Some of what you log in PlateSet counts as "consumer health data" under laws like Washington's My Health My Data Act and similar laws in Nevada and Connecticut. This notice explains exactly what that data is, why we collect it, who can see it, and the choices you have. It adds to our Privacy Policy. PlateSet is run by Ironleaf Health LLC.
What health data we collect
| Data | Where it comes from | Why |
|---|---|---|
| Food and drink you log, with calories and nutrients | You | To show your day, your totals and your trends |
| Water and sleep | You | Same |
| Body weight and body measurements | You | To show your progress over time |
| Workouts your coach gives you, and the sets, weights, times, effort and notes you log for them | Your coach, and you | So your coach can plan your training and you can both see your progress |
| Goals, daily targets, rest days and check-in answers | You, or your coach if you have one | To set your targets and track how you're doing |
| Daily notes | You | Your own journal; private unless you share them |
| Progress photos | You | Kept only on your phone. A photo leaves your phone only if you share it with your coach |
| Profile photo (optional) | You | Shown next to your name to your coach, and to your clients if you coach. We store the image only; we don't analyze faces. Removing it, or deleting your account, deletes it |
| Health intake (optional): medical conditions, medications or supplements, injuries, food allergies, pregnancy or breastfeeding, eating-disorder history, exercise limits | You | Shared only with your current coach so they can coach you safely |
| Age, height, sex and activity level in the calorie estimator | You | Used once on your phone to suggest a calorie range; not saved |
We collect it only with your consent
When you create an account, you agree to two separate things: that you're 18 or older and accept the Terms, and that PlateSet may store the health information you log to run the app for you. Sharing with a coach needs its own, separate yes (see below), and the health intake asks for another yes each time you save it. We use your health data only to provide the app to you (and to your coach, if you choose one): to store and show your log, work out totals and trends, run reminders and safety prompts, and share with your coach. We don't use it for advertising, we never sell it, and we don't use it to train AI models.
How it's processed: it's stored in our database on Google Firebase in the United States and read by the app on your phone, our coach dashboard and our servers, as described here. No third party collects information about your activity over time and across other apps or websites through PlateSet: we have no ads or advertising trackers.
Who we share it with
- Your coach, only if you join one. Joining asks for a separate yes, and no invite code works without it. The health intake asks again each time you save it. Your coach sees your food, water, sleep, weight, measurements, goals, check-ins, workouts, health intake and profile photo (if you add one). You choose whether that includes what you logged before joining, including workouts you did with an earlier coach (change it any time in Me → Share my older logs). Notes and progress photos are shared only when you choose: one at a time, or all notes with "Share all my notes". Leaving the coach stops it right away, removes photos you shared, and deletes your health intake answers (a new coach asks again).
Your coach is an independent business you choose, not our employee or service provider, and we share with them only because you ask us to. Under our Coach Terms they must use your data only to coach you and keep it confidential, and they may be covered by health privacy laws themselves. What they wrote down for themselves (their private notes, session records, programs and the training maxes they set for you) stays with them after you leave, and we can't delete copies they made outside the app. Ask your coach directly about those, or ask us to delete your data and we'll pass that on to them (see Your rights). - Service providers that run the app for us: Google Firebase and Google Cloud (accounts, database, file storage, servers, notifications and crash reports). Under Google's data processing terms for these services, Google processes the data only on our instructions, to provide, secure and run them, and not for its own purposes, except where the law requires.
- Google Play handles purchases and subscriptions as its own business, under Google's privacy policy, not as our service provider. It gets no health data from us.
- Nobody else. No advertisers, data brokers, other apps or affiliated companies. We'd only disclose data if the law required it.
We don't sell consumer health data, and we'd ask for your separate consent before sharing it with anyone not listed here, except where the law requires us to disclose it.
Food searches send the words you type (like "greek yogurt") to the USDA FoodData Central and Open Food Facts databases, without your name or account. For barcode scans, and searches when our server can't be reached, Open Food Facts also sees your device's internet address (as in our Privacy Policy). Your log itself isn't sent to them.
Your rights
- See your data: everything you've logged is in the app. You can also ask us for a copy of what we hold about you.
- See who it's shared with: ask us, and we'll tell you which of the people and companies listed above received your data, including each coach by name, with an email address or other way to contact each of them.
- Correct it: fix your entries in the app, or ask us to correct anything you can't change yourself.
- Delete it: Me → Account → Delete my account removes your account and data, as described on our account deletion page. You can also ask us to delete it, and we'll do so within 30 days of confirming it's you. What our service providers store for us is deleted with it, except crash reports (kept up to 90 days, and they never contain your log), Google Play's own record of any purchase, and copies in our database backups, which are erased as those backups expire, within 14 weeks. When your account is deleted, your coaches' notes, session records and training maxes about you are deleted from PlateSet too, and we tell each coach; under the Coach Terms they must then delete any copies they kept outside the app within 30 days.
- Withdraw consent: leave your coach to stop sharing with them, or delete your account to stop all collection.
- How to ask: email support@getplateset.com, ideally from the address on your account, so we can confirm it's you. Someone you authorize can ask for you, with proof that you did. It's free. We answer within 45 days; if we need longer, we'll tell you why within that time, and we won't take more than 45 more days.
- Appeal: if we turn down all or part of a request, reply to our answer with "Appeal" in the subject. We'll look at it again and reply in writing within 45 days, explaining what we decided and why. If you're still unhappy, you can contact your state attorney general: for Washington residents, the Washington State Attorney General at atg.wa.gov/file-complaint; for Nevada residents, the Nevada Attorney General at ag.nv.gov; for Connecticut residents, the Connecticut Attorney General at portal.ct.gov/ag.
We won't treat you differently, or charge you more, for using any of these rights.
Changes to this notice
If we change this notice, we'll update the date above. Before we collect or use your health data in a new way, for a new purpose, or share it with a new kind of recipient, we'll tell you in the app and ask for your consent first.
Keeping it safe
Your data is stored with Google Firebase, encrypted in transit and at rest. Database and storage rules let only you, and your coach while you're connected, read it. If you coach, your clients can also see your profile photo. Purchases are checked on our server, and nobody at PlateSet browses personal logs.