Ojas — Consumer Health Data Privacy Policy (United States)
Status: ⚠️ NOT REVIEWED BY A LAWYER. This page exists because several US states — Washington's My Health My Data Act, Nevada's SB 370, and the consumer-privacy laws of states such as California, Colorado, Connecticut, Oregon and Texas — treat what you log in a calorie tracker as consumer health data and require a separate, plainly linked notice about it. It describes what Ojas actually does, verified against the source code on 22 September 2026. It is written to be read, not to be safe.
This page is specific to consumer health data and to US residents. Our full Privacy Policy covers everything else and applies everywhere; where the two describe the same thing, they agree.
1. What counts as consumer health data here
Everything Ojas holds about your body and what you eat:
- what you log — foods, portions, meals, the times you logged them, and the calories, macros and micronutrients calculated from them;
- your weight history, your target weight and your weight-goal progress;
- your profile — date of birth, sex, height, activity level, and the calorie and macro targets derived from them;
- whether you have told the app you are pregnant or breastfeeding;
- allergies, intolerances and diet preference (vegetarian, eggetarian, non-vegetarian, lactose-free);
- photos of food or of a nutrition label that you choose to scan;
- activity read from Health Connect on Android (steps, exercise minutes, calories burned), if you connect it.
2. How we collect it
Only from you, and only in the app:
- you type or scan it (a meal, a barcode, a photo, a weight);
- you enter it during onboarding (date of birth, height, weight, goals);
- you connect Health Connect, which the app reads live on your device.
We do not buy health data, receive it from data brokers, or infer it from anything outside the app. There are no advertising SDKs, no analytics SDKs and no third-party trackers in Ojas.
3. Why we use it
- To show your day: calories, macros and micronutrients against your targets.
- To estimate food you photograph or describe.
- To write your coaching — the daily, weekly and monthly notes.
- To track your weight goal and suggest (never silently apply) changes to your calorie target.
- To back your data up privately so a lost phone does not cost you your history.
- To keep the service working and to prevent abuse of the AI endpoints.
We do not use it for advertising, profiling for advertising, or scoring of any kind, and we do not use it to train AI models.
4. Who we share it with
We do not sell consumer health data. We never have. Under Washington's My Health My Data Act, "selling" includes sharing in exchange for anything of value: we do not do that, and there is no consent flow for it because there is nothing to consent to.
We use three service providers, each processing only on our instructions:
| Who | What reaches them | What they may do with it |
|---|---|---|
| OpenAI | Meal text, day totals, the nutrient estimates your phone calculated, and — if you have a weight goal — its progress as relative numbers (kilograms still to go, pace per week). Never your weight or target weight. Never photos. | Return coaching text. Not used to train their models. |
| Anthropic | Food photos and label photos, dish and meal estimates, and the items above whenever the OpenAI request fails | Return the estimate or the coaching text. Not used to train their models. |
| Google Firebase (Mumbai region) | Your account, your encrypted backup, crash reports | Store and authenticate, on our instructions |
Photos are sent to be identified and are never stored by us — not in a database, not in a file store.
Health Connect activity is read on your device, shown on screen, and never transmitted anywhere or included in your backup.
5. Your rights
If you are a US resident, you may:
- know what consumer health data we hold and who has received it;
- get a copy — in the app, Profile → Help & account → Backup & restore exports everything as JSON or CSV;
- delete it — in the app, Profile → Help & account → Delete account erases your cloud backup, your account and everything on the device; or use https://sulabs.in/delete/ojas without the app installed;
- withdraw consent — stop using the AI features, disconnect Health Connect, or delete your account, which withdraws every consent you gave;
- appeal if we refuse a request.
How to ask: email sulabsstudio@gmail.com with the subject "Health data request" from the address you signed in with. We answer within 45 days, and tell you if we need a further 45. If we refuse, we say why, and you may appeal by replying to that email; if the appeal is refused you may complain to your state Attorney General.
We do not charge for this, and we will not treat you differently for asking.
6. Where it is processed
Ojas is published from India, and your account and backup live in Google's Mumbai (asia-south1) region. The AI providers process requests on their own infrastructure, which may be in the United States or elsewhere. By using Ojas you are asking us to process your data in those places. Section 12 of the Privacy Policy covers international transfers in full.
7. How long we keep it
As long as your account exists. Delete the account and the backup goes with it; the technical logs that carry no diary content are pruned on the schedule in §11 of the Privacy Policy. Reports you make about an AI response are kept for 12 months.
8. Who to contact
Gulladurthi Hari Priya (Su Labs) — sulabsstudio@gmail.com 1/118, Malepadu, Cuddapah, Andhra Pradesh 516360, India
9. Changes
If this page changes materially we update the effective date and the version above, and the app asks you to read it again where the law requires that.