Healthya Privacy Policy
At a glance. Healthya is an all-in-one AI assistant that helps you manage your own life — meals, medications, sleep, exercise, appointments, and everyday conversation. It is open to any adult and works on its own; linking a family member is optional. This policy explains what we collect, with whom we share it, and how you can exercise your rights. We do not sell or share your personal information for advertising.
1. Who we are
Healthya is a service operated by Deeper Emptiness AI ("we", "us"), which acts as the business/Controller of the personal information described in this policy.
Contact: hello@healthya.app
2. Information we collect
We collect the following categories (CCPA §1798.140(v)):
| Category | Examples |
|---|---|
| Identifiers | Phone number (used to sign in), security email address (optional — you may confirm it through your Google account), account (user) ID, device IDs, push tokens |
| Personal information (Cal. Civ. Code §1798.80) | Display name, birth year, gender (optional, only if you choose to provide it), and how you would like the assistant to address you (optional, only if you tell it) |
| Internet / electronic activity | App usage logs, feature timestamps, crash / performance reports, diagnostics for reminder buttons and watch delivery (which can note whether a paired Apple Watch has the app installed), and a record of each voice-assistant connection (when it was requested, whether it was allowed under the hourly voice limit, and which AI channel was used) |
| Device information | Device name as set on your phone, model, OS and app version, display language, and first / last sign-in time (shown to you under My devices, including devices that have since signed out; up to three devices can be signed in per app); a device public key used to confirm sensitive actions with your device’s own lock (we receive no biometric data); your IP address, kept for about a day to prevent abuse |
| Geolocation — approximate (optional) | City / district level, used for local personalization (e.g., weather-based conversation) and to find nearby care facilities such as hospitals and pharmacies (rounded to roughly 1 km before being sent to our maps provider — see section 5). We do not store precise coordinates for these purposes. Optionally, a generalized "activity area" (last 7 days, rounded to roughly 2 km blocks) may be shared with your linked family. |
| Geolocation — precise (optional, emergency readiness) | If you grant emergency location sharing to a linked family member, the app refreshes a single stored precise location about every 5 minutes while the app is open on your screen, so that a usable location already exists the moment you call 911. Only the most recent one is kept — each refresh overwrites the last, so no trail or history is stored. When you tap 911, the app also tries once to take a fresh precise reading. Nothing is collected while the app is in the background or closed. A family member you granted can view it only for 24 hours after your 911 alert. See section 7. |
| Audio / visual (optional) | Microphone signal (real-time only, not stored); meal, medication / prescription, and symptom photos you choose to upload (symptom photos are deleted right after analysis) |
| Home camera photos and camera history (optional) | When you take or choose a photo with the home camera, a reduced copy of it is sent to our AI provider to recognize what it shows (food, medicine, a sore spot, a sick or hurt pet, a checkup report, text, or something else) and, for text, to read the words in it. QR codes are read on your phone and are not sent to us unless you ask to translate their text. The recognition copy is not stored. Photos recognized as food, medicine, a sore spot, a pet, or a checkup report then continue into those features under the terms described for them in this policy. For results we show you directly — read text and explanations of other things — we keep a camera history under your account so you can reopen it on any of your devices: the photo (resized, with location and other metadata removed), the names the photo was recognized as, the text that was read and its language, the last translation you made, and the AI explanation. Your camera history is visible only to you — never to your linked family — and you can delete any entry in the app. Separately, when a photo is recognized as “something else”, the short names and the AI explanation (never the photo) are kept to improve the service and are reviewed only as aggregate statistics. |
| Health & fitness from connected health apps (optional) | Read-only measurements imported from Apple Health or Google Health Connect: sleep and sleep stages, steps, distance, active energy, and workout sessions; vital signs (heart rate, blood pressure, oxygen, temperature, respiratory rate); blood sugar and weight; fitness and gait (VO2 max, heart rate variability, walking steadiness / speed); and mental wellness (mindfulness sessions and mood). See section 8. |
| Calendar events (on-device only) | If you use the in-app schedule, the app reads and writes events in your phone's built-in calendar (Apple Calendar / Google Calendar accounts on the device) with your OS-level calendar permission. Event titles, times, locations and notes stay on your phone and are never uploaded to our servers. Only if you turn on the optional AI can read my schedule setting, the titles and times of upcoming events are sent to our AI provider when you ask about your schedule in a voice conversation or open the morning briefing. Your calendar is not copied to our servers, but what is said aloud in a conversation is saved in your conversation history. Reminders for events you create are saved as alerts on the event itself and delivered by your calendar app. See section 8. |
| Health activity records | Meal logs (time, type, optional photo / nutrition analysis), exercise (duration, type), medication (name, dose, schedule, intake), hydration (intake events), sleep (start / end times) |
| Supplement suggestions (optional) | If you ask for supplement suggestions: the result we build for you — the nutrients chosen, their grade and target amount, any matching product from our catalog, the reason codes, and a plain-language explanation — plus a note of which of your records were considered (counts and dates only, e.g., “6 medications, checkup from March”). The suggestions are computed by our own rules from records you already gave us (your medications, your latest checkup values, the last 28 days of meals, exercise and sleep, your age band and sex, your weight, and your country of residence); we collect nothing new for them. |
| Follow-along workout records (optional) | If you use the follow-along workout feature: the routine you played (a catalog key naming a public YouTube video), how many minutes you followed it, whether you finished, the weekly routine plan we compose for you, and your workout settings (focus, minutes, posture, days per week, level, video-language preference, and any body areas or conditions you mark — for example a sore knee, osteoporosis or high blood pressure). The video itself is played inside YouTube’s official embedded player and is never downloaded or stored by us. |
| Golf game records (optional) | If you use the golf scorekeeping feature: game name, holes and par, per-hole scores, handicap, standings, and the join code. These are shared with the other players in that game (your display name, handicap, and scores are visible to them). Names you type for guests (friends without the app) are stored as part of that game. When you invite a friend by phone number, we check whether that number belongs to a Healthia account in order to deliver the invitation; the number is not stored with the game and the invitation shows your display name to the invitee. If the host turns on the optional side bets (Skins per hole and/or a per-stroke bet), the stakes and currency the host chose and, when the game ends, each player's resulting position (who owes whom, as a figure) are stored with the game and shown to its players. Healthia does not process, hold, or transfer any money; settling up happens outside the app. |
| Travel planning (optional) | If you use the travel planner: the destination you type or pick, trip dates or length, itinerary pace, an optional one-line note about the kind of trip you want, and the itinerary, budget estimate and destination guide generated for you. If you ask for a trip recommended for you, a neutral traveler profile (activity level, interests, morning / evening preference, travel companions, places you have mentioned, and a few short reasons) is derived from what the assistant has learned about you and from your last 30 days of daily summaries, and is stored with that plan; it is checked so that it never contains conditions, symptoms or medication names. If you use the flight price search, the departure city and your recent searches are kept only on your phone and are not sent to our servers (see section 5 for what your phone sends to Google when the results page opens). Travel plans are not visible to linked family. |
| Health checkup reports (optional) | If you add a health-checkup report: the photos of its pages; the values, reference ranges and flags read from them (names, dates of birth, ID numbers, contact details and labelled addresses are masked before storage); plain-language explanations, lifestyle tips, next-checkup dates and year-to-year trends. Checkup reports are never visible to your linked family. |
| Pet care questions (optional) | If you ask about a pet that seems unwell: your description of its symptoms, its species, an optional photo (deleted once analysed), and the guidance shown to you. |
| Goal Pods (optional) | If you join a Goal Pod: other members of that pod see an automatically generated nickname, your goal schedule, the days and times you check in, and the prepared cheers you send — never your name or your goal’s title. Anyone signed in can see pods that are still recruiting. Closed pods are deleted after 90 days. |
| Body measurements (optional) | Height and weight you enter yourself, together with your sex and birth year, used only to size meal and snack suggestions. You may decline — meal suggestions still work without them. These values are stored under your own account, are never visible to your linked family, and the height and weight you type in, and any body-mass figure derived from them, are never sent to our AI provider (see section 5). If you have connected a health app, a recent weight measured by your device may be used instead of the weight you typed; that device-measured weight is one of your health-app measurements, and its change over a week or month (first and last value) can be included in what our AI provider receives to write your weekly and monthly reports (see section 5). |
| Self-reported health | Symptoms, mood, emotion notes |
| Religious / faith affiliation (optional, sensitive) | Collected only if you volunteer it in conversation, used for occasional faith-friendly greetings. We never infer it without your statement and never share it with family. See section 10. |
| Personality type (optional) | A four-letter personality type (with an optional A/T variant) that you set yourself — by answering the in-app MBTI test, by picking a type you already know, or by telling the assistant your type in conversation (recorded only when you state it yourself and no type is set yet; the assistant never guesses it from how you talk). Only the type code (for example "INFP-T") is included in the instructions given to our AI provider, solely to adjust how the assistant phrases its replies. It is never used for any health judgement or recommendation, and your individual test answers are not stored on our servers (only the total for each of the four axes is kept with your type). It is not visible to a linked family member unless you turn on Share MBTI type for that person in Settings → Family sharing; even then they see only the type code, never your answers or axis scores, and you can switch it off at any time. You can remove the type itself in Settings → MBTI Test. The test is an entertainment feature and not a psychological assessment (see the Terms of Service, section 5). |
| Conversation content | The text of your voice and text conversations (both your side and the assistant’s), kept until you erase your records or delete your account. Messages you delete in the AI conversation screen are only hidden from that screen (see section 11). No audio recording is kept. |
| AI memory | Distilled one-line "moments" from conversation and semantic embeddings used so the assistant can remember your context (no verbatim quotes are kept) |
| Inferences | Personality, interests, and mood inferred from conversation |
Where this information can appear on your phone or watch. Some of it is shown outside the app, where anyone holding or glancing at your phone (or your watch) may see it — this is a normal part of how reminders and widgets work, not sharing with us or anyone else:
- Notifications — reminder text appears on your lock screen, and it contains the actual wording: a medication reminder names the medicine, a 3-Day Wins reminder shows the goal title you wrote, a travel-plan notice names the destination, and a weekly-report notice may include a one-line summary. Reminders for calendar events are shown by your calendar app. If you would rather not have these visible on a locked screen, you can hide notification content for Healthya in your phone's system settings.
- Home-screen and lock-screen widgets — the "Today's plan" widget shows your remaining care items and their times (medication is shown as a neutral label), and the "3-Day Wins" widget shows the goal titles you wrote yourself, including on the iOS lock screen. If you would rather not have a goal title visible there, choose a title that does not reveal anything you want kept private, or remove the widget.
- Answer buttons — reminder buttons such as Done and Not yet can be pressed on the lock screen (and on a paired watch) without unlocking the phone or opening the app, and the answer is recorded right away. Anyone holding your phone can therefore answer a reminder for you.
- Apple Watch app — if you install Healthya on an Apple Watch paired with your iPhone, your iPhone copies the reminders it has scheduled to the watch so they can ring and be answered there. These copies carry the same wording as the notifications (medication names, labels you wrote for your own reminders, and 3-Day Wins goal titles), and the watch also lists today’s progress and your upcoming reminders on its own screen. The watch keeps the latest copy until a newer one replaces it; signing out of the iPhone app clears the reminders scheduled on the watch. When you answer on the watch, the watch sends the answer straight to our server using a code carried in that reminder, which can only record an answer for that reminder or goal — your sign-in is not copied to the watch, and the watch app uses no third-party services.
3. Sources
- Information you provide (signup, consent, conversation, photo upload)
- Device-generated information (device IDs, push tokens)
- Google — only if you choose to confirm your security email with it; it returns your verified email address
- Connected health apps (Apple Health / Google Health Connect), only with your permission
- Your phone's built-in calendar, only with your permission — read on the device, not collected by us (section 8)
- Information your linked family provides via the family app
- Outputs from third-party services (e.g., Vertex AI responses)
4. Purposes of use
- AI companion conversation and memory of your context
- Speaking first-aid instructions aloud when the built-in recordings cannot play
- Daily plans, meal / medication / hydration reminders, and lifestyle support
- Sizing meal and snack suggestions to you, using your optional height, weight, sex, and birth year
- Daily summaries combining your activity with optional health-app measurements
- Emergency support — first-aid reference, one-tap 911 dialing, and optional family alerts (see section 7)
- Care navigation (optional) — helping you find nearby hospitals, pharmacies or a medical specialty and showing general symptom guidance (informational only, not a diagnosis)
- Health-checkup reports (optional) — reading the values in your report, explaining them in plain language with everyday tips, comparing them over the years, and taking them into account in meal and supplement suggestions (informational only, not a diagnosis)
- Pet care (optional) — showing general guidance on how soon to see a vet and finding nearby animal hospitals (informational only, not a veterinary diagnosis)
- Supplement information and suggestions (optional) — explaining what vitamins, minerals and other nutrients do, and suggesting a small set that fits your records, with products that carry third-party quality marks. Informational only, not medical advice: our software applies published intake guidance (NIH, USPSTF, the Dietary Guidelines) to your records; the AI provider only rewrites that result in plain language and cannot add, remove or change anything. Please confirm with your doctor or pharmacist before starting a supplement, especially alongside prescription medicines.
- Home camera (optional) — recognizing what a photo shows and taking you to the right feature, reading and translating text in a photo, explaining other things in plain language, and keeping your camera history so you can look back at those results
- Local personalization (approximate location for weather-based conversation)
- Family support (optional) — short summaries to enable family caregiving
- Golf with friends (optional) — sharing scores and standings with the players you invite, delivering invitations by phone number, and recording a finished round as exercise in your daily summary
- Travel planning (optional) — building a day-by-day itinerary, budget estimate and destination guide for a place you choose, and opening flight prices for a route you enter in the in-app browser
- Account management, including recovering your account through your security email and managing your signed-in devices
- Legal compliance, fraud prevention, and security auditing
5. Service providers
We share information only with the following providers under confidentiality and purpose-limited agreements. None of them receive your data for advertising, and we do not share with data brokers. (YouTube may show its own ads inside workout and condition videos; see the YouTube row.)
| Recipient | Data sent | Purpose |
|---|---|---|
| Google Vertex AI (Gemini) | Display name, birth year, recent conversation, learned facts, meal / medication photos; for daily summaries, the next day’s reminder plan and weekly / monthly reports, your conversation text and care records — meals, medications and your answers to reminders (including any reason you gave for a missed dose), water, sleep, exercise, symptom check-in summaries, and, from a connected health app, sleep times, steps and workouts plus, for weekly and monthly reports, averages and changes the app calculates for sleep, steps and readings such as blood pressure, blood sugar, heart rate, oxygen and weight (mindfulness and mood are not sent) — together with your home country and, if you allow location, your city / region; for remembering your context, your conversation text and, if you shared them, your faith affiliation and personality type; for symptom checks, your description, an optional photo, your sex and age range; reduced copies of photos you take with the home camera (to recognize what they show and, for other things, to write a short explanation) and the text read from a photo when you ask to translate it; for the travel planner, the destination, trip length, pace and optional trip note you enter, your departure country (from your phone number) and — for a recommended trip — what the assistant has learned about you together with 30-day activity aggregates (the resulting profile is checked so that it contains no conditions, symptoms or medication names); for supplement suggestions, only the fact table of a result our rules already built (nutrient names, grades, target amounts, product names and short reason sentences, which may name a kind of medicine or a general finding such as ‘metformin’, ‘reduced kidney function’ or ‘after age 50’ — no lab values, exact age or medication list); for health-checkup reports, the text read from them after names, dates of birth, ID numbers and contact details are masked (a hospital or doctor name may remain); for pet care questions, your description, your pet’s species and an optional photo | Conversation understanding, daily summaries, next-day reminder plans, weekly and monthly reports, symptom guidance, meal / medication analysis, home-camera recognition, explanations and translation, plain-language wording for supplement suggestions, checkup explanations and trends, pet care guidance, and travel itineraries, guides and recommendations. Enterprise terms — not used for model training. |
| Google Vertex AI Live | Voice audio (streaming) and what you type in the conversation, the voice you chose, and the context for that conversation: display name and how you like to be addressed, your language, the assistant’s summary of what it has learned about you, your personality type and faith affiliation (only if you set or shared them), topics you asked it to avoid, your home country (from your phone number) and, if you allow location, your current city / region. During the conversation it also receives what the assistant looks up for you: memories from past conversations, your records for a past day you ask about (meals and calories, medications and whether you took them or why you missed them, water, exercise, steps, sleep), your goals, the weather where you are, your calendar events (only with AI can read my schedule on), and a short summary of the app screen you are on (on the family screen, this includes your linked family members’ names) | Real-time voice conversation — the default voice path. Enterprise terms — not used for model training. We do not keep recordings. |
| Google Gemini API (Live) | Same as above | Backup voice path, used only when the default one is unavailable (older app versions use it as their default). Paid-service terms — not used for model training. We do not keep recordings; Google’s short-term abuse-monitoring retention is governed by its API terms. |
| Google Cloud Vision | Meal and medication / prescription photos; home-camera photos recognized as text; health-checkup report photos (the full image, before masking) | Text recognition and image analysis to read labels and food, and to read the text in a photo you want translated. |
| Google Vertex AI (text embeddings) | Short conversation snippets | Semantic search so the assistant can recall relevant context. |
| Google Cloud Text-to-Speech | Fixed first-aid instructions, only when the built-in audio cannot play | Speaking first-aid instructions aloud. Your voice is not sent. |
| Google Places (Google Maps Platform) | Approximate location (rounded to ~1 km) and a care category (hospital, pharmacy, veterinary clinic, or a medical specialty such as cardiology); for the travel planner, the destination name you enter and the names of places proposed for your itinerary (sent by our server) | Finding nearby care facilities; confirming that itinerary places really exist and fetching their photos. No personal identifier is sent; not used for advertising. |
| Google Search (via Vertex AI grounding) | Your web-lookup question text, together with your home country (from your phone number) and, if you allow location, your current city / region so the answer fits where you are; generic region-scoped news queries; generic destination-guide queries for the travel planner (destination and month only) | Real-time factual lookup during conversation, the daily news brief, and destination guides. Not used for advertising. |
| OpenWeather | Approximate (city / district level) location | Weather information used to start friendly conversation. Precise coordinates are not sent. |
| USDA FoodData Central | Food names only (no personal identifiers) | Nutrition reference lookup for meals. |
| NIH Dietary Supplement Label Database (DSLD) and openFDA food-recall data | Nothing personal — our server checks the products in our supplement catalog by label ID and company name | Keeping the supplement catalog accurate: whether a product is still on the market, its label amounts, and any recalls. No user data is involved. |
| U.S. government health services — RxNorm / RxNav, openFDA, MedlinePlus, DailyMed (NLM / FDA), CMS Care Compare | Medication names, or a hospital's ZIP / name for ratings (no personal identifiers) | Standardizing medication information, drug labels / images, health-topic summaries, and hospital quality data. Public services. |
| Google Maps (Android) / Apple Maps (iOS) | Your device's IP address and the map area being displayed | Drawing the map when you look for nearby care. No account identifier is sent. |
| Google Translate (translate.google gateway) | Your device's IP address and the address of the web page being translated | When you use the app in a language other than English, web pages you open inside the app — health and pet-care articles, source links and QR-code links — are shown in your language through this gateway. Your own records are never sent. |
| Google Routes and Static Maps (Google Maps Platform) | Coordinates of the places in a generated itinerary (not your location), sent by our server | Estimating travel time between itinerary stops and drawing the day map shown in a plan. No personal identifier or device IP is sent. |
| ExchangeRate-API (open.er-api.com) | Nothing personal — our server fetches a public currency table | Showing travel budget estimates in your home currency. |
| Google Flights (google.com, opened in the in-app browser) | Your device’s IP address and the flight search you enter (departure city, destination, dates), sent by your phone directly to Google when you open flight prices | Showing live flight prices and letting you continue to an airline or travel site. That page runs under Google’s own privacy policy; we do not receive or store the prices or anything you do on that page. |
| YouTube (Google LLC) — embedded player and YouTube API Services | Your device’s IP address and the video being played, sent by your phone directly to YouTube when a workout video loads or when you tap Watch video to open a condition video in “Where does it hurt?” (the player opens paused; playback starts when you press YouTube’s play button); your language setting, used to pick the audio track / captions. We do not send your name, account ID or health data to YouTube. A condition video is about a health topic, so YouTube can see which of these public videos you chose to open — that is why condition videos load only when you tap them; until then nothing is sent to YouTube (not even a thumbnail). | Playing follow-along workout videos and condition explainer videos (public videos chosen and reviewed by us, from hospitals, public health bodies, medical societies and licensed clinicians) inside the app. This use is governed by the YouTube Terms of Service and the Google Privacy Policy. Our server also checks once a day, without any personal data, whether each catalog video is still available. Cookies and ads: videos play in YouTube’s privacy-enhanced mode (youtube-nocookie.com), and the app loads the player so that it does not store YouTube cookies on your device. While a video plays, YouTube may still keep limited technical information in the player’s browser storage (for example, a connection-speed estimate), may read Google cookies that other web pages you opened inside this app have already stored, and may show ads it selects. On iPhone, the player’s storage is discarded when it closes. This is controlled by YouTube under the Google Privacy Policy, not by us, and we receive no advertising data or revenue. The app does not sign you in to YouTube and does not access your YouTube or Google account data, so there is no account access to revoke; you can still review Google’s access at Google security settings. |
| Twilio (SMS, through our sign-in provider) | Phone number, one-time verification code | SMS verification for sign-in, re-verification before sensitive actions, and phone-number changes. |
| Resend | Email address and request details | Sending account and rights-request notification emails. |
| Expo Push (relaying to Apple APNs / Google FCM) | Push tokens, notification payloads | Notification delivery. |
| Supabase (infrastructure) | A subset of the above for storage | Service operation, with row-level security isolating your data. |
AI prompt caching. Our Google Vertex AI project is configured for memory-only (ephemeral) prompt caching. Content sent to Vertex AI may be held briefly in memory to speed up similar requests, but it is never written to Google’s durable (at-rest) cache storage, and Google does not use it for model training.
TTS audio cache. We cache synthesized audio responses keyed by a hash of the response text (no user identifier). The cache is shared across users — your individual identity is never associated with cached audio. Withdrawing TTS consent stops future synthesis requests; cache eviction is governed by our standard retention policy rather than per-user deletion.
Video calling. Video calling is not offered in the current version of the app. We do not route any video or audio to a video-calling provider.
6. Sharing with linked family
When you link a family member through the Healthya Family app, certain information may be visible to that family member in their app. Family sharing is opt-in and is gated by your consent settings in Settings → Data Use Consent.
6.1 What family always sees (regardless of consent)
- Your display name, phone number, the email address on your account, your time zone, when you joined, and the fact that you are linked to them
- Connection activity (link request, acceptance, removal)
6.2 What family sees when health-sharing consent is ON
The Share health activities with family consent grants the linked family read-only access to:
- Meals — time, type (breakfast / lunch / dinner / snack), photo (if you uploaded), AI nutrition analysis (food name, calories, caution notes), suggested next meal
- Exercise — type and duration (minutes), and distance and calories when recorded (golf rounds and follow-along workouts appear here as exercise)
- Medication — registered medications (name, dose, schedule), intake events and the reason you gave for a missed dose, and the results of AI medication reviews (with any notes family members added)
- Hydration — water intake events (shown as an approximate number of cups)
- Sleep — sleep start / end timestamps, sleep stages and sleep quality (including measurements imported from a connected health app, if enabled, and what you reported yourself)
- Reminder schedule — the times of your active care reminders, including titles you write for your own reminders
- 3-Day Wins — your progress (counts and the days you kept), never the goal titles
- Symptom check-ins — notes from symptom checks and the suggested level of care
- Device health metrics (if you connected a health app) — steps, distance, active energy, vital signs (heart rate, blood pressure, oxygen, temperature, respiratory rate), blood sugar / weight, and fitness / gait measurements imported from Apple Health or Google Health Connect
- Recent activity timestamp — when you were last active in the app
- AI daily summary — a short AI-written paragraph about your day, the emotional tone the assistant inferred from your conversations (together with the assistant's stated reasoning), and the general topics you talked about. This is a summary, not a transcript: family never sees your conversations themselves. Your words are stripped out of the emotional-tone summary before it is stored; the exercise and sleep entries above may show one short quoted phrase — about a sentence at most — that the assistant kept as supporting evidence. Quoted phrases kept for meals, medication and water are removed by our server before the summary reaches the family app.
- Weekly and monthly reports — patterns across the period (meals, medication, sleep, exercise), mood trends, the number and urgency of symptom check-ins, goal progress, health-screening flags produced by fixed rules, an AI-written recap with suggested things to ask about, and a monthly summary intended to help you and your family prepare for a doctor's visit.
What this means in practice. Because the daily summary describes your mood and the subjects you raised, a family member with health-sharing access can learn how you seemed to be feeling and what was on your mind — even though they cannot read your conversations. If you would rather they not see this, turn health sharing off in Settings → Data Use Consent.
What family never sees. Transcripts of your conversations (beyond the short evidence phrases described above), your AI memory and learned preferences, your voice, your faith affiliation, your MBTI test answers, the height and weight you entered, and your consent history are never shared with family. Your MBTI type code is shared only with a family member for whom you turn on Share MBTI type. Mindfulness minutes and self-logged mood imported from a connected health app are also never shared — they are redacted server-side even when health-sharing consent is on.
6.3 Optional location sharing with family
- Activity area — if you grant Share activity area with family (granted separately for each linked family member), that family member can see a generalized activity area from the last 7 days (rounded to roughly 2 km blocks, with the days you were there; never an exact point or a live trail). Older data is automatically deleted on a rolling 7-day window.
- Emergency location — handled separately under section 7.
6.4 What family sees when consent is OFF or withdrawn
If you decline a sharing consent — or withdraw it at any time — the family app will display a clear notice that you have not granted access, and the related categories will be hidden from family view (server-side enforcement via row-level security, not just client filtering). Withdrawal takes effect on the next family-app data refresh.
6.5 Withdrawal and re-consent
- You can toggle each sharing consent at any time in Settings → Data Use Consent.
- The change is logged in your consent history (Settings → My information rights → Consent history) as immutable evidence (CCPA Right to Know).
- Unlinking a family member also removes their visibility regardless of the consent state.
6.6 Family member's obligations
The linked family member agrees, in the family app's consent flow, to treat the disclosed information as confidential, not screen-capture or share externally, and to use it only for caregiving purposes.
7. Emergency location sharing (911)
This is the one case where we use your precise location. Healthya is not an emergency response service and cannot guarantee that help will arrive; it provides first-aid reference, one-tap 911 dialing (you place the call yourself), and optional alerts to your linked family.
- Consent. Precise emergency location sharing is off until you turn it on, and you turn it on separately for each linked family member. We strongly recommend keeping it on for at least one person.
- When we collect it. So that a usable location exists at the moment you need it, the app refreshes your stored precise location about every 5 minutes while the app is open on your screen. We do this in advance because placing a 911 call sends your phone to the dialer, which would cut off a fresh GPS reading at exactly the wrong moment. Nothing is collected while the app is in the background or closed, and we never build a location history. When you tap 911, the app also tries once — for about a second — to take a fresh precise reading; if that fails, the stored one is used.
- What is stored. Exactly one location per person. Each refresh overwrites the previous one, so there is no trail, no route, and no record of everywhere you have been — only where you were most recently while using the app.
- Who can see it. A family member you have granted this permission can view that location in their app, under row-level security, only for 24 hours after your 911 alert. Family members you have not granted it to cannot see any location, even during an emergency.
- When you call 911. Tapping 911 (or the emergency widget) sends a push notification to all your linked family members, whether or not you granted them location sharing. It contains your name only — never coordinates.
- If the permission is off or location access is unavailable, the alert is still sent, with no location attached.
- What we keep. The stored location is automatically deleted 7 days after it was last refreshed. Withdrawing the permission stops it being refreshed, so it ages out within that window; deleting your account removes it with everything else.
8. Connected health apps (Apple Health / Google Health Connect)
If you enable Connect health app (optional), Healthya reads the following from Apple Health (iOS) or Google Health Connect (Android), with your separate OS-level permission:
- Sleep start / end times, total sleep minutes, and sleep stages (deep / REM), where available
- Steps, walking / running distance, and floors climbed
- Active energy (calories)
- Workout sessions (type, start time, duration)
- Vital signs — heart rate, resting heart rate, walking heart-rate average (iPhone), blood pressure, oxygen saturation, body temperature, respiratory rate
- Blood sugar (glucose) and body weight
- Fitness and gait — VO2 max, heart rate variability, walking steadiness, walking speed, six-minute walk distance (some are iOS-only, imported where available)
- Mental wellness — mindfulness session minutes and self-logged mood (Apple Health State of Mind). This category is used only for your own service — it is not sent to our AI provider — and is never shared with family (see section 6.2)
Read-only. Healthya only reads this data; it never writes back to your health app. We use it to make your daily summaries and Health statistics reflect your real measurements, and these measurements are also among the records our AI provider (Google Vertex AI) receives to plan your next day’s reminders and to write your weekly and monthly reports (section 5). The first time you open Health statistics, up to the past 12 months are imported (on Android, with the separate permission to read past data); if health sharing is on, those past days can also appear in the daily summaries your family sees.
Apple / Google requirement. Data obtained from Apple Health or Google Health Connect is never used for advertising or marketing, is never sold, and is never shared with data brokers. It is stored under your account with row-level security. You can turn the connection off at any time in Settings; on withdrawal we stop importing new metrics. Metrics already imported are retained unless you ask us to erase them.
8.1 Your phone's calendar (schedule)
The in-app Schedule screen is a window onto your phone's built-in calendar. With your OS-level calendar permission, the app reads the events in the calendars you choose to show and writes the events you create in the app straight into the calendar you choose (by default the phone's default calendar). We do not store your calendar events on our servers, they are not part of your account data export, and deleting your Healthya account does not delete them — they remain in your phone's calendar.
Reminders for events you create in the app are saved as alerts on the event itself (by default 30 minutes before; all-day events at 9:00) and are delivered by your calendar app, so they also ring on your other devices. Healthya sends no separate schedule notification. Events created elsewhere keep their own calendar alerts.
By default the AI assistant cannot read your calendar. If you turn on the optional AI can read my schedule setting (Settings → Data use consent), the titles and times of today's and upcoming events are sent to our AI provider (Google Vertex AI Live, or the backup Google Gemini API if it is unavailable) in two situations: when you ask about your schedule in a voice conversation, and when you open the morning briefing screen (the assistant summarises the day there without being asked). Locations and notes are never sent. Creating or changing events by voice does not require this setting, and you can turn it off at any time.
One thing to know about conversations. Your calendar itself is never uploaded. But a voice or text conversation is saved as a conversation record under your account (section 2, "Conversation content"), and that record contains what was actually said — so if you dictate "dentist at three tomorrow", or the assistant reads an event back to you, that wording lives in your conversation history and may be used for the assistant's memory of your context, just like any other thing you say. You can delete it with Erase my records or Delete account; withdrawing a consent stops future collection but does not delete what is already stored.
9. Do Not Sell or Share notice
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. No opt-out is required because the protection applies automatically. (CCPA §1798.120 / CPRA)
10. Sensitive Personal Information
SPI under CPRA includes health information, audio signals, precise geolocation, and religious or philosophical beliefs. We collect precise geolocation only for 911 emergency readiness and family sharing (section 7) — with your opt-in, only while the app is open on your screen, keeping only the single most recent location, and never for advertising. We collect faith affiliation only if you volunteer it in conversation, solely for occasional faith-friendly greetings — never inferred, never shared with family, and removable anytime in Settings → What the AI has learned. We do not use SPI beyond service delivery and the purposes you have explicitly consented to. You may restrict SPI use via the in-app Consent history screen. (CPRA §1798.121 — Right to Limit Use of SPI)
11. Retention
- Active retention while your account is in use.
- Account deletion: scheduled with a 7-day grace period, then the account and all data are removed (well within 30 days). You can cancel at any point during the grace period. A minimal record that the deletion happened (when and why it was requested) is kept; your consent history is deleted with the account.
- Record deletion (account kept): same 7-day grace period, then your records are erased while your account remains. Kept with your account: points and badges, family links, golf games, goals tied to a Goal Pod with their check-ins and messages, your devices and settings, your consent history, security and rights-request records, and the log of when the voice assistant was connected (used for the hourly voice limit; it is removed when you delete your account).
- Conversation text and AI memory: kept until you erase your records or delete your account. Deleting messages in the AI conversation screen hides them from that screen only (the app says so when you delete): the text stays in your conversation record — where it can still inform your daily summaries and the assistant’s memory, and is included in your data export — until you erase your records or delete your account. You can review and delete what the assistant has learned in Settings → What the AI has learned.
- Health-checkup reports: photos are deleted 7 days after upload (sooner if you turn off medical photo analysis); the results are kept until you delete the report, erase your records, or delete your account.
- Pet care questions: photos are deleted once analysed; the question and guidance are kept until you erase your records or delete your account.
- In-app notification inbox: 90 days. Data-export download files: removed within about two days. IP addresses used to prevent abuse: about a day.
- Consent withdrawal: we stop collecting and using that category from then on. Data already stored is retained unless you separately ask us to erase it (see “Right to Delete” below).
- Activity-area location: auto-deleted on a rolling 7-day window. Withdrawing the consent stops new points being recorded; points already recorded age out within that same 7-day window.
- Emergency alert records: see section 7.
- Travel plans: kept until you delete the plan in the app, erase your records, or delete your account. Place details fetched from Google for itineraries are cached on our server for at most 30 days (Google’s terms) and hold no personal data. Flight searches are stored only on your phone.
- Golf games: a finished game is kept as the shared history of all its players. When you delete your account, your link to those games is removed and your name in them is replaced with a neutral label; the other players keep their history.
- Supplement suggestions: each result is kept so you can look back at it, until you erase your records or delete your account. While your records are unchanged, the same result is shown again for up to 30 days (or until our product catalog is re-checked, which happens weekly) instead of building a new one.
- Follow-along workouts: workout sessions, weekly plans and settings are kept until you erase your records or delete your account. No video content is stored.
- Camera history: each entry, with its photo, is kept until you delete it in the app, erase your records, or delete your account. The reduced copy sent only to recognize what a photo shows is not kept. The short names and AI explanations kept to improve the service (no photo) are erased when you erase your records or delete your account.
- Legal hold periods take precedence where applicable.
12. Your rights
Depending on your residency, you have the rights below. We grant the same rights to all users regardless of location.
12.1 Rights granted to all users
- Right to Know. Request a copy of the information we hold about you.
- Right to Delete. Request deletion of your information.
- Right to Correct. Request correction of inaccurate information.
- Right to Portability. Receive your information in a machine-readable format (JSON / CSV).
- Right to Limit SPI. Restrict use of health / voice / location data.
- Opt-out of Sale / Share. We do not sell or share — applies automatically.
- Opt-out of Automated Decision-Making. Request exclusion from AI-based profiling (CPRA Reg 2025).
- Non-discrimination. No penalty for exercising your rights.
- Right to Appeal. Appeal denied requests within 60 days (VCDPA / CPA / CTDPA).
- Authorized Agent. A trusted family member may submit requests on your behalf (CCPA §1798.135).
12.2 How to exercise
- In-app — Settings → My information rights:
- Right to Know — generates a downloadable ZIP (JSON + CSV) of your data within minutes. Request it via the download link at the end of this policy (in the app) or by email. Once per 30 days. Meal, medication and camera-history photos are not included in the automatic export but are available on request by email; symptom and pet photos (deleted after analysis) and checkup photos (deleted after 7 days) cannot be provided.
- Right to Correct — review and edit "What the AI has learned about you".
- Right to Delete — two in-app choices: Erase my records (keeps your account) and Delete account. Both are scheduled with a 7-day grace period and can be cancelled during it.
- Right to Limit SPI / Withdraw Consent — per-item withdrawal in the Consent history screen.
- Email: hello@healthya.app (subject line: [Rights Request]).
- Processing time: in-app deletions take effect after a 7-day grace period. Email-based requests are resolved within 45 days of receipt (one 45-day extension where permitted).
13. Consumer Health Data (WA MHMDA · NV SB370 · CT)
This section is the Consumer Health Data Privacy Policy required by Washington's My Health My Data Act and analogous laws. "Consumer Health Data" includes information related to physical or mental health status, medications, diagnoses, treatments, precise location, and inferences thereof.
13.1 Categories collected
- Meal, medication, hydration, sleep, and exercise records and photos
- Height and weight you enter yourself (optional), and the meal / snack portion guidance derived from them
- Sleep, steps, activity, vital signs (heart rate, blood pressure, oxygen, temperature, respiratory rate), blood sugar, weight, fitness / gait, and mental-wellness measurements (mindfulness, mood) imported from a connected health app, including up to 12 months of past measurements (optional)
- Inferred physical / emotional state from conversation
- Symptoms you report and the general symptom guidance / recommended care setting shown to you
- Supplement suggestions built from your records (nutrients, grades, target amounts, matching products, and which records were considered)
- Pill bottle, prescription, and symptom photos (if uploaded)
- Health-checkup report photos (kept 7 days) and the values, ranges, flags, explanations and trends read from them (optional)
- Body areas or conditions you mark for follow-along workouts (for example osteoporosis or high blood pressure)
- Photos and text you keep in your camera history (optional) — these can include health information if you photograph something like a prescription or a medical document
- Voice signals (real-time processing, not stored)
- A single most-recent precise location, refreshed while the app is open so it is ready if you call 911 (optional — see section 7)
13.2 Sources
- Your direct input and voice
- Microphone input (optional consent)
- Photo uploads (optional consent)
- Connected health app (optional consent)
13.3 Purposes
- Daily health support (meal / medication / hydration / sleep / exercise / mood)
- Supplement information and suggestions (optional, informational only)
- Health-checkup report reading and explanation (optional, informational only)
- Home camera recognition, text reading / translation, and camera history (optional)
- Emergency support (optional)
- Family caregiving summaries (optional)
13.4 Third parties
Same as section 5 (service providers) and section 6 (linked family). No advertising sharing.
13.5 Withdrawal and deletion
You can withdraw consent per item in the in-app Consent history screen. Withdrawal stops further collection, use and sharing of that category. To have Consumer Health Data already collected erased, use Erase my records or Delete account in the app, or contact us — we then delete it, including downstream processor copies, within the statutory period.
13.6 No geofencing
We do not use geofencing around healthcare facilities for data collection or advertising. (WA MHMDA RCW 19.373.030)
13.7 No sale (opt-in)
We never sell Consumer Health Data, and we do not share it without separate opt-in consent.
14. Biometric notice (Illinois BIPA)
We use your voice only to hold the conversation in real time — the AI provider processes the audio stream, and we keep no recordings. We do not generate, store, or use voiceprints (biometric identifiers).
Illinois residents are protected under 740 ILCS 14 (BIPA), which includes written consent and retention policy rights. Voice features will not activate if you decline the related consent.
15. Children
The service is intended for users 18+. If a sub-13 account is discovered we will immediately deactivate and delete the data (COPPA 16 CFR Part 312). We do not engage in targeted advertising to users under 16 (MD MODPA).
16. Security
We implement reasonable technical and administrative safeguards (encryption in transit and at rest, row-level security, device-keychain storage of credentials, access control, audits) consistent with the NY SHIELD Act and industry standards. No system is absolutely secure.
17. International transfers
The service operates in multiple countries including the United States. Information may be transferred internationally; in such cases the higher of local law or this policy applies.
18. Changes to this policy
Material changes are notified in-app and by email at least 7 days before effective date. Significant scope changes require renewed consent.
19. Contact
- Privacy contact: hello@healthya.app
- Rights requests: hello@healthya.app (subject line: [Rights Request])
- Operating company: Deeper Emptiness AI (mailing address available on request via hello@healthya.app)