Consumer Health Data Privacy Policy
Last updated: October 10, 2026. Applies to the Diurnal.ai mobile app and the diurnalapp.ai website.
This policy is published by PUREQUAD SRL (Romania, company details) for residents of the State of Washington under the My Health My Data Act, residents of Nevada under Senate Bill 370, residents of Connecticut under the Connecticut Data Privacy Act as amended, and anyone else whose law grants specific rights over "consumer health data". It supplements our Privacy Policy, which applies to everything else and describes the same practices in more detail. Consumer health data means personal information that identifies your past, present or future physical or mental health status.
1. Categories of consumer health data we collect
- Body and lifestyle information: year of birth, biological sex, height, weight, activity level, daily step range, smoking and alcohol habits, primary goal (for example lose weight or sleep better). Step counts stay on your phone.
- Diet and nutrition: food allergies and intolerances, meals you log (text, AI estimates and the photos you choose to analyse), calorie targets and reference intakes computed for you, weekly nutrition and inflammation ratings.
- Supplements and medicines: the products you take (name, brand, dose, ingredient list read from the label), your schedule and courses, which doses you tick off and, if you use them, stock counts and your own reorder links.
- Fitness and activity: the sports you practise, your trainings and workouts (sets, reps, weights, effort, notes, duration, distance, climb, energy and kilometre splits) and, for workouts imported from Apple Health or Health Connect, average and maximum heart rate. Daily resting heart rate, heart rate variability (HRV) and steps read from Apple Health or Health Connect stay on your phone. If you join the Sport community, also the workouts you choose to post for your sport friends (numbers only) and the kudos on them.
- Caffeine you log (last 30 days) and lab recheck reminders, stored on your phone only.
- Sleep and mood: hours, bed and wake times, how you feel in the morning, sleep habits, goal and mood check-in answers.
- Laboratory results: markers, values, units, reference ranges and test dates extracted from reports you add, comparisons between reports. Stored on your phone only, never on our server.
- Reproductive and sexual health (only if you turn on cycle tracking): periods and predictions, symptoms and mood, discharge, intimacy, ovulation and pregnancy tests, basal temperature, contraception, pregnancy and perimenopause information. Stored on your phone only, never on our server, except the small snapshot you may choose to share with a partner (section 4).
- Genetic information: a panel of 42 nutrition-related variants and their interpretation, stored on your phone only. It is not a genetic test for any disease.
- Health information you share with the AI assistant in chat, and the short notes Marc keeps about your preferences.
- Family members' routines you manage for people who do not use the app: their name, relation, age, routine, allergies, food preferences and notes.
Precise location is used on your phone only, while you record a run, walk, hike or ride: the GPS tracks and routes stay on your phone and never reach our server. If you ask for suggested loops (Premium), only your approximate starting point (rounded to about 100 m) goes through our server to OpenRouteService to calculate them; we do not store it (section 4). We do not use geofencing of any kind, and we do not infer health conditions from your activity or location for any purpose other than the features you use.
2. Sources
You, directly, when you type, tick, photograph or upload something in the app; your phone's motion sensor for the step count (phone only); Apple Health or Health Connect, only if you connect them and only for the types you switch on (sleep, steps, resting heart rate, HRV, workouts and, if you track your cycle, period days); your phone's GPS while you record an activity (phone only); the AI processor's output when it reads a photo, label or document you submitted; and the calculations the app performs on your data.
3. Purposes
To provide the features you request and nothing else: reminders and routines, supplement stock and refill reminders, meal and nutrient tracking, the caffeine guide, the Sport tab (trainings, workouts, GPS activities, tips and readiness numbers compared only with your own average), syncing with Apple Health or Health Connect, lab recheck reminders, the Sport community (showing the workouts you post to the sport friends you accept) and sharing trainings, the day by day journal, weekly reports, lab report reading and comparison, genetic wellness interpretation, the AI assistant's answers, family routines, partner sharing, backing up your data and restoring it on a new phone; only if you turn on Help improve Diurnal.ai (off by default), statistics about groups of at least 5 people, made from the workouts you record in the app and a few profile ranges and never from Apple Health or Health Connect data, to improve workouts, exercises and suggestions; and to keep the service secure and comply with law. We do not use consumer health data for advertising, marketing, profiling for marketing, data mining, or research unrelated to the service, and we do not sell it. The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements; information from Apple Health is used only to provide the features you use and is never used for advertising or data mining.
4. Sharing
| Recipient | What | Why |
|---|---|---|
| OpenAI (contract with OpenAI Ireland Ltd; processing in the USA by OpenAI, L.L.C.), AI processor, only after your AI consent | Only what the feature you use needs, always pseudonymised: never your name, e-mail, phone, exact date of birth or account id, and no calendar dates in the chat. Age as a 5-year range, weight and height rounded, family members aged 16 or over only as relation and age range, nothing about children under 16. Your recent training (relative days, no places or routes) and today's caffeine total. Lab values, the cycle summary and Marc's memory only if you tick them. Genetic panel lines only with your separate genetic consent. Lab report photos are sent whole, so cover your name and ID first. Details in section 6 of the Privacy Policy. | To generate the answer, estimate, reading or report you asked for. Not used to train models; kept by OpenAI up to 30 days for abuse monitoring, then deleted |
| Hetzner Online GmbH (Finland, EU), hosting, only with your health data consent | The synced copy of your data (never lab results, the genetic panel or the cycle log) | To back up your data and restore it on another phone, and for family features |
| One partner account you invite (optional, Premium, 18 or older) | Only the cycle snapshot you choose: display name, phase, cycle day, PMS window and, if you switch them on, predicted period, fertile days and today's symptoms, your pregnancy week in pregnancy mode, and an optional message. So your partner's view stays current on days you do not open the app, your phone also sends the same estimates for the next 45 days (fertile days and the pregnancy week only if you share them), which our server keeps with the snapshot. It shows your partner only the current day, plus heads-ups that your partner's phone turns into notifications: when your PMS days may start (at most 2 days ahead, or 7 days when you share your expected period) and, only if you share it, when your period is expected. Never your log, notes, tests or intimacy entries | Because you created an invite code; stop at any time |
| Sport friends you accept (optional, free, 18 or older) | Your display name and sports, the workouts you choose to post as numbers only (sport, day, duration, distance, climb and, only if you turn them on, the exercises with sets, reps and weights, the total weight lifted and the number of personal bests), totals counted from what you posted, and the trainings you show on your sport profile. Never heart rate, calories, routes or places, notes, your body data, labs, genetic data, your cycle or anything else from the app. Only you see who gave kudos on your posts | Because you gave the separate Sport community consent and accepted them as friends; delete a post, remove or block a friend, or delete your sport profile at any time |
| Anyone signed in to Diurnal.ai who enters a training code you share | The training only (its name, sport, exercises with sets, reps, weights and rest, and the exercises you created with their name), never your name. No other health data | Because you created the code; it works for 30 days and you can stop it at any time |
| Family members who check on your doses (optional, Premium, 18 or older, up to 3) | For the current day only: the names and times of your supplements and medicines and whether you marked them, and the time of your last update; a notification when a dose is still not marked after the delay they choose, which names no medicine. Delivered through Expo (USA) and Apple or Google. Never your meals, sleep, labs, cycle, genetic data or chats | Because you gave your explicit consent and created a code; pause or stop at any time |
| HeiGIT gGmbH (OpenRouteService, Germany), only when you ask for suggested loops (Premium) | No health data: the approximate starting point (rounded to about 100 m), the distance and the type of activity, sent by our server without your account id or IP address. We do not store it; under its own terms OpenRouteService keeps the request for 7 days, then only coordinates rounded to about 1 km | To calculate the loops you asked for |
| Apple Health or Health Connect on your phone (optional) | The workouts you record in the app, if you allow the app to save them there | Because you asked for it; they then stay under your control in that app |
| Apple (iOS on your iPhone), for Siri and Shortcuts | The names of your routine items for today and tomorrow, given to iOS on your phone as shortcut suggestions so you can log them by voice (no names in Anonymous mode). Apple states that it may collect anonymised App Shortcuts data, such as these names, to improve its services; your voice requests are processed by Apple under its own terms | So you can use voice and shortcuts |
| Family members and friends you connect with in the app | What the family feature shows, for example that a routine was completed | Because you added them |
| An AI provider you connect with your own key (optional) | The pseudonymised chat context (including your recent training and today's caffeine), never lab results, genetic findings, Marc's memory or cycle data | Because you asked for it; their terms apply |
| Public authorities | What a lawful order requires | Legal obligation |
No affiliates receive consumer health data (PUREQUAD SRL has none that process it). No other third parties receive it. Our e-mail provider (Brevo) and our subscription processor (RevenueCat) receive no health data. GoDaddy hosts our support mailbox (USA), so it holds any health information you choose to write to us by e-mail. We do not sell consumer health data and have no plans to; a sale would require your separate, signed authorization under Washington law, which we will never request.
5. Consent
We collect and share consumer health data only with your consent, given in a separate step in the app: during setup you see the health data consent text and tick an unticked box to agree; the AI features and genetic interpretation have their own consent screens, also unticked, and showing your workouts to sport friends needs its own consent, an unticked box on the screen where you create your sport profile; Help improve Diurnal.ai is a separate switch, off until you turn it on. Simply entering or uploading data is not treated as consent. If you do not consent, the app keeps your data on your phone only and nothing is sent to our server or to the AI. Each consent is recorded with its date, time and text version, and so is each connection to or disconnection from Apple Health or Health Connect.
You can withdraw consent at any time in Settings, or by e-mailing us. Withdrawing the health data consent erases the copy of your data on our server and your partner sharing snapshot, stops AI features and genetic interpretation, erases your sport profile, posts and shared trainings, and keeps your data only on your phone. Withdrawing only the AI or genetic consent stops those features; deleting your sport profile withdraws the Sport community consent; turning off Help improve Diurnal.ai leaves your data out of the next statistics (they are not stored).
6. Your rights
- To confirm whether we collect, share or sell consumer health data about you, and to access it, including a list of all third parties and affiliates with whom we shared it (section 4) and an active e-mail address or other contact for each where required.
- To withdraw consent to the collection and sharing of consumer health data (section 5).
- To have your consumer health data deleted, including by our processors, with the deletion passed on to them: Settings → Delete all data, or see Delete your account.
- Not to be discriminated against for exercising these rights.
- To appeal our decision on your request: reply to our answer within 30 days and say you appeal. A different person reviews it and answers within 45 days, explaining what was done and why. If we still refuse, we tell you how to contact your state attorney general (Washington, Nevada, Connecticut).
Use the in-app tools (Settings → Export data, Delete all data) or e-mail support@diurnalapp.ai. We verify requests by matching the account e-mail or asking you to confirm from within the app, and we respond within 45 days (extendable once by 45 days with notice). Requests are free unless manifestly unfounded or excessive.
7. Security and retention
Consumer health data is protected and retained as described in sections 13 to 15 of the Privacy Policy: encryption in transit, restricted and logged staff access (our admin tools show counts and adherence percentages only, never conversations, meals, body data or other health details, except a sport post someone reports to us, which our team sees to review the report), the synced copy kept only while your health data consent and your account exist, and deletion of everything on our server when you delete your account.
8. Contact
PUREQUAD SRL, Romania (company details). E-mail: support@diurnalapp.ai. Washington residents may also contact the Washington State Attorney General; Nevada residents the Nevada Attorney General; Connecticut residents the Connecticut Attorney General.