Privacy Policy
Draft — review before publishing. Controller identity and contact details must be completed, and the wording checked against your obligations, before this is linked from the App Store.
Controller
[Full legal name and postal address]. Contact: [email address].
What is processed
Daily summaries of the Apple Health categories you explicitly switch on, each stored with the timestamp at which you consented to it. Also your account identifier from Sign in with Apple, and an audit record of every read performed by an AI assistant you connected.
Individual Health measurements are never transmitted. Aggregation happens on your iPhone.
Legal basis
Health data is a special category of personal data under Article 9 GDPR. Processing rests solely on your explicit consent under Article 9(2)(a), given per category. There is no other legal basis, and withdrawing consent stops the processing.
Recipients
The AI assistants you personally connect — for example ChatGPT (OpenAI) or Claude (Anthropic) — receive the summaries for the categories you enabled, at the moment they query them on your behalf. No assistant is connected unless you complete an authorization step yourself.
Infrastructure providers act as processors: Supabase (database and authentication, EU region) and Railway (application hosting).
Where it is stored
In the European Union (Frankfurt). Connections to the database are encrypted in transit and rejected if not.
Retention
Summaries are kept until you delete them or delete your account, which removes them permanently. Switching a category off stops further collection and makes existing entries unreadable to assistants.
Your rights
Access, rectification, erasure, restriction, portability, and withdrawal of consent at any time, under Articles 15–21 GDPR. You may also complain to a supervisory authority — in Austria, the Datenschutzbehörde.
No medical use
Wavelet is not a medical device. It offers no diagnosis, treatment or medical advice, and must not be used as a basis for medical decisions.