HealthFlow
Contents

Privacy Policy

Effective date: [DATE OF PUBLICATION]

This policy explains what data the HealthFlow app for iPhone ("HealthFlow", "the app") handles, where it is kept, when it leaves your device, and what you can do about it. It applies to the app and to this website.

1. The short version

  • Your health data stays on your iPhone. HealthFlow has no account and no server that stores your lab results, documents, health conditions, questionnaire answers or conversations.
  • AI features only run with your consent. When you scan a report or talk to Flow, the data needed for that request is sent to an AI service. The app asks for your permission first and tells you what will be sent.
  • Analytics and crash reports are optional and are off until you agree. They never contain your health values.
  • No ads, no selling of data, no tracking across other companies' apps and websites. Your data is not used for advertising or marketing.
  • You can delete everything in the app at any time.

2. Who is responsible

HealthFlow is developed and published by Andrei Samchenko, [ADDRESS — TO BE PROVIDED] ("we", "us"). We are the controller of the personal data described in this policy.

Contact: support@myhealthflow.app

3. Data stored on your device

HealthFlow keeps the following data in the app's private storage on your iPhone. We cannot see it, and it is not copied to any server of ours:

  • Profile: name (optional), sex, date of birth, profile photo (optional), the country of your App Store account.
  • Lab results and documents: recognized values, units and reference ranges, report dates, the images of scanned pages and imported PDF files. A scanned report may contain information printed on it, such as your name, date of birth or the lab's order number.
  • Health context: health conditions you add (for example, pregnancy and its week, menstrual cycle phase or menopause), your answers to the "About you" questionnaire (for example, lifestyle, medications, supplements and diagnoses), and your goals.
  • Conversations with Flow: your messages and Flow's answers.
  • Apple Health data, if you connect it: see section 5.
  • App settings: your consent choices, free-tier usage counters and display preferences.

This data is part of your iPhone's backups (iCloud Backup or a backup on your computer) if you have backups turned on. Those backups are handled by Apple under your Apple account and settings.

4. When data leaves your device

4.1 Recognizing a lab report (AI scan)

When you scan or import a report, the app sends the images of its pages to an AI model for recognition. The whole page is sent, including your name and date of birth if they are printed on it. The model returns the values it found; you review them before anything is saved.

  • Sent to: OpenRouter, Inc. (USA), which routes the request to Google's Gemini model (Google LLC, USA).
  • When: only after you agree in the consent screen shown before your first scan. Without consent, no image is sent.
  • Not sent: your profile, your other results, your Apple Health data.

4.2 Flow chat and "Flow's review"

When you ask Flow a question or request a review of your results, the app sends the request to an AI model together with the context Flow needs to answer:

  • your sex and age in years (not your date of birth);
  • health conditions you added, including pregnancy and its week;
  • your questionnaire answers, which may include diagnoses, medications and supplements;
  • your goals;
  • your lab results with their dates, units, reference ranges and status, and the names and dates of your recent reports;
  • the text of the current conversation and the language for the answer.

Not sent: your name, your profile photo, the values of your Apple Health data, biomarkers you have hidden, and measurements you have excluded.

  • Sent to: OpenRouter, Inc. (USA), which routes the request to Anthropic's Claude models (Anthropic, PBC, USA). A shorter excerpt of the conversation is used to suggest follow-up questions.
  • When: only after you agree in the consent screen shown before your first conversation. Without consent, Flow does not run.

4.3 How AI providers handle requests

OpenRouter, Anthropic and Google process these requests to return an answer, under their terms for business API customers. Under those terms, data sent through the API is not used to train their models. Providers may keep requests for a limited period for security and abuse monitoring. We do not receive or keep a copy of your images or conversations on any server.

AI can make mistakes. Always check recognized values against your report, and see the Terms of Use for the medical disclaimer.

4.4 Subscriptions

Payments are handled by Apple through your Apple account. We never see your payment details. To manage subscriptions, the app uses RevenueCat, Inc. (USA), which receives a random app user identifier, your purchase and subscription history from the App Store, and technical data such as the app version, device type and IP address. RevenueCat does not receive your health data.

4.5 Analytics and crash reports (optional)

At the end of onboarding the app asks whether you allow usage analytics and crash reports. If you decline, these services are not started. You can change your choice at any time in Settings → Privacy → Analytics and crash reports.

If you allow it:

  • PostHog (PostHog Inc., data hosted in the EU) receives events about how the app is used — for example, that a scan was completed or the paywall was shown — with counts and settings, a random identifier, the app version, operating system version, the country of your App Store account and your subscription status. Events never contain your health values, conditions, questionnaire answers, goal names, the text of your messages or your name.
  • Sentry (Functional Software, Inc., data hosted in the EU) receives crash reports and performance traces: device model, operating system, app version, and technical details of the error. Screenshots are not attached.

4.6 Other technical services

  • Firebase (Google LLC) provides app infrastructure. It may receive technical data such as an app instance identifier, the app version and IP address. It does not receive your health data.
  • To check whether you are online, the app occasionally requests a page from apple.com.
  • When you contact us by email, we receive your email address and whatever you write. We use it only to answer you.

5. Apple Health

If you connect Apple Health, HealthFlow reads the data types you allow: heart rate, resting heart rate, heart rate variability, blood oxygen, respiratory rate, blood pressure, VO₂ max, weight, body mass index, body fat, waist circumference, blood glucose, steps, active energy, walking speed, height, sleep, sex and date of birth. HealthFlow never writes to Apple Health.

Apple Health data is stored on your device to show it next to your lab results. It is not sent to AI services, analytics or any other third party, and it is never used for advertising or marketing. If you fill in your profile from Apple Health, your sex and age become part of your profile and are used as described in section 4.2. You can change Apple Health access at any time in the Health app or in iPhone Settings.

If the EU or UK General Data Protection Regulation applies to you:

  • Data about your health sent to AI services (sections 4.1 and 4.2) is processed on the basis of your explicit consent (GDPR Article 9(2)(a) and Article 6(1)(a)).
  • Analytics and crash reports are processed on the basis of your consent (Article 6(1)(a)).
  • Subscription management is necessary to perform our contract with you (Article 6(1)(b)).
  • Security and keeping the app working, including technical infrastructure, is based on our legitimate interests in providing a reliable and secure service (Article 6(1)(f)).

You can withdraw consent at any time. This does not affect processing that happened before you withdrew it.

7. International transfers

Some of the providers above are located in the United States. Where data protection law requires it, transfers are made under the EU–US Data Privacy Framework where the provider is certified, or under Standard Contractual Clauses approved by the European Commission.

8. How long data is kept

  • On your device: until you delete it in the app or delete the app.
  • AI requests: kept by the providers only for the limited period described in section 4.3.
  • Analytics events: up to 24 months. Crash reports: up to 90 days.
  • Subscription records: as long as required for accounting and to restore your purchases.
  • Emails to support: as long as needed to resolve your request, and no longer than 24 months.

9. Your choices and rights

In the app you can:

  • Delete all your data: Settings → Delete All Data. This removes your results, documents, conversations, health context and profile from the device.
  • Export a copy: Settings → Export Data, as a file you can keep or share.
  • Turn analytics and crash reports on or off: Settings → Privacy.
  • Stop sending data to AI services by not using scans and Flow; consents can also be withdrawn in Settings → Privacy.
  • Change Apple Health access in the Health app.

Depending on where you live, you also have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to processing, and to withdraw consent. Because your health data is stored only on your device, most of these rights are exercised directly in the app. For anything else — for example, deleting analytics data or getting a complete copy of what the export does not include — write to support@myhealthflow.app. We will answer within one month.

You also have the right to lodge a complaint with your local data protection authority.

10. Age

HealthFlow is intended for adults 18 years and older. We do not knowingly collect data from anyone under 18. If you believe a minor has used the app, contact us and we will help remove the data.

11. Security

Your data is protected by your iPhone's security: the app's storage is accessible only to HealthFlow, and iOS encrypts data on a locked device. Data in transit to the services above is encrypted with HTTPS. No method of storage or transmission is completely secure; keep your iPhone protected with a passcode.

12. Changes to this policy

If we change this policy, we will publish the new version on this page with a new effective date. If a change affects what data leaves your device, the app will ask for your consent again before it applies.

13. Contact

Andrei Samchenko
[ADDRESS — TO BE PROVIDED]
support@myhealthflow.app