In short
This app holds health information about you, which Australian privacy law treats as sensitive information and which we treat the same way. It is collected because you typed it in or allowed Apple Health to share it, and it is used to run the app for you.
We do not sell it. We do not use it for advertising, and we do not let anyone else use it for advertising. There is no third-party analytics or tracking in this app — no advertising identifier is read and no usage-tracking service is built into it.
Who is responsible
PAssistant Technologies Pty Ltd (ABN 88 701 871 641) publishes HealthPal AI and is responsible for the personal information described here. We are bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth).
We are based in Hope Island, QLD 4212, Australia.
What we collect
Account details, so there is an account to attach anything to:
- Your name, email address and time zone
- Your password, kept only as a bcrypt hash — the app never stores the password itself, and we cannot read it
- Which devices you have linked, and when each was last used
- That you confirmed you are 16 or older, when you confirmed it, and which version of our terms you were shown at the time
Health and fitness information
This is the sensitive part, and it is collected only because you entered it or allowed it:
- Body figures: date of birth, sex at birth, height, weight and weigh-in history, goal weight, activity level and the goal you chose
- Food and drink: meals and foods you log, portions, the energy and macronutrients they add up to, saved meals, your pantry, supplements and water
- Training: workouts, exercises, sets, reps, weights, distances, durations, training plans and personal records
- Sleep, meditation, journal entries, gratitude notes and mood entries you write in Mental Care
- Your health timeline: medical events you record — vaccinations, tests, results, conditions — and documents or photographs you upload to it
- Targets, goals and reminders you set
Apple Health (HealthKit)
If you grant access, the app reads the following from Apple Health, and nothing else:
- Steps, walking and running distance
- Active energy and resting (basal) energy
- Exercise minutes
- Heart rate and resting heart rate
- Sleep analysis
- Body mass, so a smart scale's weigh-ins join the same history as ones you type
- Workouts recorded by your Apple Watch or another app
How Apple Health data is treated
The app only reads from Apple Health. It never writes anything back into it, and deleting your account here does not touch anything stored there.
Data read from Apple Health is used to show you your own activity, to count it towards your goals, and — if you are signed in — to sync it to your account so another device sees the same figures. It is never used for advertising or marketing, it is never sold, and it is never disclosed to anyone else for their own purposes. It is not disclosed to data brokers, insurers, employers or advertising networks.
You can withdraw HealthKit access at any time in the iPhone's Settings app, under Privacy & Security, then Health. Settings, Legal & Privacy, Manage Health Data Permissions takes you there.
Camera and photos
The camera is used only when you point it at something: a barcode, a nutrition label, a plate of food, or a health document. Photographs of meals and documents are sent to be read (see Third parties below) and photographs of documents you attach to your health timeline are stored with the record. Nothing is captured in the background.
What we do NOT collect
There is no advertising identifier, no third-party analytics package, no crash-reporting service, no location tracking and no contact-list access in this app. We do not build a profile of you for anyone else, and we do not track you across other apps or websites.
Why we collect it
Every use below is a feature of the app you can see working:
- To show you your own data, and to add it up into daily totals and trends
- To work out recommended energy and macronutrient targets from the figures you gave us
- To sync your data between your devices and restore it onto a new phone
- To send you the briefings and reminders you asked for, on the schedule you set
- To take payment for a membership, and to know which features your account is entitled to
- To keep the service secure — for example, limiting password attempts
Using the app without an account
If you skip signing in, everything you log stays on the phone. It is not sent to our servers and we do not hold it. Signing in later uploads what is already on the phone so it can be backed up.
Where it is stored
Your account data is stored in a PostgreSQL database and a private file store operated by Supabase. Both are hosted in Sydney, Australia, in the ap-southeast-2 region — the health information you log and the documents you upload are stored in Australia.
Supabase is operated by Supabase Pte. Ltd., a company based in Singapore. Storing the data in Sydney does not mean every operation on it happens in Australia: Supabase and the suppliers it uses may process or access information outside Australia where that is needed to run the service, including support and security work.
Documents you upload go into a private storage bucket that is not publicly readable; the app fetches them through the authenticated API rather than by a public link.
Where your information is stored and where it is processed are not the same question. The app is served by our backend, which runs on Cloudflare Workers, and the other services listed below handle parts of your information when you use the features that need them. Several of those operate outside Australia. See Overseas processing below.
A copy of what you have synced also lives on your phone so the app works offline.
Third parties
These are the only outside services your data reaches, and only for what is listed:
- Supabase — stores the database and uploaded documents, in Sydney, Australia. The company behind it is Supabase Pte. Ltd. in Singapore, and it engages its own suppliers — for hosting, monitoring and support — which are mostly United States companies
- Cloudflare — runs the backend that serves the app, and hosts the website. Every request the app makes is handled by Cloudflare's servers on its way to and from the database. Cloudflare does not store your health records; it carries and processes the requests
- Apple — takes payment for memberships bought inside this app, through the App Store. Your payment details are held by Apple, are never seen by this app and never reach our servers. We ask Apple whether your subscription is active and when it renews, and Apple tells us that and nothing else about you
- Stripe — takes payment for a membership that was not bought through the App Store. Card details are entered on Stripe's own secure page and never reach this app or our servers. Stripe tells us only whether a subscription is active
- Anthropic — reads the images and documents you send to be read. A photograph of a meal, a photograph or PDF of a health document, and the training-plan summary sent for review are processed by Anthropic's Claude models to produce the text that comes back. These are sent only when you use those features
- Open Food Facts and the USDA FoodData Central database — looked up when you scan a barcode or search for a food. The barcode or search term is sent; who you are is not
- Telegram — only if you connect a bot of your own. Your briefings and reminders are then delivered through Telegram's servers to the chat you nominated
- Apple — also handles app distribution; HealthKit data stays on your device except as described above
Overseas processing
The database and private file store described above are hosted in Australia. That is where your information sits, and it is not the whole picture: the company that operates them is overseas, and so are most of the other providers listed above.
Cloudflare runs the backend, so your data passes through its servers on its way between the app and the database. Anthropic processes the photographs, documents and training-plan summaries you send to be read. Stripe processes a payment for a membership set up outside the App Store. Apple, Telegram, Open Food Facts and the USDA database are reached as described above.
Those providers operate outside Australia. Processing your information therefore involves it being handled overseas, and overseas recipients may be subject to laws that differ from Australian law. Providers that run global networks may also move information between their own locations.
We take reasonable steps to use reputable providers who commit to protecting the information they hold for us. We cannot guarantee that an overseas recipient will comply with the Australian Privacy Principles.
Where we can identify them, these are the countries in which those recipients are likely to be located:
- Singapore — Supabase Pte. Ltd., the company we hold the database and file storage with. The data itself is stored in Sydney
- United States — Anthropic, which reads the photographs and documents you send; Cloudflare, which runs the backend; the USDA FoodData Central database; and most of the suppliers Supabase itself engages
- Australia, Ireland and the United States — Stripe. Our services agreement is with Stripe Payments Australia Pty Ltd; the data protection agreement is with Stripe Payments Europe, Limited in Ireland; and Stripe's own terms say that using the service transfers information to Stripe, LLC in the United States. Stripe receives your email address and an account reference so a membership can be matched to you — never your health records
- Apple, Telegram and Open Food Facts operate across several countries. We cannot name a single country for each of them, and your information may be handled by them in the United States or elsewhere
How long we keep it
We keep what you log for as long as your account exists, because a health record is only useful if it goes back. We do not delete your history to make room, and a free account's 90-day view is a limit on what is shown, not on what is stored — the older entries are still there and reappear if you take out a membership.
When you delete your account, your data is removed from HealthPal AI's live systems straight away. There is no grace period, and we keep no archive of our own. Our providers take their own backups, so an encrypted copy of a deleted record can remain in Supabase's routine backups for a short time, until that backup reaches the end of its retention cycle and is deleted or overwritten. Those backups are not used as a working copy of your account — they are the provider's disaster-recovery copies, kept and destroyed on the provider's own schedule, and not ours to erase early.
Three exceptions, all narrow: security records that count failed sign-in attempts hold no more than a one-way hash and expire on their own within hours; the security log described below is kept for 180 days; and Stripe keeps its own transaction records for as long as its financial-record obligations require, which is outside our control.
Deleting your account
Settings, then Legal & Privacy, then Delete Account. It asks for your password, then erases your uploaded files, empties every table that holds anything of yours, deletes the account itself, and then looks again to check nothing survived. If anything is still there you are told the deletion failed rather than told it worked.
Deleting your account also cancels an active membership billed through Stripe, so you are not charged for a service you no longer have. A membership bought through the App Store is Apple's and keeps running until you cancel it there — the app warns you about that before you delete.
That is the live copy gone. What happens to the copies your provider holds in its own backups is described under How long we keep it above.
Your Apple Health data is separate and is never touched.
Getting a copy, and correcting it
Settings, then Legal & Privacy, then Access & Export My Data gives you everything on your account as a single file. It is free, and it is not part of any paid membership.
Most of what we hold can be edited directly in the app. If something is wrong that you cannot fix yourself, write to info@passistant.com.au and we will correct it.
Security
Passwords are hashed with bcrypt and never stored in a form we can read. Connections to our servers use HTTPS. Uploaded documents are held in a private bucket. Sign-in and account-deletion attempts are rate-limited to make guessing a password impractical. If you connect a Telegram bot of your own, its token is encrypted before it is stored.
You can see every device signed in to your account, and sign any one of them out on its own, under Settings, then Legal & Privacy, then Linked Devices. Deleting your account revokes all of them at once.
The database enforces, on its own, that a row belongs to the account asking for it — so a mistake in our code returns nothing rather than somebody else's record.
No system is perfectly secure, and we do not claim this one is.
Security records we keep
We keep a security log of activity on accounts. A line in it says which account, which part of the app was used, when, whether it succeeded or failed, and a one-way hash of the network address it came from. It exists for one reason: if there is ever a security incident, it is what lets us work out whose account was involved so that we can tell them.
It holds no health information of any kind — nothing you have logged, no notes, no photographs, no documents and no file names — and no passwords or access tokens. It records that something happened, never what it said.
Security log lines are kept for 180 days and then deleted automatically. They are also erased with everything else when you delete your account.
If something goes wrong
If a data breach happens that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Complaints
Write to info@passistant.com.au and we will look into it. If you are not satisfied with how we handle it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or on 1300 363 992.
Changes to this policy
If we change this policy in a way that matters, the app will ask you to read and accept it before you carry on.