AI & Data
AI & Data Processing
The source, destination, processor category, and retention of every data category — in one table.
Last updated · 2026-07-23
This notice is the authoritative data-flow map, consistent with the app's actual code paths. It supplements the Privacy Policy by detailing under which consent, and in what form, health data leaves the device, and which category of processor handles it.
Data-flow matrix
The table below lists, per data category: source, whether it leaves the device, backend storage, third-party processor category, purpose, retention, and deletion path.
Health-summary features (aggregates, not raw samples)
- Source
- Apple Health (parsed on device)
- Leaves device
- Only after explicit AI-analysis consent, as aggregated features
- Backend storage
- Health-feature store
- Processor
- a third-party AI processing service
- Purpose
- Generate daily health advice
- Retention / deletion
- Until consent withdrawal or account deletion; withdrawal hard-deletes that scope
Screen-time aggregates (e.g. minutes of night usage)
- Source
- System screen-time statistics (parsed on device; not sourced from Apple Health), no app names
- Leaves device
- Aggregated minutes only, uploaded as a health observation only after explicit AI-analysis consent
- Backend storage
- Health-feature store
- Processor
- a third-party AI processing service
- Purpose
- Routine- and sleep-related analysis
- Retention / deletion
- Same as health summaries: until consent withdrawal or account deletion
Chat health-Q&A context
- Source
- On device (read on demand per question)
- Leaves device
- On demand, no persistent mirror
- Backend storage
- Not persisted
- Processor
- a third-party AI processing service
- Purpose
- Answer your health questions
- Retention / deletion
- Not retained
Voice audio (transcribed, then discarded)
- Source
- Chat voice input and nutrition voice descriptions
- Leaves device
- Yes, uploaded for transcription only
- Backend storage
- Not stored; discarded once transcription completes
- Processor
- a third-party AI processing service
- Purpose
- Convert chat / nutrition voice to text
- Retention / deletion
- Audio is not retained; the transcribed text is kept as chat conversation content
Chat conversations & attachments
- Source
- Messages and attachments you send in chat
- Leaves device
- Yes
- Backend storage
- Conversation store
- Processor
- a third-party AI processing service
- Purpose
- Continue conversations and view history
- Retention / deletion
- Until you delete the conversation or your account
AI memory (your health preferences)
- Source
- Your conversations with the AI
- Leaves device
- Yes
- Backend storage
- Memory store
- Processor
- a third-party AI processing service
- Purpose
- Personalized advice
- Retention / deletion
- Until withdrawal or account deletion; withdrawal clears the health memory
Care sharing
- Source
- Health details you authorize per grant
- Leaves device
- Yes
- Backend storage
- Care-share store
- Processor
- —
- Purpose
- Viewable by the friends you authorize
- Retention / deletion
- Until you revoke the grant; independent of AI consent
Care messages
- Source
- Messages you exchange with friends
- Leaves device
- Yes
- Backend storage
- Care-message store
- Processor
- —
- Purpose
- Private messaging between friends
- Retention / deletion
- Until you delete them or your account
Nutrition / skin / clinical records
- Source
- Content you actively create / capture
- Leaves device
- Yes
- Backend storage
- Their respective content stores
- Processor
- A third-party AI processing service (only when you request analysis)
- Purpose
- Recognition / analysis you request
- Retention / deletion
- Until you delete or close the account; deletable item by item
Account (email, login credentials)
- Source
- Provided at registration
- Leaves device
- Yes
- Backend storage
- Account store
- Processor
- a third-party email delivery service (verification-code email)
- Purpose
- Login, recovery, notifications
- Retention / deletion
- Until account deletion
Subscription & transaction records
- Source
- Apple App Store (product, transaction, and expiry information)
- Leaves device
- Yes
- Backend storage
- Subscription store (linked to your account)
- Processor
- —
- Purpose
- Entitlement verification, refund disputes, and accounting
- Retention / deletion
- Kept as long as needed for accounting and legal obligations; unlinked from your account identity after deletion
Push token / device identifier
- Source
- Device
- Leaves device
- Yes
- Backend storage
- Device-token store
- Processor
- the platform push service
- Purpose
- Send notifications
- Retention / deletion
- Until logout / deletion; logout unbinds
Crash / performance telemetry
- Source
- Device (de-identified)
- Leaves device
- Yes (de-identified)
- Backend storage
- Third-party crash-diagnostics service
- Processor
- a third-party crash-diagnostics service
- Purpose
- Stability diagnostics
- Retention / deletion
- De-identified, kept at most 90 days; structured codes only, no PII / health values
Reports & evidence snapshots
- Source
- Reports you submit and evidence snapshots of the related messages
- Leaves device
- Yes
- Backend storage
- Moderation queue; accessible only to our moderation staff, confidential from the reported user
- Processor
- —
- Purpose
- Handle reports and prevent abuse
- Retention / deletion
- Kept until the report is resolved; after account deletion only a de-identified minimal record is retained
Infrastructure is provided by third-party cloud and edge providers (hosting, CDN, and edge); AI processing is provided by a third-party AI processing service.
How we handle health data with AI
AI advice, health Q&A, and analysis are produced by a third-party AI processing service. Your health data is not used to train any model.
Your health summary is uploaded for AI analysis only after you explicitly consent to “AI health analysis.” When you turn consent off, we stop analysis and delete the health summaries and AI health memory already uploaded.
Care sharing is a separate, per-grant authorization, independent of AI consent; revoking a grant stops only that share.
Processors
In this public policy we disclose processors by category (a third-party AI processing service, a third-party email delivery service, the platform push service, a third-party crash-diagnostics service, and third-party cloud and edge providers), and share with each only the data necessary for its service.