Consumer Health Data Privacy Policy
Hey Basil LLC · Last updated October 27, 2026
This policy covers consumer health data as defined by the Washington My Health My Data Act. Everything else about Basil's data practices is in the Privacy Policy.
Categories of consumer health data collected, and why
Body measurements (weight, body fat, height); activity (steps, distance, exercise and workouts, and calories burned); sleep; on iPhone, your date of birth and biological sex from Apple Health; the age and sex stored in your plan; food and drink you log; custom trackers and their values; the things Basil remembers about you; an estimate of your daily energy expenditure; and the contents of your conversations with the coach, which may describe your health.
It is collected to provide the calorie coaching you asked for — estimating intake, setting and adjusting a plan, answering your questions about your own data, and planning proactive notifications when you enable Basil reaching out — and, when you choose to send a bug report containing health data, to provide support and debug Basil. If you turn on Help Basil learn and grow, the food and drink you log is also shared anonymously, to improve Basil's food estimates and to publish food information.
Categories of sources
Directly from you, as what you type, say, photograph, or scan in the app. From your device's health store — Apple Health on iPhone, Health Connect on Android — when you connect it and grant permission.
Third parties and affiliates it is shared with
OpenRouter, Inc., which routes each request, and the AI provider that serves it: today Google, OpenAI, or Anthropic. Which AI providers Basil uses changes over time, and we update this list when it does. Every request goes only to providers that do not train on it. Google may keep requests and responses for up to 55 days, only to detect abuse and meet legal obligations; every other AI provider is reached only through endpoints that keep nothing.
Exa, for web searches the model composes, reached through OpenRouter. Exa may use search queries to improve its service, including training its models.
Open Food Facts, which receives the barcode of a product you scan.
Cloudflare, Inc., whose Worker passes every AI request to OpenRouter and relays bug reports you choose to send, storing neither, and whose database stores the foods you choose to share anonymously with Help Basil learn and grow. Like any web host, Cloudflare sees your IP address when they are sent; we don't store it with the foods.
GitHub, Inc., only if you choose to send a bug report, which it then stores. Nothing goes to GitHub unless you send a report, and you decide what is in it before it goes: your recent conversation, which may contain body measurements or imported health readings, is included by default and can be turned off; a journal snapshot (a week of totals, your stored body measurements and imported health readings, your plan and the details behind it, and Basil's memories) is included only if you turn it on. You can read the whole report before sending it.
OpenAI, whose Codex coding assistant reads each bug report you send to triage it.
Anthropic, PBC, whose Claude coding assistant we use to work through bug reports you send.
Statsig, Inc., which receives product-usage events such as that a food entry was logged or that health sync is connected, tied to a random installation identifier. It never receives the food, the readings, or your conversations.
Hey Basil LLC has no affiliates.
How to exercise your rights
You have the right to confirm whether we collect, share, or sell your consumer health data, to access it, to withdraw consent to its collection and sharing, and to have it deleted.
Withdraw consent to sharing with the AI at any time using Stop sharing with the AI in Settings. Withdraw consent and delete imported health data at any time using Disconnect in Settings. Copies Google holds for abuse monitoring are deleted after 55 days, and we cannot delete them sooner. Delete all data erases your journal, plan, conversations, memories, and imported health readings from the device. Turn off Help Basil learn and grow in Settings to stop sharing foods. Foods already shared carry nothing that identifies you, so we can't find them to delete them. Deleting data does not remove copies in your phone's own backups, which you control, or bug reports you have sent — ask us to delete those.
To make any of these requests, or to ask us to confirm or produce the data, write to privacy@coachbasil.app. We will respond within 20 days, and you can appeal a refusal by replying to our response.