Consumer Health Data Privacy Policy
This policy covers "consumer health data" as defined by the Washington My Health My Data Act (RCW 19.373), Nevada law (NRS chapter 603A) and Connecticut law (Conn. Gen. Stat. §42-515 and following). It applies to the Iron & Oven app and to ironandoven.com. Our general Privacy Policy covers everything else.
Consumer health data we collect, and where it comes from
| Category | Examples | Source |
|---|---|---|
| Body measurements and vital signs | Weight, height, body fat, tape measurements, the body-fat estimate the app calculates, resting heart rate, heart rate variability, VO2 max, sleep, steps, active and resting energy, exercise minutes | Apple Health on iPhone or Health Connect on Android (with your permission), what you enter, and calculations the app makes from those |
| Fitness and nutrition | Workouts, sets and weights, meals, calories, macros, water, check-ins and their notes, your plan and targets | What you enter, meal photos you take, Apple Health or Health Connect |
| Photos and body scans | Meal photos, progress photos, 3D body-scan captures | Your camera |
| Health goals and context | What you tell the AI agents (for example an injury or a goal weight), what they note about you, and age and sex used to set targets | You, Apple Health (on Android, you enter your birth year and sex) |
| Signing up for a health and fitness service | Your account: email address, phone number if we ask for one, passkeys, the Apple or Google ID if you sign in with them, and sign-ins; your email address when you join the TestFlight waitlist | You, in the app; you, on ironandoven.com |
| Health details you choose to send us | A reply you report from the app, or a support email | You |
Most of this is stored only on your device, in the app. You need an account to use the app, but it holds who you are and what you bought, not your logs, photos, chat or health figures. We don't run servers that hold your logs. When you use the AI agents, the health data a request needs passes through our AI gateway, which processes it in memory and doesn't keep it (see below). The gateway keeps usage metadata only (your account ID, a device key ID, plan, token counts, cost, timings), with no health figures in it, for 90 days. The only consumer health data we hold on our own systems is your account (email address, phone number if given, passkey public keys and sign-ins), your waitlist email and anything you choose to email us.
Why we collect and use it
- To provide the app features you ask for: targets, plans, progress, meal estimates, recipes and the AI agents' answers.
- To send your messages, meal photos and the numbers the agents need through our AI gateway to the AI models, only after you agree, so the agents can answer.
- To run your account: sign you in, link your purchase to it, and keep it secure, including a phone number in the few cases the Privacy Policy lists.
- To send your TestFlight invite and beta notes, and to answer support emails and reported replies.
We do not use consumer health data for advertising, and we do not sell it.
Who we share it with
| Recipient | What | When |
|---|---|---|
| Our AI gateway (run by Rude Company on DigitalOcean, LLC, reached through Cloudflare, Inc., as our processors) | Your messages, meal photos, and the plan and numbers the agents need (meals, workouts, check-ins, measurements, body-fat estimate), and Apple Health or Health Connect figures only if you turn that on. Processed in memory, never stored or logged | Only after you agree on the Who sees what screen |
| OpenRouter, Inc., and through it Microsoft Corporation (Azure, running the OpenAI models), as our processors | The same model requests, from our gateway. Zero data retention: not stored, not used for training | Only after you agree |
| Exa (web search, as our processor) | Search queries, which can include health details from your question. Zero data retention terms | When an agent searches the web, after you agree |
| MCP servers you add yourself | Tool calls, which may include health details from the chat | Only after you add them |
| Open Food Facts | A barcode or food name being looked up | When you or an agent look up a food |
| Instacart | Items on your shopping list | When you tap Shop on Instacart |
| Apple (Apple Health, on iPhone) | Meals, water, workouts and weigh-ins you log | Only if you allow the app to write to Apple Health |
| Health Connect (on Android, stored on your phone) | Meals, water, workouts and weigh-ins you log | Only if you allow the app to write to Health Connect |
| Our sign-in service and app server (run by Rude Company on DigitalOcean, LLC, in its managed databases, backed up to DigitalOcean Spaces, reached through Cloudflare, Inc., as our processors) | Your account: email address, phone number if given, passkey public keys, sign-ins, linked purchases | When you create the account, until you delete it |
| Apple (Sign in with Apple) and Google (Sign in with Google), under their own terms | That you signed in to Iron & Oven, and when. We get back only your email address and the ID they use for you | Only if you choose to sign in with them |
| Resend, Inc. (sign-in email, as our processor) | Your email address and the sign-in email with its code | Each time you sign in by email |
| Quo (OpenPhone, Inc.; text messages, as our processor) | Your phone number and the text with its code | Only when we ask you to confirm a phone number |
| Apple (TestFlight) | Your email address | When we invite you to the beta |
| Cloudflare, Inc. (our website host, as our processor) | Your waitlist email | When you join the waitlist |
Usage statistics (off in the app until you turn them on) record that features were used, for example that a meal was logged, but never what you ate, your measurements or any other health figures.
Your consent
We ask before collecting consumer health data that isn't needed for a feature you asked for, and separately before sharing it. In the app, Agree on the Who sees what screen, shown before the first AI call, is your consent to share with our AI gateway and the processors it names (OpenRouter, Microsoft Azure, Exa); Not now sends nothing. Apple Health and Health Connect figures need a second, separate choice: Include Apple Health numbers (Include Health Connect numbers on Android), off until you turn it on.
You can withdraw consent at any time: turn the AI off in Settings → AI → What's shared (AI), Include Apple Health numbers or Include Health Connect numbers off (health figures to AI), the Health app or Health Connect's settings (access to them), disconnecting a service in Settings, deleting your account (account), or emailing us (waitlist and email).
Your rights
You may:
- confirm whether we collect, share or sell your consumer health data, and get a copy of it;
- get a list of the third parties and affiliates we have shared it with, with a way to contact each;
- withdraw consent to its collection and sharing;
- have it deleted, including from our processors and backups.
Data that lives only in the app on your phone: export it from Settings → Export my data, and delete it by deleting the app. Settings → Account → Delete account deletes your account: your email address, phone number, passkeys and sign-ins, and the account's usage records (the account ID and dates are kept 30 days so old tokens are refused; backups age out within about 12 months, as the Privacy Policy explains). You can also ask at ironandoven.com/account/delete. The gateway and its processors keep nothing you sent. For anything else we hold (your waitlist signup, emails), email hello@ironandoven.com from the address involved, with "Health data request" in the subject. We answer within 45 days. If we need longer (up to another 45 days), we'll tell you why. Requests are free, up to two a year.
Appeals. If we refuse a request, reply with "Appeal" in the subject within 30 days. We'll decide within 45 days and explain why. If the appeal is denied, you can contact the Washington Attorney General (atg.wa.gov/file-complaint), the Nevada Attorney General (ag.nv.gov) or the Connecticut Attorney General (portal.ct.gov/ag).
We won't treat you differently for using these rights.
Location
Iron & Oven does not collect precise location, and we do not use geofences.
Security and access
Only Rude Company LLC staff who need it to answer you can access waitlist, account and support data, and they are bound by confidentiality. If consumer health data is ever disclosed in a way you didn't authorize, we'll tell you on this site, in the app and by email where we have your address, within 60 days.
Changes
If we want to collect or share consumer health data in a way this policy doesn't describe, we'll update this policy and ask for your consent first.
Contact
hello@ironandoven.com · Rude Company LLC, 757 Ocean Ave Unit 114, Santa Monica, CA 90402, United States