Privacy Policy

1. Information We Collect

Account Information (Pro)

• Email address (via Sign in with Apple)
• Display name (via Sign in with Apple)
• Apple user identifier

Health & Fitness Data

• Bathroom visit timestamps, urgency ratings, pain indicators, urine color, Bristol Stool Scale type, duration, and notes
• Hydration logs (fluid type, amount, electrolyte content)
• Symptom entries (GI and general symptoms, severity, duration)
• Food logs (food name, meal type, category)
• Medication logs (name, dosage, frequency)

Apple HealthKit Data

• Heart rate and resting heart rate (read-only)
• Blood pressure systolic and diastolic (read-only)
• HealthKit data is read for local display only and is never transmitted to any external server or written back to HealthKit

Device Information

• Device identifier (for app functionality only)
• Device model and operating system version (sent during authentication for Pro users)
• APNs push notification token (for Pro subscribers)
• App version

Usage Information

• Crash reports and diagnostic data (via Firebase Crashlytics)
• Performance data (via Firebase Crashlytics)
• Feature usage events for personalized onboarding (Pro only)

Community Stats (Opt-In Only)

• If you opt in to Community Stats, fully anonymized and aggregated data is shared to provide community averages
• No personally identifiable information is included

2. How We Use Your Information

App Functionality

• Display hydration status and health insights
• Generate calendar heat maps and pattern analysis
• Provide smart hydration and wellness reminders
• Sync data between iPhone and Apple Watch
• Generate CSV/PDF reports for healthcare providers (Pro)
• Power AI-powered features including conversational logging, pattern detection, health Q&A, and proactive nudges (Pro)

Service Improvement

• Bug fixing and crash resolution (via Firebase Crashlytics)
• Feature enhancement and development

3. AI-Powered Features (Pro Only)

Bio Break offers optional AI-powered features for Pro subscribers. These features enhance your tracking experience but are entirely optional and can be disabled at any time.

What AI Features Do

• Conversational Logging: Log entries through natural language AI chat
• Pattern Detection: AI analyzes your tracking data to identify trends and correlations
• Health Q&A: Ask questions about your tracked data and receive informational responses
• Proactive Nudges: Receive personalized wellness reminders based on your patterns
• Report Narratives: AI-generated summaries for healthcare provider reports

How AI Processes Your Data

• When you use AI features, a summary of your recent health logs (entries, symptoms, medications, food) is sent to our secure backend
• Our backend processes the request via Google's Gemini API (paid tier)
• Google does not use paid API tier data for model training
• Data is processed transiently and not retained by Google for training purposes
• AI responses are generated in real-time and are for informational purposes only — they do not constitute medical advice

AI Limitations

• AI features will never diagnose medical conditions
• AI responses are general guidance, not medical advice
• Always consult a healthcare professional for medical concerns

4. Information Sharing

Limited Sharing

We may share your information only in the following circumstances:

• With your explicit consent
• AI feature usage: Health data summaries sent to Google Gemini API when you use AI features (Pro only)
• Legal obligations: When required by law or legal process
• Community Stats: Fully anonymized, aggregated data (opt-in only)

Third-Party Services

• Apple iCloud (CloudKit): End-to-end encrypted data sync for Pro subscribers
• Apple App Store: Subscription payment processing
• Convex: Cloud backend for Pro subscriber data sync and AI feature processing. Data is stored securely and encrypted in transit
• Google Gemini API: Processes health data summaries for AI features (Pro only). Google does not use paid API tier data for model training. See Google's API Terms
• Firebase Crashlytics: Crash reports and performance diagnostics linked to an installation identifier. See Firebase Privacy Policy
• Apple Push Notification Service (APNs): Delivers push notifications to Pro subscribers

5. Data Storage & Security

On-Device Storage

• Local by default: All health data is stored on your device using iOS Data Protection (NSFileProtectionComplete)
• Keychain: Authentication credentials stored with kSecAttrAccessibleWhenUnlockedThisDeviceOnly

Cloud Sync (Pro)

• Convex backend: Pro subscriber data syncs to our Convex cloud backend, encrypted in transit (TLS) and at rest
• iCloud (CloudKit): Data also syncs via Apple's CloudKit with end-to-end encryption

HealthKit Data

• HealthKit data (heart rate, blood pressure) is read locally and never transmitted off-device
• HealthKit data is not stored in iCloud or synced to any backend

Privacy Manifest

• NSPrivacyTracking: false — we do not track users
• Tracking domains: None

6. Data Retention

On-Device Data

• Data is retained on your device for as long as you use the app
• Uninstalling the app removes all local data

Cloud Data (Pro)

• Account data is retained while your account is active
• You can delete your account and all server-side data through the app's Account settings
• Account deletion permanently removes all data from our servers

AI Data

• Health data sent to Google Gemini API is processed transiently and not retained for model training (paid tier)
• AI conversation history is not persistently stored on Google's servers

7. Cookies & Tracking

What We Don't Do

• No cookies
• No third-party behavioral analytics (we use Firebase Crashlytics for crash reporting only, not behavioral analytics)
• No advertising SDKs
• No cross-site tracking
• No behavioral profiling

8. Children's Privacy (COPPA)

Age Requirements

• Age rating: 4+ (suitable for all ages)
• Free features do not require account creation
• Pro features require Sign in with Apple (account creation)
• The app does not knowingly collect personal information from children under 13

9. International Data Transfers

• Local storage: Health data is stored on your device and does not leave your device unless you use Pro features
• iCloud sync: If enabled, data is transferred and stored by Apple under their privacy terms
• Cloud backend: If you use Pro features, your data may be transferred to Convex servers and Google's Gemini API servers, which may be located outside your country

10. California Privacy Rights (CCPA/CPRA)

Your Rights Under California Law

• Right to Know: What personal information we collect and how it's used
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out: Opt-out of sale or sharing of personal information
• Right to Non-Discrimination: Equal service regardless of privacy choices

How to Exercise Your Rights

• Email: privacy@bflux.co
• Subject line: "CCPA Request"
• Response time: 45 days

11. European Privacy Rights (GDPR)

Legal Basis for Processing

• Consent: For health data and optional features (Community Stats)
• Contract: To provide the services you've requested
• Legitimate Interests: For crash reporting and app improvement

Additional Rights for EU/EEA Users

• Right to Lodge a Complaint: With your local data protection authority
• Right to Withdraw Consent: At any time, without affecting prior processing
• Right to Transparency: Clear information about data processing

12. Your Data Rights

Rights Available to All Users

• Access: All your data is on your device — you have full access at all times
• Portability: Export your data as CSV or PDF through the app (Pro)
• Erasure: Delete your data within the app or by uninstalling
• Account Deletion: Delete your account and all server-side data through Profile > Account settings (Pro)
• Object: Opt out of Community Stats or AI features at any time in app settings

How to Contact Us

• Support: bflux.co/support/bio-break/
• Response Time: Within 30 days

Contact Us