HealthMate Privacy Policy
This policy explains what personal data HealthMate uses, where it goes, how long it is kept and what your rights are. It covers the HealthMate apps for iPhone and Apple Watch and is part of the HealthMate Terms of Use.
In short
- No account. HealthMate has no sign-up, password or email login.
- Your records stay on your iPhone. Your profile, logs, Apple Health data, documents and chats are stored in the app on your device, not on our servers.
- AI features send data to be processed, not stored. When you use an AI feature, the app sends what that feature needs, for example your question, a meal photo and relevant health context, through our server in the EU to an AI provider. The result comes back to your iPhone. We don't save the content — while a conversation is going on, our server keeps the last few messages in its working memory so the coach can follow it, and they are discarded shortly afterwards (Section 3.2).
- Health data is used only with your explicit consent, which you can withdraw at any time.
- Our server keeps very little: a random ID for your installation, notification details, your recent wake-up times so the morning briefing arrives when you are up, the start time of today's next planned workout, and technical logs.
- No ads, no tracking, no analytics, and we never sell your data. We do collect crash and performance reports, with no personal content in them (Section 3.1).
- You can delete everything from the app: Settings → Privacy & Data → Delete all data.
1. Who is responsible for your data
The data controller for HealthMate is:
Ilia Vlasov, operating as "w4app" (sole trader), domiciled in Finland. Contact: (or )
We have not appointed a Data Protection Officer, because the law does not currently require one for a service of our size. We will appoint one if that changes.
If HealthMate is transferred to another entity, for example a company we set up, we will tell you in the app before the change. The new controller will be bound by this policy, and your rights will not be reduced.
2. Data stored on your iPhone
HealthMate stores the following in the app on your iPhone, and workout data on your Apple Watch. The Watch records the workout itself and sends your heart rate to your iPhone over your own devices' local connection; it does not send anything to us directly.
On your iPhone:
- Profile: your name (optional), age, sex, height, weight, activity level, goals, diet preferences, daily routine, medical conditions (optional), and your coach's name and style.
- Apple Health data you allow HealthMate to read: steps, walking and running distance, active and resting energy, exercise and stand time, workouts, heart rate, resting heart rate, heart rate variability, blood oxygen, VO2 max, irregular rhythm notifications, sleep, mindful minutes, weight, BMI, body fat percentage, lean body mass and height. During setup, and only if you allow it, HealthMate also reads your date of birth and sex from Apple Health to fill in your profile — you see both on screen and can change or clear them at any time. Nothing else is taken from Apple Health for your profile.
- What you log and create: meals (text, photos and voice), water, mood, energy, workouts and weight; health documents you upload and the details taken from them; health records such as conditions, medications and allergies; chats with the coach and trainer; briefings, plans, goals and reminders; restaurants and menus you save or scan, including the restaurant's name and its location rounded to about 100 metres; your frequent dishes with their typical portions; and the gyms you use with the equipment recorded for each. Your own location is used on your iPhone to find places near you — restaurants and gyms — and is not sent to us.
- Focus status, if you allow it: only whether a Focus (such as Sleep) is on or off — iOS does not tell us which one. HealthMate uses it on your iPhone to hold the morning briefing until your Focus ends, so it arrives when you are actually up. It is not sent to our server.
With your permission, HealthMate also saves workouts you record, and your weight and BMI, to Apple Health. If you turn on Calendar Sync, it adds planned workouts to your calendar.
HealthMate does not use iCloud to store or sync your data. We can't see the data stored on your iPhone unless the app sends it as described in Section 3. It stays until you delete it in the app, use Delete all data or delete the app.
3. Data that leaves your iPhone
3.1 AI and coaching features
These features work through our server, hosted by Amazon Web Services in Stockholm, Sweden. The server passes each request to the provider listed below and returns the result to your iPhone. It does not store what you sent or the result.
HealthMate prepares daily briefings automatically: when you open the app, after you log a meal or a workout, and a few times a day in the background.
| When you use | What the app sends | Who processes it |
|---|---|---|
| Daily briefings and coach chat | Your message or voice message, and relevant context: your profile (including your name, if you entered one), goals, recent meals and workouts, Apple Health summaries such as steps, heart rate, sleep — including last night's bedtime, wake time and time in each sleep stage, compared with your own usual night — heart rate variability and blood oxygen, and the conditions, medications and allergies you recorded. When a question in the Health Coach chat needs more, the coach can ask your iPhone for it: up to 90 days of sleep, heart rate and other vital signs, activity, workouts and mood and energy check-ins, up to 31 days of logged meals, up to a year of weight, and the list of health documents you uploaded and, only if you tap Yes when the app asks, the text of a document. Your iPhone sends only what that question asks for, and the chat shows what it is reading | OpenAI; xAI as a backup. The Health Coach chat uses OpenAI only |
| Food logging with a photo, voice or text | The photo, voice recording or text, and the meal type | OpenAI; xAI as a backup |
| Spoken replies (studio voice, on by default) | The text of the assistant's reply that is about to be spoken, and the app language. Never a recording of your voice. A few fixed phrases without any of your details, such as "Starting your workout", are kept on our server as audio for up to 30 days so they play faster; nothing in them identifies you or your device. To keep everything on your iPhone, choose the phone voice in Settings → Voice | OpenAI |
| Your frequent dishes (Pro; at most once a day, usually once a week) | Up to 30 days of your meals as text: titles, meal type, the local time without time zone, and the items with their weights and macros. No photos or voice | OpenAI; xAI as a backup |
| Calorie and macro targets | Your weight, height, age, sex, activity level and goal, with average steps, active calories and weekly workouts | OpenAI; xAI as a backup |
| Gym equipment photo | The photo | OpenAI; xAI as a backup |
| Menu scan and dish suggestions | Menu photos, or the text of a menu you open from a QR code or a file together with the website's name (never the full link), with your diet, allergies and dislikes; for suggestions, the dishes plus your remaining calories and macros, goal, diet, allergies, dislikes, conditions and recent meals | Menu reading: OpenAI, with xAI as a backup. Dish suggestions: xAI, with OpenAI as a backup |
| Restaurant or gym detection (optional, needs location permission) | For a restaurant: a short excerpt of the menu text, and the names of nearby places your iPhone found. For a gym: the gym's name, and the equipment recorded for it once you confirm which gym you are in | Nearby places are searched from your iPhone with Apple Maps: Apple receives the area being searched, as with any map search, and your location is never sent to us. The app takes one location reading when you open restaurant mode, not continuously. xAI, with OpenAI as a backup, receives the menu excerpt and that list of names to pick the most likely restaurant. A gym's name and equipment list go to our server and on to the coach as part of the features below |
| Coaching during a workout | While a workout is running: each set you log (the exercise, weight, repetitions and how hard it felt), the equipment of the gym you are in, your heart rate at the moment you speak or finish a set, and the text of what you say to the coach — your speech is turned into text on your iPhone and the recording is not sent to us (see Voice below for what Apple may do with the audio). Your heart rate goes as a snapshot at those moments, not as a continuous stream; in a cardio session it is compared with a target range — the one in your plan, one you set yourself, or your own usual range worked out from your past workouts of that type — and in a strength session no range is sent at all. There is a limit on how many times the coach answers within one workout. This feature needs your AI consent: without it, and whenever the request fails or you are offline, the session runs on prepared lines on your iPhone and nothing is sent. In a run, ride or walk the coach also receives your distance, your pace, that target range and where you are in the session — numbers mirrored from your Apple Watch. Your route and location are not sent: there are no coordinates in what leaves your iPhone, only distance and pace. After the workout, a summary (the type, duration, distance, pace, laps, the planned title, how long you spent below, in and above your plan range, and last night's sleep) goes with your next briefing. | OpenAI first; xAI as a backup. If both are unavailable, the session continues on prepared lines written by us |
| Trainer and workout plans | Your messages or voice messages, goal, schedule, activity summaries (steps, active minutes, resting heart rate, sleep, recent workouts) and fitness goals | OpenAI; xAI as a backup |
| Health documents | The document (photo or PDF) and its text; to update your records, the details taken from it together with your existing health records and goals | OpenAI; xAI as a backup |
"Backup" means the request goes to the second provider only if the first one fails.
Voice. There are two different paths, and it is worth keeping them apart:
- A voice message you record in chat is uploaded and transcribed by OpenAI. The recording itself leaves your iPhone, which is why "voice recordings" appears in what the AI features send. Your iPhone keeps a copy of each sent voice message for 7 days so you can play it back in the chat, then deletes it; a recording you cancel, or one too short to send, is deleted straight away.
- Talking to the coach, in a live conversation or during a workout, works the other way round: Apple's speech recognition on your iPhone turns your speech into text and only that text is sent to us. We do not receive the recording. Depending on your device and language, Apple's speech recognition may itself send the audio to Apple's servers to transcribe it — that is Apple's processing under Apple's privacy policy, not ours, and it is why we say the recording is not sent to us rather than that it never leaves your phone.
When the microphone is on during a workout. The coach talks to you while HealthMate is open on your screen; it does not keep running with your iPhone locked. The microphone opens only when you press to talk or right after the coach asks you something, not for the whole workout, and iOS shows its own indicator whenever an app is using the microphone, so you can check this rather than take our word for it.
We do not store what you say. During a workout our server keeps the last few turns of the conversation in its working memory so the coach can follow what you said, for up to three hours from your last message, and they are gone after that or if the server restarts. Nothing of the conversation is written to a database or a log. Replies are read aloud by your iPhone. When the Health Coach asks your iPhone for data to answer a question, our server holds that request's working state for at most 2 minutes so it can finish the answer, and then it is deleted.
What the providers receive and how they use it. Our server sends the requests, so providers don't receive your device ID, IP address or advertising identifiers. The requests can still contain personal and health information, such as your name and the context above, and we treat them as personal data. OpenAI and SpaceXAI LLC (trading as xAI) process requests only to return a result to us. Under their API terms they do not use what we send to train their models, and we have not turned on any setting that would share your data with them for training. OpenAI keeps a copy for up to 30 days to detect abuse, longer only in limited cases such as legal obligations. xAI keeps nothing: we use its zero-data-retention API, so your request and the answer are deleted as soon as the answer is returned. Crash and performance reports go to Sentry (Functional Software, Inc.), stored in its EU data region. They carry the error type, a static code and a path template, with tracing sampled — never request bodies, your text, your IP address, a user id or request headers. Once a day the app also sends Sentry a short report on whether iOS still wakes it in the background: settings such as Background App Refresh and Low Power Mode, whether notifications are allowed, whether Focus is on and whether you allowed HealthMate to see it, counts of background wake-ups, and rough time buckets like "today" or "over 24 hours ago" — no health values, no exact times and no identifier. With it goes a count of the morning notifications for each earlier day: how many briefings were ready to notify you, how many notifications were shown, and how many were held back, by reason from a fixed list (for example quiet hours, Focus, notifications turned off, or already delivered). The day is only "yesterday" or "earlier", with no date, time or text. If the subscription offers fail to load or purchases are restricted on your device, the app may send one short report each time the subscription screen opens: whether the app runs from the App Store or a test build and how it found that out, the country of your App Store (for example "FI"), how many offers loaded, whether purchases are allowed, and the error code. Each time the subscription screen loads its offers, the app also notes in the crash report which offers it asked for (such as the monthly and the yearly plan), how many loaded and any error code. None of this includes your account, a purchase or an identifier, and the app only checks whether a purchase receipt is from the App Store or a test build, never what is in it. After each menu scan the app also reports how long the scan took and its size: the number of pages, bytes sent and the time of each step — no dishes, place or images. Sentry keeps them for the retention period of our plan and we keep no separate copy.
3.2 What our server keeps
| Record | What it contains | Why | How long |
|---|---|---|---|
| Device record | A random ID our server creates when you first open HealthMate, which the app uses to sign its requests; your Apple push token, if available; time zone; platform; app version and build; plan (whether you have an active subscription or trial); whether background updates are on; when the record was created and last used | To recognise your installation, send background updates at the right local time and apply fair-use limits | Until you use Delete all data, or 12 months after the app last contacted our server |
| Update history | Which background update we sent to your device, when, and whether it arrived | To avoid duplicates and fix delivery problems | 90 days |
| Night already covered | The date on which your briefing last described the previous night, stored under a one-way code (hash) of your device ID | So the next briefing doesn't describe the same night twice | 36 hours, or until you use Delete all data |
| Frequent-dishes limit | The local date of your last frequent-dishes request, under a one-way code (hash) of your device ID. Nothing about your meals | To allow at most one such request a day | 36 hours, or until you use Delete all data |
| Wake-up times | The time you woke up on each of the last days (at most 14), with the date, taken from the sleep data sent with your briefing and stored under a one-way code (hash) of your device ID | To send your morning briefing when you are actually up | 15 days, or until you use Delete all data |
| Next workout check | The planned start time of today's next workout and the ID of its entry in your plan, plus the IDs of entries already checked today — no titles or other details — taken from the plan sent with your briefing and stored under a one-way code (hash) of your device ID | To check once, 20 minutes after the planned start, whether you have started, so the app can offer a reminder | Until local midnight that day, or until you switch AI features off or use Delete all data |
| Morning check paused | A yes/no flag in your device record, with no date or reason, saying that you switched AI features off — so we stop timing the morning briefing | To respect your choice until you switch AI features on again | Until your next AI request, or until you use Delete all data or your device record is deleted |
| Usage counters | How often you used each AI feature in a rolling period, stored under a one-way code (hash) of your device ID or, if you subscribe, of your App Store purchase ID | Fair-use limits | Deleted automatically within 45 days |
| Subscription check | Apple's signed proof of your subscription, sent with AI requests. We check it with Apple's certificates and keep the result: purchase ID, plan and expiry date | To apply Pro limits | 24 hours |
| Application logs | Time, request path, status and duration; a short one-way code of your device ID; the AI feature and model used, with token counts and cost; errors | Security, fixing problems and cost control | Up to 30 days |
| Web server logs | The IP address of each request, with the app and iOS version | Security and fixing problems | 14 days |
While you plan workouts with the trainer, the conversation is kept in the server's memory and discarded 15 minutes after your last message. During a workout, the coach's last few turns with you are kept the same way — in memory only — and discarded three hours after your last message, or when the server restarts. When the Health Coach asks your iPhone for data, the working state of that answer is kept for at most 2 minutes. Night already covered, the frequent-dishes limit, wake-up times, the next workout check, usage counters and the subscription check are held only in our server's memory, are never written to disk or backed up, and a server restart can remove them earlier. Backup copies of our server database are deleted after 30 days. We do not keep the content of AI requests or their results.
3.3 Apple
- App Store. Apple sells HealthMate Pro and processes payment under its own terms. We receive only the proof of purchase described above, never your payment details or Apple Account email.
- Push notifications. Our server sends background updates through the Apple Push Notification service. They contain only the type of update and an ID, no health information. The notifications you see are created on your iPhone. Some of them, such as a note that a vital sign is outside your usual range, can include your own values, and iOS shows notifications on the lock screen by default. To hide their content until your iPhone is unlocked, set Settings → Notifications → Show Previews to "When Unlocked".
- Apple Health, speech recognition and Apple Maps are Apple services that HealthMate uses on your device. Apple's privacy policy applies to how Apple handles that data.
- Menu websites. When you open a menu from a QR code, your iPhone loads that page itself, so the restaurant's website sees the visit as it would from any browser. HealthMate opens only web links, keeps no cookies or browsing data from the page, and our server never opens the link.
3.4 Emails
If you email us, we use your address and message to reply, and we keep the conversation for up to 24 months.
4. Why we use your data (legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Using your health data: Apple Health data, health entries and documents, and health information sent with AI requests | Your explicit consent (Art. 9(2)(a) and Art. 6(1)(a)) |
| Providing the features you use: the device record, update history, subscription check and AI requests without health data | Performance of our contract with you (Art. 6(1)(b)) |
| Finding places near you | Your consent, given with the iOS location permission (Art. 6(1)(a)). Your location is used on your iPhone and in the Apple Maps search it makes, and is never sent to us |
| Crash and performance reports and the daily diagnostic reports sent to Sentry (Section 3.1) | Our legitimate interest in keeping HealthMate working and fixing problems (Art. 6(1)(f)) |
| Fair-use limits, security, logs and backups | Our legitimate interest in keeping HealthMate secure, working and affordable (Art. 6(1)(f)) |
| Answering your emails | Our legitimate interest in helping you (Art. 6(1)(f)) |
Your consent to using health data. Before HealthMate first uses your health data in AI features, it asks for your explicit consent on a separate screen. This is separate from accepting the Terms of Use. You can withdraw consent at any time in Settings → Privacy & Data. HealthMate then stops sending health data to AI providers, and features that need it are no longer available. Withdrawing doesn't affect what happened before. Apple Health access is controlled separately in the Health app.
Do you have to provide data? No. HealthMate has no account, and Apple Health, location, camera, photos, microphone, speech recognition, calendar, notification and Focus status permissions are all optional. Location is never sent to us; it is used on your iPhone and for the Apple Maps search of nearby places. Without it, you can still find a restaurant by its name. If you decline one, only the features that need it are unavailable.
5. Transfers outside the EU
Our server and database are in the EU (Amazon Web Services, Stockholm, Sweden). AI requests are processed outside the EU, including in the United States: SpaceXAI LLC (trading as xAI) is a US company, and its default endpoint does not guarantee a processing region. For OpenAI, our contract is with OpenAI Ireland Limited in the EU; OpenAI transfers data onward to companies in its group outside the EEA under the European Commission's Standard Contractual Clauses or an adequacy decision. With SpaceXAI LLC we rely on the Standard Contractual Clauses in its data processing addendum, which forms part of its terms. Sentry stores our crash and performance reports in its EU data region. Apple may process data outside the EU under its own terms and safeguards. To get a copy of the safeguards, email .
6. Deleting your data
In the app: Settings → Privacy & Data → Delete all data. HealthMate first deletes your device record and update history from our server. This needs an internet connection; if our server can't be reached, nothing is deleted and the app tells you. It then deletes all HealthMate data on your iPhone, including your profile, logs, documents, photos, chats and settings, and returns to the start screen. If you use HealthMate again, it gets a new random ID.
Delete all data does not:
- delete data in Apple Health (manage it in the Health app);
- cancel your subscription (cancel it in your Apple Account settings);
- reach copies that expire on their own: AI providers' abuse-monitoring copies (up to 30 days), usage counters (up to 45 days), server logs (up to 30 days) and database backups (up to 30 days).
If you delete the app without using Delete all data, the data on your iPhone is removed, and your device record on our server is deleted 12 months after the app last contacted it.
7. Your rights
You have the right to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent at any time (GDPR Articles 7(3), 15 to 18, 20 and 21).
- Most of your data is on your iPhone, where you can view, change and delete it yourself.
- For data on our server, email . Because HealthMate has no accounts, we can only find your server records if you give us information that identifies them. If we can't identify you, we'll tell you (GDPR Article 11). Delete all data works without contacting us.
- We answer within one month. Complex requests may take up to two more months, and we'll tell you if so. Requests are free unless they are clearly unfounded or excessive.
- You can complain to the Finnish Data Protection Ombudsman (https://tietosuoja.fi/en) or to the data protection authority where you live.
8. Automated decisions
HealthMate uses AI to create suggestions for you. It makes no decisions that have legal or similarly significant effects on you (GDPR Article 22). Fair-use limits are technical limits on how often a feature can be used. You are free to ignore any suggestion.
9. Children
HealthMate is for adults aged 18 and over. We don't knowingly process data about anyone younger. If you believe a child is using HealthMate, contact .
10. Security
- Connections between the app, our server and our service providers are encrypted (HTTPS).
- Our server runs in the EU, and its database and cache can't be reached from the internet.
- The app identifies itself with a random ID, not your name or Apple Account, and our logs store only a one-way code of that ID.
- No AI provider keys are stored in the app.
- Administrative access to the server is restricted.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the Finnish Data Protection Ombudsman without undue delay and, where feasible, within 72 hours, and tell you in the app where the law requires it.
11. No ads, tracking or analytics
HealthMate contains no advertising, analytics or tracking tools. It sends crash and performance reports that carry no personal content (Section 3.1). It doesn't use your advertising identifier or track you across other companies' apps and websites, and we don't sell or share your data for advertising. The website that publishes this policy uses no advertising or analytics cookies. HealthMate's App Privacy details on the App Store summarise the practices in this policy.
12. Changes to this policy
We update this policy when our practices change and show the date at the top. We'll tell you in the app before significant changes take effect, and ask for your consent again where the law requires it. Previous versions are available on request.
13. Contact
- Privacy questions and requests:
- Support: and https://legal.w4app.com/healthmate/support
- Complaints: Finnish Data Protection Ombudsman, https://tietosuoja.fi/en
This policy is published at https://legal.w4app.com/healthmate/privacy.