Privacy Policy

The App requests Apple Health permissions only after you start a feature that needs them. Apple Health data is used for the Dashboard, CSV exports, personalized summaries and alerts, AI Health Chat context, and the optional Medical Records review and export features.

• •
  What data is accessed: The HealthKit types you authorize for the feature you use. You can separately choose export metrics and Medical Records types.
• •
  When data is accessed: When you open or refresh the Dashboard, create an export, use AI Health Chat, review Medical Records, or enable scheduled summary notifications. Background refresh may run after you enable notifications.
• •
  Where data is processed: CSV creation and most Dashboard calculations run on your iPhone. Opening AI Health Chat may send disclosed health context and profile data to Google's Gemini API so chat is ready. Sending a message or enabling the monthly deep-dive summary also sends data to Gemini; other summaries use Apple's on-device Foundation Models when available or a deterministic local fallback.
• •
  Data transmission: Creating a CSV does not send its health content to us or to Gemini. AI Health Chat transmits daily summaries by default and may request a narrow, on-demand window of more detailed samples when your question requires it. Medical Records are included only for paid subscribers outside the introductory trial, and only after you allow Apple Health Records access for Chat.
• •
  Data storage: Exported CSV files and AI Data Guides are created in protected local app storage and excluded from iCloud Device Backup. The App removes older app-generated files before the next export. Copies you share through the iOS Share Sheet follow the storage and retention rules of the destination you choose.
• •
  AI Data Guide profile section: Each generated guide can automatically include available, authorized age, sex, height, weight, BMI, blood type, skin type, wheelchair use, and VO2 max values. CSV metric selection does not remove those profile fields from the separate guide. Review or omit the guide before sharing if you do not want to disclose them.
• •
  Local app data: Chat history, Chat Memory, mood check-ins, generated summaries, and an on-device chat context cache can remain on your device so those features work across sessions. The controls and retention behavior differ by feature and are described below.

Controls available to you include:

• ✓Choose what to export. Pick which HealthKit data types are included, set the time range, and choose where to share each file.
• ✓Decide whether to use AI Health Chat. AI Health Chat is opt-in. Opening AI Health Chat may send the disclosed health context to Google's Gemini API so chat is ready. Sending a message or enabling the monthly deep-dive summary also sends data to Gemini.
• ✓Delete chat history. Open the Chat History drawer in the app to delete individual conversations or clear them all. Your persistent, visible Chat History is stored locally on your device; recent messages are still sent to Gemini during active chat.
• ✓Edit or clear Chat Memory. Settings → Chat Memory lets you review every fact (medications, conditions, allergies, goals, preferences, personal info), edit any of them, delete individual facts, or clear all memory at once.
• ✓Skip mood check-ins. Mood entries are always optional. Skip the prompt and chat normally. Submitted mood entries remain locally until you remove the App; the current version does not provide a separate mood-history deletion control.
• ✓Revoke HealthKit access. iOS Settings → Privacy & Security → Health → AI Health Export turns access off at any time.
• ✓Export entitlement. Lifetime Export permanently unlocks full-history CSV export. AI Health Chat includes the same export access while its subscription is active.

AI Health Chat uses Google's Gemini API to analyze your health data and answer questions. Opening Chat may send the disclosed authorized health context so chat is ready. Sending a message or enabling the monthly deep-dive summary also sends data; a request can include your question, recent conversation messages, health profile, saved Chat Memory, recent mood check-ins, and optional full Medical Records context. Chat Memory can include provider-derived medications, conditions, or allergies that you explicitly chose to save after review; those facts are sent independently of the full Medical Records setting until you delete them. Google's paid Gemini API does not use prompts or responses to improve Google products or train general Gemini models. Google retains prompts, context, and responses for 55 days for abuse monitoring and any required legal or regulatory disclosures. Abuse-monitoring data is used only for policy enforcement and preventing violations; flagged content may be reviewed by authorized Google staff. The App also uses TelemetryDeck for privacy-limited product analytics and Sentry for crash and performance diagnostics. The App shows no third-party advertisements, does not sell data to brokers, and never sends health data to any advertising or measurement partner.

Install and campaign measurement: The App uses the AppsFlyer SDK to measure which marketing campaign an install came from. It does not show ads and does not request App Tracking Transparency permission; collection of Apple's advertising identifier (IDFA) and of the vendor identifier (IDFV) is disabled in the SDK. AppsFlyer generates its own install identifier. To connect an install to a later purchase, the App sends that identifier together with the App Store purchase token to our own server at command.shiftedmediagroup.com. Apple Search Ads attribution is measured separately and first-party, sending Apple's attribution token and the same purchase token to that server. Apple's SKAdNetwork and AdAttributionKit also deliver install and conversion postbacks, which indicate which purchase tier was reached. None of these flows include Apple Health data, Medical Records, chat content, or your name or email address.

For transparency: AppsFlyer's own privacy manifest, which ships inside the App, classifies its install identifier as a device identifier used for third-party advertising, and lists sixteen tracking domains. Because the App never requests App Tracking Transparency permission, iOS blocks connections to those domains, and the cross-company advertising measurement they exist for does not take place. We disclose the classification because you would see it in Apple's own privacy report for the App.

• •
  Context caching: To reduce processing costs and improve response times, your health data summary may be temporarily cached on Google's servers with an initial 30-minute expiration. The App may extend that expiration by another 30 minutes while your chat remains active. The cache expires after the latest extension unless it is deleted sooner.
• •
  Retention, model use, and review: Google's paid Gemini API does not use prompts or responses to improve Google products or train general Gemini models. Google retains prompts, context, and responses for 55 days for abuse monitoring and any required legal or regulatory disclosures. Abuse-monitoring data is used only for policy enforcement and preventing violations; flagged content may be reviewed by authorized Google staff.
• •
  Age and consent: AI Health Export is available only to adults age 18 or older. Fresh AI Health Chat users confirm age as part of the single AI data-practices acceptance before the App prepares health data for Gemini. People who accepted the older consent receive one compact age confirmation. You can review the data practices anytime in the App's Settings.
• •
  Chat Memory: Any facts you save during onboarding, explicitly select after reviewing provider-connected records, or that the AI extracts from your conversations are included in every AI Health Chat request so the AI can reference them across sessions. Provider-derived Chat Memory is limited to medications, conditions, and allergies you choose to save. It is sent independently of the full Include Medical Records setting, so turning that setting off does not delete or stop saved memory facts. The same Google API terms above apply to memory facts. You can review, edit, or delete every stored fact in Settings → Chat Memory.
• •
  Mood Check-Ins: When you submit a mood check-in at the start of a chat (an emoji and any optional note you add), the entry is stored locally on your device and included in your next chat request so the AI can reference how you have been feeling. Your last 7 days of mood entries flow with each chat. The same Google API terms above apply. Mood check-ins are always optional.
• •
  Apple Health Medical Records (AI Health Chat, off by default): Full Medical Records context stays off by default and turns on only when you allow Apple Health Records access for Chat, either when you authorize records during setup or later under Settings → AI Chat → Include Medical Records. It is not included during the introductory trial. When it is on, AI Health Chat may include a full summary of allergies, conditions, immunizations, lab results, medications, procedures, vital signs, and clinical notes connected through Apple Health. Insurance and coverage records are not read, exported, or sent to AI. Before records can be included, the AI Data Practices screen names Google Gemini and describes this feature. The visible “Records on” badge shows when that summary is active, and you can turn it off from that badge or Settings at any time. Turning it off removes the full summary from future requests but does not delete provider-derived medications, conditions, or allergies you previously chose to save in Chat Memory. Review or delete those under Settings → Chat Memory. The same Gemini caching and safety-retention terms above apply. Availability depends on Apple Health Records support and your provider.
• •
  Same or equal privacy protection: We select third-party processors that offer privacy protections comparable to those described here.
• •
  Medical Records CSV export: You can also export your clinical records — the eight clinical record types listed above — as a local CSV file you can share, archive, or upload anywhere you choose. Insurance/coverage records are not included in the CSV export. The CSV is generated on your device with encryption-at-rest protection and is excluded from iCloud Device Backup unless you explicitly share it via the iOS Share Sheet. The CSV export does not transmit to Google or any other third party.
• •
  Chat history: The app's persistent conversation history is stored locally on your device. You can view, load, and delete past conversations from the Chat History drawer, and we do not store that persistent history on our servers. To generate replies, recent conversation messages are sent to Gemini and are subject to the Google processing and retention terms described above.

TelemetryDeck: The iOS app sends a narrow set of operational product events and a pseudonymous identifier derived by hashing IDFV on-device without an app-configured client salt; TelemetryDeck applies additional server-side protection. Events may include app sessions, generic feature use, purchase tier, Apple Ads attribution, and latency, failure, or duration buckets. A default-deny telemetry policy prevents HealthKit-derived values or proxies, Medical Records use or content, mood entries, metric, prompt, or tool categories, chat content, and export content from being sent to TelemetryDeck.

Sentry: The iOS app reports crashes, hangs, performance traces, and non-fatal diagnostics. Default PII is disabled and Session Replay is disabled. Health values and Medical Records content are not intentionally attached. Purchase tier and provider-agnostic error context may be included.

Website analytics: This website uses Vercel Analytics for basic page-view and site-use statistics, including when a visitor selects an App Store download link. That event records the website path, not health data, an App Store installation, or a purchase. This is separate from the iOS app and does not involve Apple Health data.

ChatGPT ad measurement: The Apple Health CSV guide, Apple Health Chat page, and Data Workflow page use the OpenAI Ads Measurement Pixel to measure page views and clicks on their App Store download buttons for ChatGPT advertising. When a visitor arrives through a ChatGPT ad, the pixel may receive a privacy-preserving ad reference from the landing-page URL and the page origin, and stores that ad reference in a first-party cookie when present. It does not receive HealthKit data, medical information, contact-form content, raw email addresses, phone numbers, or other customer identifiers. Automatic advanced matching is disabled.

Website contact form: If you contact us through the website, we collect the name, email address, subject, and message you submit. Cloudflare Turnstile receives the verification token and may receive your IP address for bot detection. When configured, Upstash uses an IP-address-based identifier to rate-limit submissions. Vercel function logs record the submitted email address, IP address, timestamp, spam score, and spam reason codes. Clean submissions are sent through Resend to the support mailbox with the form fields, IP address, and spam score; quarantined submissions are logged but are not emailed. These records follow the retention settings of the relevant service logs and support mailbox; no fixed retention period is promised here.

• •App-generated CSV files and guides remain in protected local app storage until the next export cleans up older files, you delete them through Files, or you remove the App
• •Copies you share follow the destination's retention rules and are no longer controlled by the App
• •Chat history and Chat Memory remain locally until you delete or clear them, or remove the App. Mood entries remain locally until you remove the App. Summaries and the on-device chat context cache remain until normal refresh or cleanup replaces them, or the App is removed.
• •Gemini context caching starts with a 30-minute expiration that the App may extend by another 30 minutes during an active chat; Google retains prompts, context, and responses for 55 days for abuse monitoring and any required legal or regulatory disclosures
• •Website contact-form logs and delivered support emails follow the configured retention of Vercel logs, Upstash rate limiting, Resend delivery, and the support mailbox; the site does not define one fixed duration across those systems

If you have questions about this privacy policy or the App's privacy practices, please contact us:

The App is designed around these requirements and principles:

• ✓Apple's App Store Review Guidelines
• ✓HealthKit Framework Requirements
• ✓General Data Protection Regulation (GDPR) principles
• ✓California Consumer Privacy Act (CCPA) principles