Privacy Policy

Effective 12 September 2026 · Quantum Digital Plus Pty Ltd

Halvia is an iPhone app that reads the Apple Health data you choose to share, keeps a copy on our servers so it can be summarised for you, and lets you connect an AI assistant of your choice to those summaries. This policy says exactly what we hold, where, for how long, who can see it, and how you take it back.

What we collect

Only the groups of Apple Health data you switch on in the app's consent screen, and nothing until you do. The groups are:

• Activity — steps, distance, flights climbed, active and resting energy, exercise, stand and move time, time in daylight, activity rings.
• Heart — heart rate, resting and walking heart rate, heart-rate variability, VO2max, blood oxygen, cardio recovery, irregular-rhythm and high/low heart-rate events, ECG classifications (and ECG waveforms only if you turn that on).
• Sleep — sleep stages and times, wrist temperature, breathing disturbances, respiratory rate.
• Body — weight, height, body fat, lean mass, BMI, waist, and your date of birth, sex, blood type, skin type and wheelchair setting.
• Vitals — blood pressure, temperature, blood glucose, lung function, audio exposure, falls, alcohol.
• Nutrition — water, energy, macronutrients, vitamins and minerals.
• Mobility — walking speed, step length, asymmetry, stair speeds, six-minute walk, walking steadiness.
• Mind — mindful minutes, State of Mind entries (mood, labels, associations), PHQ-9 and GAD-7 results.
• Cycle and Symptoms — the category types Apple Health records for them.
• Workouts — each workout's type, times, statistics, heart-rate and speed series, and GPS routes when a workout recorded one.
• Medications — logged doses and the medications they refer to (iOS 26 and later).

We also hold what any online account needs: the Apple identifier from Sign in with Apple, your device's model and OS version, the time of each sync, subscription status from the App Store, and the connections you make to AI assistants.

What we never do

• Your health data is never stored in iCloud or CloudKit. The app carries no iCloud entitlement.
• Your health data is never used for advertising, marketing or data mining, and is never sold or given to data brokers.
• We do not use it to build models, train AI, or for any purpose other than showing it to you and to the assistant you connect.

AI assistants

Third-party AI services (for example Claude, ChatGPT or Cursor) receive your data only when you connect one yourself with a pairing code, and then only what their assistant asks for while you are using it: a request for a metric returns that metric's summary and nothing else. Disconnect at any time in the app under Connect, or through the assistant. What an assistant does with what it reads is governed by that service's own policy; Halvia sends nothing to any assistant on its own.

If you share data with another person (a coach or clinician) through a share code, they see only the metrics you chose, from the date you chose, until you revoke the share.

Where your data is kept

On Cloudflare's network. Each account's health data lives in its own storage object, and we ask Cloudflare to place it in the Oceania region (Sydney) as a preference; Cloudflare may place or move it elsewhere for capacity or resilience. Authorisation tokens for assistant connections are held in Cloudflare's global key-value store, which carries no health values.

Overseas disclosure (Australian Privacy Principle 8). Because placement is a preference rather than a guarantee, your data may be stored or processed outside Australia, including in the United States, by Cloudflare, Inc. under its data-processing terms. We take reasonable steps to ensure it is handled in a way consistent with the Australian Privacy Principles.

How long we keep it

• Summaries (hourly and daily statistics, sleep nights, workouts, sparse readings such as weight) are kept while your account exists.
• Raw vital-sign readings taken many times a day (heart rate, blood oxygen, respiratory rate, temperature, blood pressure, glucose, effort) are kept for 365 days and then pruned; their hourly and daily statistics remain.
• On a free account only the last seven days of the free metrics are accepted at all.
• Pairing codes expire in five minutes; assistant connections last until you revoke them.

Deleting and exporting

In the app under Settings you can export everything we hold as a compressed file, and delete your account. Deletion revokes every assistant connection and share, erases the health data object, and removes the account record; it is immediate and cannot be undone. If you revoke Halvia's access at Apple (Settings → Apple Account → Sign in with Apple), every connection is revoked at once and the account is deleted 30 days later unless you sign in again.

Withdrawing consent

Switch any data group off in the app and it stops syncing; ask us to remove what was already synced for that group, or delete the account. You can also withdraw the app's access in the Health app under Sharing → Apps.

Not a medical service

Halvia shows wellness summaries. It does not diagnose, treat or advise, and its assistant output is not medical advice. Talk to a clinician about anything that concerns you.

Contact

Quantum Digital Plus Pty Ltd, Melbourne, Australia. The privacy officer is the company's director, reached at support@quantumdigitalplus.com with "Privacy" in the subject; access, correction and complaint requests are answered within 30 days. If you believe we have breached the Australian Privacy Principles you may also complain to the Office of the Australian Information Commissioner.