Privacy Policy

Introduction

This comprehensive Privacy Policy (the “Policy”) describes the privacy, data-governance, and information-security practices of Medstrategic LLC, doing business as DinnerMVP (“DinnerMVP,” “we,” “us,” or “our”), in connection with dinnermvp.com and every account, meal-planning interface, recipe, grocery-list function, retailer handoff, subscription, communication, promotion, and related service that expressly incorporates or links to this Policy (collectively, the “Service”). This Policy is intended to provide a reasonably accessible, comprehensive, and legally operative description of the categories of personal information we collect; the sources from which information is obtained; the business and commercial purposes for which it is processed; the categories of recipients to which it may be disclosed; the periods or criteria governing retention; and the rights, choices, and remedies available to consumers under applicable law.

This Policy applies to United States consumers and shall be construed together with the DinnerMVP Terms of Service, the Consumer Health Data Privacy Notice, and any just-in-time notice presented at or before a particular collection. Where federal, state, territorial, tribal, or local law affords a consumer a non-waivable protection that exceeds this Policy, the controlling law governs. No provision is intended to waive, restrict, or condition a right or remedy that applicable law makes non-waivable.

DinnerMVP is a meal-planning service, not a health care provider, insurer, pharmacy, benefits administrator, or HIPAA covered entity. Information about allergies, health-related dietary restrictions, or similar needs may nevertheless receive protection under state consumer health-data laws.

1 Who controls your information

Medstrategic LLC, doing business as DinnerMVP, determines the purposes and means of processing personal information described in this Policy, unless a notice states otherwise.

Privacy contact and requests: support@dinnermvp.com

Website: https://dinnermvp.com

2 Scope and definitions

“Personal information” or “personal data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or can reasonably be linked to an individual or household. It does not include information lawfully treated as deidentified, aggregated, or publicly available under applicable law. “Processing” includes collecting, using, storing, analyzing, disclosing, deleting, or otherwise handling information.

This Policy does not govern the independent privacy practices of retailers, Instacart, Amazon, payment processors, authentication providers, or other third parties after you interact with them. Their notices govern their processing. DinnerMVP remains responsible for its own disclosures and instructions to its service providers.

3 Personal information we collect

• Category: Account and identity; Examples: Account identifier, email address, display name, authentication status, verification status, account lifecycle status, and membership tier.; Primary source: You and the authentication provider you choose.
• Category: Household and meal-planning information; Examples: Household size, cooking nights, budget, dietary preferences, allergy or restriction text, disliked ingredients, cooking time, ZIP code, selected retailer, pantry or equipment preferences, leftovers, generated plans, recipes, replacements, and shopping lists.; Primary source: You and output created from your requests.
• Category: Consumer health data; Examples: Stated food allergies, intolerances, medically related dietary restrictions, and information you voluntarily provide that may reveal or permit an inference about health status.; Primary source: You. DinnerMVP does not seek diagnoses, medical records, insurance identifiers, or treatment history.
• Category: Subscription and transaction information; Examples: Selected plan, billing interval, subscription status, transaction identifiers, charge status, refund or chargeback status, and limited payment metadata.; Primary source: You and our payment processor. DinnerMVP does not store complete payment-card numbers.
• Category: Community Access information; Examples: Invitation or code, redemption status, associated partner, seat activation, entitlement status, and limited recipient information supplied by an approved partner.; Primary source: You, DinnerMVP, and the sponsoring partner.
• Category: Referral and promotion information; Examples: Referral code or link, referrer and referred-account identifiers, qualifying purchase status, validation period, reward status, fraud indicators, and reversals.; Primary source: You, referred users, payment records, and our systems.
• Category: Usage and analytics; Examples: Planner starts, plans generated, account-gate activity, plan views, retailer selections, meal replacements, shopping-list views, handoff attempts, errors, return visits, approximate timestamps, and consent choice.; Primary source: Your interaction with the Service. Optional product analytics are collected only after the required choice or consent.
• Category: Device security and network information; Examples: Browser or device type, request metadata, approximate location derived from IP, network address processed transiently, one-way security fingerprints, authentication events, rate-limit counters, and generic failure records.; Primary source: Your device, browser, network, authentication provider, and hosting/security services.
• Category: Support and feedback; Examples: Contact details, request category, message, reference number, correspondence, attachments you choose to send, and resolution status.; Primary source: You and our support systems.
• Category: Retailer and affiliate handoff; Examples: Selected retailer, ZIP code, shopping-list items, handoff status, affiliate parameters, and conversion or commission confirmation when made available.; Primary source: You, DinnerMVP, and participating retailers or shopping providers.
• Category: Derived information; Examples: Plan eligibility, usage allowance, fraud or abuse signals, likely preferences derived from saved choices, approximate cost and product-match results, and deidentified operational statistics.; Primary source: Information above and our systems.

4 Information we do not seek or store

DinnerMVP does not request or store complete credit- or debit-card numbers, bank login credentials, retailer passwords, EBT card numbers, Medicare identifiers, health-plan member numbers, benefit-card numbers, government identification documents, precise geolocation, genetic data, biometric identifiers, medical records, or protected health information from a health care provider. Do not submit these items through free-text fields or support messages.

We do not intentionally use raw IP addresses or device identifiers as product-analytics fields. Network information may be processed transiently for delivery, security, rate limiting, and fraud prevention, and infrastructure providers may retain technical logs under their own contractual retention and security controls.

5 How we use personal information

We will not use personal information for a materially different, unrelated purpose without notice and any consent required by law. We do not use allergy or other consumer health data for targeted advertising, data brokerage, eligibility decisions, insurance underwriting, employment, credit, or unrelated profiling.

• Provide, personalize, generate, validate, save, and restore meal plans, recipes, replacements, shopping lists, and retailer-specific handoffs.
• Authenticate accounts, verify email addresses, administer membership entitlements, and maintain account and consent records.
• Apply stated allergies, dietary restrictions, dislikes, household needs, time, retailer, and budget constraints to requested planning services.
• Administer Free, paid, promotional, founder, referral, and Community Access entitlements and prevent duplicate or unauthorized use.
• Process subscriptions, verify payment status, reconcile refunds or chargebacks, and maintain financial and tax records without storing full payment-card details.
• Send transactional messages such as verification, invitation, account, plan, security, billing, cancellation, and service communications.
• Send marketing messages only under a separate consent or other lawful basis, and honor unsubscribe choices.
• Operate support, feedback, accessibility assistance, complaint handling, and account recovery.
• Maintain safety, security, availability, fraud prevention, abuse controls, debugging, backups, and disaster recovery.
• Measure product performance and improve the Service using consented analytics, deidentified statistics, testing, and quality review.
• Comply with law, enforce agreements, establish or defend legal claims, respond to lawful process, and protect users, DinnerMVP, and others.
• Conduct a merger, financing, acquisition, reorganization, bankruptcy, or asset transfer subject to the protections described in this Policy.

6 Automated processing and artificial intelligence

DinnerMVP may use automated systems, including artificial intelligence, to generate or assist with meal plans, recipes, substitutions, product matching, validation, and support operations. Inputs sent to an AI or generation provider are limited to information reasonably needed for the requested function. We do not intentionally send direct account identifiers, payment information, benefit identifiers, or unnecessary support content with meal-generation prompts.

Automated systems may create inferences about food preferences or dietary suitability. DinnerMVP does not use automated processing to make decisions that produce legal or similarly significant effects concerning employment, housing, credit, insurance, education, health care access, or government benefits. Human review or correction is available through support where legally required or reasonably appropriate.

7 Cookies analytics and similar technologies

DinnerMVP may use essential browser storage, cookies, or comparable technologies for sign-in, security, consent choices, selected theme, incomplete planner state, account continuity, and fraud prevention. Essential technologies operate because they are necessary to provide or protect the Service.

Optional first-party product analytics are disabled until you make the required affirmative choice. If accepted, analytics may record the usage events described in Section 3. DinnerMVP does not currently use cross-context behavioral advertising, third-party advertising pixels, or analytics for targeted advertising. Where required, we honor recognized universal opt-out signals, including Global Privacy Control, for processing to which the signal legally applies.

You can adjust available choices through the consent control or browser settings. Blocking essential storage may prevent sign-in or other requested functions. Clearing browser storage may reset your consent choice and incomplete local planner state.

8 When we disclose personal information

Service providers and processors may use personal information only for contracted services, security, legal compliance, or other permitted purposes. DinnerMVP must maintain appropriate written data-processing terms with providers that handle personal or consumer health data.

• Recipient category: Hosting database and security providers; Purpose and information involved: Operate the Service, databases, logs, network delivery, monitoring, backups, abuse prevention, and recovery.
• Recipient category: Authentication providers; Purpose and information involved: Verify identity and return the account identifier, email, display name, and authentication status needed for sign-in.
• Recipient category: Email and communications providers; Purpose and information involved: Deliver verification, invitations, transactional communications, requested support replies, and consented marketing.
• Recipient category: Payment processors; Purpose and information involved: Process consumer subscription payments and return limited transaction, status, refund, dispute, and fraud information.
• Recipient category: AI and generation providers; Purpose and information involved: Process minimized planning inputs to produce or validate requested output under provider restrictions and our instructions.
• Recipient category: Retailers shopping and affiliate providers; Purpose and information involved: Receive shopping-list or product information, selected retailer, ZIP or service area, and attribution parameters when you request a handoff or intentionally follow a link.
• Recipient category: Community Access partners; Purpose and information involved: Receive limited seat, invitation, activation, or aggregate program-administration information under the partner agreement. We do not provide meal-plan details or health-related preferences unless specifically required to deliver a user-requested service and legally permitted.
• Recipient category: Professional advisers and authorities; Purpose and information involved: Receive information where reasonably necessary for legal, accounting, insurance, security, compliance, or a valid legal demand.
• Recipient category: Business transaction recipients; Purpose and information involved: Receive information during diligence or transfer in a merger, financing, acquisition, bankruptcy, or sale, subject to confidentiality and applicable law.
• Recipient category: At your direction; Purpose and information involved: Receive information when you intentionally ask us to share it or interact with a third party through the Service.

9 Sale sharing targeted advertising and financial incentives

DinnerMVP does not currently sell personal information for money, share personal information for cross-context behavioral advertising, or process personal data for targeted advertising as those terms are defined by applicable state privacy laws. DinnerMVP also does not sell consumer health data.

Affiliate links may allow DinnerMVP to receive a commission after a qualifying purchase. The transfer of attribution information at your direction to complete a retailer handoff is not intended as a sale of personal information. Because legal definitions differ, DinnerMVP will provide an opt-out mechanism if any current or future practice is legally classified as a sale, sharing, or targeted advertising.

Referral rewards and promotional entitlements may constitute financial incentives under some laws. Material terms—including eligibility, the reward, qualification period, and reversals—are disclosed with the offer. Participation is voluntary, and the value of the reward is reasonably related to the expected value of new subscription revenue and associated relationship information. You may withdraw from a promotion by contacting support, subject to completed transactions and fraud-prevention records.

10 Retention

We retain information only as reasonably necessary for the purposes described below, to honor your choices, and to meet legal, security, accounting, and dispute-resolution obligations. Actual periods may be shorter. Where different laws apply, the most protective required period controls.

• Information: Account profile preferences plans and shopping lists; General retention approach: While the account is active, then deleted or deidentified after a verified deletion request, subject to narrow legal and security exceptions.
• Information: Allergy and health-related dietary information; General retention approach: While needed to provide requested planning or until removed, account deletion, or a valid consumer-health deletion or withdrawal request, subject to applicable law.
• Information: Subscription transaction and tax records; General retention approach: For the period required for accounting, tax, chargeback, fraud, and legal obligations; complete card numbers remain with the payment processor.
• Information: Support feedback and accessibility records; General retention approach: For case handling, service improvement, and legal documentation, then deleted or deidentified under an approved schedule.
• Information: Security rate-limit and fraud records; General retention approach: For a limited period proportionate to the threat and legal need. One-way promotion-redemption records may be retained to prevent repeated claims.
• Information: Optional analytics; General retention approach: For a limited measurement period, then deleted or aggregated. Account-linked analytics are deleted with the account unless a lawful exception applies.
• Information: Backups; General retention approach: Removed through ordinary backup rotation. State consumer-health laws may require accelerated deletion or isolation; applicable deadlines control.

11 Security

DinnerMVP uses reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information. Measures may include access controls, least-privilege permissions, authentication, encryption in transit, provider security review, environment separation, rate limiting, secure development practices, backups, monitoring, incident response, and restrictions on sensitive fields.

No system is perfectly secure. You are responsible for protecting access to your email and authentication account and for notifying us of suspected unauthorized access. If a breach triggers legal notification duties, we will provide notice as required by applicable law.

12 Your choices and privacy requests

Depending on where you live and whether a law applies to DinnerMVP, you may have rights to confirm processing; access personal information; correct inaccuracies; delete information; obtain a portable copy; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive information; withdraw consent; obtain a list of certain third parties; appeal a denied request; and receive equal service without unlawful discrimination.

Submit a request through available account controls or email support@dinnermvp.com with the subject “Privacy request.” Describe the right you want to exercise and identify the email associated with your account. Do not send passwords, complete payment information, government identifiers, benefit-card numbers, or medical records.

We will acknowledge, authenticate, and respond within the period required by applicable law, generally 45 days or less and sometimes sooner for consumer health data. We may request information reasonably necessary to verify identity and prevent unauthorized disclosure. If we cannot verify a request, we will explain where permitted. Authorized agents must provide proof of authority, and we may verify the request directly with you.

To appeal a denial, email support@dinnermvp.com with the subject “Privacy appeal” within 45 days of the decision and explain why you believe it should be reconsidered. We will respond within the legally required period and provide the appropriate regulator’s contact information where required.

13 Account deletion

Signed-in users may use the account controls to request deletion. A verified deletion request removes the account and eligible preferences, saved plans, shopping lists, generation records, account-linked analytics, support or feedback records where applicable, and plan-interest records, subject to disclosed exceptions. We may retain limited information necessary for security, fraud prevention, completion of a transaction, legal compliance, accounting, dispute resolution, or to maintain a suppression or redemption record that does not permit ordinary account restoration.

Deleting DinnerMVP does not delete accounts or records held independently by ChatGPT, a retailer, Instacart, Amazon, Stripe, an email provider, or another third party. Contact those providers directly. Information already disclosed at your direction is governed by the recipient’s policy, although we will transmit deletion requests to processors when required.

14 Children

The Service is intended for adults and is not directed to children under 13. DinnerMVP does not knowingly collect personal information directly from a child under 13. A parent or guardian may include household size and age-related meal needs without creating an account for the child, but should not enter the child’s name, email, school, medical records, or other unnecessary identifying information.

If we learn that we collected personal information directly from a child under 13 without legally required parental consent, we will delete it. A parent or guardian may contact support@dinnermvp.com. DinnerMVP must not expand the Service to child-directed accounts or knowingly collect children’s data without a separate COPPA-compliant design and notice.

15.1 California

If the California Consumer Privacy Act applies, California residents may request to know the categories and specific pieces of personal information collected; sources; business or commercial purposes; categories of recipients; access; correction; deletion; and portability, and may opt out of sale or sharing and limit certain uses of sensitive personal information. DinnerMVP does not currently sell or share personal information for cross-context behavioral advertising. We do not unlawfully discriminate for exercising privacy rights.

The categories collected during the preceding 12 months correspond to Section 3 and may include identifiers; customer records; commercial information; Internet or electronic activity; approximate geolocation; inferences; and sensitive personal information such as account credentials and health-related dietary information. Categories of disclosure correspond to Section 8. We do not knowingly sell or share personal information of consumers under 16.

15.2 Colorado Connecticut Delaware Iowa Indiana Kentucky Maryland Minnesota Montana Nebraska New Hampshire New Jersey Oregon Rhode Island Tennessee Texas Utah and Virginia

Where an applicable comprehensive state privacy law covers DinnerMVP, residents receive the rights and notices required by that law, which may include access, confirmation, correction, deletion, portability, opt-out rights, sensitive-data consent or limitation rights, a list of certain third parties, and an appeal. DinnerMVP will recognize legally required universal opt-out mechanisms. State-specific exceptions and response periods apply.

15.3 Washington Nevada and consumer health privacy states

Allergy, intolerance, and health-related dietary information may be consumer health data. Residents and other protected consumers receive the disclosures, consent rules, access, confirmation, withdrawal, deletion, third-party information, appeal, security, and nondiscrimination rights described in the separate Consumer Health Data Privacy Notice. DinnerMVP does not sell consumer health data or use geofences around health care facilities to identify, track, collect from, or advertise to consumers.

15.4 Nevada online privacy

Nevada residents may submit a verified request to opt out of a covered sale of covered information. DinnerMVP does not currently engage in such sales. Requests may be sent to support@dinnermvp.com.

15.5 Other jurisdictions

Residents of every U.S. state, district, territory, and tribal jurisdiction retain non-waivable privacy, security, breach-notification, biometric, genetic, communications, health-data, and consumer-protection rights. An omission from this Section does not waive a right. We will update this Policy and operational processes as additional laws take effect or become applicable.

16 International processing

DinnerMVP is intended for the United States. Service providers may process information in other U.S. states or countries where they operate. Where legally required, DinnerMVP will use appropriate contractual, organizational, and transfer safeguards. Do not use the Service from a jurisdiction where our processing is unlawful or where we have not made the Service available.

17 Changes to this Policy

We may update this Policy to reflect legal, technical, or business changes. We will post the revised effective date. For a material change, we will provide notice reasonably calculated to reach affected users and obtain consent when required. We will not apply a materially different use of consumer health data or other sensitive data retroactively without the notice and consent required by law.

18 Supplemental technology and service-provider disclosures

DinnerMVP relies on carefully selected service providers acting under contract and, as applicable, under our instructions. Cloudflare provides hosting, network delivery, security, and execution infrastructure. Supabase provides authentication, database, and related application services. Resend supports transactional email delivery. Stripe processes subscription payments, billing status, customer-portal functions, refunds, disputes, and related payment events. AI or automated-generation providers may process minimized meal-planning inputs necessary to generate or validate requested output. Retailer, shopping, affiliate, and product-matching providers process information only when a user requests or initiates a handoff, follows a link, or otherwise directs the interaction.

The identification of a provider in this Policy does not expand the information DinnerMVP is authorized to disclose, constitute a representation that every provider participates in every interaction, or displace the provider’s independent legal obligations. DinnerMVP does not disclose complete payment-card numbers to itself, and it does not intentionally transmit direct account identifiers, payment credentials, benefit identifiers, or unnecessary support content in meal-generation prompts.

19 Notice concerning the preceding twelve months

During the twelve months preceding the effective date, DinnerMVP may have collected the categories described in Section 3, used them for the purposes described in Sections 5 through 7, and disclosed them for business purposes to the recipient categories described in Section 8. DinnerMVP has not knowingly sold personal information for monetary consideration, shared personal information for cross-context behavioral advertising, sold consumer health data, or knowingly sold or shared the personal information of consumers under sixteen. If DinnerMVP materially changes these practices, it will update the applicable notice and provide any opt-out, consent, or authorization required by law before the changed processing occurs.

20 Universal opt-out mechanisms and browser signals

Where applicable law requires recognition of a valid universal opt-out mechanism, including Global Privacy Control, DinnerMVP will treat the signal as a request to opt out of processing to which the signal legally applies. Because DinnerMVP does not presently sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, a signal ordinarily will not alter necessary service processing. A browser’s “Do Not Track” signal is not presently interpreted as a universal request unless applicable law or a recognized technical standard requires otherwise.

21 Relationship between consent and necessary processing

Certain processing is reasonably necessary to create or secure an account, authenticate a user, provide a requested meal plan, apply dietary restrictions, save user-directed content, process a subscription, deliver a requested communication, prevent fraud, comply with law, or complete a retailer handoff initiated by the user. Where processing is not reasonably necessary to provide the requested Service and applicable law requires consent—including certain optional analytics, sensitive-data processing, consumer-health-data collection or sharing, or materially different secondary uses—DinnerMVP will seek an affirmative, specific, informed, and freely given choice before the processing occurs. Withdrawal of consent will apply prospectively and will not affect processing already lawfully completed.

22 Deidentified and aggregated information

DinnerMVP may create and use information that has been aggregated or deidentified so that it cannot reasonably be linked to an identified or identifiable individual or household. When information is maintained as deidentified under applicable law, DinnerMVP will take reasonable measures to ensure that it cannot be associated with an individual, will publicly commit to maintaining and using it in deidentified form, and will not attempt to reidentify it except as permitted to test the effectiveness of deidentification safeguards or as otherwise authorized by law.

23 Statutory construction and preservation of rights

The examples in this Policy are illustrative and do not narrow a disclosure required by law. References to a legal right apply only when the relevant law covers the consumer, the processing, and DinnerMVP, but an omission of a jurisdiction does not waive any applicable right. If any statement in this Policy conflicts with a mandatory legal requirement, the requirement controls and the statement shall be construed to preserve the greatest lawful protection without invalidating the remainder of the Policy.

24 Contact

Medstrategic LLC, doing business as DinnerMVP

Privacy and consumer health requests: support@dinnermvp.com

Website: https://dinnermvp.com