1. Encrypted on your device
Your selected Apple Health data is summarized and encrypted on your iPhone or iPad using AES-256-GCM before it’s uploaded. The cloud stores ciphertext. The data key stays in your device’s Keychain.
2. Anonymous account
You sign in with Apple, which provides an anonymous identifier. We do not collect your name or email address.
3. Explicit, named consent for each AI
Before any AI can read your data, the app shows the specific AI service, its provider and its official privacy policy. Access is granted only when you press the confirmation button that names that recipient. Signing in, granting Health permissions and syncing are not consent to share with AI.
4. Authorization without storing secrets
An authorized connection receives decryption capability through an encrypted OAuth grant or a data key wrapped with the API key. The server stores neither plaintext API keys nor plaintext data keys. Data is briefly decrypted in server memory only to answer an authorized query.
5. Read-only, logged, revocable
- AI tools can only read the data you synced.
- Every access is logged — AI client, tool, parameters, IP address and time — and kept for 90 days so you can review it in the app.
- Revoke a connection or key at any time to stop future access.
6. Automatic deletion
Retention starts at your first successful sync and resets after each successful authorized AI query. If there’s no such query for 180 days, your cloud health ciphertext is deleted automatically. Uploads alone don’t extend this. Settings → Delete account & cloud data deletes cloud data, access history and all AI authorizations immediately.
7. No ads, no selling, no training
There is no advertising tracking. We do not sell health data or use it for advertising, profiling or model training. Recipients are required to keep data confidential, use it only for your requests and not use it for those purposes either.
8. Infrastructure
Encrypted data is stored on Cloudflare infrastructure, which processes it only to operate the service.
What we can’t control
Once an AI service receives a query result, it processes it under its own policy and your account settings (for example chat history). Revoking access stops future reads; to delete copies an AI already received, use that service’s controls.
Read the full privacy policy. Questions: rex@gravitylab.co.jp.
