Privacy

Privacy Policy

Effective October 2026 · last updated 26 October 2026 · applies to the Understory iOS app and theunderstoryhealth.com

The short version

Your health data is yours. We collect it only to compute your own readings, never to sell or share for advertising.
Skin photos never leave your phone without your explicit action: they live in an on-device, Face ID-protected store, kept out of your camera roll. They are included in your own encrypted device backup, so a new phone restores them, and they never reach our servers.
Your calendar never leaves your phone. To line your treatments up with your results, the app scans it on your device for appointments matching keywords you set, such as your clinic's name, "Botox," "dermatology." Nothing else is read, and no event ever reaches our servers.
Delete everything, anytime: Profile → Delete my account & data erases your records, documents and embeddings from our servers and signs you out. It cannot be undone by us or you.

What we collect

Health & fitness data you connect (HRV, resting heart rate, respiratory rate, wrist temperature, sleep, activity), read from Apple Health with your permission and used to compute your Daily Read against your own baseline. A once-daily summary of these is stored on our servers so your record can connect them to your labs, for example by reading a low ferritin against your HRV and sleep. We store one summary row per day, never the raw second-by-second samples.
Lab results you import from Apple Health Records. If you connect a clinic or patient portal to Apple Health and tap Import from Apple Health in Understory, we read your lab results with your permission, and only lab results. On your phone, each result is reduced to five fields: the test name, value, unit, date and reference range; the underlying clinical records, and the name of the health system that supplied them, never leave your device. That list is sent to our servers once, matched to standard marker names, and shown back to you; only the values you confirm are saved to your record. If you confirm, we keep the imported list as a document you can view or delete; if you do not, it is deleted automatically after 24 hours (the deletion job runs hourly). Deleted files are scheduled for permanent removal one day after deletion by our storage lifecycle rule and are gone within about two days. Importing is always your action: nothing is read in the background, and Understory never writes to Health. You can revoke access at any time in Settings → Privacy & Security → Health → Understory.
Episodic health readings you record or connect: blood pressure, blood glucose, the occasional heart-rhythm notification from your watch, and, where it's relevant to you, your menstrual cycle. Period dates you log stay on your phone; at most, the cycle phase computed from them (for example, "luteal") is used, never the dates themselves. We keep these readings only to give the rest of your record context, and each one stays until you delete it.
Documents you upload (lab panels, DEXA scans), parsed into structured values that you confirm before anything enters your record, and every value keeps its source. We also keep the original file you uploaded, stored securely, so the document behind each number is always there when you want to look. It's yours to remove anytime, on its own or with your whole account. An upload you never confirm is deleted automatically after 24 hours (the deletion job runs hourly). Deleted files are scheduled for permanent removal one day after deletion by our storage lifecycle rule and are gone within about two days; encrypted database backups age out within 7 days.
Account identity: your Apple ID's stable identifier and (if shared) email, via Sign in with Apple. We verify it server-side on every request.
Your first name: if you type it in the app or Sign in with Apple shares it, we keep your first name on our servers so the app can greet you and our support can recognize you.
Feedback you send: what you write in Send feedback, with your app version, so we can reply and fix what you report.
Ask answers you rate: for most questions we record only the topic, never your words. If you rate an answer, we keep that question, the answer and your rating so we can improve the answers.
App usage and diagnostics: which features you open (for example your Daily Read or a report), crash and performance reports from Apple's on-device diagnostics, and a random identifier created when you install the app so each event is counted once. This is linked to your account and used to keep the app working and to understand which features are used. Our usage analytics count features and steps only, never health values, and none of it is sold or used for advertising or tracking.
Email address: if you sign up for product updates on this site.
Site visit counts: this site counts page visits with Cloudflare Web Analytics, which sets no cookies and does not identify you.

Facial images & skin photos

Understory's optional Skin feature analyzes a photo of your face. Because a facial image is sensitive, here is exactly how it is handled:

What we collect. A single front-camera photo of your face that you capture yourself, on demand, for skin analysis. It is an ordinary photo. We do not use the TrueDepth camera, face geometry, or any depth or face-mesh data.
No face recognition, no biometric identity. The image is used only to measure visible skin attributes (such as hydration, redness, pigmentation, pores, lines, and skin tone). Understory does not create, derive, or store a faceprint, facial-recognition template, or any other biometric identifier, and never uses the image to identify you.
How it's used and who processes it. When you choose to score a capture, the photo is sent once, over an encrypted connection, to our skin-analysis processor, Perfect Corp (YouCam), for the sole purpose of returning skin metrics. Before it leaves our server, the photo is stripped of everything but the image itself: no location, device or capture-time data goes with it. It is not used for advertising, profiling, or any other purpose, and it is shared with no other third party.
Where it's stored. The photo is stored only on your device, in an on-device store protected by Face ID / passcode, kept out of your camera roll. It is included in your own encrypted device backup, so a new phone restores it. It is never stored on Understory's servers: our server relays the bytes to the processor and discards them; only the resulting numeric scores enter your record. Perfect Corp processes the photo in its cloud to return the metrics; its handling and retention of the image are governed by Perfect Corp's own privacy policy, not by Understory.
How long it's kept. On-device photos remain until you delete them. There is no time limit and no automatic upload. The derived skin scores remain in your record until you delete them.
How to delete it. You can remove individual skin photos or all of them at any time in the Skin tab, delete all skin scores from your record, and erase everything (photos, scores, and account) via Profile → Delete my account & data.

How long we keep it

Wearable data: 31 days. Daily summaries are automatically deleted after 31 days, the window your monthly report needs. Nothing is kept "just in case."
Long-term trends: before a daily summary is deleted, it is folded into a monthly average (for example, "March: average HRV 42 ms"). We keep those monthly averages so you can see change across seasons and years. They contain no daily detail.
Labs, DEXA, skin scores and the documents behind them (including lists imported from Apple Health Records): until you delete them. These are the long arc: a panel from this year is more valuable to you in three years, not less. Your uploaded files stay with the values they produced, so you always have the source, and they stay only until you remove them.
Results waiting for your app: up to 24 hours. If your connection drops while we're reading an upload or scoring a photo, we keep the result for up to 24 hours so your app can pick it up. It is deleted after that, or right away if you delete your account.
Files you send to our team to enter by hand: 30 days after we finish them. If we file the values into your record, the file stays with those values, like any upload, until you remove it.
Your first name, feedback, rated Ask answers, usage events and diagnostics: until you delete your account. Deleting your account erases them with everything else, except a minimal log of our team's access to your account (who, when and which part, never the content), kept so that access stays accountable.
Skin photos: never on our servers at all. They stay on your phone. When you choose to score a capture, the photos pass through to our analysis partner, which returns the metrics; the partner's handling of the image is governed by its own privacy policy. Only the resulting numbers enter your record.

How it's protected

Every record is isolated per member at the database layer (row-level security). One member's data is invisible to another by construction, enforced by the database itself.
Data in transit is encrypted (HTTPS); data at rest is encrypted by our infrastructure providers.
Every operator access to your health data (a support file view, a re-file you asked for, an identity look-up) is written to an audit log; your own reads are scoped to you by database row-level security.
AI processing of member data runs inside our own AWS account (Amazon Bedrock) under the AWS Business Associate Addendum: the model service does not retain or train on your data, and the text does not leave our AWS environment for a model call.

Where your data is processed

Understory is operated from the United States. The health readings and documents you store on our servers, and the account identifiers we verify, are processed and hosted in the United States.
Our skin-analysis processor, Perfect Corp (YouCam), processes skin photos in its own cloud to return the metrics; its retention of the image is governed by Perfect Corp's own privacy policy, as described above.
Our AI model, Claude by Anthropic, processes the text of documents you upload or import (lab panels, DEXA reports, Apple Health Records lists, meal and label photos you choose to read) and your Ask questions, to turn them into structured values and answers. Since October 2026 these calls run through Amazon Bedrock inside Understory's own AWS account, in the United States, under AWS's Business Associate Addendum, which we have accepted although Understory is a consumer app and not a HIPAA covered entity; the text does not leave AWS for a model call, is not retained by the model service, and is never used to train any model. No name, date of birth, or account identifier accompanies the text.
Understory is available in the United States, Canada and India. Wherever you use it, your data is processed and hosted in the United States as described above, and we remain accountable for protecting it under the law where you live.

What we never do

Sell your data, or share it with advertisers or data brokers. We would disclose it to anyone outside Understory only if the law compels us.
Use your data to train models. (Profile offers an off-by-default switch, "Help improve lab reading," under which you may let us keep your corrections to our reading of an uploaded PDF or photo for quality evaluation; revoking it deletes what was kept.)
Diagnose, treat, or prescribe. Understory is an educational, general-wellness product, not a medical device.

Adults only, and your consent

Understory is for adults 18 and older. We don't knowingly collect data from anyone under 18. If you believe someone under 18 has an account, contact us and we will delete it.
Before the app reads any of your own health data, it asks you to confirm you are 18 or older and to agree to how your data is handled, as described here. We record that agreement with the date and the version of the wording you saw. Deleting your account deletes that record too.

Your rights

You can export or delete your data at any time from the app (Profile → Data & privacy). Deletion removes your account, structured record, uploaded documents, and search embeddings from our servers. Residents of Washington, California and other states with health-privacy laws (including the Washington My Health My Data Act) have additional rights. To exercise any of them, or ask anything, contact us.

Canada. Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws, we collect and use your health information only with your knowledge and consent; because health information is sensitive, we rely on your express consent. You may ask to access or correct your information, and you may withdraw your consent at any time (subject to legal and contractual limits) by deleting your data in the app or contacting us. As described above, your data is processed in the United States; we stay accountable for it and require our processors to protect it. You may complain to us or to the Office of the Privacy Commissioner of Canada. If you live in Quebec, under Law 25 you also have the right to data portability and to be informed before your information is collected, and you may complain to the Commission d'accès à l'information.

India. Under the Digital Personal Data Protection Act, 2023, you may access, correct, and erase your personal data and withdraw your consent at any time. We process your personal data on the basis of your consent, to compute and show you your own health readings; as described above, it is transferred to and processed in the United States. For any question, or to seek grievance redressal, contact us at the address below. We act as the point of contact for data-protection queries from users in India.

Contact

[email protected]: we respond within 24 hours.

Privacy officer. The founder of Understory Health LLC is our privacy officer: the person in charge of protecting personal information under Quebec's Law 25, and the contact for data-protection questions and grievances from users in India. Write to [email protected].

See also our Terms of Service. We'll update this policy as the product evolves; material changes will be announced in-app before they take effect.

← Back to Understory