Privacy Policy
The short version
- Your health data is yours. We collect it only to compute your own readings, never to sell or share for advertising.
- Skin photos never leave your phone without your explicit action — they live in an on-device, Face ID-protected store, excluded from your camera roll and device backups.
- Your calendar never leaves your phone. To line your treatments up with your results, the app scans it on your device for appointments matching keywords you set — your clinic's name, "Botox," "dermatology." Nothing else is read, and no event ever reaches our servers.
- Delete everything, anytime — Profile → Delete my account & data erases your records, documents and embeddings from our servers and signs you out. It cannot be undone by us or you.
What we collect
- Health & fitness data you connect (HRV, resting heart rate, respiratory rate, wrist temperature, sleep, activity) — read from Apple Health with your permission and used to compute your Daily Read against your own baseline. A once-daily summary of these is stored on our servers so your record can connect them to your labs — for example, reading a low ferritin against your HRV and sleep. We store one summary row per day, never the raw second-by-second samples.
- Documents you upload (lab panels, DEXA scans) — parsed into structured values that you confirm before anything enters your record. Every value keeps its source.
- Account identity — your Apple ID's stable identifier and (if shared) email, via Sign in with Apple. We verify it server-side on every request.
- Email address — if you sign up for product updates on this site.
Facial images & skin photos
Understory's optional Skin feature analyzes a photo of your face. Because a facial image is sensitive, here is exactly how it is handled:
- What we collect. A single front-camera photo of your face that you capture yourself, on demand, for skin analysis. It is an ordinary photo — we do not use the TrueDepth camera, face geometry, or any depth or face-mesh data.
- No face recognition, no biometric identity. The image is used only to measure visible skin attributes (such as hydration, redness, pigmentation, pores, lines, and skin tone). Understory does not create, derive, or store a faceprint, facial-recognition template, or any other biometric identifier, and never uses the image to identify you.
- How it's used and who processes it. When you choose to score a capture, the photo is sent once, over an encrypted connection, to our skin-analysis processor, Perfect Corp (YouCam), for the sole purpose of returning skin metrics. It is not used for advertising, profiling, or any other purpose, and it is shared with no other third party.
- Where it's stored. The photo is stored only on your device, in an on-device store protected by Face ID / passcode, excluded from your camera roll and from device backups. It is never stored on Understory's servers — our server relays the bytes to the processor and discards them; only the resulting numeric scores enter your record. Perfect Corp processes the photo in the cloud and deletes it shortly after — per its published policy, the original photo within about an hour and the analyzed result within 24 hours — and does not add it to any long-term database.
- How long it's kept. On-device photos remain until you delete them — there is no time limit and no automatic upload. The derived skin scores remain in your record until you delete them.
- How to delete it. You can remove individual skin photos or all of them at any time in the Skin tab, delete all skin scores from your record, and erase everything (photos, scores, and account) via Profile → Delete my account & data.
How long we keep it
- Wearable data: 31 days. Daily summaries are automatically deleted after 31 days — the window your monthly report needs. Nothing is kept "just in case."
- Long-term trends: before a daily summary is deleted, it is folded into a monthly average (for example, "March: average HRV 42 ms"). We keep those monthly averages so you can see change across seasons and years. They contain no daily detail.
- Labs, DEXA and skin scores: until you delete them. These are the long arc — a panel from this year is more valuable to you in three years, not less. They stay in your record until you remove them.
- Skin photos: never on our servers at all. They stay on your phone. When you choose to score a capture, the photos pass through to our analysis partner, who returns the metrics and deletes the images within 24 hours. Only the resulting numbers enter your record.
How it's protected
- Every record is isolated per member at the database layer (row-level security) — one member's data is invisible to another by construction, enforced by the database itself.
- Data in transit is encrypted (HTTPS); data at rest is encrypted by our infrastructure providers.
- Every access to your health data is written to an audit log.
- AI processing of real member data runs only through providers under a signed Business Associate Agreement.
Where your data is processed
- Understory is operated from the United States. The health readings and documents you store on our servers, and the account identifiers we verify, are processed and hosted in the United States.
- Our skin-analysis processor, Perfect Corp (YouCam), processes skin photos in its own cloud and deletes them shortly after (original within about an hour, result within 24 hours), as described above.
- For users in the UK and EEA: when your data is transferred to the United States, that transfer is protected by appropriate safeguards under UK/EU data-protection law — Standard Contractual Clauses (and the UK International Data Transfer Addendum) with our processors — a copy of which you can request at the contact below.
What we never do
- Sell your data, or share it with advertisers or data brokers.
- Use your data to train models without separate, explicit, revocable consent.
- Diagnose, treat, or prescribe — Understory is an educational, general-wellness product, not a medical device.
Your rights
You can export or delete your data at any time from the app (Profile → Data & privacy). Deletion removes your account, structured record, uploaded documents, and search embeddings from our servers. Residents of Washington, California and other states with health-privacy laws (including the Washington My Health My Data Act) have additional rights — to exercise any of them, or ask anything, contact us.
Australia. Under the Privacy Act 1988 and the Australian Privacy Principles, you may access and correct your personal information. Health information is "sensitive information," collected only with your consent and used solely to compute your own readings. As noted above, your data is processed overseas (in the United States). You may complain to us, and to the Office of the Australian Information Commissioner (OAIC), about how your information is handled.
Singapore & India. In Singapore, under the Personal Data Protection Act (PDPA), you may access and correct your personal data and withdraw consent; you may contact us at the address below or complain to the Personal Data Protection Commission (PDPC). In India, under the Digital Personal Data Protection Act, 2023, you may access, correct, and erase your personal data, withdraw consent, and seek grievance redressal by contacting us at the address below. In both countries your health data is collected only with your consent and, as described above, is processed overseas in the United States.
Contact
We'll update this policy as the product evolves; material changes will be announced in-app before they take effect.
← Back to Understory