Privacy policy

Who we are

HealthSync is operated by Thiago Catão, an individual developer based in the United Kingdom and the controller responsible for the processing described in this policy. Contact us at thiago@healthsync.me for support and privacy requests.

Public correspondence address: Flat 51, Curie House, Wallis Road, London, E9 5TF, United Kingdom.

This policy covers the HealthSync iPhone app and service. HealthSync is intended for adults aged 18 and over.

Your health library

HealthSync reads the Apple Health categories and history you choose into a library on your iPhone. It does not change your original Apple Health records. Depending on your choices and available records, the library may contain activity, workouts, precise workout routes, sleep, nutrition, heart measurements, body measurements, symptoms, mental wellbeing, reproductive health and demographic characteristics.

Medication records, clinical Health Records, documents and vision prescriptions are not supported. Data availability depends on your iOS version, permissions and what your source apps put in Apple Health.

Your library is kept on your iPhone in protected storage and marked as excluded from device backups. Signing in with Apple does not back it up or copy it to another device. You can download a copy using the library controls.

Your account and connections

Apple verifies your sign-in. HealthSync receives an identifier specific to this app and stores the credentials needed to keep your session working and revoke it. We do not request your Apple name or email address and never receive your Apple password.

The service also stores device identifiers, connection names, approved categories and purposes, authorisations, delivery status and security information needed to operate your connections. Cloudflare processes this information and temporary delivery packages for HealthSync.

If you choose HealthSync's managed collection setup, the service also stores the provider API key or webhook credential, model or agent selection, and destination you supply. It uses these credentials to contact that provider or runner on your behalf. This is separate from connecting ChatGPT or Claude through their own OAuth flow, which does not ask you for a provider API key. Managed credentials are removed from active storage when that setup is retired or the account is deleted; recovery copies can persist as described below.

Each agent needs your separate approval. Signing in or importing data does not approve every agent. You can review the recipient and data categories before sharing, send an update manually or enable automatic updates, and later narrow access, pause sharing or remove the connection.

When you authorise delivery, selected records pass through HealthSync's service to the recipient. The service can process these packages; this is not end-to-end encryption that prevents HealthSync from accessing their contents. We use encrypted network connections and access controls.

Your chosen AI provider

A provider or agent you connect receives the information within its approved scope. Its own terms, settings and retention practices govern its copy. Check its data-use and training settings before sharing. HealthSync does not control every provider's practices or guarantee that an external agent stores or remembers information.

Recipients can include OpenAI (ChatGPT or the OpenAI API), Anthropic (Claude or the Claude API), or the operator and model services behind an agent such as OpenClaw, Hermes, Muse or Grok Bot. A software name does not establish who hosts a self-managed agent. Review the actual destination shown during approval and the services configured in that agent.

Consumer chat products and developer APIs can have different training, retention and deletion settings. HealthSync does not change those account settings. For managed OpenAI API requests, HealthSync requests that responses are not saved as response objects. This does not eliminate the provider's safety logs or other applicable retention.

Removing access prevents future authorised reads. It does not recall copies, exports or conversations already held elsewhere. Contact the recipient to manage those copies. HealthSync does not sell health records, use them for advertising or marketing, or train its own AI models on them.

Usage analytics and earlier test versions

TestFlight build 1.0 (45) and the upcoming public release do not include PostHog or collect app-usage analytics. Build 1.0 (44) and earlier TestFlight versions still contain the analytics SDK until updated. Local diagnostic reports stay on your iPhone unless you choose to share them.

Earlier TestFlight versions used PostHog's EU service for app lifecycle and setup events, agent choices, app/device details and random installation identifiers. Health records, account details, credentials and screen contents were excluded. Updating to a version without analytics removes the analytics SDK and clears its unsent local events. Older versions can continue sending events according to their own settings until updated.

Removal does not erase events already received by PostHog. Contact thiago@healthsync.me about access or deletion. If Earlier analytics appears in Settings or Account & data privacy, you can copy the saved reference to help locate those events. Existing references remain only on the iPhone; the version without analytics does not create new ones. References lost before the update or after app deletion may not be recoverable. Do not send health records or account credentials for this purpose.

The earlier test project's one-year query window is not a guarantee that all stored copies are erased after one year. We are obtaining PostHog's deletion procedure and storage/backup timeframes for these earlier events. We will update this notice when those timeframes are confirmed.

Support and service security

If you email us, we receive your contact details and the message or attachments you choose to send. Please avoid health records, passwords and API keys. Support correspondence is kept as needed to resolve the request, handle follow-up and meet applicable obligations; relevant correspondence may be needed to establish or defend legal claims.

A diagnostic report is generated locally and is shared only when you choose a destination. Service providers process request and security metadata, including IP addresses used for abuse prevention. HealthSync does not retain Worker application logs in its current service configuration. Infrastructure providers can still process security logs.

How long information is kept

Your iPhone library stays until you remove records, delete your account or delete the app and its data. Offloading the app can preserve local data. Removing the app alone does not ask the server to delete your account.

Temporary deliveries expire seven days after the request or are removed earlier after the appropriate receipt or cancellation. Expired deliveries cannot be read, even if an outage delays physical cleanup. Transfer metadata is scheduled for cleanup after 30 days from creation. Per-agent category checkpoints remain until account deletion so updates can be delivered consistently. Managed collection keeps configuration and progress while the setup is active. Completed collection jobs become eligible for cleanup after seven days; pending jobs remain until completed or cancelled. Cleanup can be delayed by outages or inactivity.

Settings → Delete account removes active HealthSync cloud data and connections, revokes Apple sign-in tokens and clears this iPhone's library. Other linked iPhones clear their library when they next connect. A failed deletion stays pending and retries. Minimal deletion receipts can remain until the session expires, at most 30 days, and a non-content namespace marker prevents old credentials from recreating the deleted namespace. Earlier Cloudflare SQLite recovery copies may remain for up to 30 days.

Apple Health originals, downloaded files and copies held by your agents remain under your or their control.

Your choices and rights

You can change Apple Health permissions in iOS, choose future imports, export or remove retained records, change each agent's access and delete your account. Signing out pauses imports and agent access while preserving your local library for your next sign-in.

Where UK or European data protection law applies, we use the following legal grounds:

• Account identifiers and connection settings: providing the service you request (contract).
• Health records and their sharing: your consent, including explicit consent for sensitive health information.
• Security and ordinary support correspondence: our legitimate interests in keeping the service secure and answering requests. We use only information needed for those purposes.
• Records needed to comply with a legal obligation: that obligation.

Withdrawing consent does not affect earlier lawful processing. You can stop future Health imports in iOS and withdraw an agent's access in HealthSync. Removing a Health permission does not itself erase copies already imported; use HealthSync's deletion controls as well.

Depending on applicable law, you may request confirmation of processing, access, correction, deletion, portability, restriction or objection, information about recipients, and withdrawal of consent. HealthSync does not make decisions with legal or similarly significant effects about you based on automated processing. A connected AI provider's processing is separate. Contact thiago@healthsync.me. We may verify your identity without asking for passwords or unnecessary health records. You may also complain to the relevant data protection authority, such as the UK Information Commissioner’s Office, your local EEA supervisory authority or Brazil’s ANPD. These choices are available without creating an account or paying a fee. Where local law gives you additional rights, you may exercise those rights too.

Where information is processed

HealthSync is operated from the UK. Cloudflare provides distributed infrastructure, and your chosen agent may process data in other countries. PostHog retains earlier TestFlight analytics in its EU service as described above. A provider's location is not a guarantee that every operation remains in that region.

Cloudflare's Data Processing Addendum provides safeguards for transfers to its infrastructure. These include the EU Standard Contractual Clauses and the UK Addendum for restricted transfers, and the Data Privacy Framework for transfers covered by it. Its subprocessor list identifies the other organisations it uses. Contact thiago@healthsync.me to request information or a copy of the applicable safeguards.

Your chosen AI provider or self-managed agent operates separately and may use infrastructure in other countries, including the United States. Its transfer arrangements depend on the provider, destination and your account. HealthSync does not promise that every recipient keeps information in your country. Review the recipient before authorising access; you can decline or remove a connection.

For earlier TestFlight analytics, HealthSync has signed PostHog's data processing agreement. Questions about earlier data, onward processing and deletion remain under review as described above; signing that agreement does not erase previously collected events.

Website

The HealthSync website provides product information and support and is hosted using OpenAI Sites. Its pages do not include usage analytics or advertising trackers. Hosting and network providers still process connection information, such as IP addresses and request metadata, to deliver and protect the site.

Changes

We will date material changes on this page and use an in-app notice or another appropriate channel when a change affects your choices. We will seek new permission where required before using data for a new purpose. Contact: thiago@healthsync.me.