Consumer Health Data Privacy Policy

Categories of consumer health data collected, and why

Body measurements (weight, body fat, height, lean body mass); activity (steps, distance, exercise and workouts, and calories burned); sleep; resting heart rate; food and drink you log; and the contents of your conversations with the coach, which may describe your health.

It is collected to provide the nutrition coaching you asked for — estimating intake, setting and adjusting a plan, answering your questions about your own data, and planning proactive notifications when you enable Basil reaching out — and, when you choose to send a bug report containing health data, to provide support and debug Basil.

Categories of sources

Directly from you, as what you type, say, photograph, or scan in the app. From your device's health store — Apple Health on iPhone, Health Connect on Android — when you connect it and grant permission.

Categories of consumer health data shared

All of the categories listed above may be shared when answering you, when planning proactive notifications you enabled, or when you choose to send a bug report. The latest body measurements and energy estimate are attached to every AI reply request while connected. Nothing is shared for advertising, and we do not sell consumer health data.

Third parties and affiliates it is shared with

OpenRouter, Inc., which routes the request, and the AI model provider that serves it, which may include Google.

Exa, for web searches the model composes, reached through OpenRouter.

Open Food Facts, which receives the barcode of a product you scan.

Cloudflare, Inc., whose Worker relays bug reports you choose to send without storing them.

GitHub, Inc., which stores bug reports you choose to send. By default a report includes your recent conversation, which may itself contain body measurements or imported health readings. If you attach a journal snapshot, the report also includes a week of totals, your stored body measurements and imported health readings, your plan and profile, and Basil's memories.

OpenAI, whose Codex coding assistant reads each bug report to triage it.

Pastmaps LLC has no affiliates.

How to exercise your rights

You have the right to confirm whether we collect, share, or sell your consumer health data, to access it, to withdraw consent to its collection and sharing, and to have it deleted.

Withdraw consent and delete imported health data at any time using Disconnect in Settings. Delete all data removes the active profile; switch to each other profile and use it there to remove every profile from the device. That does not remove copies in your phone's own backups, which you control, or bug reports you have sent — ask us to delete those.

To make any of these requests, or to ask us to confirm or produce the data, write to privacy@pastmaps.com. We will respond within 45 days. If we deny a request, our response will explain how to appeal, and you may also file a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.