Privacy Policy

Healthy Tray publishes the Healthy Tray mobile app and website. Hospitals use them to record what patients eat and to review it. This policy explains what information the app and website handle, who receives it, how long it is kept, and how to ask us about it.

Healthy Tray is used by hospital staff. Your hospital creates your account. There is no public sign-up, and patients do not use the app.

For patient information, we act on the hospital’s behalf. We are a service provider to the hospital and, where HIPAA applies, a business associate. The hospital decides what patient information is entered and who may see it. A patient’s rights over their health information are described in their hospital’s Notice of Privacy Practices, and a patient should contact the hospital first.

For information about staff who use the app, such as your name and work email, we are the party that runs the service.

From staff who use the app

• Your name and work email address. Your job title, if your administrator enters one.
• Your password. We store only a one-way hash of it (Argon2id), never the password itself.
• Your role and the hospitals you are assigned to, which decide what you can see and do.
• Sign-in and security details: when you last signed in, a count of recent failed sign-ins used to lock an account after repeated failures, and the IP address and device or browser type of each request we record in the access log (see “How we protect information”).

Patient information processed for hospitals

When staff record a patient’s meal, the service handles the information the hospital enters or the staff member captures:

• Identity and stay details: name, date of birth, sex, medical record number, room and bed, and admission and discharge times.
• Nutrition and clinical details the hospital records, such as diet orders, nutrition goals and assessment notes.
• Photographs of meal trays, taken before and after a meal, and the food items and amounts eaten that are worked out from them.
• The medical record number read from a wristband photograph, used to find the patient. That photograph is not stored.

A photograph of a tray can show what is printed on a tray ticket, so we treat every photograph as patient information.

What we do not collect

The app does not collect your location, contacts, advertising identifier or microphone audio. It has no advertising, no third-party analytics and no tracking tools. Face ID or fingerprint unlock is handled by your phone: the app is told only whether the check succeeded, and never receives or stores your face or fingerprint.

The mobile app keeps your sign-in tokens in your phone’s secure storage (the iOS Keychain or Android Keystore). It works online only. It does not save patient records to your phone’s storage.

The app asks for camera access to photograph trays and wristbands. It asks for photo library access only when you choose a photo, and then only that photo is used.

The website uses cookies that keep you signed in, remember which hospital you are working in, remember whether you must change your password, and remember whether the side menu is open. They are used only to run the service. The website sets no advertising or analytics cookies. The Privacy Policy, Terms, Support and Account deletion pages need no sign-in.

• To run the service for your hospital: sign you in, show the patients and trays you are allowed to see, and calculate nutrition.
• To keep the service secure, including the access log and sign-in lockout.
• To send account emails, such as an invitation or a password reset link, to your work address.
• To find and fix errors, using the crash reports described below.
• To answer your support and privacy requests.

We do not use information for advertising or marketing, and we do not sell it.

When staff photograph a tray, the photograph is analyzed by Amazon Bedrock, an AI service that runs inside our own Amazon Web Services account. The analysis proposes which foods are on the tray and how much was eaten. A staff member reviews the proposal before anything is saved to the record.

The AI does not supply nutrition values. Those come from the hospital’s menu and from USDA FoodData Central.

The request to the AI service carries the photograph and food names. It does not carry the patient’s name, date of birth or medical record number as separate fields. Because a photograph can show printed text, we treat it as patient information.

Before a user’s first photograph is analyzed, the app asks for that user’s permission, and the service does not analyze photographs for a user who has not given it.

A wristband photograph is read by the same service only to find the medical record number. It is not stored.

We share information only with the companies that help us run the service, and with the hospital that owns the patient information. Each acts for us, and we ask each to protect information as this policy describes.

Amazon Web Services

Hosts the service. It runs the servers and the database, stores tray photographs, sends account email, and runs the Bedrock AI analysis described above.

USDA FoodData Central

A public U.S. government food database. We send it food names to look up nutrition values. We send it no patient information.

Expo (EAS Update)

Delivers app updates to the mobile app. Its servers receive your device’s IP address and the app’s version and platform. No patient information is involved.

Crash reports go to our own servers, not to a third party. We do not share information with advertisers or data brokers. We may disclose information when the law requires it.

If the app or website fails, it can send us a short report so we can fix it. A report is limited to a fixed list of technical fields: the app name and version, a trace identifier, the type of screen, the phone or browser platform and operating system version, and the code location of the error. It cannot carry an error message, a form entry, a patient detail or a photograph, and the server refuses a report that tries.

• Information travels over encrypted connections. The database and stored photographs are encrypted at rest.
• Tray photographs have their embedded metadata, such as location and device details, removed before they are stored.
• Each account sees only the hospitals and patients its role allows, and the server checks this on every request.
• Passwords are stored as one-way hashes. An account is locked for a time after repeated failed sign-ins. A signed-in session locks after a period of inactivity.
• Each time a patient record is opened, the service writes an access log entry that records who, when, what and from where, so a hospital can review it.

No system is perfectly secure. If we learn of a breach of patient information, we will tell the affected hospital.

Hospitals must keep clinical records for their own record-keeping obligations, so the service does not routinely delete patient records, and the hospital decides how long its records are kept. We keep patient information while the hospital uses the service, and we return or delete it as the hospital’s agreement with us says.

Account details are kept while the account is active. When a hospital removes an account, the sign-in is closed and sessions end, but the closed account record, with its name and work email, and the access log entries about it may be kept so a hospital can account for who looked at what.

Wristband photographs are not stored. Crash reports hold only the technical fields listed above. Server logs and database backups are kept for a limited time and then removed on a schedule.

You can see and update your own name and email in the app, under Account. For anything else, such as getting a copy of your account details, correcting them, or asking us to delete your account, email support@healthytray.com from the address on the account, or ask your hospital’s administrator. See Account deletion for how a deletion request works and what is kept.

You can turn off camera or photo access at any time in your phone’s settings. You can sign out from Account.

If you are a patient, ask your hospital about your records. If you contact us instead, we will pass your request to the hospital.

Healthy Tray is for hospital staff and is not for anyone under 18. We do not knowingly create accounts for children. Hospitals may record information about patients who are children, as part of their care, and we handle it for the hospital as described above.

When we change this policy, we post the new version here and change the effective date at the top. If a change is significant, we will tell hospital administrators.

Questions and requests: support@healthytray.com

Please do not put patient information in an email to us.

Publisher: Healthy Tray.