Consumer Health Data Privacy Policy

This policy covers consumer health data as defined by Washington's My Health My Data Act and Nevada's consumer health data law. It applies to everyone who uses Forkmate, wherever you live. Forkmate is a product of High Country Codes, a Colorado sole proprietorship ("we," "us"). Our general Privacy Policy covers everything else.

Consumer health data we collect

Your food log: the meals and foods you record, with their calories, macros, caffeine and fluid values, and any notes, and a tally worked out from it of the foods you log most often (how often, when you last had them, and your usual meal and portion).
Body and profile details you choose to enter: sex, age, height, weight, activity level, diet style, allergies, foods you like or dislike, and calorie or macro goals.
Display preferences: whether you chose to hide calorie and macro numbers. We use them only to change what the app shows you. They are never sent to an AI assistant, analytics, or anyone else.
Meal descriptions you type in the web app, including ones you don't log, with how our matcher and our AI provider read them, whether you changed the plate before logging, whether you pressed "Fix with AI", and the day it was written; and how you described a meal that an AI assistant you connect logs or changes, when it sends us your words, with the foods. We keep them, linked to your account, for up to 1 year.
Your meal-box conversation: the meals you type into the web app's meal box, shown back to you as a conversation, with the follow-up answers you tapped and what Forkmate did with each (logged, asked, undone). A message that wasn't a meal (a question, or one with no food in it) is kept only as declined or no food, without its words. We keep each message for 7 days.
Your diary chat (the new app design): the meals you type and what Forkmate read from them, and your exchanges with Forky, the in-app coach, word for word: his questions about a meal and your answers, the questions you ask him and his answers, and messages about self-harm or an eating disorder. Kept with your diary until you delete your account; included in your export.
Saved recipes: the name you give a meal you logged, how many servings it was, and a copy of its foods and numbers. Kept until you delete the recipe or your account; included in your export.
Your consent record: when you consented to us processing this data, and, if you consented by replying in an AI assistant, which app it was and the words you replied with.
Usage events: records that you used a Forkmate feature and when. For example: that you gave consent; logged, edited or deleted a meal (through the web app or an AI assistant, and whether it had 1, 2–3 or 4+ foods; for a meal described in the web app, whether you changed the plate before logging it and a rough band for how sure our food matcher was of it); previewed a plate; moved through an onboarding step; opened the app; connected an AI assistant; or imported from MyFitnessPal. They never contain what you ate, food names, nutrition values, notes, body details, goals or display preferences.
Anything health-related you put in feedback you send from inside the app or ask a connected AI assistant to send us, including the words you typed for your most recent meal if you tick “Include my last meal’s text” (off unless you tick it, shown to you beside the box, and offered only while your consent is current).

We do not ask for precise location, biometric data, or information about reproductive or sexual health, gender-affirming care, or health-care services you seek. If you mention one of these in a message to Forky, it is kept as part of that message in your diary chat and handled as described for it. A meal photo you send can show a person or a place, but we remove its location data, never use it to identify anyone or find where you are, and do not keep it.

Why we collect it

To provide the food log you asked for: to store your diary, compute your daily calorie and macro totals and your targets, show them to you in the web app or through an AI assistant you connect, keep your food profile (diet style, allergies, likes and dislikes) and a record of the foods you eat most often so that an AI assistant you connect can read them when you ask it for help, such as suggesting a meal or logging "the usual", apply the display preferences you set, and keep your account secure. To turn a meal you type into a plate, we have our AI provider read the text into foods and amounts. When you ask Forky, the in-app coach, a question, or answer one of his questions about a meal, we have our AI provider word his reply from your words and the summary described under Who we share it with; answers about your own diary are worked out by Forkmate, not the AI. The calories and macros come from public food databases or, for a dish from a restaurant you name, from that restaurant's own published figures, which our AI provider looks up on the web using only the restaurant, dish and sauce names; a restaurant line shows whose figures they are and links the page. Only when none of those has a figure for a food does our AI provider estimate its calories and macros from the same meal text; that line is labelled "Estimate" and is saved in your diary as an estimate. We keep the meal descriptions you type only to find meals Forkmate reads wrongly and to improve how it matches foods, and, for 7 days, to show you your recent meal-box conversation so you can check or undo what was logged; we don't use them for anything else. To keep fake or throwaway accounts from using up the AI everyone shares, we check whether a new account has logged any meals yet (a count, never what they were) before it can use photo reading or restaurant lookups. We also use usage events to understand which features are used, so we can improve Forkmate and decide how to fund it. AI reading, keeping what you type and usage analytics are conditions of using Forkmate. We do not use any of it for advertising, and we do not use it to train AI models.

Where it comes from

From you, directly, in the web app.
From an AI assistant you connect (such as Claude or ChatGPT), when you ask it to log or change something in your Forkmate diary or food profile, such as an allergy or a food you don't like.
From files you choose to import, such as a MyFitnessPal export.

Consent

We collect consumer health data only after you consent to it. Before you log anything, in the web app or through an AI assistant, we ask for your consent (in the web app you tick a box; in a connected AI assistant you can instead reply that you agree after it shows you what you are agreeing to, and we record that with the time, the app and your words) to Forkmate processing your health-related data, sending the text of each meal you type in the web app to our AI provider to read it into foods and amounts, keeping the meals you type for up to 1 year to improve its food matching, and sharing pseudonymous usage events with our product-analytics provider. If you use the camera button and no barcode is found in your photo on your device, the photo is sent to our AI provider in the same way and for the same purpose as a meal you type, and we do not keep it. These are conditions of using Forkmate, so it is one consent, not separate choices: if you would rather not have any of them, you can withdraw your consent, which also pauses logging. If you gave an earlier version of this consent, we ask you again before any meal you type is sent to our AI provider or kept. Nothing you type in the web app is sent to our AI provider or kept before you consent; a first meal typed before consent is read by the AI only after you agree, before it is saved. Until you do, nothing health-related is saved, with three exceptions, all things you do yourself: your display preferences, which we accept before consent so hiding numbers never waits on it, anything you choose to write in feedback you send us, and a meal you ask an AI assistant to log before you have consented, which we hold with your account for up to 30 minutes so it can be logged once you agree, and delete unlogged if you don't.

Who we share it with

We share consumer health data with these service providers, under contract, acting solely on our behalf, and, only if you connect Forkmate to Meta Muse, with Meta, which does not act on our behalf (see below):

Our hosting and security provider: hosting and storage for the app and your diary.
Our AI provider: it receives the text of each meal description you type in the web app, to separate it into foods and amounts and, only when no published or database figure exists, to estimate their calories and macros, and, for a typed meal that names a restaurant, the restaurant, dish and sauce names on their own, to search the web for that restaurant's published nutrition (its web search passes those names to its search provider). It also receives each meal photo you take with the camera button in the web app in which no barcode was found on your device, with the details stored in the image file (such as where and when it was taken, and the camera) removed, to list the foods and amounts it can see and estimate them in the same way; Forkmate does not keep the photo. For Forky, the in-app coach, it also receives the meal you named and your answers while he asks about it, and each question you ask him with a short summary: your food profile (diet style, allergies, likes and dislikes), the names of the foods you log most and, unless Calm mode is on, today’s calorie and macro totals and your calorie goal, so he can word his reply. It receives nothing else about you. When we analyse the meal descriptions we keep, to improve food matching, it receives them again through our own business account, with how they were read and whether you changed them, but without your account, the day they were written (only the month) or a place you named after "at" or "from". It may also read how you described a meal that an AI assistant you connect sent us, in the same way as a meal you type, to check the foods and amounts against your words. To check how accurate our data is, it may also receive a copy of your meal history (the foods, amounts and figures, the day, and the meal descriptions we keep), with a code in place of your account and without notes, exact times or places. It also receives a sample of meal readings again, the meal text and how it was read, without your account, so we can check the reading was right. It may use the text and photos only to provide that service to us, may not train on them, and deletes them within 30 days (up to 2 years if its automated safety systems flag them).
Our product-analytics provider: usage analytics. From our server, it receives records of which Forkmate features you used and when (and, with your sign-up and first logged meal, how you first reached us: a one-word source label, the section of our website you landed on and any campaign tags, each from a fixed list), under an identifier derived from your account ID that the provider cannot reverse. It may use them only to provide analytics to us. It never receives what you ate, food names, calories or other nutrition values, notes, body measurements, goals, your display preferences, your IP address or your email.
Our AI quality-review provider: so we can check that our AI's readings and Forkmate's answers are accurate and safe, it receives, with your account ID, a record of each AI reading in the web app (the meal text you typed and how it was read; for a photo, only what was read from it, never the photo) and of each request a connected AI assistant makes to Forkmate (which assistant and action, and a shortened copy of the request and our answer; for a read of your diary, only how many meals and the food names), and whether you then logged, changed, cancelled or removed what was read. Email addresses, anything that looks like a phone number, web-link parameters and anything that looks like a password or key are removed first. It never receives your account's email or name, your IP address, or the words of a message we recognise is not a meal. It may use them only to provide that service to us, and we delete them after 27 days or when you delete your account.

We describe each provider by what it does rather than by name. We'll tell you the current list of providers if you ask: privacy@forkmate.ai.

If you email us health-related information, that email is handled by our email provider. When you or your assistant search for a food or scan a barcode, only the search term or barcode goes to the public USDA FoodData Central and Open Food Facts databases. It is never sent with your identity or account, so it is not linked to you. An AI assistant you connect receives what Forkmate returns to it, at your direction, so that it can answer you; how it handles your conversation is governed by its own terms. The same applies if you connect through a third-party directory's gateway (such as Smithery) rather than directly to mcp.forkmate.ai: your requests and our responses pass through that service under its own terms, and it may hold the authorization that lets it read and change your diary for you until you disconnect it there. Forkmate is listed in Smithery's directory, but Smithery runs that gateway, not us. You choose whether to use it, and we don't control how it handles your data. Connecting directly to mcp.forkmate.ai avoids it.

If you connect Forkmate to Meta Muse, more applies than for other assistants. Meta receives what Muse sends to Forkmate's tools and everything Forkmate returns, including your diary, your food profile and other consumer health data. Under Meta's connector terms, Meta may also use that information, and how you used Forkmate through Muse, to personalize and improve Muse, as an independent controller for its own purposes under its own privacy policy, not on our behalf. Disconnecting Forkmate from Muse ends Muse's access but does not delete your Forkmate diary, and deleting your diary or your Forkmate account does not delete what Meta has already received. If you don't want this, use the web app or another assistant instead of Muse.

We do not sell consumer health data, and we have not sold it. Apart from Meta, if you connect Forkmate to Meta Muse (Meta also runs an advertising business, and its own privacy policy governs what it does with what it receives), we do not share it with advertisers, data brokers or affiliates, and we do not use geofencing around health-care facilities.

Your rights

Access: confirm whether we hold your consumer health data, get a copy, and get the list of every third party it was shared with. Your full data export is in the app under Settings.
Deletion: delete your data or your whole account. Account deletion in Settings erases it from our live systems immediately. Copies in our hosting provider's point-in-time recovery expire within 30 days, and we ask our product-analytics provider to delete your usage events: it removes the person record within minutes and deletes the events in its next scheduled deletion batch. Deletion includes the meal descriptions we kept and your meal-box conversation. A de-linked analysis copy is not linked to your account, so deletion can't find it; it is deleted within 90 days of the export. To avoid sending the same description twice, we also keep how a description was read (the foods, amounts and how they were described, never a place) for up to 30 days; that copy is not linked to you or your account, so deleting your account does not reach it, and we don't try to link it. It expires on its own. Text already sent to our AI provider is deleted on its schedule (within 30 days, or up to 2 years if its safety systems flagged it); we can't recall it. Your records at our AI quality-review provider are deleted when you delete your account.
Withdraw consent: at any time, in Settings. We stop collecting new health data, stop sharing your diary and food profile with connected AI assistants, stop sending the meals you type to our AI provider to be read (meal descriptions already kept can still reach it, without your account, when we analyse them), stop keeping new meal descriptions, stop sending usage events straight away, and 7 days later, unless you consent again before then, ask our product-analytics provider to delete the ones tied to you (it removes the person record within minutes and deletes the events in its next scheduled deletion batch). There are two exceptions, both things you do yourself: you can still change your display preferences, so you can always hide the numbers, and we still keep anything you choose to write in feedback you send us. Apart from those usage events, withdrawing deletes nothing: we keep your data only so you can still see, export or delete it, or pick up where you left off. One more exception: meal descriptions we already kept may still be used to improve food matching until each expires, 1 year after it was written. Deleting your account erases them from our systems; a de-linked copy in an analysis export is deleted within 90 days, and our AI provider deletes what it received within 30 days (up to 2 years if its safety systems flag it). Your meal-box conversation still expires 7 days after each message, and you can still see and clear it. Deletion is a separate request you make when you want it. Withdrawal does not affect processing before it.

To exercise any of these, or if something is not available in the app, email privacy@forkmate.ai. We respond within 45 days, and we will tell you if we need up to 45 more. If we decline your request, you can appeal by replying to our decision. We answer appeals within 45 days. If you are not satisfied, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint or your own state's attorney general. We will not treat you differently for using any of these rights.

Changes

If we start collecting a kind of consumer health data, or using it for a purpose, that this page does not already describe, or start sharing it with a new kind of recipient, we will update this page and ask for your consent again before the change applies to you. The one exception is Meta Muse, described under Who we share it with: it applies only if you choose to connect Forkmate to Muse, and we do not ask for a separate consent for it. Other changes, such as a new usage event within the categories and purposes above, are made by updating this page and its date, without asking again.