Privacy
Privacy Policy
Effective July 2026 · applies to the Understory iOS app and theunderstoryhealth.com
The short version
- Your health data is yours. We collect it only to compute your own readings, never to sell or share for advertising.
- Skin photos never leave your phone without your explicit action — they live in an on-device, Face ID-protected store, excluded from your camera roll and device backups.
- Your calendar never leaves your phone. To line your treatments up with your results, the app scans it on your device for appointments matching keywords you set — your clinic's name, "Botox," "dermatology." Nothing else is read, and no event ever reaches our servers.
- Delete everything, anytime — Profile → Delete my account & data erases your records, documents and embeddings from our servers and signs you out. It cannot be undone by us or you.
What we collect
- Health & fitness data you connect (HRV, resting heart rate, respiratory rate, wrist temperature, sleep, activity) — read from Apple Health with your permission and used to compute your Daily Read against your own baseline. A once-daily summary of these is stored on our servers so your record can connect them to your labs — for example, reading a low ferritin against your HRV and sleep. We store one summary row per day, never the raw second-by-second samples.
- Documents you upload (lab panels, DEXA scans) — parsed into structured values that you confirm before anything enters your record. Every value keeps its source.
- Account identity — your Apple ID's stable identifier and (if shared) email, via Sign in with Apple. We verify it server-side on every request.
- Waitlist email — if you join the waitlist on this site.
How long we keep it
- Wearable data: 31 days. Daily summaries are automatically deleted after 31 days — the window your monthly report needs. Nothing is kept "just in case."
- Long-term trends: before a daily summary is deleted, it is folded into a monthly average (for example, "March: average HRV 42 ms"). We keep those monthly averages so you can see change across seasons and years. They contain no daily detail.
- Labs, DEXA and skin scores: until you delete them. These are the long arc — a panel from this year is more valuable to you in three years, not less. They stay in your record until you remove them.
- Skin photos: never on our servers at all. They stay on your phone. When you choose to score a capture, the photos pass through to our analysis partner, who returns the metrics and deletes the images within 24 hours. Only the resulting numbers enter your record.
How it's protected
- Every record is isolated per member at the database layer (row-level security) — one member's data is invisible to another by construction, enforced by the database itself.
- Data in transit is encrypted (HTTPS); data at rest is encrypted by our infrastructure providers.
- Every access to your health data is written to an audit log.
- AI processing of real member data runs only through providers under a signed Business Associate Agreement.
What we never do
- Sell your data, or share it with advertisers or data brokers.
- Use your data to train models without separate, explicit, revocable consent.
- Diagnose, treat, or prescribe — Understory is an educational, general-wellness product, not a medical device.
Your rights
You can export or delete your data at any time from the app (Profile → Data & privacy). Deletion removes your account, structured record, uploaded documents, and search embeddings from our servers. Residents of Washington, California and other states with health-privacy laws (including the Washington My Health My Data Act) have additional rights — to exercise any of them, or ask anything, contact us.
Contact
[email protected]: we respond within 24 hours.
We'll update this policy as the product evolves; material changes will be announced in-app before they take effect.
← Back to Understory