Wellness Coach

Wellness Coach — Private Edition (On-Device App)

Last Updated: July 6, 2026

Applies to: the Wellness Coach — Private Edition iOS app only. This is a separate, privacy-first app from our main Services. Where this section applies, it overrides the general Policy for that app.

Quick summary: The Private Edition is built so your wellness information stays on your device. Your journal entries, moods, photos, meals, goals, habits, and Apple Health data are stored only on your iPhone or iPad and are never sent to us, your coach, or your employer. There is no account and no password. The one exception is optional: if you verify your work email, we record a once-a-month "active" signal so your employer knows the benefit is being used — never what you did.

What stays on your device (never transmitted).

Journal entries, moods, and photos; meals, food photos, and calorie/quality estimates; goals, habits, and streaks; Apple Health data we read (sleep, steps, energy, heart rate, HRV, weight, mindful minutes); and all AI reflections and insights. We operate no servers that receive this information, and we cannot see it.

On-device processing

AI features (reflections, food estimates, coach notes) run entirely on-device using Apple's on-device models. Your text and photos are not sent anywhere for processing.
Apple Health / HealthKit is read locally with your permission and used solely to provide features to you. We do not use HealthKit data for marketing, advertising, or data-mining, and we do not store HealthKit data in iCloud. You control access in iOS Settings. (Consistent with the "Apple Health / HealthKit" disclosures in the main Policy.)
Camera and photos are used only to attach images to your journal or meals; images stay on your device.
Microphone and speech recognition, if you use voice journaling, are processed on-device; audio is not recorded to disk or uploaded.

The one exception: optional seat-activation

If your employer offers Wellness Coach and you choose to verify your work email:

We email you a one-time code to confirm you control a mailbox at a participating employer.
After verifying, we store a one-way hashed identifier and your employer's email domain on your device, and discard your email address.
About once a month, we transmit a single "active" signal containing only: the hashed identifier, your employer's domain, the month, and the app edition. No journal, mood, food, health, goal, or other wellness content is ever included.
Employer reporting is aggregated and de-identified — your employer never sees any individual's activity or status. (Consistent with "With employers/partners" in the main Policy.)

Verifying is optional; the app is fully functional without it.

What we never do

We do not sell your data, use it for advertising, or share your journal, health, food, or any wellness content with your employer, your coach, us, or any third party.

Your controls

Use the app with no account; delete all your data on-device at any time (Goals ▸ Delete all my data); turn off Apple Health access anytime in iOS Settings; and lock the app with Face ID / passcode.

Third parties (only for the optional active signal)

An email-delivery provider (to send the verification code) and our analytics provider (to record the monthly active signal) receive only the minimal data described above — never your wellness content.

Data retention

On-device data remains until you delete it or remove the app. The optional monthly active signal is retained per Section 6 (Data Retention) of the main Policy. (Counsel to confirm the applicable period for this minimal, de-identified usage signal.)