are the categories in section 2, limited by recipient and purpose below. We disclose them only as needed to provide Likely, when you direct a connection, or when the law genuinely requires it:

• Supabase receives the account health data described in section 2 as our hosted database infrastructure.
• Render processes that account health data while hosting the authenticated Likely API used to store, calculate, and sync it.
• Cloudflare receives health information only if you choose to include it in a feedback attachment and the hosted feedback service is configured to store that attachment in private Cloudflare R2 storage.
• An AI assistant you connect can receive health data only when its tool requests that data within the scopes you approved. You can revoke the connection from Connected agents in the app, or email us from your account address if that screen is unavailable.
• Authorities or a successor to Likely LLC receive only the data involved if the law compels disclosure, if disclosure is needed to protect against fraud or abuse, or if Likely LLC is acquired or merged and the successor is bound by this policy. We would notify you of a successor disclosure.

Supabase, Render, and Cloudflare act as service providers processing data on our instructions. We do not share consumer health data with a Likely affiliate. The categories of other third parties that may receive it are a connected AI-assistant provider you direct, authorities when disclosure is legally compelled or needed to protect against fraud or abuse, and a successor bound by this policy if Likely LLC is acquired or merged.

RevenueCat, Apple, and Google handle sign-in or subscription information as described in our main Privacy Policy; we do not send them your food log, body measurements, or check-in content for subscription management. Likely does not use advertising trackers or authorize its service providers to collect consumer health data over time across unrelated websites or online services. An independently operated AI assistant you connect processes data under its own policies and may collect or retain data across services; Likely shows its identity, metadata source, contact, and approved scopes before sharing and does not review or endorse the provider. We do not sell consumer health data, and we do not share it for cross-context behavioral advertising.

6 · Your rights & requests

Washington and Nevada law give covered consumers the rights below without unlawful discrimination. We make the same request channel available regardless of where you live.

• Confirm, access, and receive recipient information. You can ask whether we collect, share, or sell consumer health data about you; obtain the data; and receive a list of the actual third parties or affiliates to which it was disclosed, with an active way to contact them. Likely does not sell consumer health data.
• Review and correct. Your log and settings are editable in the app. You can ask us to correct other consumer health data associated with your account.
• Withdraw consent. You can withdraw consent for future collection or sharing covered by that consent. You can revoke an AI-assistant connection from Connected agents. You can turn off optional first-party analytics from Settings. For another withdrawal, use the request process below.
• Delete. You can delete your full account in account settings or follow the account deletion steps. You may also ask us to delete specified consumer health data and notify applicable affiliates, processors, contractors, and other third parties that received it.

How to submit a request

Use an account control where one is available. For any other consumer-health request, email support@likely.fit with the subject Consumer Health Data Request. Write from the email address on your Likely account when possible, identify the right you want to exercise, and do not include health details we do not need. You do not have to create a new account. We may ask for information reasonably necessary to authenticate you and connect the request to your data.

We respond without undue delay. For a covered Washington request, we respond within 45 days after receiving it; for a covered Nevada request, within 45 days after authenticating it. When the applicable law permits and the request's complexity or number makes it reasonably necessary, we may extend once by up to 45 days and will explain the extension within the initial period. For a covered Nevada deletion request, we delete the covered data and notify applicable recipients no later than 30 days after authenticating the request, subject to legal exceptions. Requests are free at least twice each year; the law may permit a reasonable fee or refusal for additional requests that are manifestly unfounded, excessive, or repetitive. We bear the burden of supporting that decision.

When a valid deletion request covers data in an archive or backup, the applicable law may allow deletion to wait until that system is restored. During that delay, we do not restore the data to ordinary use, and we delete it when restoration makes deletion possible. For a covered Washington request, any permitted backup-system delay is capped at six months after authenticating the request; for a covered Nevada request, at two years after authenticating the request. If more than one applicable law sets a deadline, we apply the shorter one.

How to appeal a refusal

If we refuse to act, our written response explains why and how to appeal. Reply to that response or email support@likely.fit with the subject Consumer Health Data Appeal. Identify the request being appealed; do not resend health data. Within 45 days after receiving the appeal, we will provide a written outcome and reasons. If we deny the appeal, we will also give you the appropriate way to contact the Washington Attorney General or Nevada Attorney General.

7 · Changes & contact

If we materially change this policy, we will post the updated policy here, change its effective date, and notify affected consumers in the app or by email before the change takes effect. Before collecting, using, or sharing additional categories of consumer health data, adding an undisclosed recipient category or affiliate, or using the data for an undisclosed purpose, we will provide the additional disclosure and obtain affirmative consent when required.