Privacy Policy

1. Information We Collect

Account information

• Name, email address, phone number
• Date of birth (used for age-appropriate features and RDI calculations)
• Sex (used for nutrient reference values, optional)

Profile information (optional)

• Height and weight
• Activity level
• Dietary preferences and restrictions
• Health conditions you choose to disclose

Tracking data

• Meal logs (text descriptions and/or photos)
• Symptom logs (type, severity, time)
• Bowel movement logs (Bristol scale, time)
• Fluid intake logs (volume, time)

Conversation data

• Messages exchanged with Yummbak (via WhatsApp or PWA), used to maintain context across logging sessions

Practitioner relationship data (for clients invited by a Practitioner)

• The identity of your invited Practitioner
• Configurable tracking modules your Practitioner has enabled for you

2. How We Use Your Information

We use your information to:

• Provide the food, symptom, and bowel tracking service
• Calculate nutritional estimates from your meal logs
• Display tracked data to you and (where applicable) your invited Practitioner
• Send reminders and notifications you have opted in to receive
• Generate personalised summaries and analyses based on your logged data
• Improve the service through anonymised, aggregated analysis

We do not:

• Sell your data to third parties
• Use your data for advertising
• Share your data for marketing purposes
• Use your data to train AI models (Yummbak uses the paid Gemini API; under Google's paid API terms, Google does not use your data to train its models)

3. Legal Basis and Consent

By creating an account or accepting an invitation to use Yummbak, you consent to the collection and processing of your personal data as described in this policy. You may withdraw consent or request deletion at any time. Practitioners using Yummbak are responsible for obtaining appropriate informed consent from their clients before inviting them, and for ensuring use complies with the Health Information Privacy Code 2020 and the Dietitians Act 1950.

4. Practitioner Access to Your Data

If you join Yummbak via an invitation from a Practitioner, that Practitioner will have access to:

• Your meals, fluids, symptoms, and bowel movement logs
• Your profile information (name, age, height, weight, dietary preferences)
• Your daily and weekly nutrition totals and adherence patterns
• Your logging activity (which days you logged, completeness of logs)

Your Practitioner may need to retain clinical records for up to 10 years even after your monitoring relationship ends, in accordance with NZ professional record-keeping requirements. You can request that a Practitioner's access be removed at any time by emailing privacy@yummbak.com.

5. Children's Data

Children under 18 may use Yummbak only when invited by a Practitioner who has obtained explicit consent from a parent or legal guardian.

• Data is collected only with documented parental or guardian consent
• We do not use children's data for advertising, profiling, or external sharing
• Children's data is handled with heightened care and restricted access
• Parents or guardians can request access, correction, or deletion of their child's data at any time

6. Data Storage and Security

• Database: Stored in Supabase, located in the ap-southeast-2 region (Sydney, Australia), with encryption at rest
• Access control: Row-Level Security (RLS) enforced at the database level — no user can access another user's data
• Transmission: All data transmitted over encrypted HTTPS connections
• Access restrictions: Production data access is restricted to authorised personnel only

Our infrastructure is designed to comply with the Health Information Privacy Code 2020.

7. Cross-Border Data Processing

• Storage: Supabase ap-southeast-2 region (Sydney, Australia)
• AI processing: Google Gemini API processing occurs in Google's Asia-Pacific region (Australia and Singapore data centres), under a Data Processing Agreement that prohibits use of data for AI model training

8. Third-Party Services

• Google Gemini (paid API): Meal description and photo analysis. Google does not use your data to train AI models.
• Supabase: Database hosting. Data stored in Sydney, Australia with encryption at rest.
• WhatsApp Cloud API (Meta): Message delivery if you choose to log via WhatsApp. Meta retains message metadata but not message content beyond delivery. You can log entirely through the Yummbak web app (PWA) to avoid WhatsApp involvement.
• NZ Food Composition Database (FOODfiles 2024): NZ food reference data. No personal data is shared.

9. Data Retention and Deletion

You can request deletion at any time by using the Delete Account option in app settings, or by emailing privacy@yummbak.com.

Upon deletion: your personal information (name, phone number, email) is permanently removed; health logs may be anonymised and retained for the minimum period required for any Practitioner record-keeping obligations; anonymised aggregated data may be retained indefinitely for service improvement purposes.

10. Your Rights

Under the NZ Privacy Act 2020 and Health Information Privacy Code 2020, you have the right to:

• Access your personal data and confirm what we hold
• Correct inaccurate information
• Request deletion of your data
• Withdraw consent at any time
• Make a complaint to us, and to the Office of the Privacy Commissioner if unresolved

To exercise these rights, contact us at privacy@yummbak.com. We will respond to all privacy-related requests within 5 working days.

11. Privacy Breach Notification

In the event of a privacy breach that poses a serious risk of harm to affected individuals, we will notify affected users and the Office of the Privacy Commissioner in accordance with the NZ Privacy Act 2020.

12. Health and Nutrition Disclaimer

Yummbak is an AI-assisted nutrition tracking tool. It is not a substitute for professional medical advice, diagnosis, or treatment.

• Always consult a qualified healthcare professional or registered dietitian before making changes to your diet, medication, or treatment plan
• Nutritional estimates are approximate and may not account for individual health conditions
• Symptom and bowel movement logs are observational records, not clinical assessments

13. Changes to This Policy

We may update this policy as Yummbak evolves. If changes are material, we will notify you via the app or by email at least 14 days before they take effect. Continued use after the effective date constitutes acceptance of the updated policy.

14. Contact

For privacy questions, data access requests, or to exercise any of the rights described above:

Email: privacy@yummbak.com

Response time: Within 5 working days

Location: Auckland, New Zealand

For unresolved complaints, you may also contact the Office of the Privacy Commissioner at privacy.org.nz.