Privacy Policy

Effective Date: 2026-08-28
Last Updated: 2026-09-30

This Privacy Policy explains how David Murdych, operating as “inLive” ("inLive", "we", "us", or "our") collects, uses, shares, and protects information about you when you use the inLive iOS application (the "App"), our website at www.inlive.health, and related services (collectively, the "Services").

inLive helps you understand and improve your health and longevity using on-device data analysis, AI assistance, and integrations with Apple Health and other health platforms. Because the Services involve health, fitness, and (optionally) genetic information, this policy goes into more detail than a typical consumer-app policy.

Quick Summary

• Health data is yours. We never sell, rent, or share it for advertising or marketing.
• Cross-device sync is on by default for signed-in accounts so the records you build up in the App — meals and fasts, plans, cycle and symptom entries, lab results, AI insights and more (§5.2 lists them) — follow you between your iPhone and iPad. Synced data is stored privately for your account (row-level security), you can pause sync for your whole account with one switch, and a separate control permanently deletes every synced record from our servers. Journal entries sync end-to-end encrypted — our servers store the entry's text only as sealed bytes we cannot read. The tags you add to an entry are not sealed and sync in readable form. See §5.2.
• You can sign in with Apple, Google, or email/password. We use Supabase for authentication; no passwords are stored in plain text.
• Genetic data (e.g., 23andMe) is optional and encrypted. Your raw genetic file — SNPs, genotypes and rsIDs — never leaves your device. The coarse derived markers computed from it (things like caffeine metabolism or chronotype) do sync to our backend with the rest of your profile, and may be included in cloud AI context if you consent. You can delete it all any time. See §1.4.
• No tracking, no advertising SDKs, no IDFA. Our PrivacyInfo.xcprivacy declares NSPrivacyTracking = false.
• AI features are off until you approve them, and you control where they run. By default, inLive's AI runs on-device (Apple Intelligence) and nothing leaves your phone. If you turn on a cloud model, it receives identifier-scrubbed health data plus a small set of coarse genetic markers — never your raw DNA. Two things bypass that filter: switch on live voice and your raw microphone audio streams unfiltered to the live-voice provider you chose — OpenAI or Google (§1.7), and any photo you hand to the AI is sent to your provider exactly as captured (§1.5). The optional paid BioMod Concierge tier sends that same scrubbed context to Anthropic through our own server. See §2 and §4.1.
• You can request a copy of your data or delete your account at any time from the in-app Profile screen.

Read on for the full details.

1. Information We Collect

We collect only what we need to provide the Services. The categories below match what we declared in our App Store privacy nutrition label and our PrivacyInfo.xcprivacy privacy manifest.

1.1 Information You Provide Directly

• Identity: First name, last name, optional nickname, profile photo (optional), date of birth, sex assigned at birth.
• Account credentials: Email address (required for account creation). Passwords are never stored in plain text — they are managed by Supabase Auth using industry-standard hashing.
• Health goals & preferences: Self-reported goals (longevity, weight loss, sleep, etc.), dietary preferences, allergies, religious dietary preferences, health focus areas, AI coaching tone preference.
• Body composition (self-reported): Height, weight, activity level, measurement system preference.
• Lab results & medical records (optional): Lab panels you import yourself by PDF or photo scan. inLive has no third-party lab-provider integration in v1; LabCorp and Quest Diagnostics appear in the App only as "Coming soon" placeholders and no data is received from them.
• Medication & supplement records (optional): GLP-1 doses, supplement schedules, intake logs.
• Reproductive-health and symptom entries (optional): Cycle Tracker entries you type in yourself — period start and end, flow intensity, cycle symptoms, ovulation date, fertile window, basal body temperature, cervical-mucus type and notes — plus contraception method, dose and adherence history, and symptom logs (a coded symptom with a 1–10 severity). These are special-category data under Article 9 (§1.2). The App derives phase, fertile-window and cycle-variability estimates from them on your device, and they sync to our servers as ordinary synced records (§5.2) — they are not end-to-end encrypted.
• Mood, mental wellness, journal entries (optional): Mood scores, breathing-session logs, journal text.
• AI conversations (optional): Messages you send to the AI Coach feature.

1.2 Information from Apple HealthKit (with your explicit consent)

If you connect Apple Health, the App asks for read access to 60 HealthKit data types, plus two characteristics (date of birth and biological sex). Those two are read again on each Apple Health sync and used to keep your inLive profile in step with Apple Health, so changing them in the Health app changes them in inLive. Apple's permission sheet lists every one of them individually, and you can grant or deny each type separately — the App works with whatever subset you allow.

The 60 types are:

• Cardiovascular and respiratory (10) — heart rate, resting heart rate, heart-rate variability (SDNN), blood pressure (systolic and diastolic), oxygen saturation, respiratory rate, VO₂ max, peripheral perfusion index, walking heart-rate average.
• Activity (11) — step count, walking/running distance, cycling distance, swimming distance, swimming stroke count, flights climbed, active energy, basal energy, Apple exercise time, Apple stand time, Apple move time.
• Body composition (6) — body mass, body mass index, body-fat percentage, lean body mass, height, waist circumference.
• Nutrition (9) — dietary energy, carbohydrates, total fat, protein, fibre, sugar, sodium, caffeine, water.
• Temperature, respiratory function and glucose (7) — body temperature, basal body temperature, forced vital capacity, forced expiratory volume (FEV1), peak expiratory flow rate, blood glucose, inhaler usage.
• Sleep and mindfulness (2) — sleep analysis (stages and duration), mindful sessions.
• Reproductive health (5) — menstrual flow, cervical mucus quality, ovulation test results, intermenstrual bleeding, sexual activity.
• Everyday events (3) — Apple stand hours, handwashing events, toothbrushing events.
• Cardiac events (3) — low heart-rate events, high heart-rate events, irregular heart-rhythm events.
• Audio exposure (2) — environmental audio exposure events, headphone audio exposure events.
• Workouts and activity summaries (2) — workout types and durations, daily activity summaries.

Reproductive-health data is special-category data under the UK GDPR and the EU GDPR (Article 9). These five types are included in the single Apple Health request described above so that the health record inLive keeps on your device is complete. To be straight with you: no feature in the App currently displays or analyses them. They are imported into the on-device record and nothing reads them back. In particular, the Cycle Tracker does not use them — it works only from the cycle, symptom and contraception entries you type in yourself. Those typed entries are themselves Article 9 special-category data; they are listed in §1.1, we process them on the basis of your explicit consent, and they sync to our servers as ordinary synced records (§5.2). They are stored on your device, never sold, never used for advertising, and never included in the context sent to any AI provider. If you would rather not share them, deny those five types in Apple's permission sheet or in iOS Settings → Privacy & Security → Health → inLive — nothing in the App behaves differently if you do.

We ask for more types than the App visibly charts today. Reading a type is what lets a feature use it later without asking you again, and several types feed background scoring (recovery, strain, readiness) rather than a chart of their own. You can review and revoke any of them at any time in iOS Settings → Privacy & Security → Health → inLive.

With your separate HealthKit write authorization, the App also writes back to Apple Health — only entries you create yourself, and only two kinds: a mindfulness session when you log a mood, and water you log on your Apple Watch. Nothing else is written back: not supplements or medications, not menstrual-cycle data, not workouts, not body measurements. Writes are never AI-inferred. You can revoke write access at any time in iOS Settings → Privacy & Security → Health → inLive.

Clinical health records. inLive does not read or store HealthKit clinical records or medical-record types, and does not request the HealthKit clinical-records entitlement, in v1. The "Lab results & medical records" data in §1.1 refers only to lab panels you import yourself (PDF/photo) — not to Apple Health's clinical-records API.

1.3 Information from Connected Third-Party Devices and Apps (optional)

If you authorize OAuth connections to:

• Oura Ring — sleep, readiness, activity, HRV, body temperature
• Withings — weight, BP, sleep, body composition
• Garmin — fitness and activity data
• 23andMe (file import) — genetic raw data (SNPs, ancestry, traits)
• BodyPedia (via Apple Health body composition data)
• Dexcom — coming soon; vendor review in progress. No Dexcom data is collected, transmitted, or stored at this time. When the integration goes live, we will sync continuous glucose monitoring readings (interstitial glucose values + trend arrows) only with your explicit OAuth authorization.

we sync the data they expose via their APIs, scoped strictly to what is needed for inLive's features.

1.4 Genetic Information (Highly Sensitive — Optional Opt-In)

Importing genetic data (e.g., 23andMe raw export) is strictly opt-in and requires affirmative consent each time. Genetic data is encrypted at rest using a key stored in iOS Keychain, and your raw genetic file (SNPs / genotypes / rsIDs) is never transmitted off your device. If you enable a cloud AI model, only a small set of coarse, derived markers (e.g., caffeine / lactose / alcohol metabolism, MTHFR status, vitamin-D and inflammation tendencies) may be included in the AI context — never the raw data — and only after your separate genetic-data consent. You can delete your genetic data and all derived markers at any time from the in-app Profile screen; on withdrawal of consent, derived data is destroyed within 30 days. When cross-device sync is on (the default), the coarse derived markers stored on your profile are also replicated to our Supabase backend so they follow you between devices; they are protected by row-level security but are not end-to-end encrypted. Turn off sync in Profile → Settings → Cross-Device Sync if you do not want that.

1.5 Photos

Scanning. When you scan a lab report, food label or supplement label, the text is read on your device with Apple's Vision framework and the image file is not uploaded. Only the extracted text may be sent onward, filtered as described in §2.1, if you opt into AI interpretation.

Product lookup. If you scan a product barcode, or type a food name into product search, that barcode or search text is sent to Open Food Facts (§4.1) to identify the product. Nothing else goes with it — no account, no identifier, no health data.

Handing a photo to the AI is different. If you attach a photo to a chat with the AI Coach, or ask the AI to analyse a meal or supplement-label photo, the image itself is sent to the AI provider handling that request — OpenAI, Anthropic, Google or xAI — either directly under the API key you supplied, or, in "Use with BioMod" mode, through our server under inLive's key (§2.1). Image bytes cannot be filtered, so please do not attach a photo showing anything you would not want that provider to see. inLive does not keep a copy of those photos on its own servers. (Your profile photo is different again — that one is stored in our backend; see §5.2.)

1.6 Location

If you grant location permission, the App uses your precise location to find nearby clinics, gyms, healthy restaurants and wellness venues, and to fetch a local weather forecast for the sleep-environment, recipe and activity features. We do not persistently track your location and do not build a location history.

One third party receives coordinates. To get that forecast we call Open-Meteo (Open-Meteo.com, a free weather API) with a latitude and longitude and nothing else — no account identifier, no device identifier, no health data, and no other part of your profile. Open-Meteo needs no API key, so the request is not tied to an inLive account. Venue search uses Apple's MapKit (§4.1 lists Apple as a sub-processor); your search and coordinates are handled by Apple under Apple's privacy policy. If you do not grant location permission, no coordinates leave your device and those features fall back to their non-local behaviour.

1.7 Voice and Microphone

The App has two voice modes, and they handle your audio differently. Neither ever sends audio to inLive's servers — we operate no speech infrastructure.

Dictation (the default). When you tap to record a voice question, audio is processed on-device using Apple's Speech framework with on-device recognition required. The raw audio never leaves your iPhone; if your iPhone has no on-device model for the language you selected, dictation is unavailable rather than falling back to a network recogniser. Only the transcribed text may be sent to your chosen AI provider as part of a chat message, subject to that provider's privacy policy and to your AI-data consent (§2).

Live voice (opt-in, off by default). If you turn on Live voice, the App opens a realtime connection to the live-voice provider you chose — OpenAI (Realtime API) or Google (Gemini Live API) — using the API key you supplied for that provider, and streams your raw microphone audio to that provider for as long as the conversation is running. This is what makes the coach able to answer while you are still speaking. Your spoken words — including anything about your health you say out loud — are audio data processed by that provider under its privacy policy and API terms, not ours.

Live voice requires three separate things before any audio is streamed: your AI-data consent (§2), an OpenAI or Google (Gemini) API key that you added yourself, and a one-time in-app confirmation specific to this feature which states that your audio leaves the device. Because live voice needs your microphone, you can stop it at any time by revoking microphone access in iOS Settings → Privacy & Security → Microphone → inLive; note that this also stops on-device dictation, which uses the same microphone. The consent is recorded per person, so on a shared iPhone it does not carry over to anyone else.

The system prompt sent at the start of a live-voice session includes the same health context the text coach uses, which is why AI-data consent gates it.

1.8 Information We Do NOT Collect

• We do not use the Apple Advertising Identifier (IDFA).
• We do not track you across apps or websites — NSPrivacyTracking = false.
• We do not collect contacts, calendar entries beyond what you grant us at point-of-use, or browsing history.
• We do not use third-party advertising SDKs.

2. How We Use Your Information

We use the information we collect to:

• Provide the core Services — display your health metrics, calculate biological age, generate personalized insights, surface recommendations, and remind you of supplements / fasting windows / appointments.
• Personalize your experience — tailor goal suggestions, meal plans, and coaching tone based on what you tell us.
• Sync across your devices (on by default for signed-in accounts; pause or purge any time — see §5.2) — replicate your local data through our Supabase backend so you can use inLive on multiple Apple devices under the same account, and so entries you log on your Apple Watch reach all of them.
• Process AI requests (only after you grant AI-data consent) — see the detailed AI data-flow description below.
• Communicate with you — transactional emails (account confirmation, password reset, security alerts) sent via noreply@inlive.health. We do not send marketing emails by default.
• Comply with legal obligations — respond to lawful subpoenas, court orders, or other valid legal requests; enforce our Terms of Service.
• Detect and prevent abuse — protect the integrity of the Services, detect fraudulent accounts, prevent unauthorized access.

2.1 How AI Requests Are Processed

inLive's AI features (Coach, Council, insights, and the BioMod programs) are off by default and stay locked until you grant explicit "AI & Data" consent in the App. You control where AI inference happens:

• On-device (default) — Apple Intelligence. Inference runs privately on your iPhone using Apple's on-device foundation models. Your full profile, Health data, and full genetic insights may be used, and none of it leaves your device. One exception: live voice is keyed to an OpenAI or Google API key you have added, not to which coach you are running. If you have added such a key and accepted its one-time confirmation, live voice streams your audio to that provider even while your coach is set to on-device (§1.7).
• Your own cloud key (optional). If you configure your own API key for OpenAI, Anthropic, Google AI, or xAI, your chat message and a relevant, identifier-scrubbed context window are sent directly from your device to that provider, under the API key you supplied and that provider's terms. If you also switch on live voice, your own OpenAI or Google key is used to stream your raw microphone audio to that provider in realtime (§1.7).
• BioMod Concierge (optional, paid tier). If you subscribe to the BioMod Concierge tier and have not configured your own key, your chat message and an identifier-scrubbed context window are sent to Anthropic, PBC through our own server (a Supabase edge function) using inLive's Anthropic API key. The same scrubbing applies (see below); raw genetic data is never included.
• "Use with BioMod" — managed provider mode (optional, paid tier). BioMod subscribers can also run any of the four cloud providers — Anthropic, PBC, OpenAI, L.L.C., Google LLC or xAI — under inLive's account instead of their own key ("Use with BioMod" in Profile → Settings → AI Providers). In that mode your chat message and the same identifier-scrubbed context window go to the provider you picked through our own server, using inLive's own API key for that provider, and inLive is billed for the request. Photos travel this path too: a photo you attach to a chat, or a meal or supplement-label photo you ask the AI to analyse, is relayed through our server to that provider, and image bytes are never filtered (§1.5). Raw DNA is never included on any of these paths.
• Recipe photos (free tier). When you ask the App to generate a picture for a recipe and you have not supplied your own image-generation key, the prompt — a dish name, cuisine and cooking stage — is sent through our Supabase edge function to Google or OpenAI under inLive's own API key. No health data, no profile and no identifiers are included in that prompt, and we do not retain the generated image on our servers.

In every cloud text case, before any data leaves your device we run an on-device filter over the health context we assemble. Be clear about how narrow that filter is: it matches three patterns only — email addresses, phone numbers, and one national ID format (a hyphenated US Social Security Number). It does not remove your name, your address, your date of birth, or any other country's identifier, and the App deliberately puts your first name in the assistant's instructions so the coach can address you by name. It also does not touch your Personal Context document — the free-text notes you write about yourself are attached to the prompt exactly as you typed them, so treat that field as text you are sending to your AI provider. Where this policy says "identifier-scrubbed", it means those three patterns are removed from the assembled health context — not that the payload is anonymous. This filter cannot be applied to live voice: audio is streamed to OpenAI exactly as captured, and a recording of your voice is itself an identifier — anything you say out loud goes with it. Some health signals you are asking about (for example, lab values or vitals) are intentionally included so the AI can answer your question — this is consented processing, not anonymization. Raw DNA, genotypes, and rsIDs are never sent to any cloud provider.

We do not use your information to train AI models, build advertising profiles, or for any purpose unrelated to providing the Services to you. We do not authorize our hosted AI provider to train its models on your data; Anthropic's commercial API does not train on submitted data by default. Where you bring your own provider key, that provider processes your prompts under its own terms.

3. Health Data — Special Apple HealthKit Commitments

Per the Apple Developer Program License Agreement and App Store Review Guideline §5.1.3, we make the following binding commitments about health data accessed through HealthKit:

• Never used for advertising — your HealthKit data is not used to serve, retarget, or measure advertising.
• Never used for marketing — including marketing the Services or third-party products / services to you.
• Never sold — to data brokers, insurers, employers, advertisers, or any third party.
• Never aggregated for non-health purposes — including data brokerage and product development unrelated to your personal health.
• Never shared without your explicit, granular consent — and only with services you have specifically authorized: the optional cloud AI providers described in §2.1, and only with the scrubbing described there. One further recipient, by default: if you are signed in, cross-device sync is on unless you turn it off, and summary values computed from your Apple Health data (for example your average sleep score, HRV, daily steps and VO₂ max) are replicated to our own backend at Supabase so they follow you between devices (§5.2). Individual Apple Health samples are not sent there. You can pause sync, or delete every synced record, at any time (§5.2). We do not share Apple Health data with anyone else.

These commitments survive the termination of your inLive account and your deletion of the App.

4. Sharing Your Information

We share information only in the limited circumstances described below.

4.1 With Service Providers (Sub-Processors)

We use the following sub-processors to operate the Services. Each is engaged under appropriate data-processing terms:

Websites the App fetches directly. Some features read a page from a third party's own website — a restaurant's menu or photo when you look at that restaurant, a retailer's product image, or Apple's public App Store lookup when the App shows a fitness app. Those requests go from your device to that website, so it sees your device's IP address and which page was asked for. We send no account information, no identifier and no health data with them, and we do not tell the site who you are.

We do not use Google Analytics, Firebase Analytics, Meta SDK, advertising SDKs, crash-reporting services that collect PHI, or any other analytics tools that would collect personal information from the App in v1.

4.1.1 Store Checkout — Payments Are Handled by Stripe

The in-app Store sells physical goods and services (lab and DNA test panels, supplements, and merchandise). These are not in-app purchases, and inLive never collects, transmits, or stores your card details. There is no card field anywhere in the App.

• Where payment happens. When you tap Checkout, inLive records the order on our own backend and asks our server-side checkout function to create a Stripe Checkout Session. The App then opens Stripe's own hosted payment page in the system in-app browser (SFSafariViewController), which runs outside the App's process — the App cannot read that page, its form fields, or Stripe's cookies.
• What Stripe handles. The name, billing details, and payment method needed to take payment are entered on Stripe's page and are handled by Stripe, Inc. under Stripe's own Privacy Policy. inLive never receives your card number and stores no billing address of its own. The App does not ask for, or store, a delivery address.
• What inLive stores. For each order, linked to your account: the line items (product, quantity, unit price), the order total and currency, the order's status, where it was placed (app or website), timestamps, and an opaque Stripe session reference (a cs_… handle — not a card number and not a Stripe customer record) so the payment can be reconciled. Every price is re-derived from our own catalog server-side; the amount charged is never taken from your device.
• Who can mark an order paid. Only Stripe's signature-verified webhook, server-side. The App cannot — that restriction is enforced in our database, not merely in app code.
• Where the key lives. Our Stripe secret key is held in server-side function secrets only. It is never in the App binary and never in your device's Keychain.
• Before Stripe is switched on. Until payment processing is enabled for the Store, checkout is unavailable and the App says so plainly. The draft order the App had started is cancelled straight away, no payable order is left standing, and no charge is possible.

Orders you place in the App and orders you place on our website are the same record, so an order made in one place appears in the other.

4.2 With Third-Party Health Platforms (Only When You Authorize)

If you connect Oura, Withings, Garmin, or other third-party platforms, data flows from those platforms to inLive subject to your authorization on each platform. We do not share your inLive data back to those platforms.

4.3 For Legal Reasons

We may disclose your information when we believe in good faith that it is necessary to:

• Comply with a subpoena, court order, or other lawful government request;
• Investigate or address potential violations of our Terms of Service;
• Protect the rights, safety, or property of inLive, our users, or the public;
• Detect, prevent, or address fraud or technical issues.

When legally permitted, we will give you advance notice of any required disclosure.

4.4 In a Business Transaction

If inLive is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality protections. We will give you advance notice via email and the App at least 30 days before any such transfer where legally permitted.

4.5 What We Don't Do

• We do not sell your personal information to third parties.
• We do not "share" your personal information for cross-context behavioral advertising as that term is defined under the California Consumer Privacy Act (CCPA/CPRA).
• We do not rent your data, trade your data, or grant data licenses to brokers.

5. Where Your Data Lives, How It's Stored, and How It's Protected

5.1 Local-First Architecture

inLive is local-first. Health data, including lab results, sleep records, vital readings, and genetic data, is stored on your device in an encrypted SwiftData store with iOS file protection — meaning the data is unreadable until your device has been unlocked at least once after boot. Your device's local store remains the primary copy and keeps working fully offline; the cloud copy described in §5.2 exists to keep your other devices in step.

5.2 Cross-Device Sync (on by default; pause or purge any time)

Signed-in accounts sync automatically so your data follows you between your iPhone, iPad, and (via your iPhone) Apple Watch. Here is exactly what that means:

• What is stored. Synced records are replicated to a single, dedicated table in our Supabase backend (project ref gugbfufbiajevxwaqbzl, hosted on Supabase's infrastructure on Amazon Web Services). Each record carries your account ID, the record type and ID, the record's content, timestamps, and an anonymous per-install device identifier used only for diagnostics.
• What syncs. Data you author in the App: meals and recipes-in-use, fasting sessions, supplements and intake logs, mood / symptom / breathing / cycle entries, manually entered vitals, medications and health issues, nutrition and workout plans, grocery lists, AI conversations, journal entries (end-to-end encrypted — see below), progress/rewards, saved clinicians and notes, your lab results, your genomic import's summary row and the coarse derived genetic markers on your profile (caffeine / lactose / alcohol metabolism, MTHFR status, chronotype, muscle-fibre type, vitamin-D, inflammation, COMT, cardiovascular and clotting risk), and your preferences. It also covers records the App derives or generates for you: your consent record set, biomarker scores and biological-age history, sleep and workout sessions, circadian entries, daily nutrient ledgers and nutrient targets, GLP-1 records, quests, streaks and rewards, AI-generated insights, analyses and daily briefings (which can contain free-text findings about your health), your AI feedback, and your programme enrolments. In short: if the App stores it for your account and it is not on the "does not sync" list below, assume it replicates.
• Three things are stored outside that record set. Your profile photo is uploaded to a private storage bucket in our backend and referenced from your profile row, so the same picture appears on your other devices. Your experience points and level are written directly onto your profile row. And if you use the video section, we record which videos you liked, saved or completed and how many seconds you watched, against your account, so your place and your saved list follow you. These three are not covered by the sync pause switch. Deleting your account removes the stored profile-photo file, experience points, level and video-engagement records along with the rest of your account data (§5.6).
• What does NOT sync. Your raw genetic file — SNPs, genotypes and rsIDs never leave your device (§1.4). Raw wearable data from Oura / Withings / Garmin (re-imported per device from the vendor), the image files of meal photos and lab scans, Face ID / device-security settings, and per-device layouts. Apple Health measurements are not synced by inLive as individual samples (Apple syncs those separately under your iCloud settings), but the summary averages computed from them are part of your synced profile.
• Journal entries are end-to-end encrypted. Journal text is sealed on your device with AES-GCM before it syncs; our servers store that text only as sealed bytes and cannot read it. The tags you attach to an entry, and its timestamp, are not sealed — they sync in readable form, so keep anything sensitive out of a tag. The encryption key travels between your devices exclusively inside Apple's end-to-end-encrypted iCloud Keychain — we never see or store it. If iCloud Keychain is disabled on a device, synced journal entries remain locked there until you enable it.
• Access control. Every row is protected by Row Level Security (RLS): the database enforces auth.uid() = user_id on read and write, so no user — even with the App's public API key — can read or modify another user's data.
• Pause. Profile → Settings → Cross-Device Sync switches sync off for your whole account; every device pauses. Existing synced data is kept (so re-enabling resumes seamlessly) but nothing new is uploaded.
• Purge. "Delete Synced Data from inLive Cloud" (same screen) permanently deletes every synced record from our servers, on demand, independent of account deletion. Data already on your devices stays on them.
• Deletions propagate. When you delete a record in the App, a deletion marker replaces its synced content so your other devices remove it too; the marker itself — the record's type and ID and the time you deleted it, with its content emptied — stays against your account until you delete your synced data or your account.

5.3 Encryption

• In transit: All network communication uses TLS 1.3 (or 1.2 minimum) — App Transport Security is enabled with no exceptions. Data exchanged between your iPhone and Apple Watch travels over Apple's encrypted device-to-device channel (WatchConnectivity).
• At rest, on device: SwiftData store is encrypted by iOS file protection. Genetic data is additionally encrypted with a per-user symmetric key stored in the iOS Keychain.
• At rest, in the cloud: Supabase encrypts data at rest using AWS KMS-managed keys.
• Journal entries (end-to-end): journal text is additionally sealed with AES-GCM on your device before it syncs; the key lives only in your devices' iCloud Keychain (Apple end-to-end encryption). Our servers store that text as ciphertext we cannot decrypt; an entry's tags and timestamp are not sealed.
• API keys: AI provider keys, OAuth tokens for connected devices, and other secrets are stored in the iOS Keychain — never in SwiftData, UserDefaults, or our cloud database.

5.4 Security Practices

• Code-signed with Apple Developer Program (paid) credentials, Team ID RAJH8R6U7T.
• Privacy manifest declared in PrivacyInfo.xcprivacy; no use of Required-Reasons APIs without disclosed reasons.
• No third-party crash-reporting or analytics SDKs that would access health data.
• Annual review of sub-processor security posture.
• Incident-response plan in place; in the event of a security incident affecting personal information, we will notify affected users without undue delay and in accordance with applicable law.

5.5 Apple Watch

If you install the inLive watch app, your paired Apple Watch shows a compact snapshot of your day (recovery score, calories, plan progress, fasting timer, supplement checklist) and lets you log water, mood, supplements, and meals from your wrist. This data moves only between your own iPhone and your own Watch over Apple's encrypted WatchConnectivity channel — the Watch never talks to our servers directly. The snapshot deliberately excludes your name and account identity. Entries you log on the Watch are applied on your iPhone and then follow the normal sync rules in §5.2. Signing out of the App wipes the Watch's local snapshot.

5.6 Retention

• Local data: Retained on your device until you delete the App or use the in-app "Delete Account" feature.
• Cloud data: Retained as long as your account is active. Account deletion is immediate and irreversible — when you delete your account, your user-scoped database rows, stored profile-photo objects and authentication record are permanently deleted from our active systems at the time of your request; there is no recovery window. Independently of account deletion, you can permanently delete all synced records at any time with "Delete Synced Data from inLive Cloud" (§5.2); deletion markers left behind by record deletions — the record's type and ID and the time of deletion, with the content emptied — are retained until you delete your synced data or your account.
• Backups: Encrypted backups containing your data are retained for an additional period not to exceed 12 months for disaster recovery, then permanently destroyed.
• De-identified aggregate data (statistical metrics with no possibility of re-identifying any individual) may be retained indefinitely for product analytics and research, consistent with applicable law.

6. Your Rights and Choices

You can exercise the following rights at any time. If you are in a jurisdiction that grants additional rights (e.g., the EU, UK, California), those rights apply.

6.1 Universal Rights (available to all users)

• Access — see all information stored about you in the App's Profile section.
• Export — generate a comprehensive PDF health report (and a clinician hand-off report) of your data from within the App. If you need a machine-readable copy of your raw data for portability, email privacy@inlive.health and we will provide a structured export.
• Correction — update any field directly in the App.
• Deletion — delete your account and all associated data via Profile → Delete Account. The in-app flow runs a multi-layer erasure: every local health record (across all SwiftData model types), credentials in iOS Keychain, app preferences, encrypted genetic files, OAuth tokens for every connector you authorized, and a server-side cascade that deletes your user-scoped database rows, profile-photo objects in Supabase Storage, and your authentication record itself, executed under your own authentication. The server verifies that database and Storage deletion completed before deleting the authentication record; failures are reported and can be retried. Your local session is invalidated as the final step. Account deletion is immediate and irreversible — there is no recovery window (see §5.6).
• Pause cross-device sync — one switch (Profile → Settings → Cross-Device Sync) pauses sync for your whole account on every device, without losing existing local data.
• Delete synced data — permanently remove every synced record from our servers on demand ("Delete Synced Data from inLive Cloud"), independent of account deletion.
• Revoke device connections — disconnect Apple Health, Oura, Withings, Garmin, etc. from Profile → Connections.

6.2 EU / UK Rights (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to:

• Data portability — receive your data in a structured, commonly used, machine-readable format. Request this at privacy@inlive.health and we will provide a structured export of your account data.
• Object to processing — based on your particular situation, including processing based on legitimate interests.
• Restriction of processing — in certain circumstances.
• Withdraw consent — for any processing based on consent. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Lodge a complaint — with your local Data Protection Authority. We encourage you to contact us first so we can address your concern.

Our lawful bases under GDPR Article 6 are: (a) consent, for optional features like genetic data import and AI features; (b) performance of a contract, for core App functionality you've requested — including keeping your account's data consistent across the devices you sign in on (cross-device sync), which you can pause or purge at any time; (c) legitimate interests, for security, fraud prevention, and improving the Services in ways that do not override your rights and freedoms.

For special-category data (Article 9), including health and genetic data, our lawful basis is explicit consent (Article 9(2)(a)) — captured when you accept health-data processing at account creation and reaffirmable at any time in Settings. Because cross-device sync stores health data on our servers, pausing sync (or deleting synced data) is the withdrawal mechanism for that specific processing; local-only use of the App continues unaffected.

The data controller is: David Murdych, operating as “inLive”. Contact: privacy@inlive.health.

Our Data Protection Officer / Privacy Contact: privacy@inlive.health.

6.3 California Rights (CCPA / CPRA)

California residents have additional rights to:

• Know what personal information we have collected, used, disclosed, or sold/shared in the past 12 months.
• Delete personal information we have collected from you.
• Correct inaccurate personal information.
• Opt out of any sale or "sharing" for cross-context behavioral advertising. inLive does not sell or share personal information for these purposes, so there is no opt-out mechanism to provide; this commitment is binding.
• Limit use of sensitive personal information (we use sensitive personal information only for purposes specified in §2 of this policy).
• Non-discrimination — we will not retaliate against you for exercising any privacy right.

To exercise California rights, email privacy@inlive.health with your full name, the email associated with your account, and your specific request. We will respond within 45 days.

6.4 Other US State Rights

We honor analogous rights under Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA, Washington My Health My Data Act, and other state comprehensive privacy laws. Requests can be made to privacy@inlive.health.

6.5 Genetic Data — Specific Rights

For users in jurisdictions with specific genetic-information statutes (e.g., California CGIPA), you have the right to:

• Withdraw consent for genetic data processing at any time, on any device, with effect from then onwards.
• Have your genetic data destroyed — within 30 days of withdrawal of consent, including all derivative data (carrier statuses, ancestry compositions, fitness genetic variants, nutrigenomic variants, pharmacogenomic variants).
• Receive a record of all entities your genetic data was disclosed to. Your raw genetic file (SNPs, genotypes and rsIDs) is never disclosed to anyone and never leaves your device. Coarse derived markers are disclosed to Supabase, Inc. as part of your synced profile when cross-device sync is on (§5.2), and — only if you have granted separate genetic-data consent and use a cloud AI model — to the AI provider handling that request. See §4.1.

7. Sign in with Apple

If you sign in with Apple, you may use Apple's "Hide My Email" feature to share a relay email address with us instead of your real email. We treat the relay email exactly as we would any other email address: it is used only for the purposes described in §2 of this policy. If you stop using Apple to sign in to inLive (Settings → Apple ID → Sign-In & Security → Apps Using Apple ID → inLive → Stop Using), your inLive account remains linked to whatever email was associated with it; you can transition to email/password authentication via the "Forgot Password" flow.

8. Children's Privacy

inLive is not intended for users under 18 years old. We do not knowingly collect personal information from children under 18. If you believe a child under 18 has created an account, contact us at privacy@inlive.health and we will delete the account and any associated data. The Services are not designed for compliance with the Children's Online Privacy Protection Act (COPPA) and we do not seek to support under-18 users.

9. International Data Transfers

If you use inLive from outside the country where our servers and providers operate (primarily the United States), your data is transferred internationally. We rely on the following safeguards:

• EU/UK to US transfers: Standard Contractual Clauses (SCCs) with our sub-processors that handle EU/UK personal data.
• Sub-processor agreements: All sub-processors we use have committed to data protection terms equivalent to those required by GDPR.

You can withdraw consent for international transfers at any time, but doing so will likely make it impossible to continue providing you with the Services.

10. Third-Party Services

When you use links, content, or services from third parties within or alongside the App (e.g., the websites of Oura, Withings, Garmin, or AI providers), those third parties' privacy policies apply to data they collect — not this Privacy Policy. We are not responsible for the privacy practices of third parties.

We encourage you to read the privacy policies of:

• Apple's Privacy Policy
• Apple HealthKit Privacy Disclosure
• Supabase Privacy Policy
• Stripe Privacy Policy (Store checkout — see §4.1.1)
• Anthropic Privacy Policy (hosted BioMod Concierge AI)
• Google Sign-In Privacy
• The privacy policy of any AI provider whose API key you've configured (OpenAI, Anthropic, Google AI, xAI).

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes (changes that meaningfully reduce your rights or change how we use your data), we will:

1. Update the "Effective Date" at the top of this page.
2. Send you an in-App notification at least 30 days before the changes take effect.
3. For users in jurisdictions that require it, obtain renewed consent for the changed processing.

For non-material changes (typo fixes, clarifications, structural reorganizations that don't change the substance), we will simply update the page. Your continued use of the Services after a non-material change constitutes acceptance of the updated policy.

12. Contact Us

For questions, requests, or complaints about this Privacy Policy or your personal information, contact us at:

• Email (privacy): privacy@inlive.health
• Email (general): hello@inlive.health
• Email (legal): legal@inlive.health
• Email (security disclosures): security@inlive.health
• Mailing address: David Murdych, operating as “inLive” — contact: privacy@inlive.health
• Website: https://www.inlive.health

We aim to respond to all privacy requests within 30 days, with extensions only when reasonably necessary and with prior notice to you.

---

This document is published at https://www.inlive.health/legal/app. The version controlled in our public repository at github.com/David-NextHome/inLive under legal/privacy-policy.md is the canonical source.