CONSUMER HEALTH DATA
Consumer Health Data Privacy Policy
Mero is a meal-planning service, so most of what you tell us is about your body, your training, and what you can safely eat. This policy is specifically about that information: what we collect, why, who processes it, and what you can ask us to do with it.
Effective date: September 7, 2026 · Last updated: September 7, 2026
Who this policy covers
This policy is published by Matt’s Macros Limited, which operates Mero. It applies to the Mero website at getmero.co and to the Mero mobile app on iPhone and Android. It supplements our Privacy Policy, which covers all personal information we handle; where the two describe the same practice, they are meant to say the same thing.
Some states, including Washington and Nevada, give people specific rights over health-related information held by companies that are not health-care providers. We have written this policy so those rights are easy to find and use. The request methods below are available to all Mero users. The legal rights that apply may depend on where you live.
Mero is not a health-care provider, a health plan, or a health-care clearinghouse, and it is not a business associate of one. We are not a covered entity under HIPAA, and the information described here is not medical record information. It is self-reported information you give us so we can plan your meals.
What we mean by consumer health data
In this policy, “consumer health data” means the information you give Mero about your body, your goals, your allergies, and your training, together with the health-related outputs Mero calculates from it, such as your macro targets and the plans built to hit them. We treat all of it as sensitive.
Categories, sources, and purposes
Everything in this table comes either directly from you or from Mero’s own calculations on what you gave us. Mero does not buy health data, does not obtain it from data brokers, and does not read it from other apps. The current release does not connect to Apple Health, and it does not import HealthKit data.
| Category | Examples | Source | Why we collect it |
|---|---|---|---|
| Body basics | Exact date of birth, sex selection, height | You, during onboarding | Calculating your energy needs, and confirming you are 18 or over |
| Weight | Starting weight, target weight, weight check-ins you enter over time | You, during onboarding and in Me | Calculating targets and letting you see and calibrate against your own trend |
| Goals | Goal direction and the rate you want to move at | You, during onboarding and in Me | Setting the calorie position your plan aims for |
| Allergies and dietary restrictions | The allergens you need excluded, and diet restrictions you select | You, during onboarding and in Me | Filtering recipes based on the allergies and restrictions you select |
| Recurring training schedule | Your usual weekly session days, times, and intensities, and your activity level | You, during onboarding and in Me | Generating the weeks Mero builds next, and setting the hard, easy, and rest day targets in them |
| Overrides to an accepted week | A session you move to another day, retime, change in intensity, skip, or mark as rest after a week has been accepted | You, in Today or Me | Changing what that week shows: the session day, time, intensity, skipped or rest state, and flexible-fuel presentation. It does not recalculate that accepted week’s meals, macro targets, prep, or grocery quantities |
| Meal preferences | Which meals you want covered, and your prep style | You, during onboarding and in Me | Shaping a week you will actually cook and eat |
| Derived health outputs | Macro and calorie targets, day types, weekly plans, shopping quantities, prep schedules | Mero’s calculations on the inputs above | These are the service. They are what Mero exists to produce |
| Weekly activity | Meals checked off or skipped, shopping and prep progress | You, as you use the week | Letting you resume where you left off and see the week’s progress |
| What you write to us | Support messages and optional product feedback, when you choose to describe a health matter in them | You, when you contact us or send feedback | Answering you, and improving Mero |
| Website calculator inputs | Weight, height, age, sex, activity level, and goal typed into the free calculator at getmero.co | You, on the website | Returning the macro estimate you asked for. These values are calculated and returned; Mero does not store them and does not attach them to your email or to any Mero account. |
Mero also stores operational settings such as your measurement units and your timezone. These control how the app displays and schedules things. They are not consumer health data, and they are not treated as health information in this policy.
If we ever want to collect a new category of consumer health data, use it for a new purpose, or share it with a new kind of recipient, we will update this policy and describe the change before it takes effect, and we will ask for your consent first where the law requires it.
How Mero processes it
Mero’s processing is deterministic and rule-based. Your date of birth, sex selection, height, weight, goal, and activity level go into a published formula that produces a calorie and macro target. Your recurring training schedule sorts a newly generated week into hard, easy, and rest days and decides how carbohydrate and calories are distributed across them. Once you accept a week, changing a session in it updates what that week shows for the session day, time, intensity, skipped or rest state, and flexible-fuel presentation. It does not recalculate that week’s meals, macro targets, prep, or grocery quantities. Your allergies and restrictions remove recipes from the pool that remains. A solver then assembles days that meet your targets from what is left, and the accepted week produces your shopping quantities and prep schedule.
The app does not run on artificial intelligence, and this is not profiling in the sense of predicting things about you. The same inputs produce the same plan. You can see the method we use on our methodology page.
We do not send production personal data to general-purpose AI tools. Development and support work may use synthetic fixtures, de-identified examples, or aggregate findings that cannot reasonably identify a person.
Consumer health data is encrypted at rest in Mero’s database and encrypted in transit. On your iPhone, credentials are held in the iOS Keychain with this-device-only accessibility.
Who receives it
Mero shares consumer health data only with the service providers listed above, and only so they can run the service for us. We do not sell it, and we do not disclose it to anyone who would use it to build their own products, profiles, or advertising. Each provider is engaged under its own written terms; we are reviewing those terms against the specific processor obligations that Washington and Nevada require, and we will state the outcome here.
| Provider | Role | Consumer health data it receives |
|---|---|---|
| Laravel Cloud | Application hosting and database for the Mero app | All stored categories above, held as encrypted application data |
| Cloudflare | Website hosting, content delivery, and security, including the calculator endpoint | Calculator inputs pass through Cloudflare while the estimate is calculated. They are not stored by Mero. Cloudflare may hold ordinary operational records as part of running the network. |
| Resend | Delivery of private feedback and support notification emails | Only what you write in a support message or feedback comment. Feedback notifications never contain your weight, calories, allergies, meals, grocery list, prep activity, training details, or plan contents, and your email is included only when you have explicitly allowed follow-up. |
| Apple | App distribution, Sign in with Apple, App Store purchase processing | None. Apple handles sign-in and billing, not your body, allergy, training, meal, or plan data. |
| Sign in with Google, and Google Play distribution and purchase processing on Android | None. Google handles sign-in and billing, not your body, allergy, training, meal, or plan data. | |
| RevenueCat | Subscription and entitlement management | None. RevenueCat receives your Mero account identifier and purchase history only. |
| Expo | App updates and failed-update diagnostics | None. |
| Google Analytics | Website analytics | None. The calculator reports that a calculation finished; it does not send your inputs or your results. |
| Klaviyo | Waitlist and email | None. Klaviyo receives your email address, a name if you gave one, and how you found us, including whether you signed up from the calculator page. It does not receive the values you entered. |
We may also disclose consumer health data when required by law, legal process, or a valid government request; to protect the rights, safety, and security of Mero, our users, or others; or in connection with a merger, acquisition, financing, or sale of assets, in which case it stays subject to this policy. If you ask us for the list of recipients, we will give it to you; because Mero’s providers are fixed rather than chosen per person, the list above is the same for every member.
What we do not do
- We do not sell your consumer health data. Not for money, and not for anything else of value. Because we do not sell it, there is nothing for you to authorize and no authorization we will ask you to sign.
- We do not use consumer health data for advertising. It is never sent to an advertising company, and it is never used to build advertising audiences or profiles. Mero does advertise the product itself: a few marketing pages carry an advertising pixel that records page views and waitlist signups so we can measure our ads and show follow-up ads to people who visited. That pixel runs only on the marketing pages that carry the waitlist form, never in the app and never on the free macro calculator, and it receives none of the data described in this policy. The Privacy Policy explains it and how to opt out.
- We do not track you across apps or sites with this data. The mobile app contains no advertising SDK and no general behavioral-analytics SDK, and no third party collects consumer health data through Mero over time or across other websites and services. The advertising pixel on our marketing pages is the one place a third party sees your activity, and what it sees is that one of those pages was viewed or a waitlist signup succeeded, never your body, training, allergy, meal, or plan data.
- We do not use geofencing. Mero does not collect precise or coarse location at all, and it does not operate or use geofencing around a health-care facility to identify you, collect data about you, or send you messages.
- We do not collect it from anywhere but you. No data brokers, no other apps, no HealthKit.
Your rights
You can ask us to:
- Confirm and access. Tell you whether we are collecting, sharing, or selling your consumer health data, and give you access to it.
- List recipients. Give you the list of third parties and affiliates we have shared your consumer health data with, and a way to contact them.
- Correct it. Fix inaccurate information. Most of it you can change yourself at any time under Me in the app, which is usually faster than asking us.
- Withdraw consent and stop collection. Ask us to stop collecting or sharing your consumer health data. Because this information is what Mero uses to build your plan, withdrawing consent generally means closing your account; we will tell you plainly if that is the case rather than quietly degrading the service.
- Delete it. Have your consumer health data deleted. You can start this yourself under Me in the app, or write to us. Our data deletion page explains exactly what deletion covers and what minimal, de-identified record we keep afterwards.
We will not discriminate against you for exercising any of these rights. Using them will not get you a worse plan, a worse price, or worse support.
One thing to know about deletion: deleting your Mero account does not cancel an Apple subscription. You need to cancel that separately in your Apple subscription settings.
How to make a request
Email [email protected] and tell us what you want us to do. For deletion you can also use the in-app request under Me. We will acknowledge your request, act on it as quickly as we can, and in every case within the time applicable law allows; if we need more time we will tell you why before that period runs out.
Verifying who you are. Before we act on a request about a specific person’s data, we need to be reasonably sure you are that person, so we do not hand your information to someone else. Usually that means writing from the email address on the account, or making the request from inside the app where you are already signed in. If we cannot verify you, we will say so and explain what would let us proceed.
Authorized agents. Where the law allows it, you can have someone make a request for you. We will ask for proof that you authorized them, and we may still ask you to confirm it directly.
If we say no. If we cannot do what you asked, we will tell you which part we declined and why. For example, we may not be able to verify identity, or a narrow legal obligation requires us to keep something. We will do the parts we can rather than refusing the whole request.
Appeals
If we refuse a request, you can appeal by replying to our decision or writing to [email protected] with “Appeal” in the subject line. A person will review the decision again, and we will write back with the outcome and our reasoning within the time applicable law allows.
If we deny your appeal, you can complain to your state attorney general. If you live in Washington, the Washington State Office of the Attorney General accepts complaints at atg.wa.gov/file-complaint. If you live in Nevada, the Nevada Office of the Attorney General accepts complaints at ag.nv.gov. We will include this information with any denial.
Changes to this policy
If we change this policy, we will update the effective date above and post the new version here. If the change adds a category of consumer health data, a new purpose, or a new kind of recipient, we will describe it before it takes effect and, where the law requires consent, ask for yours first. We will not apply a new purpose to data we already hold without telling you.
Contact
Matt’s Macros Limited, Las Vegas, Nevada, United States.
For anything in this policy, including rights requests and appeals, contact [email protected]. For general help with the app, contact [email protected].