Privacy Policy

This policy explains what information Chomply collects about you, why we collect it, who we share it with, and how you can access, correct, export or delete it. Chomply holds health information, because the product cannot tell you whether a food is safe for you without knowing what you avoid. We treat that information as sensitive, we do not sell it, and we do not use it to train AI. We are bound by the Australian Privacy Act 1988 and the Australian Privacy Principles. If you are in the European Union, the United Kingdom or California, extra sections at the end apply to you.

About this policy

Chomply is operated by [[LEGAL.ENTITY_NAME NOT SET]] (ABN [[LEGAL.ABN NOT SET]], ACN [[LEGAL.ACN NOT SET]]), referred to here as "we", "us" and "our".

We are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), which govern how we collect, hold, use and disclose your personal information. This policy explains how we apply them.

If you have any question about privacy, or want to exercise a right described below, you can contact our privacy officer at [[LEGAL.PRIVACY_EMAIL NOT SET]].

In plain terms: this is how we handle your information, and that email address reaches the person responsible for it.

A plain-English summary

• We collect health information (your avoidances, reactions and related data) because Chomply cannot work without it.
• We do not sell your personal information, and we never use your health information for advertising.
• We do not use your information to train AI models, and our AI provider does not use your prompts to train theirs.
• You can export your data or delete your account at any time from within the app.

The rest of this policy sets out the detail behind each of those points.

What we collect

We collect the following categories of information.

Account and identity information

Your name or display name, email address, password (stored only as a secure hash), and any two-factor authentication or passkey credentials you set up.

Family and dependant profiles

Profiles you create for members of your household, including their name or nickname and the health and dietary information you enter for them.

Health and dietary information

Your avoidances, allergies and intolerances, and information you log such as reactions, symptoms, Pinpoint journeys and food tracker exposures. This is the core information that lets the app tell you whether a food matches something you avoid.

Usage information

Your activity in the app, including scans, searches, saved products, your pantry, your grocery lists and your recipes.

Photographs of labels and products

Images you upload or capture when you scan or add a product, and the ingredient text we extract from them.

Payment information

Your subscription status and billing history. Card details are entered directly with our payment processor, Stripe, and we never receive or store your full card number.

Technical information

Information collected automatically by your device and browser, including your IP address, device and browser type, and session identifiers.

Communications with support

The content of messages you send us, and our replies, when you contact support.

Sensitive information and your consent

Health information is "sensitive information" under section 6 of the Privacy Act 1988 (Cth), and it receives a higher level of protection than ordinary personal information.

We collect your health information only with your consent. You give that consent when you register and agree to this policy, and again when you first use a health feature such as setting up an avoidance or logging a reaction. You may withdraw your consent at any time. Because Chomply cannot operate without health information, withdrawing consent means your account must be closed, and we will help you export your data first if you wish.

In plain terms: your health data is specially protected, we only collect it because you agree to it, and if you take that agreement back the account has to close because the app cannot run without it.

How we collect it

We collect information in three ways:

• directly from you, when you register, set up profiles and avoidances, log information, upload photos, or contact support;
• automatically from your device, when you use the app (for example technical and usage information);
• from third-party product databases, when you scan or search for a product and we retrieve its ingredient information.

In plain terms: some information you give us, some your device provides as you use the app, and product data comes from outside databases.

Anonymity and pseudonymity

Australian Privacy Principle 2 gives you the option, where practicable, of dealing with us anonymously or under a pseudonym. You may use a pseudonym as your display name in the app.

An account cannot be fully anonymous, however, because it holds health information tied to a login that must be able to reach you (for example for security notices and billing). Some interactions, such as making a payment or receiving support, also require identifying details.

In plain terms: you can use a nickname on screen, but a health account still needs a real login and contact point behind it.

Why we use it

We use your information for the following purposes, which map to what we collect above:

• account and identity information, to create and secure your account and to contact you about it;
• family and dependant profiles, to let you manage avoidances for your household;
• health and dietary information, to compare products against your avoidances, produce scan results, and power Pinpoint and the food tracker;
• usage information, to provide features such as your pantry, lists, saved products and history, and to understand and improve how the app is used;
• photographs, to read ingredient labels and add products;
• payment information, to manage your subscription and process payments;
• technical information, to keep the service secure, diagnose problems and prevent abuse;
• communications, to provide support and respond to you.

In plain terms: we use each piece of information for the feature it belongs to, plus keeping the app secure and improving it.

Who we disclose it to

We share information only where it is needed to run the service. We do not sell it. The recipients are:

Recipient What they receive Why Where they are located Stripe Payment and subscription data (not held by us) To process payments and manage subscriptions United States and Australia Google (Gemini) Your Sage prompts and the context needed to answer To generate Sage responses United States OCR.space Photographs of labels To extract ingredient text from images United States Open Food Facts, UPC ItemDB, FatSecret, TheMealDB Barcodes and search terms only, no personal data To retrieve product and recipe information Various Google OAuth Your sign-in identity To let you sign in with Google United States Google Analytics Usage events To understand how the app is used United States Our email delivery provider Your email address and message content To send account, security and support emails See our hosting and provider details Our hosting provider All data at rest To host and store the app and its data [[LEGAL.HOSTING_REGION NOT SET]]

We may also disclose information where we are required or authorised to do so by law, or to protect the safety, rights or property of any person.

In plain terms: this table is everyone we hand information to, what they get, and why. Product lookups send no personal data.

We do not sell your information

We do not sell your personal information to anyone, and we never use your health information for advertising or to build advertising profiles.

The disclosures listed above are limited to the providers that make the service work, on our instructions.

In plain terms: your data is not a product we sell, and your health data is never used to target ads.

AI features

When you use Sage, your prompt and the context needed to answer it are sent to our AI provider (Google, via Gemini) to generate a response.

Your prompts and their context are used only to produce your answer. They are not used to train the provider's models. Even so, please do not enter information into Sage that you would not want processed by a third-party provider.

In plain terms: Sage sends what it needs to our AI provider only to answer you, not to train their AI, but treat it like any third-party service and do not overshare.

Direct marketing

With your consent, we may send you marketing messages about Chomply features, tips and offers, by email.

You consent to these when you opt in, and you can unsubscribe at any time. Every commercial electronic message we send carries a functioning unsubscribe facility, as required by the Spam Act 2003 (Cth). Unsubscribing from marketing does not stop essential account, security and transactional messages, which are not marketing.

In plain terms: we only market to you if you opted in, every marketing email has a working unsubscribe link, and turning it off still leaves the important account emails.

Sending information overseas

Some of the providers listed above are located overseas, including in the United States, as shown in the disclosure table.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it in a way consistent with the Australian Privacy Principles, for example through contractual protections. By using features that rely on an overseas provider (for example Sage, OCR label reading, payments and analytics), you consent to the disclosure of the relevant information to that provider overseas.

In plain terms: some of our providers are overseas, we take reasonable steps to keep your information protected there, and using those features means you agree to that overseas handling.

How we keep it secure

We protect your information with measures including:

• encryption of data in transit;
• passwords stored only as secure hashes, never in plain text;
• optional two-factor authentication and passkeys for your account;
• role-based access controls that limit who can see what;
• audit logging of administrative access to personal data.

No system can be completely secure, and we cannot guarantee absolute security, but we work to protect your information and to respond quickly if something goes wrong.

In plain terms: we use strong, standard protections, and we are honest that no system is ever perfectly secure.

Data breaches

We are bound by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

If we suspect an eligible data breach, we will assess it within 30 days. Where a breach is likely to result in serious harm to affected individuals, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and tell you what happened and what you can do about it.

In plain terms: if there is a serious data breach, we investigate quickly and tell you and the regulator, as the law requires.

How long we keep it

We keep your account data for as long as your account is active.

After your account is closed, we delete or de-identify your personal information within 90 days, except where we are required or permitted by law to keep it longer. As a specific exception, we retain a de-identified record of which legal document revision you accepted, and when, as a legal record that a valid agreement was in place. This record is not linked to your health information.

In plain terms: we keep your data while your account exists, delete it within about 90 days after you close the account, and keep only a stripped-back record that you accepted the terms.

Accessing and correcting your information

You can access much of your information directly in the app, including through the in-app data export, and you can correct your profile and health information by editing it.

If you want to access or correct information that is not available in the app, email [[LEGAL.PRIVACY_EMAIL NOT SET]]. We will respond within 30 days. We may need to verify your identity first, and in the rare cases where we cannot give access, we will explain why.

In plain terms: most of your data is right there in the app to view, export and edit, and for anything else that email will sort it within 30 days.

Deleting your account

You can delete your account at any time from your account settings.

When you delete your account, we remove your personal and health information within the timeframe described in "How long we keep it" above. We retain only what we are legally required or permitted to keep, such as limited billing records and the de-identified record of your legal acceptance. Deletion is permanent and cannot be undone, so please export anything you want to keep first.

In plain terms: you can delete your account yourself, we then erase your data apart from a few records the law makes us keep, and it cannot be reversed.

Children's information

Chomply accounts are for adults only. A child does not hold their own account.

Where information about a child is in the app, it has been provided by their parent or guardian through a household profile. That adult is responsible for the child's information and may view, correct or delete it at any time.

In plain terms: kids do not have logins, a parent manages a child's profile, and that parent controls the child's information.

Cookies

We use cookies and similar technologies. How they work, what each one does, and how to control them, is set out in our Cookie and Tracking Policy.

In plain terms: see the separate cookie policy for the detail on cookies.

Making a complaint

If you think we have mishandled your personal information, please tell us first. Write to [[LEGAL.PRIVACY_EMAIL NOT SET]] and we will respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

In plain terms: raise it with us first, and if we do not sort it out you can take it to the national privacy regulator using those details.

If you are in the European Union or United Kingdom

If you are located in the European Union or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal data, and this section applies to you in addition to the rest of this policy.

Controller

The controller of your personal data is [[LEGAL.ENTITY_NAME NOT SET]], contactable at [[LEGAL.PRIVACY_EMAIL NOT SET]].

Lawful bases

We process your personal data on the following lawful bases:

• performance of a contract, to provide the service you have signed up for (Article 6(1)(b));
• your explicit consent, for the processing of health data, which is special category data (Article 9(2)(a));
• our legitimate interests, in keeping the service secure and improving it, where those interests are not overridden by your rights (Article 6(1)(f)).

Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. Where we rely on consent, you have the right to withdraw it at any time, without affecting processing already carried out. You also have the right to lodge a complaint with your local supervisory authority.

International transfers

When we transfer your data outside the European Economic Area or the United Kingdom, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), to protect it.

In plain terms: if you are in the EU or UK, you have the full set of GDPR rights, we process health data on your explicit consent, and we protect any transfers out of your region with approved safeguards.

[FOR LEGAL REVIEW: confirm whether an EU or UK representative must be appointed under Article 27 given expected traffic volumes.]

If you are in California

If you are a California resident, the California Consumer Privacy Act (as amended) applies to you, and this section applies in addition to the rest of this policy.

The categories of personal information we collect are described in "What we collect" above, and include identifiers, health and dietary information, commercial (subscription) information, internet activity, and images.

We do not sell or share your personal information, as those terms are defined under California law. You have the right to know what personal information we hold about you, to request its deletion, and to request that we correct inaccurate information. We will not discriminate against you for exercising any of these rights. To make a request, contact [[LEGAL.PRIVACY_EMAIL NOT SET]].

In plain terms: if you are in California, you can ask what we hold, have it corrected or deleted, we do not sell or share it, and exercising these rights costs you nothing.

Changes to this policy

We may update this policy from time to time. When we do, we will publish the updated version with a new effective date.

Where a change is material, we will require you to re-accept the policy before you continue to use the app.

In plain terms: we can update this policy, we will date it, and for significant changes we will ask you to accept the new version.

How to contact us

You can contact us about privacy at:

[[LEGAL.ENTITY_NAME NOT SET]] ABN [[LEGAL.ABN NOT SET]] [[LEGAL.REGISTERED_ADDRESS NOT SET]] Privacy officer: [[LEGAL.PRIVACY_EMAIL NOT SET]]

In plain terms: those are the details for reaching us about your privacy.