Hekato Pty Ltd (ACN 702 732 152), Brisbane, Australia, operates Avocando.
This page is for people in the United States, and in particular residents of Washington, Nevada and Connecticut, whose laws give "consumer health data" its own protections. It describes only our handling of consumer health data. Our Privacy Policy at avocando.app/privacy describes everything else and gives more detail on each point below.
1. What consumer health data we collect, and why
Avocando is a food, fitness and habit tracker. When you use it, we collect the health-related information you choose to enter or ask the App to work out: your food and nutrition logs; your weight and body-fat readings; your workouts, exercises, routines and habits and your completion history; your height, sex, date of birth and activity level, which the App uses with your logs to calculate your calorie and macro targets; your goals; what you write to Avo, the App's AI assistant, and its replies, which we keep for 36 hours after the last message, and a record of each change Avo makes to your data for you, which we keep for 12 months; photos of meals, nutrition labels and shop receipts you scan, if you turn on AI photo recognition (read by our AI provider; a meal photo you send to Avo is kept privately for 36 hours and then deleted within the hour, and we keep no other scanned photo); and information the App works out from your data: your targets, trends and summaries, the tips Avo shows you and, only if you turn on health inference, Avo's estimates of your body composition and fat-loss trend. If you report one of Avo's replies, we also keep that reply, the message you sent just before it and any note you add, while your account exists, and a person at Hekato reads them to check the reply. We use this data to provide the tracker and the features you choose, and to keep them working and secure: calculating your targets, showing your trends, answering you when you ask Avo, estimating foods from photos, fixing errors, testing updates before we release them (Section 3 says how), protecting the App and its users, and meeting our legal duties. We do not use it for advertising or marketing, we do not sell it, and we do not use it to train AI models.
2. Where it comes from
From you, when you enter it or scan a photo; from the App's own calculations; from the food databases the App uses (Open Food Facts, USDA and foods other users add); and from a household member, when they send you a meal or recipe you accept. We do not read your device's location, your contacts or your calendar, and we do not connect to any wearable or health platform.
3. Who receives it
Nobody at Hekato browses your consumer health data. A person at Hekato looks at it only when needed: to check a reply you report, to act on a request you make to us, to fix a problem that affects your account, to protect the App and its users, or when the law requires it. Our service providers process consumer health data for us, on our instructions and under written contracts that limit their use of it to providing their service to us: Supabase (our database, in Sydney, Australia, and our server functions, which run in the region nearest you); Cloudflare (hosting, bot checks and encrypted backups); OpenAI and Google (the Gemini AI service), both in the United States, which write Avo's replies, import recipes and match foods, read scanned photos and, if you agree, estimate trends (either may do any of these, and neither may train its models on what we send); Sentry (error reports, United States), which can occasionally see health data inside an error message; PostHog (usage analytics, United States), only if you allow usage analytics, which receives which features you used, never what you logged; Resend (account emails, United States), which sees health data only if you write it in a creator request the App emails to us; and Google Workspace (our support email), which sees health data only if you write it in an email to us. Other providers receive no consumer health data: Expo, which delivers updates to the phone app; RevenueCat, which confirms Premium subscriptions bought through Apple or Google; and Wise, which pays creators; nor do the app stores, sign-in services and other companies the Privacy Policy names. Before a release that makes larger changes to our database, or that follows a longer gap since the last release, we first rehearse it on a copy of the database with names, email addresses and anything you wrote in your own words removed; the copy stays with Supabase in Sydney, Australia, and is deleted within 7 days. We do not share consumer health data with any other third party or with any affiliate (we have none), except a court, regulator or the police when the law requires it, or a buyer of the business, as the Privacy Policy explains. A meal or recipe you send to a member of your household is read by that person because you chose to send it; that is your choice, not a disclosure by us. When you scan a barcode or search for a food, your device also queries the Open Food Facts database directly, which receives the barcode or search words and your device's internet address; that is a lookup you make, not a disclosure of your logs.
4. Your consent
We collect consumer health data only with your consent, which you give in the App when you turn on "Core tracking (required)", and we never obtain it through our Terms of Service. Avo, the AI assistant (what you write to Avo, recipes you import and the profile details, logs and trends Avo looks up to answer you, sent to OpenAI or Google Gemini in the United States), AI photo recognition and health inference each need their own, separate consent, which you can withdraw in Settings. You give the Avo consent by tapping "Agree and start" when you first open Avo, which also turns on AI photo recognition, or "Agree" when you first import a recipe, and again if you have turned it off; you can also turn AI photo recognition on by itself. Reporting one of Avo's replies is a further consent, which you give by tapping "Agree and send" on the Report sheet and withdraw by emailing us. We never share consumer health data in a way that would need separate consent; if we ever propose to, we will ask you first, separately. We never sell consumer health data, and we never use a geofence.
5. Your rights
You can: confirm whether we collect, share or sell your consumer health data and access it, including a list of every third party and affiliate it has been shared with and how to contact them (today that list is empty); withdraw your consent, in Settings for Avo, the AI assistant, AI photo recognition, health inference and usage analytics, by email for a report you made about one of Avo's replies, and for core tracking by deleting your account; and delete your consumer health data, which Settings, Danger zone, Delete account does at once, except anything a complaint, dispute or legal claim still needs, which we keep until it is resolved (Privacy Policy, Section 7). Copies elsewhere go on their own schedules, as our Privacy Policy, Section 7, explains: backups are deleted 30 days after they are made, error reports after 30 days and analytics events after 12 months; our AI providers may keep what we sent them for a limited period to detect abuse of their service (Privacy Policy, Section 6). Email support@avocando.app, from the address on your account, to make any request. We answer within 30 days, and in any case within the 45 days the law allows; if we need longer we tell you why within those 45 days and take up to 45 more. Requests are free. If we refuse a request, we tell you why and how to appeal: reply to our email with "Appeal" in the subject and we decide the appeal within 45 days. If we deny your appeal, you can complain to your state's attorney general: in Washington, the Attorney General's Consumer Protection Division, atg.wa.gov; in Nevada, the Attorney General's Bureau of Consumer Protection, ag.nv.gov; in Connecticut, the Attorney General's Privacy Section, portal.ct.gov/ag/common/complaint-form-landing-page.
6. Changes
If we make a material change to this page, we will tell you before it takes effect, in the App or by email, and ask for your consent where the law needs it. Each change updates the effective date above.
7. Contact
Hekato Pty Ltd, support@avocando.app.