Nevada Consumer Health Data Privacy Policy

Effective October 30, 2026.

This policy describes how Sonder Digital LLC (“we”) handles consumer health data, as Nevada law (NRS 603A.400 to 603A.550) defines it, collected through the Grain app and grainios.com.

1. The consumer health data we collect, why, and how we use it

• Health details you add to your profile: allergies and how severe they are; health conditions, including pregnancy or feeding an infant; ingredients you avoid in food and in beauty products; skin concerns; supplement goals; period and intimate-care preferences; a gluten-free or dairy-free eating style; a weight-loss goal; and a Gluten-Free or Crossed Grain certification preference. We use them only to check products for you: allergy and condition warnings, your personal score, fit checks, and leaving products that conflict with them out of suggestions. We do this on our own servers and in the app, and we do not send these details to our AI provider.
• What we work out from them: your personal score and fit results for the products you look at. We use them only to show them to you.
• Health details you choose to type into an Ask Grain question, a product search, a product correction you send with Submit Feedback or an email to us. We use them only to answer that question, search or email, or to check that correction. Our AI provider (Google) processes questions and searches for us to produce the answer, our email delivery provider (Resend) carries product corrections to our inbox, and our email provider (Google Workspace) holds the emails you send us and those corrections.
• Health details you record for people you shop for are stored with your account on our servers, and we use them only to check products for them in your account.

2. Where it comes from

From you, when you enter it, type it or send it to us, and from our own calculations (your personal score and fit results).

3. How we process it

We store it in the United States with our hosting provider and use it on our own servers and in the app. Questions and searches you type are processed for us by our AI provider (Google); when a search is answered with the help of Google Search, Google, as our processor, keeps it for up to 30 days to produce the answer and to debug and test that search system.

4. The consumer health data we share, and with whom

We share consumer health data only with service providers that process it for us under contract:

• our hosting provider (Supabase, which runs on Amazon Web Services in the United States and uses Cloudflare’s network to carry the app’s traffic) stores all of it;
• our AI provider (Google) receives the health details you type into an Ask Grain question or a search;
• our email delivery provider (Resend) carries the product corrections you send with Submit Feedback to our inbox;
• our email provider (Google Workspace) holds the emails you send us and those corrections.

We do not share consumer health data with any third party or affiliate.

5. Your rights and how to use them

• Confirm and access: ask whether we collect consumer health data about you and get a copy of it, with a list of every third party and affiliate we have shared it with and how to contact them.
• Review and correct: change your health details at any time on the Profile tab, or ask us.
• Withdraw consent: email contact@grainios.com with “Withdraw consent” in the subject. We stop collecting and sharing your health details and delete them within 15 days.
• Delete: delete any health detail in the app, delete your account (Profile tab, tap your name, Account Settings, Delete Account), or email us. We delete it within 30 days of confirming your request and tell our service providers to delete it.
• How to ask: email contact@grainios.com, preferably from the address on your Grain account, or use the app where shown. We may ask you to confirm that the request is yours. We answer within 45 days. If we need longer, we tell you why within those 45 days and answer within 45 more.
• Appeal: if we decline to act on your request, reply to our decision or email contact@grainios.com with “Appeal” in the subject. We answer in writing within 45 days and explain why. If we deny your appeal, you can complain to the Nevada Attorney General at ag.nv.gov/Complaints/CSU_Complaints___FAQ/.

6. Changes to this policy

When we change this policy we update the effective date above. Before a material change takes effect we email account holders, and we ask for your consent before we collect or share new categories of consumer health data or use it for new purposes.

7. Tracking across services

No third party collects consumer health data about you over time and across different websites or online services when you use Grain.

Contact: Sonder Digital LLC, contact@grainios.com.