Consumer Health Data Privacy Policy

Who we are

fufu is a food safety application developed and operated by Fufu Technologies B.V., trading as fufu, registered office Papaverweg 34, Unit B100, 1032 KJ Amsterdam, the Netherlands, KvK number 42043464. We are the controller of the consumer health data described in this policy.

For questions about this policy, or to exercise any of the rights below, contact us at hello@getfufu.app.

Why this is a separate policy

Washington State’s My Health My Data Act, and similar laws including Nevada SB 370, require any business handling consumer health data to publish a policy devoted to it. This is that policy. It sits alongside our main Privacy Policy, which applies to everything else.

It applies to everyone in the United States, not only residents of the states that require it. We would rather hold one standard than several.

What counts as consumer health data here

These laws define health data broadly — it covers health, wellness and nutrition, and anything from which health status could reasonably be worked out. In fufu that means:

• Allergies and intolerances recorded on a household profile, and their severity.
• Age groups that describe a physical state: pregnancy, breastfeeding, and the infant, toddler and senior bands.
• Diet preferences, where they relate to health, and the faith rulesets on a profile.
• Your scan history — the products and dishes checked, and what was flagged for whom.
• The restaurant a scan was made at, if you have switched restaurant tagging on. It is off by default, and switching it off erases the tags.

How we collect it

Only from you, and only when you enter it. We ask for your consent to collect health information separately from anything else — it is not bundled into accepting our terms, and agreeing to the terms does not agree to this.

We do not buy health data, we do not receive it from data brokers, advertising networks or partners, and we do not infer it from anything other than what you type in.

What we use it for

One purpose: running the safety check you asked for. Specifically:

• Comparing a scanned product or menu item against each profile in your household.
• Showing you why something was flagged, and suggesting alternatives.
• Telling you if a product you scanned is later recalled.

That is the complete list. We do not use it to build a profile of you, to target advertising, to train models, or to work out anything about you that you did not tell us directly.

We do not sell it

fufu has never sold consumer health data and will not sell it. We have no advertising business and no data partners. Because we do not sell it, we will never ask you for the signed authorisation these laws require before a sale — if anyone ever asks you for one in fufu’s name, it did not come from us.

Who we share it with

Only the service providers needed to run fufu, each under a written agreement that forbids using your data for their own purposes:

• Supabase — the database that stores your household and history.
• Our hosting provider — runs the website and its servers.
• Our email provider — sends sign-in links and safety recall notices.
• Google (Gemini) — reads the photograph when you scan a label or a menu, and receives your household’s allergens, severe allergens, age groups, diets and faith rulesets when you ask for recipes. It is never told whose they are — names are replaced before anything is sent. Google does not use this to improve its products; it keeps a request for up to 90 days, and only if its automated abuse checks flag it, and then deletes it. This happens in the European Union, on Google’s Vertex AI service in the Netherlands.

All of the providers above process your data in the European Union. Three providers outside it also help run fufu, as our Privacy Policy sets out: Expo (United States), which delivers push notifications, including recall alerts; RevenueCat (United States), which manages purchases made in the app; and Paddle (United Kingdom), which handles purchases on our website. These transfers rely on the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

Our payment providers, Paddle and RevenueCat, never receive health data. Paddle handles your payment and billing address; RevenueCat receives a random account identifier and your purchase history. Neither has access to your household, your profiles or your history.

If you turn on analytics in the app, PostHog (on its EU Cloud) receives a record of how you use the app, such as the screens you open and whether a scan passed or was flagged. It never receives your household, your profiles, any allergy, diet, faith or life-stage detail, or what you scanned. Analytics are off unless you turn them on, and you can turn them off in Settings → Privacy.

We disclose health data to law enforcement only where a valid legal order compels it, and we will tell you unless we are legally prohibited from doing so.

How long we keep it

• Household profiles: until you delete them — one person at a time, everyone at once with Reset household data in Settings, or by deleting your account. Deleting is immediate; your past scans are not deleted with them.
• Scan history: until you delete it — one scan at a time, or all of it in History — or delete your account.
• Restaurant tags: until you delete the scan or your account, or switch restaurant tagging off, which erases them all. Coordinates used to search for restaurants are never stored or logged.
• Guest households, used without an account: deleted if they go unused for 30 days.
• Scan records: a record of each scan — the product, the label text read, the result, and the age group, diet and faith rules it was checked against, never a name or account — kept to improve fufu and deleted after 12 months.

Your rights over health data

You may, at any time:

• Ask what consumer health data we hold about you, and who we shared it with.
• Get a copy of it.
• Have it deleted, and have our service providers instructed to do the same. Deleted data can remain in our encrypted backups for up to 7 days; we never restore it from them.
• Withdraw your consent, which stops any further collection.

Much of this you can do yourself in the app: delete a profile, clear your history, or close your account. For anything else, email hello@getfufu.app. We respond within 45 days, and we will tell you if we need the one extension the law allows.

Deleting your health data does not delete records of payments, which we are legally required to keep. Those contain your name, billing address and what you paid, and never anything about your health.

How we protect it

Health data is stored encrypted, access is restricted at the database level so one account can never read another’s, and only staff who need it for support can reach it. Each saved scan keeps the result shown for each person at the time, and saved favourites keep who they were made for until you remove them. Deleting a person or resetting the household doesn’t change past scans; you can clear them in History.

Complaints

Email us first at hello@getfufu.app — we would rather fix it. If you are not satisfied, Washington residents may contact the Washington State Attorney General, and residents of other states may contact their own Attorney General.