Privacy Policy

We may collect health and wellness information that you choose to provide or generate through use of Fava, such as selected health conditions, medications, allergies, dietary preferences, food searches, food scores, grocery lists, and related app activity.

In this beta of Fava, we may additionally collect or generate:

• custom preference entries you type
• saved foods, saved label scans, saved guides, and user-created lists (list names you write are stored as you enter them)
• beta feedback you submit about a result
• result snapshots you save, so that a saved result reflects what the app showed you at the time you saved it
• optional screenshots you attach to feedback, only when you choose to attach one

We use Anthropic's Claude API to help analyze food, barcode, photo, and recipe information and to generate plain-language explanations and swap suggestions. To provide these features, we may send Anthropic information such as the food, barcode, photo, or recipe you searched, your selected conditions, medications, allergies, and dietary preferences. Deterministic safety rules and final safeguards may modify or override model-generated output for certain allergy, medication, and celiac-related situations.

This wording reflects Fava's current beta architecture and is pending final legal review.

Fava stores account, profile, and app activity data using Supabase (Supabase, Inc.) as our database and authentication provider. Depending on how you use the app, stored records may include:

• account and profile information
• selected health conditions
• selected medications
• selected allergies
• dietary preferences
• food searches you run
• food scores generated for you
• saved foods, saved label scans, saved guides, and user-created lists
• result history and result snapshots where applicable
• beta feedback you submit
• feedback screenshots when you choose to attach one and the feature is enabled

Fava uses lightweight product analytics to understand how the app is used and to improve it. General analytics events include event names, screen or route context, opaque item identifiers, and counts (for example, "a result was viewed" or "a list was created").

General analytics events do not include your food search terms, selected conditions, selected medications, selected allergies, your displayed food scores, deterministic safety flags, or the free-text content of your feedback submissions. Health-related content and free-text feedback are handled through the systems described in the sections above, not through general product analytics.

Fava is a direct-to-consumer wellness service and is not intended to provide services on behalf of healthcare providers, health plans, or other HIPAA covered entities. Information you provide to Fava may not be subject to HIPAA, but we treat health-related information as sensitive and handle it as described in this Privacy Policy.

When you submit feedback about a result:

• your authenticated user ID may be attached to the report
• relevant result context — the item, its displayed score, the headline, the scoring version, and the app build — may be attached
• only profile factors that materially shaped or were evaluated for that specific result should be attached; the report is not a copy of your full Profile
• an optional screenshot may be stored if you choose to attach one
• internal Fava reviewers may access your submission to investigate the report
• feedback may be exported for QA and testing during the beta
• feedback is not used automatically to retrain a model, rescore an item, or change a result you are currently looking at

You may request deletion of your Fava account and the data associated with it. When you do, we remove your account and profile records — including your selected conditions, medications, allergies, dietary preferences, saved items and user-created lists, food searches, scoring history, and beta feedback — from our active systems.

Uploaded photos, recipe text you entered, and optional feedback screenshots follow the same deletion request. Backup copies and aggregated, non-identifying operational data may be retained for a limited period as described in the base Privacy Policy below.