Washington, Nevada and Connecticut have laws that protect consumer health data: information that identifies you and says something about your physical or mental health. Allergies, and some diets, can reveal a health condition. So we treat every dietary restriction and allergen you record in Fumet as consumer health data, wherever you live. This policy explains what we collect, why, who receives it, and how to see it, delete it or stop us using it. It sits beside our privacy policy, which covers everything else.
Fumet is run by FUMET LLC, an Oregon limited liability company, based in Portland, Oregon, USA. Questions about this policy and requests under it go to [email protected].
What we collect
On a Family plan, each member of a household can keep a dietary profile. For each person who has one, we collect:
- Dietary restrictions you choose, such as vegetarian, gluten-free or low-FODMAP.
- Allergens you choose, such as peanuts, crustaceans or milk.
- Your consent: that you agreed to us keeping this information and to showing it to your household, when you agreed, and which version of the wording you agreed to.
We don't collect any other health information, and we don't need it to run Fumet.
Why we use it
Only to filter and flag recipes for you and your household, and to warn your household's meal plans and shopping lists about recipes that conflict with someone's profile. That is the whole reason Fumet asks for it.
We don't use it for advertising, we don't build a profile of you from it, and we never sell it.
Where it comes from
- From you, when you fill in your dietary profile in the app.
- From your household admin, who can fill in a profile for another member. Nobody sees or uses what they enter until that member accepts it. If the member declines, or doesn't answer within 30 days, we delete it.
How we ask for your consent
Before we store your dietary profile, the app asks you to agree to two things, separately from accepting our terms:
- that we keep your dietary restrictions and allergies so Fumet can flag recipes for you;
- that we show them to the members of your household so their meal plans can account for them.
Both are needed, because a profile your household can't see can't do what it is for. Nobody can agree for you, including your household admin. If you join a different household, the app asks again, because the people who would see your profile are different.
Who receives it
- The members of the household you agreed to share it with. They see your restrictions and allergens, and recipes are flagged for them. Your household admin can also change your profile. If you leave the household, are removed from it, or it is closed, your profile is deleted.
- The service providers that host Fumet for us, which process it only on our instructions, under contracts that require them to protect it:
- Amazon Web Services stores it in our database and its backups, in the United States (us-east-1).
- Cloudflare carries it between your device and our servers.
- Google Workspace holds our email inbox, so it receives anything you write to us about your profile, for example in a request under this policy.
Our error reporting service, Sentry, is set up not to receive the content you put into Fumet, and that includes your dietary profile. The full list of our service providers, and what each one receives, is in our privacy policy.
We never sell consumer health data. We don't share it with anyone else, unless the law requires us to.
What we don't do
- We don't sell your consumer health data, or give it to anyone in exchange for anything.
- We don't share it outside the household you chose.
- We don't use it for advertising.
- We don't set up geofences around health care locations, or collect your precise location at all.
How long we keep it
| Information | How long |
|---|---|
| Your dietary profile and your consent | Until you turn off your dietary profile, leave the household, the household is closed, or you delete your account. Each of these deletes it from our servers at once |
| A profile your admin entered that you haven't accepted | Until you accept it. We delete it if you decline, or 30 days after the admin last changed it if you don't answer |
| Copies on your household's devices | Removed from each device the next time it connects to Fumet |
| Backups | 30 days. Deleted information can remain in a backup until the backup expires |
| Our record of a request you made and our answer | 24 months |
Seeing, deleting or withdrawing
You can do most of this yourself, at any time, for free.
- See it. Your profile is in the Fumet app, under your dietary profile. You can also export everything you have stored with us from your account settings, which includes your profile and your consent, or email us for a copy.
- Withdraw your consent and delete it. In the app, open your dietary profile and turn it off. That deletes your restrictions and allergens from our servers at once, and from your household's devices when they next connect, and we stop collecting them. You can turn it on again later, which asks for your consent again.
- Delete it by email. Ask us at [email protected] to delete your dietary profile, or to stop using it. We delete it without deleting the rest of your account.
- Delete your account. Deleting your account from its settings deletes your dietary profile with everything else.
Data on your own device is yours to remove. Turning off your dietary profile removes it there too, and uninstalling the app deletes everything the app stored.
How we answer a request
Email requests go to [email protected]. We may ask you to confirm the request from the email address on your Fumet account, so we know it comes from you.
- We answer within 45 days of receiving your request. If we need longer, we'll tell you why within those 45 days, and take at most 45 more.
- Once we have confirmed a request to delete, we delete what you asked us to within 30 days. Backups that still hold it expire within 30 days after that.
- We'll tell your household's devices to remove it too, which they do when they next connect.
- Answering a request is free. We won't treat you differently for making one.
If we refuse
If we decline your request, in whole or in part, we'll tell you why. You can appeal by replying to our answer, or by emailing [email protected] with "Appeal" in the subject. We answer an appeal within 45 days and explain our decision in writing.
If we still refuse, you can complain to your state's attorney general:
- Washington: the Washington State Office of the Attorney General, consumer complaint form.
- Nevada: the Nevada Attorney General's Bureau of Consumer Protection, complaints page.
- Connecticut: the Connecticut Office of the Attorney General, complaint form. Choose "Consumer Data Privacy" as the subject.
Our answer to a refused appeal names how to contact the attorney general where you live.
Changes to this policy
When we change this policy, we'll update the date above. If we change what we collect, why we use it, or who receives it, we'll ask for your consent again before the change applies to you.
Contact
FUMET LLC, Portland, Oregon, USA (Oregon registry number 263808199). [email protected]