Ginger Health Agent (“Ginger Health”, “the app”, “we”) is a personal nutrition and health-tracking app for iPhone. This policy explains what data the app handles, where it is stored, who it is shared with, and the specific commitments we make about data read from Apple Health.
The short version
- Your health and food data lives on your iPhone. Ginger Health has no user accounts and no central database of your records.
- We only read from Apple Health. Ginger Health never writes to Apple Health.
- We never use your health data for advertising, and we never sell it or share it with data brokers.
- To generate insights and read your labels/photos, some data is sent — encrypted in transit — to a small number of named processors (below) solely to provide features you asked for, then discarded by them per their terms.
- You can export everything or erase everything from within the app at any time.
Data Ginger Health accesses from Apple Health (read-only)
If you connect Apple Health, Ginger Health requests read access to only the types it uses. It requests no write access. The types are:
- Date of birth and biological sex (to set up your profile)
- Height and body mass / weight
- Sleep analysis (nightly sleep and, on iOS 16+, sleep stages)
- Heart-rate variability (SDNN) and resting heart rate
- Active energy, Apple Exercise minutes, workouts, and activity summaries
This data is used to pre-fill your profile and to show your sleep, recovery signals and activity alongside what you eat. It is read directly from the Apple Health store on your device.
Apple Health read permissions are private by design: iOS does not tell the app which types you allowed. If you decline a type, Ginger Health simply receives no data for it and shows an empty state — it cannot and does not detect what you withheld.
Other data you provide or connect
- Food logs, meals, recipes, supplements and medications you enter or scan.
- Photos of meals, nutrition labels and barcodes you choose to capture, and documents (blood-test results, nutritionist plans) you choose to upload.
- WHOOP (optional): if you connect WHOOP, Ginger Health retrieves your recovery, sleep and strain data via WHOOP’s API using OAuth. You can disconnect at any time.
- Apple Calendar (optional): if you grant access, Ginger Health reads your calendar events on your device to surface eating-related plans. It only reads: it never creates, edits or deletes events, and calendar data stays on your device. You can revoke access any time in iOS Settings › Privacy › Calendars.
Where your data is stored
- On your device: all of the above is stored locally on your iPhone (in the app’s on-device database). It is not held in any account-based server database.
- Optional encrypted backup: if you turn on backup, an end-to-end encrypted copy is stored via Netlify Blobs so you can restore after a reinstall or on a new device. The encryption key is held on your device; the backup cannot be read by us or by the hosting provider. Health data is never placed in iCloud.
- Anonymous install key: so that only the genuine app can use Ginger Health’s AI features, each installation creates a random cryptographic key pair on your device. The private key never leaves your device (it is kept in your iOS Keychain); the public key and a random install ID are registered with our server. They are not linked to your name, email or health data, and are used only to authenticate the app’s requests. This is not an account.
Who we share data with (processors)
Ginger Health uses a small set of third-party services only to deliver features you use. Data is sent over encrypted connections (HTTPS) and only the minimum needed for the feature is sent.
| Processor | What is sent | Why |
|---|---|---|
| Anthropic (Claude API) | Nutrition summaries, your recovery/sleep snapshot, and images/documents you submit (meal photos, labels, blood-test and plan files) | To generate your personalised insights and greeting, and to read (OCR) your labels, photos and documents into structured data |
| WHOOP | OAuth tokens for your own account | To retrieve your WHOOP recovery/sleep/strain (only if you connect WHOOP) |
| Open Food Facts | The product barcode you scan | To look up product nutrition (no personal data is sent) |
| Netlify | App hosting; the encrypted backup blob (if enabled); the anonymous install key and install ID; it brokers the WHOOP sign-in above | Hosting, authenticating requests from the app, and secure token handling |
These processors act on our instructions to provide the service and under their own terms; they are not permitted to use your data for their own advertising, and we do not sell data to anyone. We do not share your health data with any party for that party’s own purposes.
AI processing, your choice
- Sending data to Anthropic is a separate choice from the rest of this policy. When you set up Ginger Health we ask for your consent to it, and we record what you agreed to and when.
- You can withdraw that consent at any time in You → AI features, and turn it back on the same way. While it is off, nothing is sent to Anthropic.
- With AI processing off, the features that depend on it are unavailable: reading meal photos, labels, blood tests and nutrition plans, AI food search, and the personalised greeting and insights. Everything else keeps working on your device.
- Withdrawing consent stops future sending. It does not affect data already processed while it was on.
HealthKit-specific commitments
In line with Apple’s requirements for apps that use HealthKit, we commit that:
- Data read from Apple Health (HealthKit) is used only to provide health and fitness features to you within the app.
- We will not use HealthKit data for advertising, marketing, or any use-based data mining, and we will not sell it.
- We will not disclose HealthKit data to third parties except to provide a service you requested (the processors named above), with your consent, and never for their own advertising or data-mining.
- We do not store HealthKit data in iCloud.
Data retention and deletion
- Export: you can export all of your data as a file at any time from Settings → Data.
- Erase: you can reset/erase all local data from Settings → Data. If you enabled encrypted backup, disabling it removes the backup.
- Disconnect: disconnecting Apple Health or WHOOP (or revoking Apple Calendar access in iOS Settings) stops further data access from that source. Because the encryption key is on your device, deleting the app removes the ability to decrypt any backup.
- Data submitted to processors for insight generation and OCR is retained by them only as long as their terms require to deliver the response, and is not used to train models on your personal data beyond what those terms state.
Security
- Optional backups are end-to-end encrypted with a key held on your device.
- The app can be locked with Face ID / device passcode so only you can open it.
- Connections to all services use HTTPS.
Children
Ginger Health is not directed to children and is intended for adults managing their own health. We do not knowingly collect data from children under the age required by your local law.
Your rights
Depending on where you live (e.g. under UK GDPR / EU GDPR), you may have rights to access, correct, export or delete your personal data, and to withdraw consent you have given. Because your data is held on your own device, the export and erase controls in the app give you direct control. For any request or question, contact us.
Changes to this policy
We may update this policy as the app evolves. Material changes will be reflected by updating the date above and, where appropriate, noted in the app.
Contact
Ginger Health — gingerhealthagent@gmail.com