Legal
Consumer Health Data Privacy Policy
Effective date: July 2026
Ingrid helps with supplement ingredients, and to do that safely she sometimes needs health context, like the medications you take. This page explains what happens to that information: what is collected, why, for how long, and what is never done with it.
What this policy covers
This page describes how Ingredlabs handles health-related information, in plain words. It exists because some of what you tell Ingrid, like a sleep problem or a medication you take, is health information, and you deserve to know exactly what happens to it.
What health information the service handles
Only what you choose to type in the conversation: the health goal or concern you describe, conditions or physical states you mention, medications and supplements you already take, and your age range and gender if you share them. There is no account, and we never ask for your name, email, or contact details.
Where it comes from
One source only: the conversation you have with Ingrid. We do not buy health data, we do not pull it from other companies, and we do not infer it from your browsing.
Why it is collected
To do what you asked: medications and conditions are used to check that suggested ingredients are safe alongside them, and your goal shapes which ingredients Ingrid suggests. A short-lived working record of the exchange also supports quality and safety checks while the service is young.
How long it is kept
The working record of a conversation deletes itself automatically within 90 days. Safety events are kept as categories only, never your words, for 30 days. What remains after that is a de-identified summary under a random one-time number, with no connection to your browser, device, or the conversation record, and we commit to keeping it de-identified and never attempting to re-identify anyone.
What is never done with it
Your health information is never sold, and it never will be. It is not shared with third parties for their own use, not used for advertising, and not given to the retailers behind product links: clicking a retail link sends them nothing of what you told Ingrid.
Who can see it
Our own infrastructure providers process data on our behalf to run the service, under their standard confidentiality obligations. No one else. There are no advertising partners and no data buyers.
Your rights
Washington's My Health My Data Act gives you the right to ask whether health data about you is collected, to withdraw consent, and to request deletion. Write to ingrid@ingredlabs.ai and you will get an answer within 45 days. One honest limitation: because there are no accounts, we usually cannot tell which records are yours, and the law asks us to act only on requests we can verify. Whatever happens with a request, the working record of a conversation deletes itself within 90 days, and long-term data is de-identified so it cannot be matched to anyone, including you.
Questions and requests
If you have any other question about health information and this service, write to ingrid@ingredlabs.ai and a human will answer.