Consumer Health Data Privacy Policy

Eme's List is a product of 1265 Enterprises LLC. This policy explains how we handle consumer health data and supplements our general Privacy Policy.

It applies to residents of Washington (My Health My Data Act), Nevada (NRS 603A.400–603A.550), and Connecticut (Connecticut Data Privacy Act, as amended), and to residents of any other state with a comparable law.

1. What consumer health data we collect, and why

When you search for a product or ask for comparable products, the app sends our servers:

• The avoidance categories you have selected (for example, an ingredient or class you have chosen to avoid), so our servers can identify which products match your selections and how to order the results.
• Your search term or the product you selected, so we can find and return that product and its label information.

We receive this with each request, and we use it only to answer that request.

We collect this to provide the service you asked for. Under RCW 19.373.030 a regulated entity may collect and share consumer health data "to the extent necessary to provide a product or service that the consumer has requested." Sending your selections so we can return matching results is what makes that feature work.

2. What we do not do with it

• We do not store a reusable avoidance profile or medication list on our servers. Your saved profile, My Meds list, and recent searches stay on your device.
• We do not sell consumer health data, and we receive no money or other valuable consideration for it.
• We do not use it for advertising, marketing, or profiling. We have no advertising relationships.
• We do not infer or derive your health status beyond answering the request you made.
• We do not use geofencing. We do not place any virtual boundary around a facility that provides health care services, and we do not collect precise location.
• Our operational logs do not record your search terms, avoidance selections, request addresses, or request contents. We have deliberately disabled the request logging that would otherwise capture them.

3. Where it comes from

Directly from you, through the app, at the moment you make a request. We obtain no health information from prescribers, pharmacies, clinics, insurers, manufacturers, data brokers, advertising networks, or any other outside source.

4. Who we share it with, and why

We share consumer health data only with the service providers below, only as necessary to deliver the request you made, and only under contract:

• Cloudflare: routes and protects each request on its way to our servers. Cloudflare handles the request as it passes through, which includes the search and avoidance information in it.
• Google Cloud: runs the servers and databases that calculate and return your results.
• Firebase (Google): confirms you are signed in and that the request came from a genuine copy of the app.

We have no affiliates, and we share consumer health data with no one else.

Apple App Attest verifies device integrity on iOS and is not designed to receive medication or avoidance information. Our website providers (Cloudflare Pages and, only with your consent, Google Analytics) are separate from the app and do not receive consumer health data.

5. How long we keep it

We do not retain your avoidance selections or search terms after the request is answered. They are not written to a profile, a cache, a search index, or an analytics table.

Our operational and security logs are kept for 30 days and do not contain your search terms, avoidance selections, request addresses, or request contents. Database backups rotate out within seven days.

6. Your rights

You may:

• Confirm whether we collect, share, or sell your consumer health data
• Access the consumer health data we hold, together with a list of every third party and affiliate we have shared it with, and contact information for each
• Withdraw your consent to our collection or sharing of your consumer health data
• Delete your consumer health data

To delete your saved profile, you don't need us. Delete it in the app or remove the app, on each device you use. It is stored there, not on our servers. Because we hold no copy, we also cannot restore it for you.

To make a request:

• In the app: delete your account at Settings → Account → Delete Account. This policy and our Privacy Policy are linked from the Account tab.
• By email: support@emeslist.com, with the subject line "Consumer Health Data Request"
• Online: https://emeslist.com/privacy-request

We respond within 45 days. If we need more time we may extend once by a further 45 days, and we will tell you before we do. Requests are free.

Withdrawing consent. If you withdraw consent, we will stop processing your consumer health data. Search and comparison features will no longer work, because sending your selections is how those features operate. You can continue to use the parts of the app that run on your device.

We will not deny you service, charge you a different price, or treat you differently for exercising a right under this policy.

If we decline a request

We will tell you why and explain how to appeal. Send an appeal to support@emeslist.com with "Consumer Health Data Appeal" in the subject line. We respond to appeals within 45 days. If we deny an appeal, you may complain to your state Attorney General:

• Washington: https://atg.wa.gov/file-complaint
• Nevada: https://ag.nv.gov/Complaints
• Connecticut: https://portal.ct.gov/ag

7. Changes

We will post any change on this page and update the date above. For material changes we will provide notice in the app and, where we have your email address, by email. If we ever intend to sell consumer health data, we will first obtain your separate, signed authorization in the form the law requires, and retain a copy for six years. We have no plans to do this.

1265 Enterprises LLC · 1500 N Grant St, Ste N, Denver, CO 80203 · support@emeslist.com