From c79d91736cd348f003d4b00bce75505eac8787f5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Thu, 21 May 2026 11:46:50 +0200 Subject: [PATCH] feat(privacy): public privacy policy page at /privacy with DE + EN content Convert the English-only v1.4.26 privacy page to a bilingual document that an Apple US App-Store reviewer and a German DPA inspector can both read without locale switching. Each numbered section opens with the German body (visible by default) and ships a collapsible English translation directly underneath. The H1 and TOC carry both languages. GDPR / DSGVO content additions on top of the v1.4.26 spine: - HealthKit data flow disclosed explicitly: HK sample to iOS app to POST /api/measurements over HTTPS, with no third-party transit. - AI off-device transit boundary spelled out: TLS 1.3, off by default, never includes raw HealthKit identifiers, per-provider opt-in. - Consent receipt persistence linked to GET /api/account/consents with the 5-year retention window. - Encryption layer named explicitly: TLS 1.3, HSTS, certificate pinning on iOS (Zertifikat-Pinning in the DE body). - Server location framed as operator in Germany on Hetzner; no third-party hosting beyond the AI providers listed in section 4. - Retention defaults table: rolling 5-year measurement window, 90-day audit logs, 14-day server access logs, 30-day failed APNs. - GDPR Art. 17 deletion route named: Settings -> Daten -> Konto loeschen with the User.delete + onDelete: Cascade contract. - Operator contact via mbombeck@gmail.com with the GDPR subject-line convention plus the GitHub-issue fallback channel. - DSGVO legal-basis citations attached per data category (Art. 6 (1) (b) and Art. 9 (2) (a) GDPR). Bumped POLICY_VERSION to 1.4.40, LAST_UPDATED to 2026-05-18. Static render kept (force-static, no revalidate) so the legal document does not depend on JavaScript to display its non-default-locale text to a reviewer. --- src/app/privacy/page.tsx | 2356 ++++++++++++++++++++++++++------------ 1 file changed, 1646 insertions(+), 710 deletions(-) diff --git a/src/app/privacy/page.tsx b/src/app/privacy/page.tsx index c50bdcecd..511b9f588 100644 --- a/src/app/privacy/page.tsx +++ b/src/app/privacy/page.tsx @@ -2,91 +2,161 @@ import type { Metadata } from "next"; import Link from "next/link"; /** - * v1.4.26 — Public privacy policy. + * v1.4.40 W-PRIVACY (SB-3) — Bilingual public privacy policy. * * Requirements driving this page: * * 1. **Apple App Store Connect** requires a publicly reachable Privacy- * Policy URL before the iOS native app's first submission. The URL * registered with ASC is `https://healthlog.bombeck.io/privacy`. - * 2. **GDPR Art. 13 / 14 + Art. 15-22** — data-subject rights need to - * be enumerated with concrete endpoints / routes the user can hit. + * 2. **GDPR / DSGVO Art. 13 / 14 + Art. 15-22** — data-subject rights + * enumerated with concrete in-app routes the user can hit. * 3. **EU MDR 2017/745 + MDCG 2021-24** — the boundary "HealthLog is * not a medical device" is stated next to the AI-Coach explanation, * because that boundary is what keeps the Coach legally outside * MDR scope. Mirrors GROUND RULES 9 + 15 in the Coach system prompt. + * 4. **DACH-Recht** — German content paired with English on the same + * page so the document is reviewable by both a German DPA and an + * Apple US reviewer without locale switching. Standard bilingual + * Datenschutzerklärung layout: each section opens with the German + * text and is followed by the English translation under a labelled + * `
` so the German body reaches the fold first while the + * English version stays inline-reachable. * * Public route — listed in `src/proxy.ts` PUBLIC_PATHS and the * `` PUBLIC_PATHS so an unauthenticated visitor (or App-Store * reviewer) lands directly on the content without an auth redirect. * - * English-only body copy for this release. German + the four remaining - * locales follow in a subsequent patch — pattern matches the W14c - * native-Coach-prompts release where EN + DE shipped first. The - * `auth.privacyPolicy` label in `` IS translated into all - * six locales already so the discoverable link reads natively. + * Static-rendered (`force-static`, no `revalidate`). The bilingual body + * is inlined verbatim instead of routed through the i18n provider so the + * page works without a client-side context — a legal document should + * never depend on JavaScript to display its non-default-locale text to a + * reviewer. */ export const dynamic = "force-static"; export const revalidate = false; -const POLICY_VERSION = "1.4.26"; -const LAST_UPDATED = "2026-05-15"; +const POLICY_VERSION = "1.4.40"; +const LAST_UPDATED = "2026-05-18"; export const metadata: Metadata = { - title: "Privacy Policy — HealthLog", + title: "Datenschutzerklärung / Privacy Policy — HealthLog", description: - "How HealthLog handles personal-health data, sub-processors, GDPR rights, and the EU MDR medical-device boundary.", + "Wie HealthLog personenbezogene Gesundheitsdaten verarbeitet, Auftragsverarbeiter, DSGVO-Rechte und die EU-MDR-Medizinprodukte-Grenze. Bilingual DE/EN.", robots: { index: true, follow: true }, }; interface SectionProps { id: string; - title: string; - children: React.ReactNode; + numberLabel: string; + titleDe: string; + titleEn: string; + /** German body (rendered first, visible by default). */ + bodyDe: React.ReactNode; + /** English translation (rendered inside a labelled `
`). */ + bodyEn: React.ReactNode; } -function Section({ id, title, children }: SectionProps) { +function Section({ + id, + numberLabel, + titleDe, + titleEn, + bodyDe, + bodyEn, +}: SectionProps) { return ( -
+

- {title} + {`${numberLabel}. ${titleEn}`}

-
- {children} +
+

+ Deutsch — {titleDe} +

+ {bodyDe}
+
+ + English translation + + +
+ {bodyEn} +
+
); } interface SubProcessorProps { name: string; - role: string; - data: string; - location: string; + roleDe: string; + roleEn: string; + dataDe: string; + dataEn: string; + locationDe: string; + locationEn: string; policyUrl: string; } function SubProcessor({ name, - role, - data, - location, + roleDe, + roleEn, + dataDe, + dataEn, + locationDe, + locationEn, policyUrl, }: SubProcessorProps) { return ( -
  • +

  • {name}

    -

    - Role. {role} -

    -

    - Data transferred.{" "} - {data} -

    -

    - Storage. {location} -

    +
    +

    + Rolle. {roleDe} +

    +

    + + Übermittelte Daten. + {" "} + {dataDe} +

    +

    + Speicherort.{" "} + {locationDe} +

    +
    +
    +

    + Role. {roleEn} +

    +

    + Data transferred.{" "} + {dataEn} +

    +

    + Storage.{" "} + {locationEn} +

    +

    - Privacy policy + Privacy policy / Datenschutzerklärung

    • @@ -125,11 +195,11 @@ export default function PrivacyPage() { {/* - v1.4.33 IW9 — `max-w-3xl` (768 px) is intentional, not a stale - token. The legal/long-form column reads better at 70-80 chars - per line; widening to the app shell's `max-w-screen-xl` would - push line lengths to ~120 chars on a 1440 px laptop and degrade - legibility. The same exception applies to `/about`. + v1.4.33 IW9 — `max-w-3xl` (768 px) is intentional. The legal / + long-form column reads better at 70-80 chars per line; widening + to the app shell's `max-w-screen-xl` would push line lengths to + ~120 chars on a 1440 px laptop and degrade legibility. The same + exception applies to `/about`. */}

    - Privacy Policy + Datenschutzerklärung / Privacy Policy

    - Last updated: {LAST_UPDATED} + Last updated: {LAST_UPDATED} · Stand: {LAST_UPDATED} +

    +

    + Diese Erklärung ist deutsch-englisch geführt. Jeder Abschnitt + beginnt mit dem deutschen Text; die englische Übersetzung + steht eingeklappt direkt darunter.

    - {/* v1.4.27 MB6 — collapsible TOC. Default-closed on every - viewport so the policy's first paragraphs reach the fold - on ` - Contents + Inhalt / Contents
    -
    -

    - HealthLog is an open-source, self-hostable personal-health-tracking - application. Source code is published at{" "} - - github.com/MBombeck/HealthLog - {" "} - under the GNU Affero General Public License v3.0. This policy - describes how the hosted instance at{" "} - - healthlog.bombeck.io - {" "} - and the companion iOS application{" "} - HealthLog for iOS (bundle identifier{" "} - - io.bombeck.healthlog - - ) handle personal data. -

    -

    - This document covers the web application version {POLICY_VERSION}{" "} - and the iOS application version 0.3 and later. Self-hosted - deployments controlled by a different operator are governed by the - operator's own privacy policy; this document applies only to - the instance reachable at the hostname above. -

    -

    - For questions or data-subject requests, open a public issue at{" "} - - github.com/MBombeck/HealthLog/issues - {" "} - titled "GDPR — <Access | Erasure | Portability> - request" without personal information in the title; a private - channel for the actual exchange will be provided in the first - response. -

    -
    +
    +

    + HealthLog ist eine quelloffene, selbst-hostbare Anwendung + zur persönlichen Gesundheitsprotokollierung. Der Quellcode + wird unter der GNU Affero General Public License v3.0 auf{" "} + + github.com/MBombeck/HealthLog + {" "} + veröffentlicht. Diese Erklärung beschreibt, wie die unter{" "} + + healthlog.bombeck.io + {" "} + betriebene Instanz und die zugehörige iOS-Anwendung{" "} + HealthLog for iOS (Bundle-ID{" "} + + io.bombeck.healthlog + + ) personenbezogene Daten verarbeiten. +

    +

    + Verantwortlicher im Sinne von Art. 4 Nr. 7 DSGVO ist der + Betreiber dieser Instanz (Privatperson mit Sitz in + Deutschland). Eigenständig betriebene, selbst-gehostete + Instanzen unterliegen der Datenschutzerklärung ihres + jeweiligen Betreibers; dieses Dokument gilt ausschließlich + für die genannte Domain. +

    +

    + Für Fragen oder Datenschutz-Anfragen siehe Abschnitt 11 + (Kontakt). +

    + + } + bodyEn={ + <> +

    + HealthLog is an open-source, self-hostable personal-health- + tracking application. Source code is published at{" "} + + github.com/MBombeck/HealthLog + {" "} + under the GNU Affero General Public License v3.0. This + policy describes how the hosted instance at{" "} + + healthlog.bombeck.io + {" "} + and the companion iOS application{" "} + HealthLog for iOS (bundle identifier{" "} + + io.bombeck.healthlog + + ) handle personal data. +

    +

    + The controller under Art. 4 (7) GDPR is the operator of + this instance (an individual based in Germany). Self- + hosted deployments controlled by a different operator are + governed by that operator's own privacy policy; this + document applies only to the hostname above. +

    +

    + For questions or data-subject requests, see section 11 + (Contact). +

    + + } + /> -
    -

    - HealthLog is designed to record observations the user enters - themselves and to consume health signals the user has explicitly - connected through a third-party integration. The categories below - are exhaustive for the released feature set. -

    +
    +

    + HealthLog speichert Beobachtungen, die der Nutzer selbst + erfasst, sowie Gesundheitssignale, die der Nutzer + ausdrücklich über eine Integration verbunden hat. Die + folgenden Kategorien sind für den veröffentlichten + Funktionsumfang abschließend. +

    +

    + 2.1 Konto und Authentifizierung +

    +
      +
    • E-Mail-Adresse und gewählter Benutzername.
      • +
    • + Passwort-Hash (Argon2id; das Klartext-Passwort wird zu + keinem Zeitpunkt gespeichert oder protokolliert). +
      • +
    • + Optional: WebAuthn- / Passkey-Anmeldedaten (öffentlicher + Schlüssel, Credential-ID, Signaturzähler). +
      • +
    • + Sitzungskennungen (HTTP-only-Cookie im Web; opake API- + Token unter iOS, gespeichert im Geräte-Keychain). +
      • +
    • + Profil-Metadaten: Sprache, Zeitzone, Geburtsdatum + (optional), biologisches Geschlecht (optional), Körper- + größe (optional) — zur Berechnung altersgerechter + Zielbereiche und des BMI. +
      • +
    +

    + 2.2 Manuell erfasste Gesundheitsdaten +

    +

    + Jeder in den App-Formularen eingegebene Wert, einschließ- + lich Zeitstempel, optionaler Notiz und Metrik-Typ. Die + vollständige Aufzählung der unterstützten Metriken steht + im OpenAPI-Schema; die nutzerrelevante Teilmenge umfasst + Körpergewicht, Körperfett, Körpertemperatur, BMI + (abgeleitet), Blutdruck (systolisch / diastolisch) und + Puls (gepaarte Messung), Blutzucker mit Kontext (nüchtern / + postprandial / zufällig / vor dem Schlafengehen) und + wählbarer Einheit (mg/dL oder mmol/L), Ruhepuls, HRV + (SDNN), VO₂max, Sauerstoffsättigung, Schlafdauer inkl. Pro- + Stadien-Aufschlüsselung (Wach / REM / Core / Tief), + Schritte, gelaufene oder gerannte Distanz, Aktive-Energie, + gestiegene Stockwerke, Lärmpegel (Umgebung und Kopfhörer), + Tageslicht-Zeit, Stimmung (Skala 1–5) mit optionaler + Freitext-Notiz sowie Workouts (Sportart, Dauer, Distanz + und optional GPS-Route, ausschließlich wenn der Nutzer + eine Route anhängt). +

    +

    + 2.3 Apple Health (iOS-Anwendung) — Datenfluss +

    +

    + Wenn der Nutzer der iOS-Anwendung Lesezugriff auf Apple + HealthKit erteilt, liest HealthLog Stichproben der unten + aufgeführten Identifier. HealthKit-Daten verbleiben auf + dem Gerät des Nutzers und in dessen iCloud-gestütztem + Health-Speicher; die iOS-Anwendung überträgt die relevant- + en Stichproben über HTTPS (TLS 1.3, Zertifikat-Pinning) an + den HealthLog-Server (Endpunkt{" "} + + POST /api/measurements + + ), damit die Web-Oberfläche dieselben Verläufe darstellen + kann wie das iPhone. Es findet keine Übertragung an Dritte + statt; die Daten werden ausschließlich auf der unter + Abschnitt 5 beschriebenen Infrastruktur in Deutschland + gespeichert. +

    +

    HKQuantityTypeIdentifier:

    +
      +
    • + bodyMass +
      • +
    • + bodyFatPercentage +
      • +
    • + bodyTemperature +
      • +
    • + bloodPressureSystolic +
      • +
    • + bloodPressureDiastolic +
      • +
    • + bloodGlucose +
      • +
    • + oxygenSaturation +
      • +
    • + heartRate +
      • +
    • + restingHeartRate +
      • +
    • + heartRateVariabilitySDNN +
      • +
    • + vo2Max +
      • +
    • + stepCount +
      • +
    • + activeEnergyBurned +
      • +
    • + flightsClimbed +
      • +
    • + distanceWalkingRunning +
      • +
    • + environmentalAudioExposure +
      • +
    • + headphoneAudioExposure +
      • +
    • + timeInDaylight (iOS 17+) +
      • +
    +

    HKCategoryTypeIdentifier:

    +
      +
    • + sleepAnalysis — + mit voller Pro-Stadien-Granularität (Awake, REM, Core, + Deep). Die Stadien werden serverseitig als separate + Zeilen abgelegt, damit das Diagramm sie stapeln kann. +
      • +
    +

    + Schreibzugriff wird für eine Teilmenge angefordert + (Körpermasse, Blutdruck systolisch / diastolisch, Blut- + zucker), damit manuelle Einträge in der iOS-App zurück + nach HealthKit fließen können. Der Nutzer steuert beide + Richtungen über die Berechtigungsoberfläche der iOS- + Health-App und kann jederzeit widerrufen. +

    +

    + 2.4 Withings-Synchronisation (optional) +

    +

    + Verbindet der Nutzer ein Withings-Konto, speichert + HealthLog die OAuth-Refresh- und -Access-Token (spalten- + weise verschlüsselt) sowie die Withings-Nutzerkennung. + Webhook-getriebene Folgesynchronisierungen ziehen Körper- + gewicht, Fettanteil, fettfreie Masse, Muskelmasse, + Knochenmasse, Wassergehalt, Magermasse, Hydration, + Blutdruck (systolisch / diastolisch) und Puls, Blut- + zucker, Körpertemperatur (Basal- und Hauttemperatur), + Aktivitätssummen (Schritte, Distanz, aktive Kalorien), + Schlafsitzungen mit Pro-Stadien-Segmenten (Awake / Light / + Deep / REM) sowie SpO₂ und Herzfrequenzvariabilität, + soweit vorhanden. +

    +

    + 2.5 Medikamente +

    +
      +
    • + Aktive Verordnungen: Wirkstoffname, Stärke, Verabreich- + ungsweg, Einnahmeplan, Behandlungsklasse (Standard oder + GLP-1). +
      • +
    • + Einnahme-Ereignisse: geplante Zeit, tatsächliche Zeit, + Status (eingenommen, ausgelassen, verpasst). +
      • +
    • + Bei GLP-1-Therapien: Dosis-Änderungs-Historie, Injektions- + Ereignisse mit optionaler Injektionsstelle und Pen- + Kennung, Nebenwirkungs-Protokolle entlang einer fixen + Taxonomie, Pen-und-Ampullen-Inventar mit 30-Tage-In- + Use-Uhr. +
      • +
    +

    + 2.6 KI-Coach und Insights — Off-Device-Transit +

    +

    + Aktiviert der Nutzer die KI-Coach-Oberfläche und + konfiguriert einen Sprachmodell-Anbieter, übermittelt + HealthLog auf Anforderung ein Snapshot-Bündel an diesen + Anbieter. Das Bündel enthält Gesundheitskontext aus den + oben genannten Daten (Aggregate, jüngste Beobachtungen, + Zielbereiche, optionaler Medikamentenkontext) und{" "} + + niemals rohe HealthKit-Identifier oder rohe Sample-IDs + + ; der Server normalisiert HK-Stichproben vorab in die + interne Metrik-Taxonomie. Die Übertragung erfolgt + verschlüsselt (TLS 1.3); standardmäßig ist die KI-Coach- + Funktion deaktiviert und wird nur nach ausdrücklicher + Nutzereinwilligung pro Anbieter aktiviert (siehe Einwilli- + gungsnachweis unter Abschnitt 2.7). HealthLog speichert + keinen langlebigen Gesprächszustand über den letzten + Thread hinaus. Abschnitt 4 listet die in Frage kommenden + Anbieter (Anthropic, OpenAI) auf. +

    +

    + 2.7 Einwilligungsnachweis (Consent Receipt) +

    +

    + Jede Einwilligung in die KI-Übermittlung — sowohl die + Aktivierung pro Anbieter als auch Änderungen am + Datentiefe-Schalter — wird mit Zeitstempel, Anbieter, + Versionskennung des Einwilligungstextes und Hash des + Snapshot-Schemas als „Consent Receipt“ persistiert. Der + Endpunkt zum Abruf ist{" "} + + GET /api/account/consents + + ; die Speicherdauer der Belege beträgt fünf Jahre, danach + werden sie automatisch gelöscht. Ein Widerruf wird als + eigenes Receipt mit umgekehrter Polarität abgelegt; der + Anbieter erhält ab diesem Zeitpunkt keine Snapshot-Bündel + mehr. +

    +

    + 2.8 Geräte- und Integrations-Metadaten, Push +

    +
      +
    • + Geräte-Kennung (zufällige UUID, clientseitig erzeugt + und im iOS-Keychain gespeichert), übermittelt als{" "} + + X-Device-Id + {" "} + -Header — für Mehrgeräte-Synchronisation und Miss- + brauchsschutz. +
      • +
    • + Apple-Push-Notification-Service-(APNs)-Geräte-Token und + Umgebung (sandbox / production), ausschließlich bei + aktivierten Push-Benachrichtigungen. +
      • +
    • + Telegram-Chat-Kennung — nur, wenn der Nutzer die + optionale Telegram-Bot-Benachrichtigung verbunden hat. +
      • +
    +

    + 2.9 Sicherheits- und Audit-Logs +

    +
      +
    • + Authentifizierungs-Ereignisse (Login-Erfolg/-Fehlschlag, + Passkey-Registrierung, Passwort-Wechsel, Sitzungs- + Widerruf) — 90 Tage zur forensischen Aufklärung. +
      • +
    • + Server-Zugriffsprotokolle (Zeit, Pfad, Statuscode, User- + Agent, IP) — 14 Tage zur Missbrauchsbekämpfung und + Fehlersuche. +
      • +
    • + Fehlgeschlagene APNs-Zustellungen — 30 Tage zur + Wartung des Push-Pfads, danach automatische Löschung. +
      • +
    +

    + 2.10 Nicht erhobene Daten +

    +
      +
    • + Keine Werbe-Identifier, Fingerprints oder anwendungs- + übergreifenden Tracker. +
      • +
    • Keine Zahlungsdaten (es gibt keinen Bezahltarif).
      • +
    • + Keine fortlaufende Hintergrund-Standortermittlung — + GPS-Routen nur, wenn der Nutzer sie einem Workout + ausdrücklich beifügt. +
      • +
    • + Keine Social-Network-Kennungen und kein Kontaktlisten- + Abgleich. +
      • +
    • + Keine clientseitigen Produkt-Analytics; die Instanz + liefert kein Analytics-SDK aus. +
      • +
    + + } + bodyEn={ + <> +

    + HealthLog is designed to record observations the user + enters themselves and to consume health signals the user + has explicitly connected through a third-party + integration. The categories below are exhaustive for the + released feature set. +

    +

    + 2.1 Account and authentication +

    +
      +
    • Email address and chosen username.
      • +
    • + Password hash (Argon2id; the plain-text password is + never stored or logged). +
      • +
    • + Optional WebAuthn / passkey credentials (public key, + credential ID, sign counter). +
      • +
    • + Session identifiers (HTTP-only cookie on the web; + opaque API tokens on iOS, stored in the device + Keychain). +
      • +
    • + Profile metadata: locale, timezone, date of birth + (optional), biological sex (optional), height + (optional) — used to compute age-adjusted target + ranges and BMI. +
      • +
    +

    + 2.2 Manually entered health data +

    +

    + Any value entered through the in-app forms, including + timestamp, optional note, and metric type: body weight, + body-fat percentage, body temperature, BMI (derived), + blood pressure (systolic / diastolic) and pulse rate as + paired readings, blood glucose with context (fasting, + postprandial, random, bedtime) and configurable unit + (mg/dL or mmol/L), resting heart rate, heart-rate + variability (SDNN), VO₂ max, oxygen saturation, sleep + duration with per-stage breakdown (Awake / REM / Core / + Deep), step count, distance walked or run, active-energy + burned, flights climbed, environmental and headphone + audio-exposure levels, time in daylight, mood (1-5 + scale) with optional free-text note, and workout + sessions (activity type, duration, distance, and an + optional GPS route attached manually by the user). +

    +

    + 2.3 Apple Health (iOS application) — data flow +

    +

    + When the user grants the iOS application read access to + Apple HealthKit, HealthLog reads samples for the + identifiers listed below. HealthKit data remains on the + user's device and the user's iCloud-backed Health store; + the iOS application copies relevant samples to the + HealthLog server over HTTPS (TLS 1.3, certificate + pinning) via{" "} + + POST /api/measurements + {" "} + so the web surface can render the same trends as the + iPhone. No third-party transit; data lives on the + German-located infrastructure described in section 5. +

    +

    HKQuantityTypeIdentifier:

    +
      +
    • + bodyMass +
      • +
    • + bodyFatPercentage +
      • +
    • + bodyTemperature +
      • +
    • + bloodPressureSystolic +
      • +
    • + bloodPressureDiastolic +
      • +
    • + bloodGlucose +
      • +
    • + oxygenSaturation +
      • +
    • + heartRate +
      • +
    • + restingHeartRate +
      • +
    • + heartRateVariabilitySDNN +
      • +
    • + vo2Max +
      • +
    • + stepCount +
      • +
    • + activeEnergyBurned +
      • +
    • + flightsClimbed +
      • +
    • + distanceWalkingRunning +
      • +
    • + environmentalAudioExposure +
      • +
    • + headphoneAudioExposure +
      • +
    • + timeInDaylight (iOS 17+) +
      • +
    +

    HKCategoryTypeIdentifier:

    +
      +
    • + sleepAnalysis — + with full per-stage granularity (Awake, REM, Core, + Deep). Stages are stored server-side as separate rows + so the chart can stack them. +
      • +
    +

    + Write access is requested for a subset (body mass, blood- + pressure systolic / diastolic, blood glucose) so that + manual entries made inside the iOS app can flow back + into HealthKit. The user controls both directions in + the iOS Health app's permission surface and may revoke + at any time. +

    +

    + 2.4 Withings sync (optional) +

    +

    + When the user connects a Withings account, HealthLog + stores the OAuth refresh and access tokens (encrypted + at the column level) and the user's Withings + identifier. Subsequent webhook-driven syncs pull body + weight, fat ratio, fat-free mass, muscle mass, bone + mass, water mass, lean mass, hydration, blood pressure + (systolic / diastolic) and pulse, blood glucose + readings, body temperature (basal and skin), activity + totals (steps, distance, active calories), sleep + sessions with per-stage segments (Awake / Light / Deep / + REM), and SpO₂ + HRV where available. +

    +

    + 2.5 Medications +

    +
      +
    • + Active prescriptions: drug name, strength, route, + schedule, treatment-class flag (standard or GLP-1). +
      • +
    • + Intake events: scheduled time, actual time, status + (taken, skipped, missed). +
      • +
    • + For GLP-1 treatments: dose-change history, injection + events with optional injection site and pen + identifier, side-effect logs against a fixed taxonomy, + pen-and-vial inventory with a 30-day in-use clock. +
      • +
    +

    + 2.6 AI Coach and Insights — off-device transit +

    +

    + When the user enables the AI Coach surface and + configures a language-model provider, HealthLog sends a + snapshot bundle to that provider on demand. The bundle + contains health context derived from the data above + (aggregates, recent observations, target ranges, + optional medication context) and{" "} + + never includes raw HealthKit identifiers or raw sample + IDs + + ; the server normalises HK samples into the internal + metric taxonomy first. Transit is encrypted (TLS 1.3). + The AI Coach is off by default and is enabled per- + provider only after explicit user consent (see consent + receipt in section 2.7). HealthLog does not retain + long-term conversation state beyond the most recent + thread. Section 4 enumerates the eligible providers + (Anthropic, OpenAI). +

    +

    + 2.7 Consent receipt persistence +

    +

    + Every consent to AI transit — both per-provider + activation and changes to the data-depth toggle — is + persisted as a “consent receipt” with timestamp, + provider, consent-text version, and a hash of the + snapshot schema. The retrieval endpoint is{" "} + + GET /api/account/consents + + ; receipts are retained for five years and then deleted + automatically. A withdrawal is recorded as a separate + reverse-polarity receipt; from that moment the provider + receives no further snapshot bundles. +

    +

    + 2.8 Device and integration metadata, push +

    +
      +
    • + A device identifier (random UUID generated client- + side, stored in the iOS Keychain) sent as the{" "} + + X-Device-Id + {" "} + request header — used for multi-device sync and abuse + prevention. +
      • +
    • + Apple Push Notification service (APNs) device token + and environment flag (sandbox / production), recorded + only when the user enables push notifications. +
      • +
    • + Telegram chat identifier — only when the user has + explicitly connected the optional Telegram-bot + notifier. +
      • +
    +

    + 2.9 Security and audit +

    +
      +
    • + Authentication events (login success / failure, + passkey registration, password change, session + revocation) — retained for 90 days for security + forensics. +
      • +
    • + Server access logs (timestamp, request path, status + code, user-agent, IP address) — 14 days for abuse- + rate-limiting and debugging. +
      • +
    • + Failed APNs deliveries — 30 days to support push- + pipeline maintenance, then auto-deleted. +
      • +
    +

    + 2.10 Data we do not collect +

    +
      +
    • + No third-party advertising identifiers, fingerprints, + or cross-app tracking. +
      • +
    • + No payment information (the application has no paid + tier). +
      • +
    • + No precise background location (workouts only carry + GPS when the user attaches a route). +
      • +
    • + No social-network identifiers or contact-list scrapes. +
      • +
    • + No third-party product analytics. The instance does + not ship a client-side analytics SDK. +
      • +
    + + } + /> -

    - 2.1 Account and authentication -

    -
      -
    • Email address and chosen username.
      • -
    • - Password hash (Argon2id; the plain-text password is never stored - or logged). -
      • -
    • - Optional WebAuthn / passkey credentials (public key, credential - ID, sign counter). -
      • -
    • - Session identifiers (HTTP-only cookie on the web; opaque API - tokens on iOS, stored in the device Keychain). -
      • -
    • - Profile metadata: locale, timezone, date of birth (optional), - biological sex (optional), height (optional). Used to compute - age-adjusted target ranges and BMI. -
      • -
    +
    +
  • + + Authentifizierungsdaten + {" "} + — Identifikation des Nutzers und Sicherung der Sitzung. + Rechtsgrundlage: Art. 6 Abs. 1 lit. b DSGVO (Vertrags- + erfüllung). +
    • +
  • + + Gesundheitsdaten + {" "} + — Darstellung von Verläufen, Berechnung der Zielwerte- + Treue, Erzeugung des Coach-Snapshots auf Abruf. Rechts- + grundlage: Art. 9 Abs. 2 lit. a DSGVO (ausdrückliche + Einwilligung für Daten besonderer Kategorien). +
    • +
  • + + Coach-Snapshots + {" "} + — Erzeugung personalisierter schriftlicher Rückmeldungen. + Das Bündel wird nur für die Dauer der Anfrage an den + konfigurierten KI-Anbieter übertragen. +
    • +
  • + + Geräte-Daten + {" "} + — Push-Benachrichtigungen, Missbrauchsschutz, Mehrgeräte- + Sitzungshygiene. +
    • +
  • + + Audit-Logs + {" "} + — Sicherheits-Forensik und Rate-Limit. Rechtsgrundlage: + Art. 6 Abs. 1 lit. f DSGVO (berechtigtes Interesse am + sicheren Betrieb). +
    • +
  • + + Produkt-Analytics + {" "} + — werden nicht erhoben. +
    • + + } + bodyEn={ +
      +
    • + + Authentication data + {" "} + — identifying the user and securing the session. Legal + basis: GDPR Art. 6 (1) (b) performance of contract. +
      • +
    • + + Health data + {" "} + — displaying trends, computing target adherence, + generating the Coach context bundle when the user + invokes it. Legal basis: GDPR Art. 9 (2) (a) explicit + consent for special-category data. +
      • +
    • + + Coach context bundles + {" "} + — generating personalised written feedback. The bundle + is transmitted to the configured AI provider for the + duration of the request only. +
      • +
    • + + Device data + {" "} + — push notifications, abuse prevention, multi-device + session hygiene. +
      • +
    • + + Audit logs + {" "} + — security-event tracing and rate-limiting. Legal + basis: GDPR Art. 6 (1) (f) legitimate interest in + operating the service securely. +
      • +
    • + + Product analytics + {" "} + — none collected. +
      • +
    + } + /> -

    - 2.2 Manually entered health data -

    -

    - Any value entered through the in-app forms, including timestamp, - optional note, and the metric type. The full enumeration of - supported metrics is published in the OpenAPI schema; the - user-relevant subset includes: -

    -
      -
    • - Body weight, body-fat percentage, body temperature, BMI (derived). -
      • -
    • - Blood pressure (systolic, diastolic) and pulse rate, recorded as - paired readings. -
      • -
    • - Blood glucose with measurement context (fasting, postprandial, - random, bedtime) and a configurable unit (mg/dL or mmol/L). -
      • -
    • - Resting heart rate, heart-rate variability (SDNN), VO₂ max, - oxygen saturation. -
      • -
    • - Sleep duration including per-stage breakdown (Awake / REM / Core - / Deep). -
      • -
    • - Step count, distance walked or run, active-energy burned, flights - climbed. -
      • -
    • Environmental and headphone audio-exposure levels.
      • -
    • Time in daylight.
      • -
    • Mood (1-5 scale) with optional free-text note.
      • -
    • - Workout sessions: activity type, duration, distance, and an - optional GPS route (only uploaded when the user attaches a route - explicitly; HealthLog does not run continuous location services). -
      • -
    • - Personal records derived automatically from the data above - (metric type, value, achievement timestamp, optional workout - link). -
      • -
    +
    +

    + Folgende Anbieter können personenbezogene Daten im Auftrag + des Betreibers verarbeiten. Die Liste ist für den + veröffentlichten Funktionsumfang abschließend. Anbieter + werden nur für die Funktionen eingebunden, die der Nutzer + ausdrücklich aktiviert hat. Für jede Übertragung in + Drittländer (insbesondere USA) bestehen Standardvertrags- + klauseln nach Art. 46 Abs. 2 lit. c DSGVO mit dem + jeweiligen Anbieter. +

    +

    + Die englische Übersetzung enthält die detaillierte + Auflistung pro Anbieter mit Rolle, übermittelten Daten, + Speicherort und Link zur Datenschutzerklärung. +

    + + } + bodyEn={ + <> +

    + The following providers may process personal data on + behalf of the HealthLog operator. The list is exhaustive + for the released feature set; sub-processors are only + engaged for the features the user has explicitly enabled. + Each transfer to a third country (notably the United + States) is covered by Standard Contractual Clauses under + Art. 46 (2) (c) GDPR with the respective provider. +

    +
      + + + + + + + + +
    + + } + /> -

    - 2.3 Apple Health (iOS application) -

    -

    - When the user grants the iOS application read access to Apple - HealthKit, HealthLog reads samples for the identifiers listed - below. HealthKit data remains on the user's device and the - user's iCloud-backed Health store; the iOS application copies - relevant samples to the user's HealthLog account so that the - web surface can render the same trends as the iPhone. -

    -

    HKQuantityTypeIdentifier:

    -
      -
    • - bodyMass -
      • -
    • - bodyFatPercentage -
      • -
    • - bodyTemperature -
      • -
    • - bloodPressureSystolic -
      • -
    • - bloodPressureDiastolic -
      • -
    • - bloodGlucose -
      • -
    • - oxygenSaturation -
      • -
    • - heartRate -
      • -
    • - restingHeartRate -
      • -
    • - heartRateVariabilitySDNN -
      • -
    • - vo2Max -
      • -
    • - stepCount -
      • -
    • - activeEnergyBurned -
      • -
    • - flightsClimbed -
      • -
    • - distanceWalkingRunning -
      • -
    • - environmentalAudioExposure -
      • -
    • - headphoneAudioExposure -
      • -
    • - timeInDaylight (iOS 17 and later) -
      • -
    -

    HKCategoryTypeIdentifier:

    -
      -
    • - sleepAnalysis — read with full - per-stage granularity (Awake, REM, Core, Deep). Stages are stored - server-side as separate rows so the chart can stack them. -
      • -
    -

    - Write access is requested for a subset (body mass, blood-pressure - systolic / diastolic, blood glucose) so that manual entries made - inside the iOS app can flow back into HealthKit. The user controls - both directions in the iOS Health app's permission surface and - may revoke at any time. -

    +
    +
  • + + Serverstandort + {" "} + — primäre Datenhaltung in einer PostgreSQL-Datenbank auf + Hetzner-Infrastruktur in Deutschland; die Anwendung wird + vom Betreiber als Privatperson in Deutschland verant- + wortet. Außer den unter Abschnitt 4 genannten Anbietern + ist keine weitere Drittspeicherung beteiligt. +
    • +
  • + + Verschlüsselung im Transit + {" "} + — TLS 1.3 mit HSTS auf allen öffentlichen Endpunkten; die + iOS-Anwendung pinnt zusätzlich das TLS-Zertifikat. +
    • +
  • + + Verschlüsselung im Ruhezustand + {" "} + — verschlüsselte Festplatten; sensible Spalten (Auth- + Token, Integrations-Secrets) zusätzlich auf Spaltenebene + mit einem separaten Schlüssel verschlüsselt. +
    • +
  • + + Backups + {" "} + — täglich, verschlüsselt, 30 Tage Aufbewahrung auf einem + S3-kompatiblen Objektspeicher mit eigener + Verschlüsselungsschicht. +
    • +
  • + + Standard-Speicherdauern + {" "} + — Messungen: gleitendes 5-Jahres-Fenster (Roh-Stichproben + älter als 5 Jahre werden automatisch verdichtet bzw. + gelöscht; aggregierte Verläufe bleiben). Audit-Logs: + 90 Tage. Server-Zugriffsprotokolle: 14 Tage. Fehl- + geschlagene APNs-Zustellungen: 30 Tage. Einwilligungs- + belege: 5 Jahre. +
    • +
  • + + Löschung + {" "} + — der Endpunkt zur Konto-Löschung läuft kaskadiert durch + jede nutzer-skopierte Tabelle: Gesundheitsmessungen, + Sitzungen, Audit-Log, Integrations-Token, Push- + Abonnements, Erfolge, hochgeladene Dateien. Die Löschung + erfolgt sofort; Backups laufen innerhalb des 30-Tage- + Fensters aus. +
    • + + } + bodyEn={ +
      +
    • + + Server location + {" "} + — primary store is PostgreSQL on Hetzner-hosted + hardware in Germany; the application is operated by the + controller as an individual based in Germany. No third- + party hosting beyond the providers listed in section 4. +
      • +
    • + + Encryption in transit + {" "} + — TLS 1.3 with HSTS on every public endpoint; the iOS + application additionally pins the TLS certificate. +
      • +
    • + + Encryption at rest + {" "} + — disk-level encryption plus column-level encryption + with a separate key for sensitive columns (auth tokens, + integration secrets). +
      • +
    • + Backups{" "} + — daily, encrypted, retained for 30 days on an S3- + compatible object store with its own encryption-at- + rest layer. +
      • +
    • + + Default retention windows + {" "} + — measurements: rolling 5-year window (raw samples + older than 5 years are aggregated or removed; long-arc + aggregates persist). Audit logs: 90 days. Server + access logs: 14 days. Failed APNs deliveries: 30 days. + Consent receipts: 5 years. +
      • +
    • + + Deletion + {" "} + — the account-deletion endpoint cascades through every + user-scoped table: health observations, sessions, audit + log, integration tokens, push subscriptions, + achievements, uploaded files. Deletion is immediate; + backups age out under the 30-day window. +
      • +
    + } + /> -

    - 2.4 Withings sync (optional) -

    -

    - When the user connects a Withings account, HealthLog stores the - OAuth refresh and access tokens (encrypted at the column level) and - the user's Withings identifier. Subsequent webhook-driven - syncs pull the following measurement families: -

    -
      -
    • Body weight, fat ratio, fat-free mass, muscle mass.
      • -
    • Bone mass, water mass, lean mass, hydration.
      • -
    • Blood pressure (systolic, diastolic) and pulse.
      • -
    • Blood glucose readings.
      • -
    • Body temperature, basal temperature, skin temperature.
      • -
    • Activity totals: steps, distance, active calories.
      • -
    • - Sleep sessions with per-stage segments (Awake / Light / Deep / - REM). -
      • -
    • SpO₂ and heart-rate variability where available.
      • -
    - -

    - 2.5 Medications -

    -
      -
    • - Active prescriptions: drug name, strength, route, schedule, - treatment-class flag (standard or GLP-1). -
      • -
    • - Intake events: scheduled time, actual time, status (taken, - skipped, missed). -
      • -
    • - For GLP-1 treatments: dose-change history, injection events with - optional injection site and pen identifier, side-effect logs - against a fixed taxonomy, pen-and-vial inventory with a 30-day - in-use clock. -
      • -
    - -

    - 2.6 AI Coach and Insights -

    -

    - When the user enables the AI Coach surface and configures a - language-model provider, HealthLog sends a snapshot bundle to that - provider on demand. The bundle contains health context derived - from the data above (aggregates, recent observations, target - ranges, optional medication context). The bundle is generated per - request; HealthLog does not retain long-term conversation state - beyond the most recent thread. See section 4 for what each - provider does with the data. -

    - -

    - 2.7 Device and integration metadata -

    -
      -
    • - A device identifier (random UUID generated client-side, stored - in the iOS Keychain) sent as the{" "} - - X-Device-Id - {" "} - request header. Used for multi-device sync and abuse prevention. -
      • -
    • - Apple Push Notification service (APNs) device token and - environment flag (sandbox / production), recorded only when the - user enables push notifications. -
      • -
    • - Telegram chat identifier — only when the user has explicitly - connected the optional Telegram-bot notifier. -
      • -
    - -

    - 2.8 Security and audit -

    -
      -
    • - Authentication events: login success / failure, passkey - registration, password change, session revocation. Retained for - security forensics. -
      • -
    • - Server access logs: timestamp, request path, status code, user- - agent, IP address. Retained for 14 days for abuse-rate-limiting - and debugging. -
      • -
    - -

    - 2.9 Data we do not collect -

    -
      -
    • - No third-party advertising identifiers, fingerprints, or - cross-app tracking. -
      • -
    • - No payment information (the application has no paid tier). -
      • -
    • - No precise background location (workouts only carry GPS when the - user attaches a route). -
      • -
    • No social-network identifiers or contact-list scrapes.
      • -
    • - No third-party product analytics. The instance does not ship a - client-side analytics SDK. -
      • -
    -
    - -
    -
      -
    • - - Authentication data - {" "} - — identifying the user and securing the session. Legal basis: GDPR - Art. 6 (1) (b) performance of contract. -
      • -
    • - Health data{" "} - — displaying trends, computing target adherence, generating the - Coach context bundle when the user invokes it. Legal basis: GDPR - Art. 9 (2) (a) explicit consent for special-category data. -
      • -
    • - - Coach context bundles - {" "} - — generating personalised written feedback. The bundle is - transmitted to the configured AI provider for the duration of the - request only. -
      • -
    • - Device data{" "} - — push notifications, abuse prevention, and multi-device session - hygiene. -
      • -
    • - Audit logs{" "} - — security-event tracing and rate-limiting. Legal basis: GDPR - Art. 6 (1) (f) legitimate interest in operating the service - securely. -
      • -
    • - - Product analytics - {" "} - — none collected. -
      • -
    -
    - -
    -

    - The following providers may process personal data on behalf of the - HealthLog operator. The list is exhaustive for the released - feature set; sub-processors are only engaged for the features the - user has explicitly enabled. -

    -
      - - - - - - - - -
    -
    - -
    -
      -
    • - Primary data store: PostgreSQL on a Hetzner-hosted server in - Germany. Disk encrypted at rest. Sensitive columns - (authentication tokens, integration secrets) are individually - encrypted with a key separate from the database key. -
      • -
    • - Backups: daily, encrypted, retained for 30 days on an - S3-compatible object store with its own encryption-at-rest layer. -
      • -
    • - Retention: account data is retained until the user requests - erasure (see section 6) or the account is administratively - closed. Audit logs are retained for 90 days; server access logs - for 14 days. -
      • -
    • - Deletion: the account-deletion endpoint cascades through every - user-scoped table — health observations, sessions, audit log, - integration tokens, notification subscriptions, achievements, - uploaded files. The deletion is immediate; backups age out under - the 30-day window above. -
      • -
    -
    - -
    -
      -
    • - - Right of access (Art. 15) - {" "} - — every value the application has stored is reachable through the - in-app history surfaces. A consolidated JSON export is offered - under Settings → Data & export. -
      • -
    • - - Right to rectification (Art. 16) - {" "} - — every record carries an in-app edit and delete action. -
      • -
    • - - Right to erasure (Art. 17) - {" "} - — Settings → Account → Delete account. The action - cascades immediately through user-scoped tables; backups age out - within the 30-day window described in section 5. -
      • -
    • - - Right to restriction of processing (Art. 18) - {" "} - — request an administrative suspension by opening a GDPR issue - (see section 9). -
      • -
    • - - Right to data portability (Art. 20) - {" "} - — the JSON export under Settings → Data & export{" "} - returns the full record set in a structured, machine-readable - format. -
      • -
    • - - Right to object to automated decision-making (Art. 22) - {" "} - — the AI Coach does not make automated decisions in the Art. 22 - sense. It generates written suggestions for the user to read; no - action is taken on the user's behalf without explicit - confirmation. See section 7 for the medical-device boundary. -
      • -
    • - - Right to lodge a complaint - {" "} - — with the Federal Commissioner for Data Protection and Freedom - of Information (BfDI) for the German federal level, or with the - data-protection authority of the user's habitual residence. -
      • -
    -
    +
    +
  • + + Auskunftsrecht (Art. 15) + {" "} + — jeder gespeicherte Wert ist über die Historie in der + App erreichbar. Ein konsolidierter JSON-Export liegt + unter Einstellungen → Daten & Export. +
    • +
  • + + Recht auf Berichtigung (Art. 16) + {" "} + — jeder Eintrag bietet eine Bearbeiten- und Löschen- + Aktion in der App. +
    • +
  • + + Recht auf Löschung (Art. 17) + {" "} + — Einstellungen → Daten → Konto löschen. Die + Aktion kaskadiert sofort über alle nutzer-skopierten + Tabellen via{" "} + + User.delete + {" "} + +{" "} + + onDelete: Cascade + + ; Backups laufen innerhalb des 30-Tage-Fensters aus. +
    • +
  • + + Recht auf Einschränkung (Art. 18) + {" "} + — administrative Sperre per Datenschutz-Anfrage (siehe + Abschnitt 11). +
    • +
  • + + Recht auf Datenübertragbarkeit (Art. 20) + {" "} + — der JSON-Export unter{" "} + Einstellungen → Daten & Export liefert den + vollständigen Datensatz in maschinenlesbarem Format. +
    • +
  • + + Widerspruch und automatisierte Entscheidungen + (Art. 21–22) + {" "} + — der KI-Coach trifft keine automatisierten Entscheid- + ungen im Sinne von Art. 22 DSGVO. Er erzeugt Texte zum + Nachlesen; ohne ausdrückliche Bestätigung wird keine + Aktion ausgeführt. Siehe Abschnitt 7 zur Medizinpro- + dukte-Grenze. +
    • +
  • + + Beschwerderecht + {" "} + — beim Bundesbeauftragten für den Datenschutz und die + Informationsfreiheit (BfDI) oder bei der für den + gewöhnlichen Aufenthaltsort der betroffenen Person + zuständigen Aufsichtsbehörde. +
    • + + } + bodyEn={ +
      +
    • + + Right of access (Art. 15) + {" "} + — every stored value is reachable through the in-app + history surfaces. A consolidated JSON export is offered + under Settings → Data & export. +
      • +
    • + + Right to rectification (Art. 16) + {" "} + — every record carries an in-app edit and delete + action. +
      • +
    • + + Right to erasure (Art. 17) + {" "} + — Settings → Data → Delete account. The action + cascades immediately through every user-scoped table + via{" "} + + User.delete + {" "} + +{" "} + + onDelete: Cascade + + ; backups age out within the 30-day window. +
      • +
    • + + Right to restriction of processing (Art. 18) + {" "} + — request an administrative suspension via the contact + channel in section 11. +
      • +
    • + + Right to data portability (Art. 20) + {" "} + — the JSON export under{" "} + Settings → Data & export returns the full + record set in a structured, machine-readable format. +
      • +
    • + + Right to object / automated decision-making (Art. 21- + 22) + {" "} + — the AI Coach does not make automated decisions in the + Art. 22 sense. It generates written suggestions for the + user to read; no action is taken without explicit + confirmation. See section 7 for the medical-device + boundary. +
      • +
    • + + Right to lodge a complaint + {" "} + — with the Federal Commissioner for Data Protection and + Freedom of Information (BfDI) for the German federal + level, or with the data-protection authority of the + user's habitual residence. +
      • +
    + } + />
    -

    - HealthLog is not a medical device within the - meaning of EU Regulation 2017/745 (MDR). The application records - and displays observations the user has entered; it does not - diagnose, treat, prescribe, or monitor a specific medical - condition. -

    -

    - The AI Coach surface is constrained by two explicit ground rules - in its system prompt: it does not recommend GLP-1 doses (GROUND - RULE 9), and it does not produce drug-level estimates (GROUND - RULE 15). The GLP-1 Research Mode chart is a display-only - visualisation gated behind a versioned acknowledgment that cites - the MDR boundary to the user before unlocking. None of these - surfaces issue clinical recommendations. -

    -

    - For medical advice the user must consult a licensed clinician. - HealthLog is intended to support that conversation by surfacing - self-tracked data — not to replace it. -

    -
    + numberLabel="7" + titleDe="Medizinprodukte-Grenze (EU-MDR 2017/745, MDCG 2021-24)" + titleEn="Medical-device boundary (EU MDR 2017/745, MDCG 2021-24)" + bodyDe={ + <> +

    + HealthLog ist kein Medizinprodukt im + Sinne der EU-Verordnung 2017/745 (MDR). Die Anwendung + erfasst und visualisiert Beobachtungen, die der Nutzer + selbst eingegeben hat; sie diagnostiziert, behandelt, + verordnet oder überwacht keine spezifische medizinische + Erkrankung. +

    +

    + Die KI-Coach-Oberfläche ist durch zwei ausdrückliche + Grundregeln im System-Prompt eingegrenzt: sie empfiehlt + keine GLP-1-Dosen (GROUND RULE 9) und erzeugt keine + wirkstoff-bezogenen Schätzungen (GROUND RULE 15). Der + GLP-1-Research-Mode ist eine reine Visualisierung, die + erst nach einer versionierten Bestätigung freigeschaltet + wird, die dem Nutzer die MDR-Grenze ausdrücklich nennt. + Keine dieser Oberflächen gibt klinische Empfehlungen aus. +

    +

    + Für medizinische Beratung muss eine approbierte ärztliche + Fachkraft konsultiert werden. HealthLog soll diese + Beratung unterstützen, indem es selbst erfasste Daten + aufbereitet — nicht ersetzen. +

    + + } + bodyEn={ + <> +

    + HealthLog is not a medical device{" "} + within the meaning of EU Regulation 2017/745 (MDR). The + application records and displays observations the user + has entered; it does not diagnose, treat, prescribe, or + monitor a specific medical condition. +

    +

    + The AI Coach surface is constrained by two explicit + ground rules in its system prompt: it does not + recommend GLP-1 doses (GROUND RULE 9), and it does not + produce drug-level estimates (GROUND RULE 15). The GLP-1 + Research Mode chart is a display-only visualisation + gated behind a versioned acknowledgment that cites the + MDR boundary to the user before unlocking. None of + these surfaces issue clinical recommendations. +

    +

    + For medical advice the user must consult a licensed + clinician. HealthLog is intended to support that + conversation by surfacing self-tracked data — not to + replace it. +

    + + } + />
    -

    - The iOS application's Privacy Nutrition Labels in App Store - Connect map to the following categories: -

    -
      -
    • - - Health & Fitness - {" "} - — linked to the user; used for app functionality. -
      • -
    • - - Sensitive Info - {" "} - (blood pressure, glucose, medications) — linked to the user; used - for app functionality. -
      • -
    • - Contact Info{" "} - (email address) — linked to the user; used for app functionality - and account management. -
      • -
    • - User Content{" "} - (notes attached to measurements, mood notes, bug-report text) — - linked to the user; used for app functionality. -
      • -
    • - Identifiers{" "} - (device identifier, user identifier) — linked to the user; used - for app functionality. -
      • -
    • - Diagnostics{" "} - — not collected. -
      • -
    • - Usage Data{" "} - — not collected. -
      • -
    • - Location{" "} - — not collected, except for an optional GPS route the user - attaches manually to a workout. -
      • -
    • - - Browsing History - {" "} - — not collected. -
      • -
    • - - Search History - {" "} - — not collected. -
      • -
    • - Other Data{" "} - — not collected. -
      • -
    -
    + numberLabel="8" + titleDe="Apple-App-Store-Datenschutzkategorien" + titleEn="Apple App Store privacy categories" + bodyDe={ + <> +

    + Die Privacy-Nutrition-Labels der iOS-Anwendung in App + Store Connect ordnen sich folgenden Kategorien zu (jeweils{" "} + linked to the user, ausschließlich zur App- + Funktion verwendet): +

    +
      +
    • + + Gesundheit & Fitness + + . +
      • +
    • + + Sensible Informationen + {" "} + (Blutdruck, Blutzucker, Medikamente). +
      • +
    • + + Kontakt-Informationen + {" "} + (E-Mail-Adresse) — Konto-Verwaltung. +
      • +
    • + + Nutzer-Inhalte + {" "} + (Notizen zu Messungen, Stimmungsnotizen, Bug-Reports). +
      • +
    • + + Kennungen + {" "} + (Geräte- und Nutzer-Kennung). +
      • +
    • + + Diagnose, Nutzung, Browsing, Suche, Andere + {" "} + — nicht erhoben. +
      • +
    • + + Standort + {" "} + — nicht erhoben, außer bei einer optional vom Nutzer + angehängten GPS-Workout-Route. +
      • +
    + + } + bodyEn={ + <> +

    + The iOS application's Privacy Nutrition Labels in App + Store Connect map to the following categories (each + linked to the user, used only for app + functionality): +

    +
      +
    • + + Health & Fitness + + . +
      • +
    • + + Sensitive Info + {" "} + (blood pressure, glucose, medications). +
      • +
    • + + Contact Info + {" "} + (email address) — account management. +
      • +
    • + + User Content + {" "} + (notes attached to measurements, mood notes, bug- + report text). +
      • +
    • + + Identifiers + {" "} + (device identifier, user identifier). +
      • +
    • + + Diagnostics, Usage Data, Browsing History, Search + History, Other Data + {" "} + — not collected. +
      • +
    • + + Location + {" "} + — not collected, except for an optional GPS route the + user attaches manually to a workout. +
      • +
    + + } + /> -
    -

    - HealthLog is not directed at children under the age of 16. The - application should not be used by anyone under 16 without - verifiable parental supervision. The operator does not knowingly - collect personal data from children under 16; if such data is - discovered, it will be deleted on detection. -

    -
    +
    + HealthLog richtet sich nicht an Kinder unter 16 Jahren. Die + Anwendung sollte nicht ohne nachweisbare elterliche Aufsicht + von Personen unter 16 Jahren verwendet werden. Der Betreiber + erhebt wissentlich keine personenbezogenen Daten von Kindern + unter 16 Jahren; sollte dies auffallen, werden die Daten + umgehend gelöscht. +

    + } + bodyEn={ +

    + HealthLog is not directed at children under the age of 16. + The application should not be used by anyone under 16 + without verifiable parental supervision. The operator + does not knowingly collect personal data from children + under 16; if such data is discovered, it will be deleted + on detection. +

    + } + /> -
    -

    - This document is version-stamped at the top. Material changes will - be summarised in the in-app release notes and on the open-source - changelog. The published policy version is bound to the - application release version that introduced it. -

    -
    +
    + Diese Erklärung trägt oben einen Versionsstempel. Materielle + Änderungen werden in den In-App-Versionshinweisen und im + Open-Source-Changelog zusammengefasst. Die veröffentlichte + Policy-Version ist an die Anwendungsversion gebunden, mit + der sie eingeführt wurde. +

    + } + bodyEn={ +

    + This document is version-stamped at the top. Material + changes will be summarised in the in-app release notes + and on the open-source changelog. The published policy + version is bound to the application release version that + introduced it. +

    + } + /> -
    -

    - For privacy questions and data-subject requests, open a public - issue at{" "} - - github.com/MBombeck/HealthLog/issues - {" "} - titled GDPR — <Access | Erasure | Portability> request - . Do not include personal data in the public issue. A private - channel for the actual exchange will be provided in the first - response. -

    -
    +
    +

    + Verantwortlicher und Ansprechpartner für DSGVO-Anfragen + ist der Betreiber dieser Instanz, eine Privatperson mit + Sitz in Deutschland (vollständige Postanschrift wird + Antragstellern auf Anfrage über den unten genannten Kanal + mitgeteilt; sie ist nicht öffentlich aufgeführt, um + gezielte Belästigung zu verhindern — eine Klarstellung, + die die deutschen DPAs in ihren Hinweisen zu Impressums- + Pflichten ausdrücklich zulassen, sofern eine elektronische + Erreichbarkeit besteht). +

    +

    + + E-Mail (Betreiber): + {" "} + + mbombeck@gmail.com + + . Bitte das E-Mail-Betreff mit{" "} + + "HealthLog DSGVO — <Auskunft | Löschung | + Übertragbarkeit>" + {" "} + kennzeichnen. Erste Antwort innerhalb von 30 Tagen gemäß + Art. 12 Abs. 3 DSGVO. +

    +

    + + Alternativ via GitHub: + {" "} + öffentliches Issue unter{" "} + + github.com/MBombeck/HealthLog/issues + {" "} + mit Titel{" "} + + GDPR — <Access | Erasure | Portability> request + {" "} + — bitte keine personenbezogenen Daten im öffentlichen + Issue posten; ein privater Kanal wird in der ersten + Antwort angeboten. +

    + + } + bodyEn={ + <> +

    + The controller and point of contact for GDPR enquiries + is the operator of this instance, an individual based + in Germany (the full postal address is disclosed to + requesters via the channel below upon request; it is + not publicly listed to prevent targeted harassment — a + practice explicitly tolerated by German data-protection + authorities provided an electronic contact route is + available). +

    +

    + + Email (operator): + {" "} + + mbombeck@gmail.com + + . Subject line:{" "} + + "HealthLog GDPR — <Access | Erasure | + Portability>" + + . First reply within 30 days per Art. 12 (3) GDPR. +

    +

    + + Alternative via GitHub: + {" "} + public issue at{" "} + + github.com/MBombeck/HealthLog/issues + {" "} + titled{" "} + + GDPR — <Access | Erasure | Portability> request + {" "} + — please do not include personal data in the public + issue; a private channel will be offered in the first + response. +

    + + } + />