Suppli — Consumer Health Data Privacy Policy

Suppli is a supplement-intake tracking bot operated by a small independent team. This policy describes how we handle your consumer health data, as defined under Washington's My Health My Data Act.

Categories of consumer health data we collect

• Supplements you track — their purpose and dose
• Your intake and adherence history
• Menstrual cycle data — only if you enable cycle tracking

Sources of this data

Directly from you — through manual entry in the bot or files you choose to upload.

How we use it

To send you reminders, track your progress, and provide optional AI-generated tips.

Categories of health data we share

We share your supplement names, purposes, doses, and adherence with our AI text-processing provider to power import and AI features. We do NOT share your cycle-tracking entries (the dates and cycle day you log) with anyone. If you import a plan file that mentions cycle phases, that text is processed by our AI provider as part of the file.

Categories of third parties and affiliates we share with

• AI text-processing provider (OpenAI, USA) — receives supplement names, purposes, doses, and adherence; does not receive cycle data, your name, or your Telegram ID
• Cloud hosting provider (Railway)
• Messaging platform (Telegram) — delivers messages

We have no corporate affiliates. We do NOT sell consumer health data and we do NOT share it for advertising.

How we obtain your consent

We collect your consumer health data only after you give consent through a clear affirmative act. On your first /start, before any data is collected, the bot shows a consent screen with a prominent link to our Privacy Policy; you must tap 'I agree to processing my health data' to proceed. We do not bundle this consent into any general terms of use. The same consent is required before you add a supplement or import a plan.

Menstrual cycle data has its own separate consent: turning on cycle tracking shows a dedicated consent screen, and we process cycle data only after you tap 'I consent to processing my cycle data.' We record each consent together with the policy version and the date you granted it, and you can withdraw it at any time (see Your rights).

Your rights

You can access and export your data with /mydata, and delete your data and withdraw your consent with /deletedata, at any time, directly in the bot. You can withdraw consent for cycle tracking by turning cycle tracking off. You may request the list of third parties we have shared your data with via /feedback. We will not discriminate against you for exercising these rights.

Appeals

Your rights to access, export, and delete your data and to withdraw consent work instantly in the bot (/mydata, /deletedata). If you believe we have not fulfilled your request, you can appeal by messaging us via /feedback; we will review the appeal and respond in writing within 45 days. If we deny your appeal, we explain why and give you a way to submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint.

Data security

We use reasonable measures to protect your consumer health data and to limit access to it.

Age

This service is for adults 18+ and is not intended for anyone under 18.

Contact

For any privacy request, use the /feedback command in the bot.

Last updated: 20 June 2026.