Privacy policy

Version 2026-11-08. This English version has the same content as the German version; if they differ, the German version applies.

1. Controller

[controller name missing]
[address missing]
Email: [email missing]

2. What HealthFactory does

With your permission, the iPhone app reads data from Apple Health and transfers it encrypted (HTTPS) to this server. The server prepares it (e.g. trends, averages, merging duplicates from different apps) and makes it available through an interface (MCP) to your own Claude or ChatGPT account (no other user has access; service providers see section 5), after you have set up the connection there yourself and confirmed it with your passkey or in the app (with Face ID or Touch ID).

3. Which data

• Health data (special category under Art. 9 GDPR), as far as you allow it in Health: weight, body fat, lean mass, BMI, height, waist circumference; sleep and sleep stages; resting heart rate, heart rate, heart rate variability, VO2max, heart rate recovery, respiratory rate and wrist temperature during sleep; blood pressure, oxygen saturation, breathing disturbances during sleep, body temperature; steps, active energy, exercise minutes, distance; workouts (type, duration, energy, heart rate, effort, source) with details (heart rate curve, running, cycling and swimming metrics, laps and segments) and, if the recording contains one, the GPS route of the workout (location data, particularly sensitive); nutrition (energy, macro- and micronutrients, caffeine, water); alcohol (number of alcoholic drinks per day, only if you log them in Health; for sleep factors and lab context); mood and mindfulness (mood entries from Health with their pleasant-unpleasant value, chosen feelings and life areas, mindful minutes, minutes in daylight from the Apple Watch; for the patterns, never an assessment of your mental health); symptoms; values you log to Health in the app or via Claude (weight, body fat, waist circumference, blood pressure, mood, water, caffeine; they take the same path as your other Health data); cycle (period days and flow, basal body temperature) if you allow it in Health; medications and supplements that you allow individually in Health (name, form, doses with time and amount). In addition: body composition reports (e.g. BIA) that you scan or let Claude enter (only the numbers, not the photo); additional scale values from the scale manufacturer's data export that you pick in the app yourself (visceral fat, muscle, bone and water mass with time; the export is read on the iPhone only, nothing else in it is transmitted); medications and supplements you log yourself or let Claude log (name, dose, time); lab results you enter, import from a photo of your report (the photo is only read on the iPhone; stored are test name, value, unit, reference range, date and lab) or let Claude enter; self-experiments (title, period, chosen metrics); and voluntary details: year of birth, sex and height, only for reference values such as basal metabolic rate and maximum heart rate. On request the app takes them from your Health profile (only the year of the date of birth is stored); you can clear them in the app at any time. For each value the source (e.g. app or device name) and time.
• Your own entries and analyses: goals you set (e.g. target weight, yearly distance) and analyses calculated from your data (weekly review, readiness, energy balance, records and milestones, patterns, model values). They are computed on the server from the data above and shown only to you.
• Optional contact details: first name, last name and a contact email if you enter them in the app (Settings → Contact), separate from your account. We use them to address you personally about your feedback and, if you allow it, to contact you; news by email only with its own checkbox (Art. 6(1)(a) GDPR), withdraw any time in the app.
• Account data: email address and display name (with an invitation link) or only a random identifier (for accounts created in the app), the identifier from Sign in with Apple if you use it, time zone, public key of your passkey (no password; not needed for app accounts), paired devices (name) with the public key for confirming with Face ID (the secret part stays on the iPhone), time and version of your consent and which data types you have turned off (with time).
• Technical data: times of uploads, sync runs (trigger, counts, errors) and sign-ins; per device its name, app version, setup step, notification token and which data types the app may write to Health; connected assistants with last use; IP address in short-lived server logs. Logs contain no health values.

4. Purpose and legal basis

The main purpose is to make your own data available to you for analysis in Claude or ChatGPT and in the app. The legal basis is your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR). There is no advertising, no third-party tracking, no use for other purposes and no sale of data. For operation and troubleshooting the operator sees usage figures per account (last sync, app version, number of entries, last use via Claude or ChatGPT), no health values. For the usage figures, server logs and the security of the service the legal basis is the legitimate interest in secure operation (Art. 6(1)(f) GDPR), for the deletion list after an account deletion the legal obligation to keep deleted data deleted even after a restore (Art. 6(1)(c) GDPR). HealthFactory does not make diagnoses and does not replace medical advice.

Providing your data is voluntary. Without consent you cannot use HealthFactory; without individual data types only the analyses based on them are missing. Analyses such as readiness, unusual values or patterns are generated automatically but are only hints for you; there is no automated decision-making with legal or similarly significant effect (Art. 22 GDPR).

Age: HealthFactory is for people aged 14 and over (Section 4(4) of the Austrian Data Protection Act, DSG); you confirm this when you sign up. Under 18 (calculated from the year of birth in your profile) there are no goals for weight, body fat or calories and no weight-loss or deficit calculations, only trends against your own earlier values. For Claude and ChatGPT the age limits of the respective provider apply.

5. Recipients and service providers

• Server: the controller's own server in Austria; nightly backups to own storage and additionally off-site in cloud storage (Microsoft OneDrive).
• Cloudflare, Inc. (USA) forwards all connections to the server (tunnel). To do so, the encrypted connection is decrypted at Cloudflare and passed on encrypted to our server; Cloudflare therefore technically has access to the transmitted content, including health data, but does not store it for us. IP addresses and connection data may be processed in third countries. Basis: Cloudflare's data processing agreement and the EU-US Data Privacy Framework or standard contractual clauses. With the planned move to a server in the EU, Cloudflare will no longer handle data connections.
• Microsoft Ireland Operations Ltd. (Microsoft 365): sending emails (sign-in codes, replies to feedback, notices to the operator) and storage for off-site backup copies (OneDrive).
• Anthropic (Claude): only if you connect the connector in your Claude account does Claude retrieve data on your behalf to answer your questions. Anthropic is a controller in its own right: what Claude retrieves becomes part of your chat and is stored there under the terms and privacy policy under which you use your Claude account (Anthropic also processes data in the USA; whether chats are used for training is a setting in Claude). You can disconnect at any time.
• OpenAI (ChatGPT): only if you set up the connection in your ChatGPT account does ChatGPT retrieve data on your behalf. OpenAI is a controller in its own right: what ChatGPT retrieves becomes part of your chat and is stored there under OpenAI's terms and privacy policy (OpenAI also processes data in the USA; whether chats are used for training is a setting in ChatGPT). You decide whether to connect Claude, ChatGPT or neither.
• Apple: the app is distributed via TestFlight; Apple receives the usual installation details. If you use Sign in with Apple, Apple confirms your sign-in. Notifications are sent via the Apple Push Notification service (device token and notification text); notifications after a workout and for personal bests include values such as workout type, duration, distance, pace, energy, best times and strength figures, notifications about unusual values include no values. Notifications about unusual values are sent only if you turn them on; those after workouts, for personal bests and the weekly review can be turned off in the app; notices about missing data, new connections and replies to feedback cannot. Beyond that, the app does not pass Health data to Apple.

6. Access by the operator

Other users have no access to your data; every query is technically restricted to your account. As server administrator, the operator has technical access to the database and backups. This access is used only as far as necessary for operation, backup or troubleshooting, and your health data is not viewed without your consent. For development, operation and handling feedback the operator uses AI tools from Anthropic (Claude, Anthropic PBC, USA) as a service provider; Claude may see feedback texts, attached screenshots and, when explicitly requested, name and email address to reply. Health data from your account is not retrieved for this; it would be technically possible via server access, so the same rule applies as for the operator. The operator uses Claude for this through their own account under Anthropic's terms; there is no data processing agreement for this, and Anthropic also processes data in the USA. You therefore decide yourself what you send with a message (text, screenshot, contact details) when you send it; the form points this out.

Feedback: if you send a bug report, idea or question via the app or via Claude/ChatGPT, the operator reads your text, an attached screenshot and technical details (app and iOS version, device model, last sync) to reply and improve the app. Health values are included only if you write them yourself or they appear on the screenshot; by sending you explicitly consent to this. You can withdraw a message in the app at any time; for completed messages a screenshot is deleted after 30 days and the message itself after 12 months, all of them with your account.

7. Retention

Your data is kept until you delete your account. It is then removed from the database immediately. It remains in backup copies until they are overwritten: daily database backups after 14 days, snapshots of the server backup (including off-site) after 12 months at the latest. Backups are used only to recover from an outage; if one is restored, accounts deleted in the meantime are deleted again. For this, after a deletion we keep only the account's random identifier and the time, for as long as the backups, also in the notice email to the operator (Art. 17 and Art. 6(1)(c) GDPR).

Further periods: an account created in the app that never received data is deleted after 7 days. The log of sync runs (times, counts, errors) is kept for 90 days. A connection to Claude or ChatGPT not used for 30 days is disconnected by the server. Screenshots in feedback are deleted 30 days after the message is closed, closed messages after 12 months. Notice emails to the operator (without names and addresses, with a short identifier) are deleted after 90 days, notices about deleted accounts after 13 months. Earlier versions of this policy are available at /en/privacy/<version>; which version you agreed to, and in which language, is stored with your account; the app shows the version under Settings.

8. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw your consent at any time with effect for the future. For individual data types (workout routes, mood and mindfulness, cycle, medications and supplements, alcohol) you withdraw in the app under Settings → Consent per data type: the data type is no longer transferred, and what is already stored on the server is deleted from the database immediately (backup copies as in section 7; for medications also the doses you logged yourself); your account and all other data remain. If you turn it back on, the app reads it from Health again. You exclude other data types by turning them off for HealthFactory in Health. You withdraw entirely by deleting your account. You can trigger export and deletion yourself in the app (gear icon → Settings → Account) or in the account area; otherwise an email to [email missing] is enough. You can lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).