Privacy Policy

1. Who we are

DishCal is operated by MediPaid Technologies Inc. (“MediPaid”, “we”, “us”), a company incorporated in the Republic of the Philippines. This policy covers dishcal.com and the DishCal application only. MediPaid’s other products — including MediPaid claims services, HFIC and PlatoIQ — are governed by a separate policy at privacy.medipaid.tech.

2. HIPAA does not apply to DishCal

We want to be direct about this, because health apps are often assumed to be HIPAA-covered. DishCal is not a HIPAA covered entity or business associate. HIPAA governs healthcare providers, health plans and clearinghouses. DishCal is a consumer application you buy directly, so HIPAA does not apply to it, and we make no claim that it does.

Other law does apply. In the United States we are subject to the FTC Health Breach Notification Rule, which requires us to notify you, the Federal Trade Commission and in some cases the media if your identifiable health information is disclosed without your authorisation. We are also subject to Section 5 of the FTC Act, which makes any misdescription of our data practices unlawful. That is why this policy describes what our system actually does rather than what would sound most reassuring.

3. Information we collect

We collect only what the features you use require.

3.1 Account information

• Email address and password. Authentication is handled by Supabase Auth. Passwords are stored only as salted hashes; we never see or store your plaintext password.

3.2 Health information you provide

This is sensitive personal information, and in several jurisdictions it is a special category of data. Please read this section carefully.

• Health conditions you select — which may include diabetes, hypertension, kidney disease, liver disease, cancer or malignancy, thyroid disorders, cardiovascular disease and lung disease.
• Medications, dosages and schedules, and your record of doses taken or missed.
• Allergies and dietary restrictions, including religious observance such as halal. Religious observance is itself sensitive information, separately from your health data.
• Physical characteristics — age, sex, height, weight and activity level.
• Meal records — photographs of meals, written or spoken descriptions, scanned barcodes, and the nutritional values derived from them.
• Derived values — calculated calorie and nutrient targets and the clinical summaries you generate.

This information is identified, not anonymous. It is linked to your account. We process it to provide the features you asked for and for no other purpose. We never use it for advertising and we never sell it.

3.3 Billing information

• We store your subscription status, plan, currency and PayPal subscription identifier.
• We never receive or store your card number or PayPal credentials. Those are entered directly with PayPal.

3.4 What we deliberately do not collect

• No analytics, advertising or session-recording software runs anywhere in DishCal. There is no Google Analytics, no advertising pixel, no heatmap or session replay tool. This is verifiable in our application code.
• We do not collect precise geolocation.
• We do not access your photo library beyond the single image you choose to submit.
• Voice input is transcribed on your own device by your browser. We receive the resulting text only, never an audio recording.

4. Artificial intelligence

DishCal uses an AI system. When you log a meal by photo, description or barcode, the meal image or text is sent to Anthropic PBC to estimate its nutritional content and to generate a short piece of advice.

• What is sent: the image or text you submit, together with the health conditions and dietary restrictions on your profile, so the result is relevant to you.
• What is not sent: your name, email address or account identifiers.
• Estimates are estimates. The nutritional figures are model-generated approximations, not measurements. DishCal shows you its confidence and lets you edit every value before saving.

5. Where your data is stored

Please read this section if data location matters to you. Our infrastructure is not all in one country.

Your health records are stored in South Korea. When you scan a barcode, the barcode number — and nothing else about you — is sent to Open Food Facts. When any page loads, Google receives your IP address in order to serve the fonts.

6. How we use your information

• To calculate your daily calorie and nutrient targets from the conditions you selected.
• To estimate the nutritional content of meals you log.
• To show meal recommendations filtered for your conditions, dietary restrictions and allergies.
• To operate medication reminders and dose tracking.
• To generate clinical summaries at your request.
• To manage your trial, subscription and billing.
• To secure the service and investigate abuse.

We do not use your health information to train AI models, for advertising, or for any purpose you did not ask for.

7. Sharing

We do not sell, rent or trade your personal information. We share it only with the service providers listed in section 5, only to the extent needed to run the feature you are using. We may also disclose information where legally compelled, and we will tell you unless we are prohibited from doing so.

Clinical summaries are shared only by you. DishCal lets you print or send a summary to your doctor. We do not transmit it on your behalf and we keep no record of who you sent it to.

8. Your rights

Depending on where you live you may have rights to access, correct, delete, port or restrict the use of your information, and to withdraw consent. We honour these requests regardless of where you live.

How to exercise them today: email dpo@medipaid.tech from your account address. We will respond within 30 days. You can also delete individual meals, medications and profile details directly in the app at any time.

Being straight with you about a limitation: DishCal does not yet have one-click self-service buttons for full data export and account deletion. Those requests are handled manually by email today. We are building the automated versions. We mention this because a policy that implied otherwise would be inaccurate.

9. Security

• All traffic is encrypted in transit (TLS).
• Row Level Security is enforced at the database level on every table holding user data, so one account cannot read another account’s records even if the application layer were bypassed.
• Billing status cannot be modified by any client — only by our servers.
• Credentials are held in managed environment configuration, never in source code or client-side code.
• No security is absolute. If your identifiable health information is disclosed without authorisation, we will notify you as the FTC Health Breach Notification Rule requires.

10. Retention

We keep your account data for as long as your account exists. Meal photographs are not stored — they are sent for estimation and discarded; only the resulting nutritional values and dish name are saved. On deletion of your account we remove your profile, meals, medications and dose records. Billing records are retained where tax and accounting law requires.

11. Children

DishCal is for adults. You must be 18 or older to hold an account. An adult may create profiles for a child or dependant in their legal care, and is responsible for consenting on that person’s behalf. We do not knowingly allow under-18s to register directly. If you believe a minor has registered, contact dpo@medipaid.tech and we will delete the account.

12. Changes

We will post any change here and update the date above. Where a change materially affects your rights or expands how we use your data, we will give notice before it takes effect and, where the law requires it, ask for your consent again.

13. Contact

Data protection: dpo@medipaid.tech
General support: support@medipaid.tech
MediPaid Technologies Inc., 117 E. Rodriguez Jr. Ave., C5, Pasig City, Philippines

14. Medical disclaimer

DishCal provides health-management information and does not replace professional medical advice, diagnosis, or treatment. Calorie and nutrient targets are estimates produced by a standard formula (Mifflin-St Jeor) adjusted for the conditions you select; they are not a clinical prescription. Medication reminders are a convenience, not a clinical safety system, and will not alert you when the application is closed. Always consult your physician or a registered dietitian before making decisions about your diet or medication.