HealthLoom Privacy Policy

Effective date: October 28, 2026

HealthLoom is an Android app published by Loominate ("we", "us"). It reads health data from Android Health Connect on your phone and lets you share it with the AI assistants you choose. This policy explains what we collect, why, who can see it, and how to delete it. Questions: [email protected].

What we collect

Health data from Health Connect, only after you grant permission in the app. HealthLoom requests read access to:

Heart rate, resting heart rate, heart rate variability, blood oxygen, respiratory rate, blood pressure, blood glucose, body temperature
Steps, distance, speed, VO2 max, exercise sessions, active and total calories burned, basal metabolic rate
Sleep
Weight, height, body fat
Nutrition and hydration
Health data history and background reads, so older data and updates can sync without keeping the app open

Account information: your email address and a sign-in identifier. You can sign in with Google, with an email address and password, or with an email link, all through Firebase Authentication. Passwords are handled by Firebase and are never visible to us.

Recovery key: the app generates a recovery key that can unlock your vault on a new phone. It is stored on your device and, where available, in Google's Block Store. We do not hold it in a form we can read.

Measurements and notes you add inside the app or through your connected AI assistant (for example goals, preferences, or logged events). You can also choose to enter your birth year, sex and height; these are optional and are used only to estimate your resting energy (basal metabolic rate) when your devices report none.

Technical data: crash reports and diagnostics (via Firebase Crashlytics) and a device token used to deliver notifications (via Firebase Cloud Messaging). These contain no health values.

Why we use it

To sync your Health Connect data to your private HealthLoom vault.
To let AI assistants that you approve read your data, so they can answer questions about your sleep, activity, recovery, and more.
To sign you in, send you the notifications you enable, and keep the service working and secure.

We do not sell your data. We do not use it for advertising, and we do not use it to build advertising or credit profiles. We do not use your health data to train AI models.

Who can see your data

You.
AI assistants you approve. When you connect an assistant (for example Claude or ChatGPT), it can request your data, and what it requests is sent to that provider and handled under its own terms and privacy policy. You can revoke access at any time in the app.
Service providers that run the app for us: Google Firebase (sign-in, crash reporting, notifications) and Fly.io (hosting). They process data only on our behalf.
Authorities, only where required by law.

How it is protected

Data is encrypted in transit (HTTPS/TLS). Each user's stored health database is encrypted with its own key. The key is held in wrapped form and can only be unlocked with secrets held by your phone and the AI apps you approve, so we store ciphertext and cannot read your data at rest. Data is decrypted in memory only while a request that you or an approved assistant made is being served. No system is perfectly secure, and a compromise of our servers while a request is being served is a risk we cannot fully eliminate.

Retention and deletion

We keep your data until you delete your account. To delete it, open the app, go to You → Delete account and data. This removes your account and your stored health data from our servers. You can also email [email protected] from your sign-in address and we will delete it for you. If you choose "Start fresh" in the app, the previous vault is kept for 7 days so you can restore it, then it is permanently erased.

Deleting your account does not delete data in Health Connect or in an AI assistant's own history. Manage those in Health Connect and in that assistant.

Backups or logs that may briefly contain residual data are cleared on a rolling basis. Logs redact emails and tokens.

Your choices

Grant or revoke individual Health Connect permissions at any time in Android settings.
Disconnect an AI assistant in the app, which ends its access.
Turn notifications off in the app or in Android settings.
Request a copy or correction of your data by email.

Health Connect and Google Play limited use

HealthLoom's use of information received from Health Connect adheres to the Google Play User Data policy, including the Limited Use requirements. We use Health Connect data only to provide and improve the user-facing features described above. We do not transfer it to others except to provide those features at your direction, for security or legal reasons, or as part of a merger or sale with your consent. We do not allow humans to read it unless you give consent for specific data, it is needed for security or abuse investigation, or the law requires it. HealthLoom is a wellness and information app. It is not a medical device and does not provide medical advice or diagnosis.

Children

HealthLoom is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes

If we change this policy, we will update the effective date above and, for material changes, tell you in the app.

Contact

Loominate · [email protected]