Privacy Policy & Health Connect Disclosure

1. Data Controller, Publisher & Privacy Contact

Health Ledger is published and operated by:

• Legal Entity / Publisher: Individual Entrepreneur FOP Oleksandr Seleznov / ФОП Селезньов Олександр Андрійович (OLEKSANDR SELEZNOV)
• Registered Business Address: Ukraine, 08301, m. Boryspil, vul. Bankivska, bud. 32, kv. 47 (Україна, 08301, м. Бориспіль, вул. Банківська, буд. 32, кв. 47)
• Privacy & Support Email: healthledger.support@gmail.com
• Public Privacy Policy URL: https://health-ledger.app/privacy
• Public Terms of Use URL: https://health-ledger.app/terms
• Public Account & Data Deletion Resource: https://health-ledger.app/delete-account

2. Health Connect (Android) & Google Health (Web) Data

With your explicit permission, Health Ledger reads and writes biometric and sleep metrics so you can view trends alongside your food journal, medications, and medical records:

• Android (Health Connect): Weight (READ_WEIGHT, WRITE_WEIGHT), height (READ_HEIGHT, WRITE_HEIGHT), sleep sessions and sleep stages (READ_SLEEP), and historical health records (READ_HEALTH_DATA_HISTORY) when you grant historical access in Health Connect.
• Android Sleep widget: With your permission (READ_HEALTH_DATA_IN_BACKGROUND) on supported devices, Health Ledger periodically reads sleep data while the app is closed to update your home screen widget. A small summary of the last session’s time asleep and stage proportions is cached privately on your device and cleared when you sign out or delete your account.
• Web PWA (Google Health API): Weight, height, and sleep metrics authorized through Google OAuth scopes when you connect Google Health in the web app.

How Health Connect & Google Health Data Is Used

• Display & logging: Displaying weight, BMI, and sleep duration/stage charts in the app and writing new weight or height measurements when you log them.
• User-initiated AI context: When you use the AI assistant, recent summary metrics (such as recent weight, height, and sleep totals) may be included in the prompt context sent to the backend to answer your question.
• No developer health database: Health Ledger does not sync your Health Connect or Google Health timeline into a developer-operated database.
• Limited Use & no advertising: Use of information received from Health Connect and Google APIs adheres to the Health Connect Permissions Policy and the Google API Services User Data Policy, including the Limited Use requirements. Health data is never sold, never shared with advertising networks or data brokers, and never used for creditworthiness, lending, or personalized advertising.

3. Personal Health Records in Google Drive (appDataFolder)

When you sign in with Google and grant Google Drive App Data access (https://www.googleapis.com/auth/drive.appdata), Health Ledger stores your personal health ledger inside your own Google Drive's hidden application data folder (spaces=appDataFolder):

• Food journal entries & meal photos (food-entry-v1, food-attachment-v1)
• Medical records, lab reports & PDF attachments (medical-record-v1, medical-attachment-v1)
• Medication & supplement courses, schedules & dose logs (medication-course-v1)
• AI chat conversations, reading notes, shared user memory & chat attachments (chat-record-v1, chat-attachment-v1)

Files in appDataFolder are stored in your personal Google account and are accessible only to Health Ledger when authorized by you. The developer does not have direct access to your Google Drive files.

4. On-Device Storage & Local Caches

To support fast startup, offline reading, and queued edits before syncing to Google Drive, Health Ledger stores local caches on your device:

• Android local storage: On-device SQLite databases and app-private files for cached food entries, medical records, medication courses, AI chat history, home-screen widget snapshots, and local notification schedules.
• Web PWA local storage: Browser IndexedDB databases and local storage for cached food entries, medical records, medication courses, AI chat history, and service-worker reminder schedules.

5. AI Assistance & Gemini Processing

When you send a message in the AI chat, attach a meal photo or document, use voice dictation, or generate a medical record summary, the relevant text, audio, image, or PDF content is transmitted over HTTPS to the Health Ledger API server and processed using the Google Gemini API:

• Transient request processing: The Health Ledger server forwards your prompt and selected context (such as recent food logs, active medications, or medical record summaries) to the Gemini API to generate a response or structured tool action.
• Temporary media uploads: Large attachments (such as medical PDFs or chat attachments) may be uploaded temporarily to the Gemini Files API for analysis and are deleted immediately after processing.
• Conversation continuations: To maintain multi-turn context across messages, Gemini interaction identifiers are encrypted with an owner-bound server key and stored in your Google Drive chat records. When you delete a chat conversation or delete your account, Health Ledger instructs the backend to delete those stored Gemini interactions.

6. Reminders & Push Notifications

Health Ledger supports optional food-logging reminders and medication dose reminders:

• Android local reminders: Scheduled on your device using Android notifications and alarms.
• Cross-device push notifications (optional): If you enable remote push notifications (Firebase Cloud Messaging on Android or Web Push on the PWA), the Health Ledger backend stores your Google user ID, an installation identifier, your push delivery token/endpoint, your timezone, and your reminder schedule rules (such as meal inactivity windows or medication dose times) in a PostgreSQL database so it can trigger timely reminders.
• Privacy-preserving push payloads: Remote push payloads contain generic wake/reminder signals and schedule metadata; your medical documents, meal photos, and chat transcripts are never stored in the notification database.

7. Subscriptions, Metering & Billing Records

To enforce one-time Starter and recurring AI allowance limits, verify Google Play subscriptions, and protect the AI service from abuse, the Health Ledger backend stores minimal account and billing metadata:

• AI usage metering & rate limiting: Per-account allowance activation and optional expiry dates, usage and pending-request counters for one-time grants and recurring billing periods, and short-lived rate-limit buckets keyed by a cryptographic hash of your user identifier.
• Google Play subscription records: When you purchase or link a subscription on Android, the backend records your Google user ID, subscription product/tier, validity timestamps, order identifiers, Play Integrity verification metadata, and a Google Cloud KMS-encrypted copy of the Google Play purchase token.
• No payment card storage: All payments are processed directly by Google Play. Health Ledger never receives or stores your credit card or bank details.

9. Regional Disclosures (United States, EU/EEA, UK & Ukraine)

United States Residents

• Consumer health notice (non-HIPAA service): Health Ledger is a direct-to-consumer personal health journal and wellness tool, not a health care provider, health plan, or health care clearinghouse ("covered entity" or "business associate") under the US Health Insurance Portability and Accountability Act (HIPAA).
• No sale or targeted advertising (CCPA/CPRA & US state privacy laws): We do not "sell" or "share" your personal information or consumer health data for cross-context behavioral advertising, nor do we disclose health data to data brokers.
• Your US privacy rights: Depending on your state of residence, you have the right to know/access, export, correct, and delete your personal data, and to withdraw consent for health data processing at any time through the app, Google Drive, Android Health Connect, or by contacting healthledger.support@gmail.com.

European Economic Area (EEA), United Kingdom & Ukraine

• Data controller: FOP Oleksandr Seleznov (ФОП Селезньов Олександр Андрійович), Ukraine, 08301, m. Boryspil, vul. Bankivska, bud. 32, kv. 47.
• Legal bases for processing (GDPR Art. 6 & Art. 9 / Law of Ukraine on Personal Data Protection):
  • Explicit consent (Art. 6(1)(a), Art. 9(2)(a)): Reading and writing Health Connect / Google Health measurements, storing health records in your Google Drive appDataFolder, processing health prompts/documents with Gemini AI when you submit them, and sending optional notifications.
  • Performance of a contract (Art. 6(1)(b)): Authenticating your session, delivering requested app features, and verifying subscription entitlements.
  • Legal obligation & legitimate interests (Art. 6(1)(c), Art. 6(1)(f)): Retaining non-health billing/order audit records and hashed rate-limit counters to comply with tax/accounting rules and prevent quota or purchase-token abuse.
• International transfers: Backend services and Google Cloud / Gemini API processing may operate on servers in the European Union and the United States using Google Cloud's standard contractual clauses and security safeguards.
• Your rights: You have the right to access, rectify, erase, restrict, or export your data, object to processing, withdraw consent at any time without affecting prior lawful processing, and lodge a complaint with your local data protection authority.