Rarewell Privacy Policy
Effective date: 2026-10-12
Last updated: 2026-10-12
Who we are
Rarewell is an app for families managing rare metabolic conditions. It is operated by Rarewell, LLC, a Florida limited liability company.
Contact: support@rarewellco.com
This policy explains what information Rarewell collects, why, who can see it, and what choices you have. It applies to the Rarewell mobile app and to rarewellco.com.
We have tried to write this in plain language. Where a term has a specific legal meaning, we say so.
The short version
- Everything you log stays private by default. Nothing is shared with researchers, companies, or anyone outside your household unless you turn it on.
- We ask separately for each kind of sharing. There are seven choices, not one, and you can change any of them at any time.
- Saying no costs nothing. Rarewell works exactly the same either way. No feature is locked behind a sharing choice.
- You can export everything we hold about you, at any time, from the app.
- You can delete your account and your identifiable data at any time by emailing support@rarewellco.com.
- We are paid when a company licenses de-identified data. We say so plainly in the app, and we say it here.
The rest of this policy is the detail behind those statements.
1. What we collect
1.1 Information you give us
Account information. Your email address and a password. Your display name.
Household information. The name of your household, the people you track, their dates of birth, the condition each person is managing, and where applicable their genetic variant or clinical subtype.
Care information. This is the substance of the app:
- Meals and foods logged, with weights and nutrient values
- Recipes, batches, meal plans, and pantry contents
- Prescriptions, formula, supplements and doses
- Lab and blood results you enter
- Wellness entries — sleep, illness, mood, and similar notes
- Photographs of nutrition labels and barcodes, when you use the scanner. Food photos taken with the label scanner are saved — see Section 6.
Communications. Anything you send to support@rarewellco.com, and feedback you submit in the app.
Payment. If you subscribe to Rarewell Pro, Apple processes the payment through the App Store. Rarewell never sees your card details; we receive only confirmation that a subscription is active.
1.2 Information collected automatically
Technical and diagnostic data. When the app encounters an error, we receive a report describing what went wrong — the error message, the screen it happened on, the app version, the device model and operating system version, and a randomly-generated identifier for the session. We use Sentry for this.
That is all. Rarewell has no usage analytics and no advertising trackers, and shows no ads.
1.3 Information from your device
Camera. Only when you use the label scanner, and only for that scan. We ask for the permission when you first use the scanner, not at install, and declining it does not prevent you using the rest of the app.
2. Why we collect it
To run the app. Calculating daily totals, tracking against limits, keeping your household's records in sync across the people you have invited.
To keep it working. Diagnosing errors, preventing abuse, and maintaining security.
To communicate with you. Responding to support requests, and sending notifications you have enabled.
To meet legal obligations. Where a law requires us to keep or produce records.
To improve Rarewell for everyone, in the specific ways described in Section 4 — and only where you have said yes.
3. Who can see your information
3.1 Inside your household
Anyone you invite to your household can see the information their role allows.
Roles:
- Parent or guardian (admin) — full access, can invite and remove people, and can make consent decisions for the people tracked in the household
- Caregiver — can log meals and manage day-to-day tracking, but cannot make consent decisions
- Helper — limited logging
- Viewer — read-only
You control who is in your household. Removing someone removes their access immediately.
3.2 Our service providers
We use a small number of companies to run Rarewell. They process data on our instructions and are contractually prohibited from using it for their own purposes.
- Supabase — database and authentication hosting
- Expo — app delivery and updates
- Sentry — error reporting
- Apple — app distribution and, if you subscribe, payment processing. Apple processes the payment; Rarewell never sees your card details
- RevenueCat — keeps track of whether a subscription is active, so the app knows what your household can use. It receives a randomly-generated account identifier and the subscription's status from Apple — not your name, your email address, or anything you record in the app
- Resend — delivers invitation and account email. When you invite someone to your household, it receives their email address and the invitation itself: your display name, your household's name, the role you chose, and the link. For account email — confirming an address, signing in — it receives your email address and the message
- Anthropic — when you use the label scanner, the photos of the label are sent to Anthropic's API to be read. Nothing about your family goes with them
- ActiveCampaign — sends the email tips and updates described in Section 4.3, if you turn them on
Two food databases also receive a little of what you type, and nothing else. OpenFoodFacts receives the barcode when you scan one, if that source is switched on in data sources. USDA receives the words you type into search. Neither receives anything about your family.
3.3 Outside Rarewell
Nothing leaves Rarewell except through the choices in Section 4. We do not sell your identifiable information. We do not share it with advertisers.
3.4 If required by law
We may disclose information if we are legally required to — a court order, a subpoena, or a legal obligation. If we can lawfully tell you first, we will.
3.5 If Rarewell is acquired
If Rarewell, LLC is acquired by, merges with, or transfers its assets to another organisation, your information transfers with it, and any permissions you have given carry over to that organisation on the same terms described here. You can withdraw them at any time, before or after.
We are telling you this because it is how these things work, and because a permission granted to a company that no longer exists helps nobody.
4. Your sharing choices
This is the part that matters most, and it is the part Rarewell is built around.
Everything below is OFF until you turn it on, with one exception noted in 4.1. You can change any of them at any time in Profile → Privacy and consent. Turning something off takes effect immediately.
We record every choice — which category, when, and the exact wording you were shown. You can see that history in the app and download it.
4.1 Choices where nothing leaves Rarewell
Community signals (on by default)
Aggregate counts drawn from what everyone logs — how many households have a product in their pantry, which brands are common, how often a food is logged. These are computed inside Rarewell and never sent outside it. No individual record is shown to another family, and counts appear only when enough households contribute that no single one can be identified. Turning this off removes your household from those counts; you still see counts contributed by others.
Cohort matching (off by default)
Groups the person you are tracking with others sharing the same condition and, where applicable, the same variant or clinical subtype, and shows you what those households log — common foods and brands, typical intake of the nutrient you track, adjusted for body weight and grouped by age range.
A summary appears only when at least ten households are in the group. If fewer than ten match, nothing is shown. We do not widen the group to reach ten without telling you — every summary states which group it describes.
These summaries describe what other families do. They are not advice, not a target, and not a comparison against any clinical measure. What the person you are tracking should eat is set by their clinician, not by this app.
Nothing is matched or shown yet. Turning this choice on records your permission for when it is.
4.2 Choices where de-identified data leaves Rarewell
Before anything is shared under these choices, we remove direct identifiers as described in Section 5.
Academic and nonprofit research (off by default)
Universities, academic medical centres, nonprofit research foundations, and clinician-researchers can use de-identified data for research into the condition you track and related conditions. Results may be published in journals or presented at conferences, and are always reported about groups, never about an individual.
Commercial research and licensing (off by default)
Pharmaceutical, biotechnology, medical nutrition and similar companies can license de-identified data for research and product development.
Rarewell, LLC is paid for these arrangements. We are telling you plainly because you should know what you are agreeing to. You are not paid, and saying no costs you nothing.
Why this exists: companies developing treatments, medical foods and clinical tools need real-world information about how these conditions are managed day to day — what people actually eat, how levels respond, what works over years rather than weeks. Very little of that information exists, because the conditions are rare and nobody has been collecting it. That gap is a real obstacle to better treatment.
Variant and genetic data (off by default)
Covers genetic information specifically — the variant or genetic result recorded for the person you are tracking — and applies in addition to the research choices above.
It is separate because genetic information is protected differently from other health data, including under the Genetic Information Nondiscrimination Act and state genetic privacy laws. It also cannot be fully de-identified in the way other data can: a rare variant may be shared by very few people worldwide, and someone with access to other genetic databases might in principle connect it back to an individual.
We reduce that risk by contract, by grouping, and by the ten-household floor — but we cannot promise it is impossible, and we would rather say so than imply otherwise.
4.3 Choices about being contacted
Clinical trial notifications (off by default)
We tell you when a trial or study is recruiting people who match the profile of the person you are tracking, based on their condition, variant or subtype, age, and general location.
Nothing is shared when you turn this on. We do the matching inside Rarewell and send you a message. No researcher or sponsor receives anything about you at this stage. If you want to take part, you tell us at that point, for that specific study, and we show you who is running it and exactly what would be shared before you decide.
Nothing is matched or sent yet. Turning this choice on records your permission for when it is.
Research partner announcements (off by default)
We tell you when Rarewell begins working with a research organisation on a project relevant to the condition you track. Nothing is shared. If a partnership involves sharing data, you are asked separately.
Tips and updates by email (per adult, off by default)
Short emails about how to use Rarewell and what has changed. They are sent through ActiveCampaign, which receives your first name, your email address, and the counts that decide which emails are sent — for example how many foods your pantry holds. No email names a condition. Every email carries an unsubscribe link, and unsubscribing turns this off.
4.4 Who may make these choices
Consent decisions belong to the parent or guardian — the admin of the household. A household may have more than one; both parents of a child can hold that role.
If the person being tracked is an adult managing their own care, the choices are theirs. They confirm which record is theirs in the app, and from that point a household admin cannot make consent decisions on their behalf.
If the person being tracked is under 18, a parent or guardian makes these decisions for them. A minor can use every part of Rarewell, but cannot turn on the choices in Sections 4.2 and 4.3 for themselves — a parent or guardian has to join their household first. When a guardian joins, they confirm that they are the parent or legal guardian of that person, and we record that confirmation.
We record whether each choice was made by the person themselves or by a parent or guardian on their behalf.
4.5 Withdrawing
You can turn off any choice at any time. When you do:
- Sharing stops immediately.
- We notify anyone who already received your data and require them to delete it under the terms of their agreement with us, within the period that agreement specifies.
- Research already published cannot be unpublished, and de-identified data already incorporated into completed work cannot be recalled.
- Aggregate statistics that included your contribution — counts and cohort summaries — are recalculated without you.
We keep a record of every recipient, what they received, and when, specifically so that a withdrawal can be acted on. That record is not visible in the app; if you want to know whether your data has been included in any release, contact us and we will tell you.
As of the effective date of this policy, no data has been shared with any external recipient.
4.6 The shared food database
When you scan a nutrition label, Rarewell adds the product record — the name, the brand, the barcode and the nutrition values — to a shared database that all Rarewell families draw from. This is how the food database grows.
This happens on every scan, regardless of any setting. It is product data only: nothing about your family, your household, or the person you track goes with it.
5. De-identification
Where this policy says data is de-identified, we mean that before it leaves Rarewell we remove:
- Names
- Email addresses, phone numbers and any other contact details
- Street addresses, and any geographic detail smaller than a state
- All dates more specific than a year, including exact dates of birth, of logging, and of any recorded event
- Account identifiers, device identifiers, and any other unique identifier
- Photographs and any images
This follows the identifier list in the HIPAA Safe Harbor standard, which we use as our benchmark even though Rarewell is not itself a HIPAA-covered entity.
Age is kept. Not date of birth — age, in years, or in months for infants. Age is essential to research in metabolic conditions, because tolerance changes as a person grows, and a dietary record without it has little research value.
We do not use the word "anonymous" to describe this data, because under some privacy laws that word means irreversibly non-identifiable, and rare-disease data rarely meets that standard. De-identified is the accurate word.
Everyone who receives de-identified data is contractually prohibited from attempting to re-identify anyone, and from passing it on.
6. How long we keep it
While your account is active, we keep your information so the app works.
Label scanner photos are saved for as long as the scanned record exists so that a scanned record can be checked against the package it came from. Only Rarewell's administrators can see them; other families never do.
When you delete your account — today, by emailing support@rarewellco.com; see Section 7 — we delete your identifiable information. Some things survive, and we want to be clear about which:
- De-identified data already shared with a researcher or licensee. Once identifiers are stripped, that data is no longer about you, and there is no way to reach back into work already done.
- Aggregate statistics that included your contribution.
- Records the law requires us to keep, for as long as it requires.
- Backups, for a short period, until they cycle out on their normal schedule.
- The shared food database. Products you scanned remain available to other families; the link between those products and your household is removed.
- Label scanner photos that show someone's face are deleted with your account. Photos of the packaging alone are kept, because they're part of the food's record.
Deleting your account is permanent and cannot be undone.
7. Your rights and how to use them
In the app, right now, without asking anyone:
- See everything we hold about you — Profile → Export all my data. You get every record, in spreadsheet form, including your full consent history.
- Change any sharing choice — Profile → Privacy and consent.
By contacting support@rarewellco.com:
- Delete your account and your identifiable data. Today this is done by email; the delete account row in the app tells you so, and we confirm when it is complete
- Correct information that is wrong
- Ask whether your data has been included in any release, and to whom
- Object to or restrict a particular use
- Ask anything else about this policy
We respond within 30 days, and sooner where a law requires it.
We will never charge you, refuse you service, or give you a worse experience for exercising any of these rights.
7.1 If you are in the United States
Depending on your state, you may have specific rights to know what is collected, to delete it, to correct it, to obtain a portable copy, and to opt out of sale or of certain profiling. The tools above satisfy these; the contact address handles anything they do not.
On "sale" and "sharing." Some state laws define these terms broadly. Rarewell does not sell personal information as most people would use the word. We do license de-identified data, and only with your explicit permission — see Section 4.2, where we say so plainly. If you have not turned that on, nothing about you is licensed to anyone.
Washington residents: Washington's My Health My Data Act gives you specific rights over consumer health data, including the right to withdraw consent and to have that data deleted. The tools above apply, and you can contact us directly.
Nevada residents: you may direct us not to sell your covered information. We do not sell it.
7.2 If you are in the European Economic Area or the United Kingdom
Rarewell, LLC is the data controller.
Our lawful bases:
- Contract — running the app you signed up for
- Legitimate interests — keeping it secure and working, and improving it, balanced against your interests
- Legal obligation — where a law requires it
- Explicit consent — everything in Section 4, and all health and genetic data, which are special-category data under Article 9
Your rights include access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. Withdrawing does not affect the lawfulness of what happened before you withdrew.
Transfers. Rarewell's servers are in the United States. Where we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses.
Complaints. You can complain to your national data protection authority. We would rather you told us first, but it is your right either way.
7.3 If you are in Canada
You have rights of access and correction under PIPEDA, and may complain to the Office of the Privacy Commissioner.
8. Children
Accounts are for parents, guardians, and adults managing their own care. Rarewell does not ask your age when you create an account.
A child's record is created and controlled by a parent or guardian. Most of the people tracked in Rarewell are children; their information is entered by a parent or guardian, who controls it and makes every sharing decision described in Section 4.
A person tracked in Rarewell who manages their own care can confirm that in the app ("this is me"). From that point the sharing decisions about their information are theirs. While the person tracked is under 18, the research and contact choices in Sections 4.2 and 4.3 stay with the parent or guardian.
Rarewell records whether each consent decision was made by the person themselves or by a parent or guardian on their behalf. That record is part of your consent history and of your data export.
9. Security
- Everything is encrypted in transit and at rest.
- Access is enforced at the database, not just in the app, so one household's data is unreachable from another's account.
- Every consent decision is recorded permanently and cannot be edited or deleted — including by us.
- Access to production systems is limited to those who need it.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your information, we will tell you and the relevant authorities as the law requires.
10. Communications
Rarewell sends no push notifications today.
We may send service messages by email — about your account, security, and material changes to this policy — because you need them. The tips and updates in Section 4.3 are separate, off by default, and yours to turn on or off.
11. Changes to this policy
If we change this policy in a way that materially affects your rights or how we use your information, we will tell you in the app and ask you to acknowledge it before it takes effect.
A change to this policy never turns on a sharing choice you had turned off. New kinds of sharing require a new, explicit choice.
Previous versions are available on request.
12. Contact
Rarewell, LLC
PO Box 25205
Lakeland, FL 33802
United States
support@rarewellco.com
13. Governing law
This policy is governed by the laws of the State of Florida, without regard to its conflict-of-laws rules. This does not remove any right you have under the law of the country or state where you live.