Consumer Health Data Privacy Policy
Effective date: October 18, 2026
BellyMD, Inc. ("BellyMD," "we," "us") makes the MGB+ supplements sold at belly-md.com, runs the MeNome assessment at menome.belly-md.com, and publishes the MeNome app. Much of what you tell us is about your body. This policy explains how we handle that information.
It is written to meet the Washington My Health My Data Act and Nevada's consumer health data law, which require a separate policy for "consumer health data." Connecticut treats the same information as sensitive data. We apply this policy to everyone who uses BellyMD, wherever you live.
This document adds to our Privacy Policy and the MeNome Privacy Policy. Both still apply. Where they differ from this policy on consumer health data, this policy controls.
What "consumer health data" means here
Personal information that is linked, or reasonably linkable, to you and that says something about your past, present, or future physical or mental health. At BellyMD that includes symptom answers, conditions and medications you report, measurements from a BioScan, and anything we infer from them, such as a pattern archetype, a BellyScore, or a formula recommendation. It also includes a purchase of a product made for a named symptom.
1. What we collect, where, and why
On belly-md.com
- Pattern quiz answers and your result. Used to show you a result on the page and, if you give us your email, to send it to you and suggest a formula.
- Founder Pick intake. Symptoms, triggers, screening answers, allergies and sensitivities, and notes you add. Used to choose the formula in your order. These answers are attached to the order as order notes so the people packing it can see what was chosen and why.
- Orders. Which MGB+ formulas you bought and when. Our products are made for gut-brain symptoms, so we treat order history as consumer health data.
- Consultations. Anything you tell us when you book or attend a consultation with Dr. Pescatore, and the written summary we prepare for you.
- Sign-ups and messages. Which health article you signed up from, reviews you write, and what you say to our support team.
In the MeNome assessment (menome.belly-md.com)
- Your answers: main symptom, triggers, how long it has been going on, age band, sex, cycle information if you choose it, context such as conditions, medications and earlier events, your goals, and any free text. Plus the archetype and score we compute from them.
- Used to prepare your results and, if you continue into the app, to start your MeNome account.
- Your answers stay in your own browser until you submit them with your email, after ticking a separate health-data consent box.
In the MeNome app
- Daily check-ins: symptom and lifestyle ratings, foods, hydration, sleep, and your trigger library.
- Health history you enter: diagnoses, surgeries, medications and supplements with doses and schedules, treatments tried, family history, lifestyle, and your "My Story" text.
- Questionnaires: Rome criteria, Bristol Stool Scale, and IBS-SSS answers and totals.
- Cycle tracking, if you turn it on.
- Events and appointments you log, including a clinician's specialty and the place, the questions you wrote, and the changes you hoped for.
- Document records: a document's name, category, and date. The file itself stays on your phone and is never uploaded.
- BioScan results: heart rate, heart-rate variability, a voice-stress score, a mood estimate, and signal quality. Raw video and audio are processed on your phone and never leave it.
- Text from a BioScan voice check-in or voice food log. The audio is not uploaded.
- Apple Health data you authorize, calendar event titles if you enable Life Pattern Sync, and traits you confirm for the Links feature.
- Your conversations with Cora, and the BellyScore, patterns, and summaries we compute.
- Used to run the app: your record, your score, pattern detection, Cora, weekly summaries, and the exports you request.
2. Where it comes from
- You. Quizzes, forms, check-ins, bookings, messages, and reviews.
- Your device, with your permission. The camera and microphone during a BioScan you start, Apple Health, and calendar titles.
- Our own systems. Inferences we draw, such as an archetype, a BellyScore, or a formula recommendation, and your order records.
- Service providers acting for us. For example, a payment confirmation or a delivered-email event.
We do not buy consumer health data from data brokers or anyone else.
3. How we use it
- To provide what you asked for: your result, a formula recommendation, your order, a consultation, or the app.
- To communicate about those things: results emails, order and account notices, and weekly summaries if you enable them.
- For marketing only as far as you have opted in. Our product emails are based on your being a customer or user, or on a quiz result you asked us to email. We do not use your MeNome health records to decide what to market to you. If we ever want to, we will ask you separately first.
- To improve our products using de-identified or aggregated data that no longer identifies you.
- For research only with a separate, specific consent that names the study.
- For safety, security, fraud prevention, and legal obligations.
We do not collect or use consumer health data for any purpose not listed here without first telling you and getting your consent.
4. How we ask for consent
- Pattern quiz. We collect only what is needed to show you the result you asked for, and to email it if you give us your address.
- Founder Pick. You choose whether to fill in the intake. What you enter goes on your order.
- MeNome assessment. A separate, unticked checkbox, on its own and not part of the Terms, before your answers are submitted. It tells you what we collect, why, and how to withdraw.
- MeNome app. A separate health-data consent when you first set up the app. Separate, optional consents for location (pollen), AI analysis of food photos, confirmed traits, research, and any sharing. We record which version of the wording you saw.
You can withdraw any consent at any time (Section 7). Withdrawing stops future collection and use. It does not undo something you already asked us to do, such as an order, and we will delete your data on request.
5. Who receives it
We do not sell consumer health data, and we will not without the signed authorization the law requires. We do not share it with anyone for their own purposes. We do not use geofences near health care facilities.
Service providers that work for us
These companies process data only on our instructions, under contracts that stop them from using it for themselves.
| What they do | Who | What they receive |
|---|---|---|
| Cloud hosting and system email | Amazon Web Services; Google Cloud (our store's attribution tracker at tracker.belly-md.com) | Assessment, account, and app records; order and account notices; store checkout and purchase events with your contact and order details |
| Generative AI behind Cora | Anthropic's Claude models, run through Amazon Bedrock on AWS or by Anthropic PBC | What you type to Cora and relevant context from your records, with your name, email, and birth date removed |
| Store platform | Shopify | Orders, customer accounts, and intake notes attached to orders |
| Email, and text messages if you opt in | Klaviyo | Store: email address, orders, quiz answers and result, sign-up events. App: email address and sign-up, purchase, and first-open events. Never your app health records. |
| Subscriptions and billing | Recharge (store), RevenueCat and Stripe (MeNome), Apple (in-app purchases) | Purchase and subscription status. Card numbers go to the payment processor, not to us. |
| Fulfillment and shipping | Our fulfillment partners | Name, address, what to ship, and any order notes from Founder Pick |
| Crash and error monitoring | Sentry | Scrubbed diagnostics |
| Push notifications | Expo | A device token and the text of each notification, which can mention your symptoms or patterns |
| Bot protection on the assessment | Cloudflare Turnstile | IP address and a challenge token, never your answers |
| Store analytics | Triple Whale, Google Analytics | Orders and site usage |
| Reviews | Judge.me | What you write in a review, which is public |
| Support email | Google Workspace | Messages you send us |
Advertising and measurement partners
On belly-md.com, measurement pixels from Meta, Google, TikTok, OpenAI, and Trybe (creator attribution) receive standard shopping events: pages viewed, items added to cart, and purchases, including the product. When you start or complete the pattern quiz, Meta also receives an event that names the quiz and the formula we recommended, but not your individual answers. Because our products are made for gut-brain symptoms, these events can suggest something about your health. These partners do not receive your quiz answers, Founder Pick intake, consultation information, or anything from the MeNome assessment or app.
You can turn this off at Your privacy choices, and we honor the Global Privacy Control signal. The MeNome assessment and app contain no advertising pixels or tracking SDKs; the pixel code in the assessment is switched off.
Affiliates and other disclosures
BellyMD has no affiliates that receive consumer health data. We may disclose information when the law requires it, to protect someone's safety, or as part of a merger or sale of the company, in which case this policy still applies and we will tell you.
If we ever want to share your consumer health data with a third party for its own use, we will ask for a separate consent first, which you can withdraw.
6. How long we keep it, and how we protect it
- Store. Order records for as long as your account, our guarantee, accounting, and the law require. Quiz answers and intake notes until you ask us to delete them.
- Assessment. Your lead record until it becomes part of a MeNome account, or until you ask us to delete it.
- App. Until you delete the entry or your account. Account deletion takes effect after a 30-day grace period. Raw camera and audio data are never stored. Server-side BioScan values are kept only long enough to compute your results.
Access is limited to the people and providers who need it to serve you. Data is encrypted in transit and at rest.
7. Your rights, and how to use them
You can:
- Confirm whether we collect, share, or sell your consumer health data, and get a copy of it, including a list of everyone we have shared it with and how to contact them.
- Withdraw consent to collection or sharing.
- Have it deleted, including from backups and from our service providers.
- Opt out of advertising pixels at Your privacy choices.
How. Email privacy@belly-md.com with the subject "Health data request," or write to the address below. In the MeNome app you can export your data, delete entries or your account, and switch off camera, microphone, Apple Health, calendar, and notification access in your device settings. We may ask you to confirm your identity before we act.
When. We respond within 45 days. If we need longer, we will tell you why and take up to 45 more. Deleting from backups can take up to six months. Requests are free, up to twice a year.
Appeals. If we decline a request, reply to our answer with "Appeal" in the subject line. We will respond in writing within 45 days. If you still disagree, you can complain to the Washington Attorney General at atg.wa.gov/file-complaint, to the Nevada Attorney General at ag.nv.gov, or to your own state's attorney general.
We will never refuse service or charge you more for using these rights.
8. Adults only
BellyMD services are intended for adults 18 and older. We do not knowingly collect consumer health data from anyone under 18. If you believe we have, email us and we will delete it.
9. De-identified data
When we de-identify data, we remove what could identify you, we commit publicly to keeping it that way and never trying to re-identify anyone, and we require anyone we give it to in that form to do the same.
10. Changes
If we change this policy, we will post the new version here with a new effective date. If a change affects your consumer health data in a material way, we will also tell you by email or in the app before it takes effect.
11. Contact
BellyMD, Inc.
94 North Kirschling Drive, Swedesboro, NJ 08085, United States
privacy@belly-md.com