Skip to content
Sign inStart a fitting

Consumer health data privacy policy

Dietary, allergy, and accessibility details in RSVPs.

Guests can choose to tell a couple about dietary needs, allergies, or accessibility needs when they reply. We collect those details only with consent or as needed to deliver the reply the guest asked us to send, share them only with the couple, the vendors the couple shares a plan with, and the providers that host the service, and never sell them or use them for advertising.

Applies to
Washington, Nevada, Connecticut, and all other guests
Effective
October 17, 2026

Scope

This policy is provided by Crafted Kit LLC d/b/a The Cordially Invited (“we”) under Washington's My Health My Data Act (RCW 19.373), Nevada's consumer health data law (NRS 603A.400 to 603A.550), and Connecticut's consumer health data provisions. We apply it to every guest, wherever they live. “Consumer health data” means personal information that is linked or reasonably linkable to you and identifies your past, present, or future physical or mental health status.

Categories of consumer health data we collect

  • Dietary needs and restrictions, including food allergies and intolerances.
  • Accessibility, mobility, disability-related, or other accommodation needs for attending a wedding event.
  • Health information a guest chooses to write in an RSVP note or in an answer to a question the couple added to their RSVP, such as a medical or pregnancy-related seating need. We ask guests to use the dietary and accessibility fields, which request consent, rather than notes for health details.

Sources

  • The guest, when they reply to an invitation.
  • An adult replying for their household, or a parent or guardian replying for a child.
  • The couple or a collaborator they authorize, when they enter or correct a guest's reply on the guest's behalf. They must have the guest's permission to do so.

Why we collect it and how we use it

We collect and use consumer health data only to:

  • deliver the guest's RSVP to the couple so they can plan meals, seating, access, and other accommodations for their wedding;
  • store and display the reply to the guest and the couple, and let the guest change or delete it; and
  • keep the service secure, prevent abuse, and comply with legal obligations.

We collect it either with the consent you give at the RSVP form or because it is necessary to provide the RSVP service you asked for. We do not use it for advertising, marketing, analytics, profiling, product experiments, or training artificial intelligence, and we do not draw inferences from it.

Categories of consumer health data we share, and with whom

We share each category listed above with the following categories of recipients, and only for the purposes described in this policy:

  • The couple and the collaborators they authorize, such as a co-host or wedding planner.
  • Vendors the couple chooses, such as a caterer, venue, or planner, through plan links the couple creates in the service. These show the dietary or accessibility needs relevant to that vendor's work, and a change or deletion appears the next time the link is opened. The couple may also share details with vendors outside the service.
  • Service providers that process it on our behalf: Supabase (database and storage), Vercel (hosting), and Cloudflare (encrypted backups).
  • Government authorities or other parties when required by law, legal process, or to protect someone's safety.

We have no affiliates that receive consumer health data. We do not sell consumer health data, and no third party collects consumer health data about you across websites or over time through our service.

Your rights

  • Confirm and access: ask whether we collect, share, or sell your consumer health data and get a copy of it, including a list of every third party and affiliate we shared it with and an email address or other online way to contact each of them.
  • Withdraw consent: withdraw the consent you gave at the RSVP form at any time. Withdrawing removes the details from your reply.
  • Delete: have your consumer health data deleted. We delete it from our active systems, notify our service providers and the couple, and remove it from archived or backup systems within six months of authenticating your request.

We will not deny you the service, charge you differently, or treat you differently for exercising these rights.

How to make a request

The fastest way to change, withdraw, or delete your details is your private RSVP link: open it, clear the details or uncheck the consent box, and save. You can also email hello@thecordiallyinvited.com with the subject “Health data request,” the couple's names or Wedding address, and the guest's name. We verify requests using the email address or private RSVP link connected to the reply. Requests are free up to twice a year.

We respond within 45 days. If we need more time, we will tell you within those 45 days, and may extend once by up to 45 more days. If we decline a request, you can appeal by replying with the subject “Health data appeal.” We decide appeals within 45 days and explain the outcome. If your appeal is denied, you may contact the Washington Attorney General, the Nevada Attorney General, or the Connecticut Attorney General.

Changes to this policy

We will post any change here with a new effective date before it takes effect. Before a material change in how we collect, use, or share consumer health data takes effect, we will notify couples by email, show the change on RSVP forms, and ask guests for new consent where the law requires it.