Special-Category Health Data Consent
1. What data do we need and why?
The allergies and allergens you select are special-category personal data about the child’s health. Cute Meals uses this information only if you choose health-data personalisation; you can continue using the basic account without providing allergy information.
Allergy information is requested to provide the following functions, not to make a diagnosis:
- Compare recipe ingredients with declared allergies and remove matching recipes or mark them with a visible warning.
- Use intolerance and excluded-ingredient criteria derived from allergies when searching external recipe services.
- Adjust meal suggestions, recipe ranking and ingredient alternatives to the child’s restrictions.
- Only when you use a profile-aware AI feature, provide the context needed to avoid responses that conflict with known allergies.
2. Data and records processed
The following data may be processed under your consent:
- The selected allergy/allergen names and codes, and intolerance or exclusion terms derived from them.
- When profile-aware AI is used, the context needed for the response from the profile name, age, allergies, conditions, diet, disliked foods and calculated nutrition needs.
- The guardian declaration, notice version, consent time, platform and app version used to evidence and manage consent.
3. Who may receive it, and when?
Allergy information is not made public or sold for advertising. It may be shared with the following processors or providers only when the relevant feature is used and only to the extent needed to provide it:
- Google Cloud and Supabase infrastructure: hosting, database storage and server-side processing of the allergy record in the child profile.
- Google Gemini: when you use the Cutey AI assistant, limited child-profile context that may include allergy information, your message and relevant conversation history; when you use photo analysis, the image you select.
- OpenAI: in features that generate or explain AI recipes or nutrition content, the request text and necessary allergy constraints.
- Spoonacular: when you search external recipes, intolerance and excluded-ingredient terms derived from selected allergies. The child’s name and full profile are not part of those search criteria.
4. International-transfer and disclosure risks
Google, OpenAI, Spoonacular and some infrastructure providers may be located outside Türkiye or process data on systems abroad. Allergy information that constitutes health data, or a restriction derived from it, may therefore be transferred internationally.
Sharing is not risk-free even where strong safeguards are used. The main risks are listed below. Cute Meals applies data minimisation, encrypted transmission, access restrictions and provider controls, but no system can guarantee absolute security. This health-data processing consent is not, by itself, the mechanism for recurring international transfers; an applicable KVKK Article 9 adequacy or appropriate-safeguard mechanism must be established and documented separately.
- Unauthorised access or disclosure resulting from a security incident, incorrect access control or network attack.
- Even when direct identifiers are minimised, messages, profile context, IP address or technical records being combined and linked to the child or account.
- Data becoming subject to another country’s laws, government-access rules and provider retention or backup processes, including delayed deletion from backups.
- AI or external-recipe data being incomplete, outdated or wrong and missing a hidden ingredient, cross-contact risk or allergen.
5. Safety boundary: not an allergen-free guarantee
Cute Meals can filter only from the current information you provide, recorded recipe ingredients and available system rules. It cannot verify manufacturing cross-contact, undeclared ingredients or errors in recipe data. Showing a recipe does not mean it is safe for the child. Always check product labels and ingredients, and consult a healthcare professional about known or suspected allergies.
6. Choice, consequences and withdrawal
Consent must be freely given, specific and informed. If you refuse, basic account access continues, but allergy data cannot be stored and allergy-based filtering, personalisation or profile-aware AI may be unavailable.
You can withdraw consent prospectively at any time using “Withdraw consent” in the app. This erases allergies, conditions, growth measurements and derived personalisation records from the child profile. Requests already processed by external providers and limited records that must be retained by law may remain subject to the applicable retention and backup periods.
7. Parent/guardian statement
The consenting person confirms they are at least 18, authorised to act for the child and that the information entered is accurate. Reading this page or accepting general terms is not consent; valid consent is recorded only when the separate checkbox in the app is freely and actively selected.