Privacy notice

1. Controller

2. Service, accounts, and devices

Wearable Context makes health and activity data from sources you connect available to the built-in AI assistant and to AI clients you expressly authorize through the read-only MCP service. We process account data, password hashes, session and security data, verification data, and encrypted access and refresh tokens. WHOOP, Withings, Polar, and optional Apple Health and Health Connect are currently supported.

Technical data may include IP address, browser or device information, pseudonymous account identifiers, timestamps, request identifiers, and limited security, rate-limit, and failure metadata. We do not place health values or Chat text in technical operational logs.

When you connect WHOOP, we read its basic profile. We store a secret-key-pseudonymized WHOOP user identifier to prevent the same WHOOP account from being assigned to multiple Wearable Context accounts, plus the name for “Connected as.” We discard the WHOOP email and do not compare it with the Wearable Context email.

For paid subscriptions, we process the plan, billing interval, seller and environment, external customer, product, transaction and subscription references, lifecycle status, renewal intent, access dates, and verified event receipts. We do not store payment methods, card details, or complete provider payloads. Web purchases are processed through Stripe Managed Payments and Link; iOS-app purchases are processed through the Apple App Store.

The mobile app can save multiple accounts on one device. OAuth credentials are held in protected device storage. The app also stores the active-account selection, preferences, active chat, and a native-health SQLite synchronization queue and checkpoints. Anyone with access to an unlocked device may switch among accounts available there. Removing an account from the device deletes its local sign-in, local active-Chat pointer, and any pending native-health synchronization copy owned by that account; it does not delete the account or its data on the server.

3. Health data, Apple Health, and Health Connect

Apple Health and Health Connect are optional. The mobile app asks only for read access to steps, active energy, weight, body-fat percentage, lean body mass, resting heart rate, heart-rate variability, respiratory rate, VO₂ max, sleep, and workouts. Transfer starts only after you separately approve account synchronization. We store those normalized values, including source app, local calendar day, and source time zone or UTC offset where available. Apple does not tell apps which individual read permissions you declined; Health Connect lets you select individual categories.

On Android, the app asks for Health Connect background access and extended history only when the device supports those features. Without background access, synchronization runs only while you use the app. Without extended history, initial Health Connect access is typically limited to 30 days rather than up to 90 days. The Health Connect privacy link shown with its permission controls opens this public notice.

For cloud wearables, health and activity values authorized by the provider are generally retrieved for the specific Chat or MCP request. Connection records and explicit consent are stored per account. You can revoke each connection and consent for the future.

Wearable Context does not sell health data or use it for advertising, insurance, employment, eligibility decisions, or training general-purpose AI models.

4. AI assistant and chat history

The built-in Chat is an AI assistant. Your prompt, limited prior conversation, and results from authorized tools — including health data in those results — are sent through Vercel AI Gateway to the model provider selected for the account to generate a response. A Google Gemini model is currently the default; a different model provider configured by the operator may be used for an individual account. AI output can be wrong or incomplete and is not medical advice, diagnosis, or treatment.

We retain chat messages, assistant responses, and normalized tool calls and their inputs and outputs for up to 30 days to provide history, diagnose failures, and handle reported feedback. Hidden model reasoning, provider credentials, and raw provider responses are not stored as chat history. You can delete individual chats early.

If you use the optional voice memo, the recording is sent to the transcription provider selected by the operator. Google Gemini 3.5 Transcribe through Vercel AI Gateway is currently the default; prompt training is disabled, but EU-only processing and provider zero-data-retention are not currently guaranteed for that route. Alternatively, Deepgram can be selected through its EU endpoint with model-improvement retention disabled. The server discards the audio after the request. If transcription fails, your browser keeps the recording only in memory for up to 15 minutes so you can retry. It is cleared after success, when you discard it, or when you leave the page. The transcript can replay the same request for 15 minutes. It is unavailable after that; the expired row is deleted on the next voice request or daily cleanup, normally within 24 hours. In browser Chat, click the microphone to start recording, then choose Stop to return an editable draft or Send to transcribe and immediately send only the recorded text.

5. Legal bases and consent

Account creation, authentication, and service delivery rely on Article 6(1)(b) GDPR. Necessary security and limited technical logging rely on Article 6(1)(f). Connected wearable data may be health data under Article 9 and is processed only after explicit consent under Articles 6(1)(a) and 9(2)(a).

Apple Health or Health Connect account synchronization has its own consent and is separate from the respective device permissions. External MCP clients additionally require your health:read approval. Withdrawal applies to future processing and does not affect the lawfulness of earlier processing.

Managing your privacy choice with c15t/Inth and determining the applicable consent rules rely on Article 6(1)(c) GDPR where necessary to meet legal obligations and otherwise on Article 6(1)(f). Optional measurement with PostHog EU is based solely on your consent under Article 6(1)(a) GDPR. You can withdraw that choice at any time through Privacy choices on the web or the mobile-app setting.

Strongly minimized JavaScript error reports from the signed-in mobile app rely on our legitimate interest under Article 6(1)(f) GDPR in finding failures and maintaining service stability. You may object by contacting privacy@wearablecontext.com.

Separate, strongly minimized server-side completion measurement relies on our legitimate interest under Article 6(1)(f) GDPR in understanding use and reliability of the service and improving onboarding. You may object to that processing at any time in signed-in account settings or by contacting privacy@wearablecontext.com.

Subscription management, access delivery, and product support rely on Article 6(1)(b) GDPR. Where billing or transaction evidence is required for a legal duty, processing relies on Article 6(1)(c). Stripe/Link or Apple additionally process payment and transaction data under their own responsibility, terms, and privacy notices.

6. Recipients and international transfers

• Vercel Inc. for hosting, the web application, and AI Gateway,
• PlanetScale Inc. for PostgreSQL configured in an EU region,
• Resend Inc. for transactional email,
• Stripe, Link, and the Stripe entity identified at Checkout for web purchases, payment processing, invoices, subscription management, fraud prevention, transaction support, and refunds,
• Apple and the Apple entity identified in the applicable App Store for StoreKit purchases, subscription management, billing, and refunds,
• the wearable provider you connect,
• the selected AI model provider, currently Google LLC by default,
• Google LLC or Deepgram Inc. for optional voice transcription, depending on the selected model,
• Consent Management Inc. (Inth/c15t) for consent rules and evidence of your choice,
• PostHog Inc., or the PostHog entity named in the contract, for optional consented measurement and minimized mobile JavaScript error reports in its EU Cloud,
• the MCP or AI client you expressly authorize.

Where a recipient is outside the EEA, we use an adequacy decision, Standard Contractual Clauses, or another appropriate safeguard where required. Wearable providers and external clients you select also operate under their own privacy notices.

7. Retention and deletion

Account data and encrypted provider tokens are retained until disconnection, withdrawal, or account deletion. Chats expire no later than 30 days after their last update and are physically deleted on the next Chat or administrator activity; you can delete them earlier from Chat history. Necessary security and rate-limit data are retained only as long as required for protection, investigation, or legal duties.

The internal subscription projection remains until account deletion or for as long as necessary for access management, disputes, or legal recordkeeping. Stripe/Link and Apple determine retention of their payment, invoice, and transaction records under their own legal duties. Deleting a Wearable Context account does not automatically erase those independent transaction records.

Synchronized native-health measurements form a rolling copy of up to 90 days; Health Connect may initially be limited to 30 days without extended-history access. Older values are removed daily and during synchronization. Stopping synchronization deletes the active server copy from the live database and prevents future transfer. Details already included in a chat follow the separate Chat period or are removed when that chat is deleted. Time-limited backups may remain until the documented recovery window ends.

8. Cookies, app analytics, and tracking

The website and web app use necessary cookies for your privacy choice, authentication, OAuth security, session management, and your light/dark appearance preference. When a page loads, c15t/Inth receives the IP address and technical request data to determine the applicable consent rules and remembers your choice for 180 days locally and in a hosted consent record.

PostHog is loaded from its EU Cloud only with your consent. We collect shortened page categories, selected campaign parameters, the referring domain, basic technical browser and device information, clicks on account and plan actions, signup start and success, and controlled onboarding steps and outcomes. These events can include a randomly assigned experiment variant, coarse source kind, form factor, plan, and billing interval. We may also send country plus first-level region codes that Vercel derives from the IP address. We do not send the city, postal code, coordinates, timezone, IP address, or raw advertising click identifiers to PostHog. PostHog uses a random browser identifier for this purpose. We do not send names, email addresses, health data, Chat content, exact wearable provider, or full URLs, and we do not use advertising trackers. Analytics data is retained for no more than twelve months. Withdrawal stops future measurement and removes the local analytics identifier.

After sign-in, the mobile app uses a project-specific private support ID derived one-way from the internal account ID. The source account ID, name, and email address are not sent to PostHog. Strongly minimized JavaScript error reports may be sent without optional product measurement. They contain only the exception type, constrained stack-frame file locations, error area, and basic app, library, operating-system, and device-type information. Error-message text, source context, variables, page/request URLs, URL query strings and fragments, location, IP/GeoIP data, health values, exact wearable providers, Chat prompts or responses, and advertising identifiers are removed before delivery.

Optional product measurement begins only after a separate, account-specific choice. It includes only measurement enablement, app opens, successfully completed Chat requests, controlled Settings, Billing, and Connections actions, and controlled onboarding steps and outcomes. The choice is held separately for each account saved in protected device storage. Turning it off in app Settings stops optional product measurement and removes queued product-analytics events; minimized JavaScript error reports remain active. Mobile telemetry is retained for no more than twelve months.

Independently of that optional measurement, the server may record six successfully completed actions: account creation, Chat request, wearable connection, Checkout creation, onboarding experiment assignment, and subscription activation after onboarding. Every event receives a fresh random identifier and can contain only its documented coarse properties plus country and region codes supplied by Vercel. It contains no account or person profile, IP address, URL, contact detail, health value, Chat content, or exact wearable source. These data are retained for no more than twelve months. You may object to this processing.

9. Your rights

Subject to the GDPR, you may request access, correction, deletion, restriction, portability, or object to processing, and you may withdraw consent. Contact privacy@wearablecontext.com. You may also complain to a data protection authority, particularly the Hamburg Commissioner for Data Protection and Freedom of Information.

10. Automated decisions and children

Wearable Context does not make decisions with legal or similarly significant effects and does not create advertising profiles. The service is currently intended only for adults. Questions can be sent to support@wearablecontext.com.