Consumer Health Data Privacy Policy

Effective September 2026. This policy is separate from our general Privacy Policy and covers health-related information specifically, as required by the Washington My Health My Data Act, Nevada SB 370, and Connecticut's health data provisions. It applies to everyone who uses GF Savings, wherever you live.

In plain language: GF Savings exists to find the extra cost of gluten-free food on your receipts so you can claim it as a medical expense. Doing that means we hold information that says, in effect, "this person follows a medically necessary gluten-free diet." We collect only what the tool needs to do that job for you, we do not sell it or share it for advertising, and you can delete all of it yourself from your dashboard.

1. What consumer health data we collect

Category	What it is	Where it comes from
Receipt images and line items	The receipt you upload and the items, prices, store, and date we read from it, including which items we identify as gluten-free and claimable.	You, when you upload.
Claim records	The claim packets you generate (which items, which amounts) and whether you marked them submitted.	Created by the tool from your receipts.
Diet attestation	Your confirmation, when you generate a packet, that the items were bought for a medically necessary gluten-free diet for you or a dependent. This is stamped into the PDF with your name and a timestamp.	You, by checkbox.
Letter status	Whether you told us you asked your doctor for a Letter of Medical Necessity, and your doctor's surname if you entered it to pre-fill the letter template.	You, on the letter setup page.
Benefit profile	Whether you plan to use an FSA, HSA, or the tax route; which administrator you named; the month your plan year ends.	You, on the dashboard.
Corrections	Edits you make to what the tool read (for example, marking an item gluten-free or not), used to improve reading accuracy.	You, in the review screen.

What we do not collect: your doctor's letter itself (it is merged into your packet in your browser and never sent to our servers), your diagnosis records, your account or card numbers (Stripe handles payment), and any precise location.

2. Why we collect it, and how we use it

To read your receipt, identify gluten-free items, price a comparable regular product, and calculate the difference you can claim.
To build your claim packet and show you how your administrator wants it filed.
To keep your receipts and claims available to you until you delete them.
To improve reading accuracy, using the corrections you make and, in aggregate, the items the tool got wrong.
To send you transactional email about your account (password resets, receipts, reminders you have not turned off).

We collect this data because it is necessary to provide the service you asked for. We do not use it for advertising, and we do not build profiles about you for any other purpose.

3. Who processes it on our behalf

Processor	What they receive	Why
OpenAI	The text and image of your receipt	Reading the items on the receipt
Google Cloud (Document AI)	Your receipt image	Optical character recognition before the items are read
Railway	Everything stored in your account	Hosting the application and database
Stripe	Your email and subscription status; never your receipts	Payments
Resend	Your email address and the content of transactional emails	Sending email
Google	Your Google profile, only if you choose "Sign in with Google"	Sign-in

Each processor is bound to use the data only to provide that service to us. We do not share consumer health data with anyone else, and we do not sell it and will not sell it without your separate, written authorization.

4. How long we keep it

Receipts, claims, and your profile: until you delete them or delete your account.
Generated claim PDFs: automatically removed from our servers about 7 days after you generate them (you keep your download).
After you delete your account: your data is removed from the live database immediately and from backups within six months.
Payment records: Stripe keeps its own records as required by law; our local log of subscription events is kept without any link to your deleted account.

5. Your rights and how to use them

Delete everything yourself: open your dashboard and use "Delete my account and data." It removes your account, receipts, receipt images, claims, and profile, and cancels any subscription.
Delete a single receipt or claim: from the dashboard, at any time.
Ask us: email [email protected] to confirm what we hold about you, to receive a copy, to withdraw consent, or to delete. We respond within 30 days, and we may ask you to verify the email on the account first.
Appeal: if we decline a request, reply to our response and say you are appealing; a different person reviews it within 30 days. You may also contact your state attorney general.

We will never treat you differently for exercising these rights.

6. Security

Data is encrypted in transit. Passwords are stored hashed. Access to the database is limited to the people who operate the service. No method of storage is perfectly secure, and we will tell you if a breach affects your data.

7. Changes and contact

If this policy changes, the effective date above changes with it. Questions and requests: [email protected].