Privacy policy.
Last updated: 2026-05-06
This is the privacy policy for Carmeta, a product of JLG Ventures LLC (“Carmeta,” “we,” “us,” or “our”). It explains what information we collect when you use carmetahealth.com or any related Carmeta service, how we use it, and the choices you have.
We've tried to write this in plain language. If anything is unclear, write to legal@carmetahealth.com and we'll explain.
Who we are
Carmeta is a product operated by JLG Ventures LLC, a limited liability company formed in Georgia, United States. When this policy refers to “Carmeta,” it means JLG Ventures LLC operating the Carmeta service.
For privacy questions, contact us at legal@carmetahealth.com.
What we collect
We collect three categories of information.
Information you give us directly. When you sign up for early access, we collect your email address. When you eventually use the full Carmeta product, we collect lab values you choose to share with us (such as LDL, ApoB, triglycerides, HDL, A1c, fasting glucose), along with optional context like dietary preferences, sex assigned at birth, age, and goals.
Information collected automatically. When you visit carmetahealth.com, our hosting provider (Vercel) logs basic technical information: your IP address, browser type, the pages you visited, and the time of your visit. This is standard server logging used to keep the site running and to detect technical problems. We do not use third-party analytics, advertising pixels, session recording tools, or any tracking technology that profiles you across the web.
How we use it
We use your information to:
- Send you early-access invitations when Carmeta is ready
- Email you when Carmeta launches
- Provide the Carmeta product itself once it launches — generating your personalized food plan, providing food check-in feedback, tracking your lab trends over time
- Operate, secure, and improve the service
- Respond when you contact us
- Comply with legal obligations
We do not use your information to train AI models, sell or share with advertisers, or build profiles for marketing.
What we do not do with your data
This is important enough that we want to say it directly.
We do not sell your health data. Not to insurance companies, not to employers, not to advertisers, not to data brokers, not to anyone. This is a permanent commitment.
We do not share your health data with third parties for their own marketing purposes.
We do not use your health data for advertising, profiling, or any purpose unrelated to providing the Carmeta service.
We do not place advertising tracking pixels or third-party analytics tools on pages where you enter or view your health data.
These commitments are also obligations under Washington's My Health My Data Act, California's Confidentiality of Medical Information Act, and similar state laws — but we'd hold to them regardless.
Service providers
We use a small number of service providers to run Carmeta. Each one only sees the data it needs to do its job. Each is bound by its own privacy and security commitments.
- Supabase hosts our database. Supabase stores your account record and (eventually) your lab data and plan history. Data is encrypted in transit and at rest.
- Vercel hosts the carmetahealth.com website and our application infrastructure.
- Cloudflare routes email sent to addresses ending in @carmetahealth.com to our team's inbox, and provides DNS for the domain.
If we add new service providers, we'll update this list. We don't engage providers who would use your data for their own purposes beyond providing service to Carmeta.
Your choices and rights
You can:
- Unsubscribe from the early-access list. Use the unsubscribe link in any email we send, or email legal@carmetahealth.com.
- Request a copy of your data. Email legal@carmetahealth.com and we'll provide everything we have on file in a portable format within 30 days.
- Request deletion of your data. Email legal@carmetahealth.com or use any account-level deletion control once the full product is live. We'll delete your data within 30 days, except where we're legally required to retain certain payment records (typically 7 years for tax purposes).
- Correct inaccurate data. Email legal@carmetahealth.com if anything we have on file is wrong.
If you live in California, Washington, Colorado, Connecticut, Virginia, or another state with comprehensive privacy laws, you have additional rights under those laws — including the right to know specifically what we have, the right to opt out of certain processing, and protection against discrimination for exercising your rights. We honor all of these. Contact us at legal@carmetahealth.com to exercise any of them.
Security
We protect your data through encryption in transit (TLS) and encryption at rest, restricted internal access, and standard authentication on all systems. We monitor for unauthorized access. No system is perfectly secure, but we take this seriously, especially for health information.
If we ever discover a breach affecting your personal data, we'll notify you and any required regulators consistent with applicable law.
Cookies
We use the minimum cookies needed to operate the site — essentially session cookies for the Reserve flow and authentication once that exists. We do not use advertising cookies, third-party tracking cookies, or cookies for behavioral profiling. You can disable cookies in your browser, though some features may not work without them.
Children
Carmeta is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, contact legal@carmetahealth.com and we will delete it.
International users
Carmeta operates from the United States and our service providers are primarily US-based. If you access Carmeta from outside the US, your information will be transferred to and processed in the US, which may have different data protection rules than your home country. By using Carmeta, you consent to this transfer.
Changes to this policy
We may update this policy as Carmeta evolves. If we make material changes — particularly any change that expands how we use your data — we'll notify you by email and post the updated policy with a new “Last updated” date. Continued use of Carmeta after a change means you accept the updated terms.
We will never reduce the protections in this policy retroactively without your explicit opt-in consent. If we ever wanted to (we have no plans to), the changes would only apply to data collected after you consented.
Contact
For any privacy question or to exercise any right described above:
JLG Ventures LLC
Operating Carmeta