Consumer Health Data Privacy Policy

Last updated: July 26, 2026

This policy is required by the Washington My Health My Data Act (RCW 19.373) and applies to Washington State residents and to people whose consumer health data is collected in Washington. It is separate from, and in addition to, our general Privacy Policy. Where the two overlap, this policy governs consumer health data. Nothing in this policy conflicts with our general Privacy Policy.

Butler is operated by LoRoCo LLC, a Washington limited liability company based in Seattle, Washington. Contact us at [email protected].

Short version

• Butler is a meal planner. It is not a medical or health app, and it doesn't ask you for a diagnosis.
• Some of what you choose to enter can still reveal health information — most commonly food allergies, intolerances, and medically motivated dietary restrictions.
• We collect that only because you entered it, and only to plan meals your household can actually eat.
• We have never sold consumer health data and we will not sell it.
• We do not use geofencing around any health care facility.
• You can withdraw consent and delete this data at any time, from inside the app.

What consumer health data we collect

We collect the following categories of consumer health data, and only when you enter or connect it yourself:

• Food allergies and intolerances — recorded in a family member's dietary restrictions (for example "peanut allergy", "celiac", "lactose intolerant").
• Dietary restrictions that may reflect a health condition or treatment — for example low-sodium, diabetic-friendly, or a restriction you've told us a doctor recommended.
• Health-related statements you make in chat — if you explain to the assistant why someone avoids a food, that message is stored as part of your conversation history.
• Health-related inferences we could draw from your food data — for example, the assistant taking your recorded restrictions into account when suggesting a recipe.

We do not collect diagnoses, medications, lab results, biometric or genetic data, precise location, health insurance information, or data from Apple Health or any similar health platform. Butler does not ask for any of these and has no feature that uses them.

Where it comes from

The categories of sources are:

• You — typed directly into family member profiles, recipes, or chat, or captured in a photo you upload.
• Other adult members of your household — anyone you invite to your household can add or edit household data, including dietary restrictions.
• Our own processing — inferences the assistant draws from the household data described above.

We do not buy, rent, or otherwise obtain consumer health data from data brokers, advertising networks, or any other outside source.

Why we collect it, and how it's used

We collect consumer health data for one purpose: to provide the meal-planning service you asked for. Specifically, to keep allergens and restricted ingredients out of suggested recipes and meal plans, to flag them on grocery lists, and to let the AI assistant answer your questions accurately.

We do not use consumer health data for advertising, marketing, profiling, scoring, research, or AI model training. We will not use it for any purpose beyond those described above without first asking for your separate consent.

What we share, and with whom

We share consumer health data only as needed to run the service, and only with service providers who process it on our behalf under contract. The categories of consumer health data shared are the same categories listed above. The categories of third parties and the specific parties are:

• AI providers — Anthropic (chat assistant) and Google LLC (Gemini) (photo analysis). Household context, which may include dietary restrictions, is sent so the assistant can answer. Both are contractually prohibited from using it to train their models.
• Infrastructure providers — Supabase, Inc. (database and image storage) and Railway Corporation (backend hosting). They store the data; they do not use it.
• Communication providers — Apple Inc. (push notifications) and Resend (transactional email). We do not put health details into notifications or emails.

We do not share consumer health data with advertisers, data brokers, analytics companies, or social networks. We have no affiliates. Optional integrations you may connect — Google (Gmail, Calendar), Kroger, Instacart, CellarTracker — do not receive consumer health data.

We do not sell consumer health data

LoRoCo LLC does not sell consumer health data, as "sell" is defined in RCW 19.373, and has no plans to. If that ever changed, we would first obtain your valid written authorization, separate from any other consent, containing everything the statute requires — and you could revoke it at any time.

No geofencing

We do not implement a geofence around any health care facility, and Butler does not collect precise location at all.

Consent

We collect consumer health data only to the extent necessary to provide the meal-planning features you have asked us for. When you record that a family member is allergic to peanuts, keeping peanuts out of that household's meal plans is the service you requested, and we use the information for nothing else.

We share it only with the service providers listed above, who process it on our behalf under contract and may not use it for their own purposes. We do not disclose it to any third party for that party's own use. If we ever wanted to collect consumer health data for a purpose beyond those described here, or to disclose it to a third party for their own use, we would ask for your consent first — as a clear, separate, opt-in choice, never bundled into our Terms of Service or this policy.

You are never required to provide a health reason. If you'd rather not, simply record that a family member doesn't eat something and leave the reason out — Butler works exactly the same way.

Your rights

If you are a Washington consumer, you have the right to:

• Confirm and access — find out whether we collect, share, or sell your consumer health data, and get a copy of it, together with a list of all third parties with whom we've shared it and a way to contact them.
• Withdraw consent — withdraw your consent to our collection and to our sharing of your consumer health data, separately.
• Delete — have your consumer health data deleted from our records, including from backups and archives.
• Not be discriminated against — we won't deny you the service, charge you a different price, or degrade Butler because you exercised any of these rights.

How to exercise them

• In the app — edit or remove any dietary restriction on a family member; delete a conversation to remove chat history; or use Settings → Account → Delete account to remove everything at once.
• By email — write to [email protected] from the email address on your account and tell us what you'd like. If you can't access the app, this is the fastest route.

We'll respond within 45 days of receiving your request. If we need more time, we'll tell you within that first 45 days and take up to 45 more. There's no charge.

When you ask us to delete, we delete the data from our live systems and instruct every processor listed above to do the same, and it is removed from backups within 30 days.

If we say no

You can appeal by replying to our decision, or by emailing [email protected] with "Appeal" in the subject line. We'll review it and write back within 45 days explaining our reasoning. If we still deny your request, you may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint.

Changes to this policy

We will not collect, use, or share additional categories of consumer health data, or use it for additional purposes, without updating this policy first and obtaining your consent. If we materially change this policy, we'll notify account holders by email or in-app message before the change takes effect.

Contact

LoRoCo LLC — [email protected]
Seattle, Washington, USA