Privacy
Last updated: 25 August 2026
This page covers the Helsa iOS app. The server in this repository is software you run yourself; when you run it, the data on it is yours and the policy that governs it is your own.
The short version
The app collects nothing. There is no account, no analytics, no crash reporting, no advertising, and no server operated by the developer — so there is no place for your data to be sent to, even by mistake. Your health data is read from Apple Health on your device, analysed on your device, and stays there.
⚠️ The one channel that is not nothing is the one you choose to use: writing to support. Anything you send in an email — including a screenshot with figures on it — arrives in a mailbox and sits there until it is deleted. It is read by one person, it is never added to anything, and nothing else happens to it. If you would rather it did not exist at all, open an issue without the health data instead. Please crop what you do not need to send.
The one way data leaves your phone is a server you set up and whose address you type in. That is off by default.
What the app reads
With your permission, from Apple Health: every quantity type Apple Health offers — 120 of them today — plus sleep, workouts and their routes, and the events your watch records (a fall, a high or low heart rate, an irregular rhythm, a loud environment).
That list is not only steps and heart rate. It includes the measurements people most want named: blood pressure, blood glucose, blood oxygen, atrial-fibrillation burden, spirometry and inhaler use, body temperature. Helsa reads whichever of them you have, because a health app that quietly skipped the serious types would be the less honest design — and because it never decides what your data means.
Permission is requested group by group, and refusing a group is a normal outcome the app is built to handle. It reads nothing you have not allowed.
What the app writes
Three things, all into Apple Health, all entered by you:
- your daily journal — mood, symptoms, tags;
- the symptoms you write on an event;
- the water you log.
Everything else it only reads. It keeps no database of its own: what you write goes into Apple Health, where other apps can reach it and where you can delete it.
What leaves your device
By default, nothing.
| When | Where to | |
|---|---|---|
| Health data | Only if you turn on uploading and enter an address | The server you named, over mutual TLS with a device certificate |
| Map tiles (the app) | When you look at a map or share a route on one | Apple, through MapKit — Apple’s own privacy policy applies |
| Map tiles (the web dashboard) | Only if you switch a map on; it is off by default | Whatever tile source you chose, reached through your own server, never from the browser. What each choice sends |
| Settings | If you have iCloud on | Your own iCloud account (preferences only — never health data) |
There is no fourth row. In particular there is no telemetry, no “anonymous usage statistics”, and no error reporting: the app contains no third-party software development kit of any kind, and its package manifest has an empty dependency list.
Your calendar
If — and only if — you turn on the appointment feature, the app reads the titles of your calendar entries for the next 14 days, to offer a summary sheet before a medical appointment. It stores nothing from your calendar, logs nothing, and sends nothing anywhere. Notes, locations and attendees are never read. It is off by default, and until you turn it on the app does not ask for calendar access at all.
⚠️ iOS offers only “write only” and “full access” for calendars — there is no read-limited level — so the narrowing above is done by the app itself rather than enforced by the system.
System search
If you turn on search indexing, what you wrote — your notes and the days they belong to — becomes findable in the system’s own search. Measured data is never indexed. The index lives on your device, and turning the switch off deletes what was already indexed rather than merely stopping new entries.
Notifications
Reminders and follow-up questions are local notifications, scheduled on the device. Nothing is sent through a push server. They are off by default.
Children
The app is not directed at children, and it collects nothing from anyone.
Changes
If this policy changes, the date at the top changes with it, and the history is in this repository’s commit log.
Contact
Questions about privacy, or about this page: open an issue in the repository, or see SECURITY.md for anything that should not be public. If you would rather write, the address and what happens to what you send are on the support page.