The short version
- Your health data stays on your phone. decoderHealth reads Health Connect or Apple Health into a local database on your device. We do not run a health data server and we never upload your measurements, fasts, or check-ins.
- An account is optional. Everything except AI chat works offline with no sign-in. If you create an account, we store only the identifiers needed to sign you in and to honour your subscription.
- AI chat sends the minimum. When you ask the assistant a question, it receives your recent messages with identifiers redacted and, when it asks for them, compact daily, weekly, monthly, or yearly aggregates. It never receives your profile, notes, raw records, or device identifiers.
- No ads, no trackers. decoderHealth contains no advertising SDK and no third-party analytics.
- You can delete everything. Uninstalling removes local data. Deleting your account in the app permanently removes your server-side records.
Health data
decoderHealth is a health data aggregator. With your permission it reads the following record types from Health Connect on Android or Apple Health on iOS:
- Weight, body fat percentage, and lean body mass
- Steps, distance, workouts, active energy, and total calories burned
- Sleep sessions and sleep stages
- Nutrition and water intake
- Blood glucose
- Menstruation flow
These records are copied into a SQLite database inside the app's private storage on your device. decoderHealth uses them to draw charts, compute derived values such as BMI, BMR, TDEE and energy balance, and generate the deterministic insights and coaching shown in the app.
When you enter a value manually in decoderHealth, the app writes it back to Health Connect or Apple Health so your platform health store remains the source of truth. decoderHealth never writes to any other destination.
On Android, decoderHealth requests Health Connect's separate background-read permission so it can refresh once per hour while the app is closed. This refresh reads new records into the local database and nothing else. You can revoke it at any time in Health Connect settings.
Health Connect and Apple Health data are never synced to an off-device health store. The one bounded exception is the aggregate values sent during an AI chat request, described in section 6.
Data that stays on your device
The following information is stored only in the app's local database and is never transmitted to us:
- Health profile. Date of birth, height, sex, timezone, unit preferences, and your weight goal. These are used on-device to compute BMI, BMR, TDEE and calendar windows.
- Fasting timer and history. Fasting protocols, start and end times, and phase progress.
- Check-ins and notes. Check-in answers, mood, and any free text you write.
- Buddy coaching state. Which insights you have seen and how you responded to them.
- Chat transcripts. The full visible transcript of every AI chat session, stored exactly as typed. Deleting a session in the app deletes its messages.
- Reminder schedules. Local notification times for check-in reminders.
Uninstalling decoderHealth removes all of this. The app also offers a health diagnostics export, which produces a text summary of sync status that you may choose to share with us when reporting a problem. It is generated on demand and only leaves your device if you send it.
Account data
An account is required only for Pro and AI chat. You can sign in with Google, with Apple on iOS, or with an email address and password. Authentication is provided by Supabase, which acts as our processor.
When you create an account we store:
- A random account identifier
- Your email address, and for Apple or Google sign-in the identity token those providers issue
- The display name Apple or Google returns at first sign-in, if provided
- Account creation and last-updated timestamps
The server-side profile record deliberately contains no health fields. Google and Apple sign-in happen natively on your device. decoderHealth never opens a browser, never receives your provider password, and the provider client secret never ships in the app.
If you sign up with email and password, Supabase sends a single confirmation email containing a link that opens the app. We do not send marketing email.
Subscriptions
decoderHealth Pro is sold through Google Play and the Apple App Store and brokered by RevenueCat. We never see your card number or billing address. The stores handle payment and tell RevenueCat that a purchase happened.
RevenueCat receives your account identifier and the store's anonymised transaction receipt, and reports back the entitlement state. RevenueCat also sends a webhook to our server, from which we record:
- Which plan you bought, its start and expiry dates, and whether it renews
- Subscription events such as renewal, cancellation, billing issue, or plan change
- The number of AI chat turns used in the current billing period
Turn counts are used to meter chat usage against your billing period and to monitor our costs. They are not sold or shared.
AI chat
AI chat is the only feature that sends anything derived from your health data off your device. It requires a signed-in account with an active Pro subscription. Each request goes to an authenticated function we run on Supabase, which forwards it to a large language model provider through Router.com.
What the model receives:
- At most the eight most recent messages in the current session, and up to four relevant earlier messages, after redaction.
- Compact aggregates for the metric types and calendar window the model explicitly requests, such as average weight per week for the past three months. The model asks; your device answers with only that.
- Derived values computed on-device, such as BMI, BMR, TDEE, or energy balance, when requested. Only the results leave your device, never the profile inputs.
What the model never receives:
- Your name, email, or contact information
- Date of birth, height, sex, goals, conditions, or other profile fields
- Check-in notes or any other free text outside the chat itself
- Health Connect or Apple Health record identifiers, decoderHealth record identifiers, source app names, or device identifiers
- Raw health records or raw metadata
Redaction. Before any message leaves your device, decoderHealth removes common direct identifiers from what you typed: email addresses, phone numbers, URLs, IP addresses, government and payment number patterns, stated names, dates of birth, and street addresses. The app tells you when redaction occurred. Your local transcript keeps the original text. No pattern-based filter can guarantee that free prose contains no identifying detail, so we recommend you avoid typing personal identifiers into chat.
Server-side logging. Our gateway records, for each turn, your account identifier, the session and message identifiers, the model used, token usage, and a device fingerprint used to detect abuse. During the current pre-launch period the gateway also stores the request and response payloads sent to and received from the model provider so we can diagnose failures. These payloads may include redacted chat text and the compact aggregates described above. They are linked to your account, deleted with it, and are being reviewed for a shorter retention window before general availability.
Provider retention. Router.com and the underlying model provider process requests to generate a reply. Requests use an opaque per-session cache key with a 24-hour prompt cache. We do not share your requests with providers for any purpose other than generating the reply.
The assistant provides general information about your data. It does not diagnose, treat, or triage. decoderHealth is not a medical device.
Permissions
decoderHealth requests only the permissions its features need.
- Health Connect read and write (Android) and Apple Health read and write (iOS) for the record types listed in section 2.
- Health Connect background read (Android) for the hourly refresh.
- Activity recognition (Android), required by Health Connect for step and workout records.
- Notifications for check-in reminders you schedule. Reminders are generated locally. We do not use push notifications.
- Run at startup (Android) so scheduled reminders and background refresh survive a reboot.
- Internet for sign-in, subscriptions, and AI chat.
- In-app billing (Android) for Google Play purchases.
decoderHealth does not request location, camera, microphone, contacts, or photo library access.
Analytics and advertising
decoderHealth contains no advertising SDK, no third-party analytics SDK, and no crash-reporting SDK. We do not use the Apple advertising identifier or Android advertising ID, and we do not track you across apps or websites. The app does not request App Tracking Transparency because it has nothing to ask for.
The only usage information we hold is the subscription and chat turn accounting described in sections 5 and 6.
Retention and deletion
- Local data lives on your device until you delete it in the app or uninstall decoderHealth. Health records you wrote back to Health Connect or Apple Health remain in those stores and are governed by their controls.
- Account data is kept while your account exists. You can permanently delete your account from the Account screen. The app calls a server function that identifies you from your signed session, revokes it, and deletes your authentication user. Database cascades then remove your profile, subscriptions, billing periods, turn counts, and diagnostic chat logs. The client cannot name a different account to delete.
- Subscriptions are billed by Google Play or the App Store. Deleting your account does not cancel a store subscription. Cancel it in your store's subscription settings.
- RevenueCat retains subscription records under its own policy. You can ask us to request deletion there on your behalf.
Your rights
Because your health data is on your device, you already hold and control it. For the account, subscription, and chat gateway records we hold, you may ask us to:
- Provide a copy of the data linked to your account
- Correct inaccurate data
- Delete your data, which you can also do yourself in the app
- Object to or restrict processing
Where the GDPR, UK GDPR, CCPA/CPRA or similar law applies, these are your legal rights and we will respond within the statutory period. We do not sell personal information and we do not share it for cross-context behavioural advertising. If you are in the EU or UK you may also complain to your supervisory authority.
Our legal basis for processing account and subscription data is performance of our contract with you. Our legal basis for the AI gateway logs is our legitimate interest in operating a reliable service and preventing abuse. Health data processing on your device happens under your explicit consent through the platform permission dialogs.
Children
decoderHealth requires users to be at least 13 years old, and the app will not accept a date of birth below that age. We do not knowingly collect information from children under 13. Where local law sets a higher age for consenting to health data processing, that age applies. If you believe a child has created an account, contact us and we will delete it.
Changes
We will update this page when the app's data handling changes. Material changes, such as any change to what AI chat sends or how long gateway logs are kept, will be announced in the app before they take effect. The effective date at the top of this page tells you when it was last revised.
Contact
Questions about this policy or a request to exercise your rights: privacy@decoderHealth.com.