Privacy Policy - HealthReports

Last Updated: 13 October 2026

This policy explains how HealthReports collects, uses, and protects information when you use the app and its services.

1. Information We Collect

Depending on your choices and permissions, we may process:

• HealthKit data that you authorize for reading (e.g., activity, sleep, heart, vitals).
• Manual entries you add in the app (e.g., nutrition, vitals, body metrics), and notes you write about your workouts (why you did one, who came along, how you felt). Workout notes stay on your device, and in your iCloud if you turn their sync on. An effort rating you give a workout in the app is saved to Apple Health, where the Fitness app shows it too.
• Assistant context you create or approve (notes, preferences, and other non-HealthKit context).
• Subscription and purchase information from the App Store and RevenueCat.
• Usage and diagnostics data:
  • Firebase Crashlytics collects crash reports and device information.
  • Firebase Remote Config delivers feature flags and settings.
  • Google Analytics for Firebase collects aggregated usage metrics.
  • AppGlance collects anonymous usage events (screens opened, purchases, exports) tied to a random install identifier. They never include your health data.
  • Firebase Cloud Messaging stores usage metadata on our servers, linked to your device's notification token: which general report sections you have opened (never reports on sensitive topics such as cycle, pregnancy, menopause, symptoms, mood or medication), whether you have active goals, and whether you have chosen a health focus and taken its plan, but not which focus. Which focus people choose is only added to monthly totals that identify no one. This data is used to send you relevant feature notifications and to understand how the app is used.

2. How We Use Information

• Generate reports, trends, and insights based on your HealthKit data.
• Power the assistant and provide contextual answers.
• Store your manual entries and preferences.
• Manage subscriptions and entitlements.
• Improve stability and performance via diagnostics.
• Comply with legal obligations.
• Send you relevant push notifications about app features based on your usage patterns (e.g., notifying you about a report you have not yet explored). This is based on usage metadata only, never on your health data or on reports about sensitive topics.

3. Data Storage and Security

• By default, HealthKit data and manual entries are stored locally on your device.
• Assistant context is stored locally unless you enable iCloud sync.
• If iCloud sync is enabled, assistant context is stored in your private iCloud CloudKit database and synced across your devices.
• Data in transit uses TLS and data at rest is protected by Apple and iOS security.
• You can delete assistant context and disable sync at any time.

4. Third-Party Services

We use the following services to deliver the app:

• Apple Health / HealthKit - access to health data with your permission.
• Apple App Store - payments and subscription management.
• RevenueCat - subscription entitlement management.
• Apple Refund Request Processing - when you request a refund from Apple, we may share consumption data with Apple to help resolve your request.
  • Data shared may include: account age, purchase history, refund history, delivery status, and usage patterns of purchased features.
  • This data sharing is strictly limited to refund request resolution and complies with Apple's policies. By using the app and making purchases, you consent to this data sharing practice.
• Firebase Crashlytics - crash diagnostics.
• Firebase Remote Config - feature flags and settings.
• Google Analytics for Firebase - aggregated usage analytics.
• AppGlance - privacy-focused usage analytics: anonymous events tied to a random install identifier, without health data, not used for tracking or advertising.
• AI provider (e.g., OpenAI) - processes assistant requests to generate responses.
  • Receives: your questions and messages, photos of meals you choose to analyse, the health data relevant to the conversation, and the conversation so far.
  • Does NOT receive: your name, email, Apple ID, or any identifier of you or your account. Our server uses your purchase identifier only to count your AI credits and replaces it with a pseudonymous code, derived from it irreversibly, that lets the provider detect misuse without knowing who you are.
  • So that a conversation can continue, the provider keeps its state for up to 30 days, with nothing that identifies you.
  • Data is processed according to the AI provider's data processing terms. We recommend reviewing their privacy policy.
• iCloud CloudKit - optional sync between your devices, turned on item by item in Settings (e.g., assistant context, goals, training plans, workout notes). It is stored encrypted in your private iCloud database.
• Apple Fitness+ catalogue. When a workout was an Apple Fitness+ session, the app looks it up on fitness.apple.com to show its title, trainer, body focus and equipment. Only the session's catalogue number is sent to Apple, never any health data; each session is looked up once and kept on your device.
• WishKit - the feature requests board in the app. Receives the ideas, comments and votes you post, an anonymous identifier it creates itself and, if you subscribe, the list price of your plan as a monthly figure, so requests can be weighed. It receives no health data, name or email.
• Apple Private Cloud Compute - a report too large for the on-device model can be summarized on Apple's servers, under Apple's privacy guarantees: the data is used only for that request and is not kept. This is turned off; we will say so in the release notes before turning it on.
• Firebase Cloud Messaging (Google) - sends push notifications and stores usage metadata (general report sections opened, goal activity, whether a health focus is chosen) for notification targeting and usage statistics. No health data, no reports on sensitive topics and not the focus you choose.

Each provider processes only the data required for its service. Please review their policies for details.

5. Your Rights

• Review and revoke HealthKit permissions in iOS Settings at any time.
• Delete local app data from the app or by removing the app.
• Enable or disable iCloud sync for assistant context in Settings.
• Manage or cancel subscriptions in your App Store account.
• Contact us to request access to or deletion of data we control.

6. Children's Privacy

The app is not intended for children under 16. We do not knowingly collect personal data from children.

7. Changes to this Policy

We may update this Privacy Policy from time to time. Updates will be posted in the app and on our website.

8. Contact

For questions or requests regarding this Privacy Policy: