Trust
Security.
Health data is the most personal kind there is. This page is what we do to keep yours safe, what we never do with it, and — just as important — what we don't claim.
The short version
Seven things, and the rest of the page is the detail behind them.
- Where it lives
- On your iPhone first. A cloud copy exists only once you create an account — if you never make one, your entries never leave the device.
- Sensitive entries
- Seven kinds of entry are held in the iPhone's keychain rather than ordinary app storage: medications, medication log, vitals, dream journal, journal, cycle, and Mind reflections.
- In transit
- Everything that moves between the app and our servers travels over an encrypted connection.
- Your records
- Scoped to your account at the database level, not just in the app — the rule is enforced where the data is stored, not where it is displayed.
- Never
- We do not sell your data and we do not run ads. There are no advertising SDKs in the app.
- Export
- Tap Download My Data in the Me tab. Every entry you have made, written to a JSON file you can keep or move elsewhere — including the two things that never reach our servers. Nothing is held back, and it is not a Pro feature.
- Deleting
- Deleting your account from inside the app removes your data, not just your profile. How to delete.
What analytics can see — and what it never sees
We use product analytics to find out which parts of the app people actually use. It is deliberately blind to the parts that matter most.
- Who you are
- A random identifier generated on first launch. It is never linked to your account, your email, your name, or your photo — the app has your account ID and deliberately does not pass it on.
- Always dropped
- Free text of any kind: journal entries, mood notes, dream descriptions. Also emails, real names, photos, and specific health values.
- An allowlist, not a blocklist
- Eleven properties are permitted — things like which tab you opened, how long a breathing session ran, whether a purchase succeeded. Everything else is stripped out before an event is sent, so a new property has to be added deliberately to travel.
- Blocked outright
- Ten kinds of event never leave the phone at all: crisis-resource taps, journal activity, mood entries, and the “how did you feel” answers in Mind and Sleep.
That last row is the one worth explaining. Those events carry no content — a mood entry is recorded as the fact that one happened, not what it said. We block them anyway, including the count.
A stable identifier plus “this person opened their journal on eleven consecutive evenings, then stopped for three weeks” describes something real about a life, without a single word of what was written. Occurrence is content when it is attached to the same identifier over time. So those events stay on the phone, where the app can still use them to show you your own patterns.
Three things that never leave your phone
All three are deliberate, all three cost us something, and all three are written into the code as exceptions that a future change has to argue with.
- Route coordinates
- GPS traces from timed workouts stay on the device. They are not part of the cloud backup, which is why the app can answer “Location: not collected” and mean it.
- Private zones
- The places you mark so a shared route never reveals them — usually home. A zone is a coordinate, so it stays on the device that set it. Only the count travels, which is enough for a new phone to prompt you and not enough to locate anything.
- Cycle history
- Menstrual cycle tracking stays on the device. It is the most sensitive category the app holds and it does not roam.
The honest cost: neither one survives a move to a new phone. A restored device brings back your habits, meals, sleep, workouts and everything else — and starts your routes and cycle history from empty. You can export cycle data from the app before you switch.
We think that is the right trade for these two, and we would rather say so than quietly upload them. The full list of what does and does not sync.
What other people can see
By default, nothing. Everything social in HealthApp is something you switch on.
- Friends, Circles and partners
- Opt-in, and you set what is shared pillar by pillar and circle by circle. Nothing is shared because you joined something.
- Weekly partner summaries
- Carry categories, never your entries — the shape of your week, not its contents.
- Leaderboards
- League standings and weekly brackets are shared between players. That is what a leaderboard is: if you join one, the people in it can see where you placed.
- Public profile
- Off unless you turn it on, and it carries nothing quantitative — which pillars you are working on, not your numbers.
What we don't claim
This is the section most security pages leave out, which is exactly why it belongs here.
- No HIPAA
- HIPAA governs healthcare providers, insurers and their business associates in the United States. It does not apply to an app you buy for yourself, and a HIPAA badge on a consumer wellness app is decoration. We will never display one.
- No SOC 2
- A SOC 2 report comes from an independent audit firm after a real programme. We have not done one. If we ever do, we will link the report rather than a logo.
- No certifications
- We hold none, and we do not use the words “bank-grade” or “military-grade”. Neither describes anything you could check.
- Not a medical device
- HealthApp is a wellness and lifestyle tracking tool. It does not diagnose, treat, or provide medical advice.
A badge you cannot verify is worth nothing to you. Every claim on this page is either something you can see in the app or something you can hold us to — and the things we have not earned are named as such.
Found a problem?
If you think you have found a security or privacy issue, we would rather hear it from you than read about it later.
- Where to send it
- cliffordcorporation@gmail.com, with “Security” in the subject line.
- What helps
- What you did, what happened, and roughly when — plus anything you managed to capture at the time. You do not need to prove anything: a hunch worth checking is worth sending.
- What we do
- We read every one and we will reply. If you report something real, we will tell you when it is fixed.
- Please do not
- Test against other people’s accounts or data. If you need an account to poke at, tell us and we will help.
Health you can trust with your data.
Every line on this page is something you can check in the app or hold us to. Nothing on it is a badge.