Privacy policy

Last updated: November 5, 2026. Draft for review.

Halden keeps your health data to show it back to you, and shares it only with people you choose. We never sell it, never use it for ads, and never let advertisers track you.

Who we are

Halden is made by Precipice Technology LLC, [address]. Questions: support@haldenhealth.io.

What we collect

• Email address and name, from you when you sign in. For your account and sign-in codes.
• Birth date, sex, height, goals, units and settings, from you in onboarding and Settings. For typical ranges for your age, your targets and how numbers are shown.
• Apple Health data: resting heart rate, heart rate variability, breathing rate, blood oxygen, sleep, steps, exercise minutes, wrist temperature, blood pressure, glucose, weight, cardio fitness (VO₂ max), heart rate, walking heart rate, heart rate recovery, active and resting energy, physical effort, and workouts. Only the types you allow, and you can turn each one off. For your trends, statuses, Recovery and patterns.
• Your health record: conditions, medicines, allergies, lab results and visits, from your provider's patient portal (Epic MyChart). Only after you sign in there and connect it. For your record, visit prep and care plan updates.
• What you add: readings, check-ins, notes, habits, questions, experiments, workouts, meals and your questions to Ask Halden. For the features you use them in. You can delete past questions.
• Meal photos and descriptions, only when you ask for an estimate. Sent to Anthropic to estimate what's in the meal, then thrown away. We keep only the meal you save.
• Purchases, from Apple through RevenueCat. To know whether you have Halden Pro.
• Achievements: which badges you've earned, and a few things only the app sees, like whether you added a widget or which tabs you've opened. Counts only, never what you wrote or read. To award badges.
• Invites: your invite code, and which account entered it. The person who invited you sees counts only, never your name. To give them a free month when you start paying for Pro.
• A push token and your phone's time zone, if you allow notifications. To send notifications and hold them during your quiet hours.
• App usage: screens opened, time on each, features used, onboarding steps and crash counts, under a random install ID that isn't linked to your account. To see what works and fix what doesn't. You can turn this off in Settings.

We don't collect your contacts, location or advertising ID, and we don't keep photos. We don't store your IP address.

Where it's kept

On our servers at [host and region], in a database encrypted at rest. Tokens for your health record and push tokens are also encrypted, with keys kept apart from the database. On your iPhone, your sign-in is kept in the Keychain, and visit notes in a protected file that isn't backed up.

Who processes it for us

• [Host] runs our servers and database.
• [Email provider] sends sign-in codes and report notices. Emails never contain health details, only links.
• Apple provides Sign in with Apple, push notifications and the App Store. Push messages never contain health details.
• RevenueCat keeps your subscription status, under your account ID.
• OpenAI rewords some lines of your morning brief, from our server. It sees only template lines such as "Recovery is 28 of 100 this morning". It never sees your name, account, dates, visit names, your own words, or anything from your health record. Requests are made with storage off.
• Anthropic (Claude) answers your questions in Ask Halden, from our server, only when you ask. It gets your question and the facts Halden picks to answer it (numbers, dates, condition and medicine names), never your name, email or account. Not used for training. If you speak a question, Apple's speech recognition turns it into text, on the phone when the phone supports it; Halden never gets the audio.
• Anthropic (Claude) estimates what's in a meal from a photo or your words, from our server, only when you ask. It gets the photo or words and nothing else: not your name, account, dates or anything from your health record. The photo isn't stored by us.
• Epic, only when you connect your record, under their own policies.

None of them may use your data for their own purposes.

Who you can share with

Nothing is shared unless you share it.

• Share links for a care team: you pick what's in them and when they expire, up to 30 days. You can end a link at any time, and you see when it's opened.
• Caregivers: someone with their own Halden account, linked by your invite. You pick what they see, and you can pause or end it at any time. They never see your notes.
• Automated reports: sent to you, your care team or a caregiver, as you choose. The email holds only a link.
• Health Card in Apple Wallet: shows only what you turn on. Its QR code opens a share link that expires.

How long we keep it

• Your data: until you delete it or your account.
• App usage events: 13 months.
• Rate-limit counters: 1 day. Push queue entries: 30 days.

Your choices and rights

• Turn off any Apple Health type, any notification, or app usage sharing in Settings.
• Review what's in your record, and mark items Current, Past or Not mine.
• Download your data: CSV in the web portal, or a FHIR file of your record.
• Delete your account in Settings. This deletes your data from our servers at once, disconnects your health record, and clears it from your phone.
• Depending on where you live, you may have more rights, such as access, correction and objection. Write to support@haldenhealth.io.

Children

Halden is for adults. Every account confirms the person is 18 or older.

Not a medical device

Halden shows trends to discuss with a care team. It doesn't diagnose or treat conditions. In an emergency, call 911.

Changes

We'll tell you in the app before a change to this policy takes effect.