Simple Health Privacy Policy

Effective date: September 16, 2026

Simple Health reads your Apple Health data and explains it in plain language. This policy is written the same way. It tells you exactly what we collect, where it goes, who sees it, and how to make any of it stop.

This policy covers the Simple Health iPhone app, the Apple Watch app, the widgets, our backend service, and our website (hellosimplehealth.com). It applies together with our Terms of Service. You can always find the latest version of both inside the app and at our legal pages.

The short version

You sign in with Apple. We receive a stable Apple identifier, your email address (which may be Apple's private relay address), and optionally your name.
The app reads Apple Health data on your iPhone only with your permission, and only the categories you approve.
You choose how AI runs. On-Device AI processes your health data entirely on your iPhone: nothing is sent to our servers to generate insights. Cloud AI sends health summaries and event-level statistics (never continuous raw sensor recordings) to our server and to OpenAI. Auto, the default until you pick an engine, prefers Cloud AI whenever your plan allows it, so it behaves like Cloud AI.
One important exception: smart notifications always use the cloud pipeline, even if you chose On-Device AI. While notifications are enabled, a short summary of single events (workouts, sleep, mindfulness, activity, heart events such as high, low, or irregular-rhythm notifications, body measurements such as weight or body composition, and cycle tracking entries) is sent to our server and forwarded to OpenAI to write the notification text. This applies to everyone with notifications on, including the free plan, not just paid or trial plans. Free accounts are capped at a set number of AI-written notifications per day. If you are offline, or a free account is over its daily limit, the notification is not written from an on-device template; instead it waits and is generated by the cloud once it is reachable again or the limit resets (over the daily limit the summary still reaches our server but is not forwarded to OpenAI until the limit resets). Turning off Simple Health notifications in iOS Settings stops this completely.
We never sell your data, never show ads, and never use your health data for advertising, marketing, or data mining. We never use your data to train AI models, and by OpenAI's API terms it does not use this data to train or improve its models either.
Apple handles all payments. We never see your card details or billing address.
You can delete your account inside the app at any time. That permanently deletes your account data from our servers.

Who we are

Simple Health is operated by Haider Nawaz ("we," "us"), based in Pakistan. For data protection law, we are the controller of the personal data described in this policy.

Questions, requests, or complaints: haider.builds@icloud.com

What we collect

Data you give us

Sign in with Apple: a stable, pseudonymous Apple user identifier, your email address, and (only on first sign-in, if you share it) your first and last name. If you choose Apple's "Hide My Email," we receive a relay address and never see your real email.
Profile details you choose to add: age, sex, height, weight, your typical wake and bed times, your health goals, and your activity level. These are optional and used only to make explanations more accurate.
Your choices: which AI engine you selected (On-Device, Cloud, or Auto) and which wearable devices you own.
Feedback: anything you send us, for example by email.

Apple Health data (only with your permission)

With your permission through Apple's Health permissions screen, the app can read these categories from Apple Health. You can grant or deny each one individually, and change your mind anytime in iOS Settings > Privacy & Security > Health.

Activity and fitness (steps, distance, workouts, active energy, and similar)
Heart (heart rate, resting heart rate, HRV, cardio fitness, and high, low, or irregular-rhythm events)
Sleep
Body measurements (including weight, blood pressure, blood glucose, blood oxygen, and respiratory rate)
Cycle tracking (menstrual data)
Mental wellbeing and mindfulness (State of Mind entries and mindful minutes)
Nutrition (dietary energy and water)
Hearing (audio exposure levels)

How your Health data is stored: when you are signed in and have left the "Share my health timeline with the developer" setting on (it is on by default; Settings > Help > Privacy), the app uploads a daily snapshot of your rolled-up Health metrics (such as sleep, steps, heart rate, and workouts), your day's activity timeline, and the daily reads the app works out from them (Recovery, Effort, Rhythm and Fitness age) to the Simple Health backend, where it is stored and tied to your account. We use it to power the experience across your devices and to improve the app. Under that same setting, the app also stores monthly and yearly summaries of your Health history: averages, totals, and trends for metrics such as sleep, steps, and workouts, never raw sensor recordings. These summaries reach back as far as your Health data goes (often several years), so the AI can answer questions about earlier months and years. You can turn this off at any time in Settings > Help > Privacy, which stops further uploads, and deleting your account removes everything we have stored (see "Deleting your account and data" below).

These are the categories we may request, including but not limited to the examples above; you grant or deny each individually.

This data comes from your iPhone's Health app, including data that wearables (Apple Watch, or third-party devices like Oura or Whoop) sync into Apple Health. We read it; we do not write anything into Apple Health.

When the app sends health information to our server (for cloud insights, chat, or smart notifications), it sends summaries and event-level statistics: for example, daily totals and averages, a single workout's duration and average heart rate, last night's sleep-stage totals, or in some cases your most recent heart-rate reading. We never send continuous raw sensor recordings.

Data created while you use the app

AI insights: weekly story insights are stored on our server so they can be re-shown; other insights are cached only on your device.
AI memory: the app keeps a private list of patterns it notices in your health data, such as your usual sleep and wake times, workout rhythms, or recovery trends, plus facts you tell it directly in chat, so future insights do not have to relearn them; you can review, edit, or delete any of it, or turn it off entirely, in Settings. When the AI remembers something you said in a chat, the exact sentence you typed that supports that memory is stored with it (on your device and, with your consent, in the same protected server copy as the rest of your memory) so you can always see why a memory exists. It is included in your data export and deleted with your memory or your account.
Intimate moments: the app watches your heart rate, movement and energy for a pattern that looks like an intimate moment, and records the ones it is confident about. It also reads anything already recorded as Sexual Activity in Apple Health, by you or by another app. The moments themselves stay on your iPhone, in a separate store nothing else opens. They are never uploaded to our servers, never included in the daily health snapshot, never sent to a widget, your Apple Watch or your lock screen, never included in analytics or crash reports, and never shared with our AI provider. Nothing is written back to Apple Health. This feature is not shown anywhere in the app yet. While we are still working out how well the detection performs, the app sends us an anonymous report roughly once a week describing only what the detector did: how many days it looked at, how often it proposed a moment, which checks ruled other ones out, how the scores it worked out were spread across the scale, and how often it agreed with a Sexual Activity entry you had already logged yourself. Those reports carry no dates, no heart rates or other readings, no account identifier, and nothing else that could identify you or be linked back to you. We keep them for 12 months and use them only to improve the detection. This is on by default in most countries; in the EEA, the United Kingdom and Switzerland it is off until you switch it on, because data about your sex life needs your consent there before we may infer it. You can switch it off at any time under Settings, then Privacy & Support, which stops both the detection and the reports; the Erase Intimate Moments button beside the switch deletes what was recorded, and so does deleting your account.
Chat: when you chat with the AI, your conversation is kept on your device and, with your consent (the same setting that stores your health data), a copy is stored on our server so the conversation survives reinstalling the app or switching devices. It is included in your data export, deleted when you clear the conversation or delete your account, and automatically removed after 90 days.
Push notification tokens: device tokens from Apple so we can deliver notifications.
Subscription and trial records: your subscription status from Apple (product, purchase and expiry dates, and Apple transaction identifiers, which identify the purchase, not your card or identity), including whether a purchase started with an Apple introductory offer and whether that offer converted into a paid subscription, plus a record of the 24-hour free trial we ran on our own servers until September 4, 2026, if you used one. Apple never gives us your payment details.
Account activity: your last sign-in time and basic short-lived server logs used to keep the service running and secure.

What we do not collect

No advertising identifiers. No precise or GPS location. No contacts. No advertising SDKs, and nothing that tracks you across other apps or websites. Diagnostic logs created by the app (Apple's OSLog) stay on your device.

Product analytics (Mixpanel)

We use Mixpanel to understand how the app is used so we can improve it: which screens are opened, which features are used, your sign-in, onboarding, and subscription steps, and your app and OS version, subscription tier, and chosen AI engine. These product-interaction events are linked to your account identifier. We never send your Apple Health values or any health readings to Mixpanel; a built-in safeguard strips health values before any event leaves your device, and we never use this data for advertising or cross-app tracking. Mixpanel also derives an approximate location (country, region, and city) from your IP address to understand where the app is used; we never collect precise or GPS location. Analytics is on by default in the released app and is always off in our development builds. You can turn it off anytime in Settings > Help > Privacy, and doing so never changes how the app works.

Crash & error diagnostics (Sentry)

When the app crashes or hits an unexpected error, we send a diagnostic report to Sentry, a crash-reporting service, so we can find and fix the problem. These reports contain technical information such as the error and its stack trace, sampled performance timings, your device model, operating system, and app version, and a short trail of recent non-health app events (for example, that a screen opened or a network request failed), tagged with your account identifier. We never send your Apple Health values or any health readings to Sentry; the same safeguard that protects analytics also strips health values here, and no advertising or cross-app tracking is involved. Crash and error reporting is part of keeping the app reliable, so it is always on in the released app and always off in our development builds.

If you join our website waitlist

If you enter your email on our website (hellosimplehealth.com) to join the early-access list, we store that email in our database (Neon) for the sole purpose of telling you when the beta opens. We do not use it for anything else and do not share it. Ask us to remove it anytime at haider.builds@icloud.com.

Your AI engine choices

New accounts pick an AI engine during setup, and you can change it anytime in Settings. If no choice has been made, the app uses Auto.

On-Device AI (Apple Foundation Models)

Your health data is processed entirely on your iPhone using Apple's on-device models. Nothing is sent to our servers or to any AI provider to generate your insights.

Cloud AI (OpenAI)

Health summaries and event-level statistics are sent from your iPhone to our server (a Cloudflare Worker), which forwards them to OpenAI. When the cloud engine is active, questions you type into the in-app chat are also sent, together with the related health context. We use Cloud AI for insights when you have chosen Cloud AI or Auto (Auto prefers the cloud when it is available).

What OpenAI does with this data:

Under OpenAI's API terms, OpenAI does not use API data to train or improve its models.
OpenAI may retain API inputs and outputs only briefly to detect abuse, and longer only if required by law. So we cannot promise the data is never stored, but it is not used to train models.

Auto

Settings also offers an Auto option, and Auto is what the app uses until you pick an engine. Auto prefers Cloud AI whenever it is available on your plan, then On-Device AI, then a simple non-AI template. Picking Auto, or leaving it as the default, can send your health summaries to our server and to OpenAI exactly like choosing Cloud AI. If you never want that, pick On-Device AI.

Important: smart notifications use the cloud pipeline

This is the one exception to the on-device promise, and we want it to be impossible to miss.

When smart notifications are enabled, the app generates notification text with the cloud AI, regardless of which engine you selected. When a notable event happens (a workout, a sleep session, a mindfulness session, your activity rings, a heart event such as a high, low, or irregular-rhythm notification, a body-measurement entry such as weight or body composition, or a cycle-tracking entry), a short summary of that single event (for example, one workout's duration and effort, or that a high or irregular heart rate event occurred), bucketed to the hour of day, is sent to our server and forwarded to OpenAI so the notification copy can be written. We never send raw sensor streams or precise timestamps. This now applies to all accounts with notifications enabled, including the free plan, not only the free trial or a Cloud AI plan. To control cost, free accounts are limited to a set number of AI-written notifications per day. When cloud generation is unavailable at that moment (you are offline, or a free account is over its daily limit), the notification is not written from an on-device template; instead it waits and is generated by the cloud once it is reachable again or the limit resets. Over the daily limit, the summary still reaches our server but is not forwarded to OpenAI until the limit resets. Disabling notifications for Simple Health in iOS Settings stops all of this entirely. Everything else then runs fully on-device if that is your chosen engine.

How we use your data

To generate and show your health insights, chat answers, and notification text
To create and sign you into your account, and sync your settings across your devices
To deliver push notifications you have enabled
To verify your subscription or trial and unlock the features you paid for
To respond to your feedback and support requests
To keep the service secure, prevent abuse, and debug problems
To meet legal obligations

We do not use your data for any other purpose without telling you and, where required, asking first.

What we never do

We never sell your personal data or your health data. We never have, and we have no plans to.
We never share your data with data brokers or advertisers. There are no ads in Simple Health.
We never use Apple Health data for advertising, marketing, or use-based data mining, and we never disclose it to third parties for their own purposes. This is both our promise and an Apple platform rule for HealthKit apps.
We never use your data to train AI models, and by OpenAI's API terms our AI provider does not use this data to train or improve its models.
We never store your personal health information in iCloud.

Your watch app and widgets read health data locally on your devices (from data your iPhone shares with them and, on the watch, from the watch's own Health database). They never communicate with our servers.

Service providers we share data with

We share data only with the service providers below, only so they can run parts of the service for us. Each is bound by a data processing agreement requiring protection at least as strong as this policy, and none of them may use your data for their own purposes. We have no affiliates and share consumer health data with no one else. We would disclose data beyond this list only if validly required by law, and we would tell you unless legally prevented.

Provider	What they do	What they receive
Apple	Sign in with Apple, push notifications, App Store payments	Apple receives your device's push notification token (to deliver notifications) and purchase verification requests containing transaction identifiers. In the other direction, Apple sends us your Apple identifier, email, optional name, and purchase records (transaction identifiers, never payment details). We never receive card details or billing addresses.
RevenueCat	Runs our in-app purchase infrastructure and revenue analytics	Purchase records from the App Store: transaction and product identifiers, prices and currency, and subscription status, together with a pseudonymous customer identifier (your account ID) and basic app and device metadata. RevenueCat never receives your name, email, payment details, or any health data.
Cloudflare	Hosts our API (Workers) and, where configured, routes cloud AI requests (AI Gateway)	All traffic between the app and our backend, including health summaries when cloud features are used. Requests are processed on Cloudflare's global network at the data center nearest you. Cloudflare does not use this content to train AI models.
Neon	Our database (serverless Postgres)	Your profile, your stored daily health snapshots, monthly and yearly summaries of your Health history, weekly story insights, your chat conversations, push notification tokens, subscription and trial records, AI memory (patterns and facts from chat, including supporting sentences), and any feedback. Stored in the United States, encrypted at rest and in transit.
OpenAI	Cloud AI engine	Health summaries and event-level statistics sent for cloud insights, questions you type into the in-app chat with the related health context (when the cloud engine is active), and single-event summaries for smart notification text (for all accounts with notifications enabled, including free accounts up to a daily limit). Not used to train OpenAI's models under its API terms; retained only briefly for abuse monitoring, longer only if required by law.
Mixpanel	Product analytics	App usage events such as screen and feature interactions and your sign-in, onboarding, and subscription steps, plus app and OS version, subscription tier, and chosen AI engine, and an approximate location (country/region/city) derived from your IP, linked to your account identifier. Never any Apple Health values. Not used for advertising and not shared for cross-app tracking.
Sentry	Crash & error diagnostics	Crash and error reports (error type and stack trace), sampled app performance timings, a short trail of recent non-health app events, and your device model, OS version, and app version, tagged with your account identifier. Never any Apple Health values. Not used for advertising or cross-app tracking.

Where your data is stored

Our database is hosted by Neon in the United States. API requests are processed on Cloudflare's global network. OpenAI processes cloud AI requests in the United States. RevenueCat processes purchase records in the United States. Our team administers the service from Pakistan.

If you are in the EEA, the UK, or Switzerland, this means your data is transferred outside your region. Where a provider is certified under the EU-US Data Privacy Framework, we rely on that certification; otherwise we rely on Standard Contractual Clauses and equivalent safeguards. You can ask us for a copy of the relevant safeguards at haider.builds@icloud.com.

Legal bases (EEA, UK, and similar laws)

Explicit consent: reading your Apple Health data; sending health summaries to our server and to OpenAI for cloud insights and chat (based on the engine setting you confirm during setup or in Settings, including Auto); and sending event summaries for smart notification text (your notification setting). Health data is sensitive, so reading it requires your explicit permission through Apple's Health screen, and cloud processing follows the AI engine you choose. The developer-timeline storage described above is on by default, and you can switch it off at any time in Settings > Help > Privacy. Detecting intimate moments, and sending the anonymous detection reports described above, rest on the separate switch under Settings > Privacy & Support: in the EEA, the United Kingdom and Switzerland that switch is off until you turn it on, because data about your sex life is a special category that we may only infer with your explicit consent.
Contract: creating your account, syncing your settings, and managing your subscription and trial.
Legitimate interests: keeping the service secure, preventing abuse, basic operational logging, and product analytics to understand usage and improve the app (you can opt out anytime in Settings > Help > Privacy).
Legal obligation: where the law requires us to keep or disclose something.

You can withdraw any consent at any time, as easily as you gave it: switch to on-device AI, turn off notifications, turn off analytics in Settings, revoke Health permissions in iOS Settings, or delete your account. Withdrawing consent does not affect the lawfulness of processing that already happened. The app keeps working without cloud consent: the on-device engine and your Health data on your phone do not depend on it.

We make no automated decisions about you that have legal or similarly significant effects. AI insights are informational explanations, nothing more.

How long we keep your data

Your stored daily health snapshots and weekly story insights: kept for up to 18 months, then deleted automatically. Deleting your account removes them immediately, whatever their age.
Your chat conversations: each message is deleted 90 days after it was sent, and sooner if you clear the conversation or delete your account.
Everything else tied to your account (profile, the monthly and yearly summaries of your Health history, AI memory, push notification tokens, subscription and trial records, feedback): kept while your account exists, deleted when you delete your account. We keep the summaries for as long as the account because they are aggregates rather than raw health records, and they are what lets the AI talk about your earlier years.
The health context we send with a cloud insight, chat reply, or notification: used only to answer that one request, with no separate copy kept. (Your chat messages themselves are the bullet above; the stored snapshots and summaries are described earlier.)
Your session token: valid for 30 days, stored only in your device's Keychain. Signing out removes it.
OpenAI's copies: deleted by OpenAI after only a short abuse-monitoring window, unless law requires longer.
Product-analytics events (Mixpanel): retained for up to 12 months to understand usage trends, then deleted or aggregated.
Crash & error reports (Sentry): retained for up to 90 days to diagnose and fix problems, then deleted.
Anonymous intimate-moment detection reports: retained for 12 months, then deleted automatically. They are not tied to your account, so deleting your account does not remove them; there is nothing in them to find you by.
Server and gateway logs: kept temporarily for operations and security, then deleted.

If a law ever requires us to keep specific data longer, we will keep only that data, only as long as required, and we will tell you.

Deleting your account and data

Open the app, go to Settings, tap your profile picture in the top corner, then tap Delete account. This immediately and permanently deletes everything we store about you in our database: your profile, your stored daily health snapshots (summaries and activity timelines), the monthly and yearly summaries of your Health history, stored insights (weekly stories), your chat conversations, your AI memory (including the sentences from chat that support it), push notification tokens, subscription records, trial record, and any feedback. We also revoke your Sign in with Apple token with Apple, so the app can no longer use it. No email or phone call required.

Three things deletion cannot do for you:

It does not cancel Apple billing. If you have an active subscription, cancel it in iOS Settings > [your name] > Subscriptions, or the App Store will keep charging you. Refunds are handled by Apple, not us.
It does not control Apple's or OpenAI's own systems. You can revoke Simple Health's Sign in with Apple access in your Apple Account settings, and OpenAI's short abuse-monitoring retention expires on its own schedule described above.
It does not individually purge short-lived server and gateway logs. They expire automatically on the schedule described above.

You can also request deletion, or ask what we hold about you, by emailing haider.builds@icloud.com.

Your rights

Everyone, everywhere

You can ask us to access, correct, export, or delete your data, and you can withdraw any consent, by using the in-app controls or emailing haider.builds@icloud.com. We aim to respond within 30 days and will always meet the deadline your local law sets. We will never punish you for exercising your rights. Nothing in this policy limits mandatory consumer or privacy protections you have under the laws of your country.

EEA and UK

You additionally have the rights of access, rectification, erasure, restriction, objection, and data portability, plus the right to lodge a complaint with your data protection authority (any EU supervisory authority, or the ICO in the UK).

California

The categories of information we collect, the third parties we share with, and your choices are all described above. We do not sell or share personal information for cross-context behavioral advertising. We will notify you of policy changes as described below. Global Privacy Control and Do Not Track signals request opt-outs from selling or sharing personal information; we never sell or share personal information, so there is nothing for these signals to switch off, and you are already opted out by default.

Consumer health data (Washington, Nevada, Connecticut)

This section, with the rest of this policy, serves as our Consumer Health Data Privacy Policy.

What we collect: the Apple Health categories, profile details, and AI-related health summaries described above.
Our sources: your iPhone's Apple Health data, including data synced from wearables, and details you enter yourself.
Why: to generate your insights, chat answers, and notifications, and to run your account, as described above.
Who receives it: only the processors named in this policy (Apple, Cloudflare, Neon, OpenAI). We have no affiliates and share consumer health data with no one else.
Your rights: access your consumer health data (including a list of the third parties that received it), withdraw consent, and have it deleted, including from our processors.
How to exercise them: use the in-app deletion or email haider.builds@icloud.com.

Security

All traffic between the app, our servers, and our providers is encrypted in transit (TLS 1.2 or higher).
Data at rest in our database is encrypted.
Your session token lives in your device's Keychain, not in plain storage.
Purchases are verified server-side with Apple's App Store Server API, and access to production systems is restricted.

No system is perfectly secure. If a breach affects your data, we will notify you and the relevant regulators as required by law, including the timelines of the US FTC Health Breach Notification Rule.

Children

Simple Health is not directed at children. You must be at least 13 years old, and at least the age of digital consent where you live (16 in parts of the EEA). We do not knowingly collect data from anyone under these ages; if you believe we have, email haider.builds@icloud.com and we will delete it.

Not medical advice

Simple Health is an informational and educational tool, not a medical device. Its AI explanations are not medical advice, diagnosis, or treatment. Always talk to a qualified clinician about your health, and never rely on the app in an emergency: call your local emergency services.

Changes to this policy

When we change this policy, we will update the effective date at the top and post the new version in the app and at our legal pages. For material changes, we will notify you in the app, and where the law requires fresh consent (for example, a new use of your health data), we will ask before the change applies to you.

Contact

Haider Nawaz
Based in Pakistan
Email: haider.builds@icloud.com