2.1 Account data
When you create an account we collect:
• Email address
• Name
• Time zone and location (country/city level for nutrition localisation)
• Dietary preferences and food exclusions
• Health goals
2.2 Wearable data (Garmin, Whoop)
Via OAuth 2.0, with your explicit authorisation, we fetch:
• Heart rate variability (HRV)
• Resting heart rate
• Sleep stages and duration
• Training load and Body Battery / Strain score
• VO2max estimates
• Daily step count
Data is fetched daily at 5:30am. We store this data in your personal health log. You can revoke access at any time in your account settings or directly in the Garmin / Whoop app.
2.3 Nutrition data (Cronometer)
Via OAuth 2.0, with your explicit authorisation, we fetch:
• Daily calorie totals
• Macronutrient breakdown (protein, carbohydrate, fat, fibre)
• Full micronutrient breakdown
We do not store the underlying food diary entries — only the aggregated daily summary needed for agent recommendations.
2.4 Blood test data
You may upload blood test reports as PDF files. We process these as follows:
• The PDF is uploaded to temporary storage (AWS S3)
• Claude AI (Anthropic) extracts biomarker values using vision processing
• You review and confirm or correct the extracted values
• The original PDF is deleted from S3 immediately after you confirm extraction
• Extracted biomarker values and calculated indices are stored in your health record
We never permanently store your blood test PDFs.
2.5 Menstrual cycle and BBT data
You provide:
• Period start dates and cycle length
• Daily basal body temperature (BBT) — entered via Telegram prompt each morning
This data is stored in your health record and used by the Cycle + BBT agent to personalise your daily plan.
2.6 Gmail data
If you connect Gmail, we request read-only, restricted access to detect travel plans. Specifically:
• Scope: read-only access to email headers and body for flight and hotel confirmation detection
• Purpose: to auto-detect upcoming travel for timezone and nutrition localisation
• What we store: detected trip details (destination, dates, timezone) after your confirmation
• What we do NOT store: full email content, email body text, sender data, or any non-travel emails
Gmail access is scanned daily. You can disconnect Gmail at any time in settings. We will immediately delete all derived travel data on request.
2.7 Location data
We request GPS location from your device at specific moments only (e.g. when you open the app to update nutrition localisation). We do NOT continuously track your location, store precise GPS coordinates, or share location data with third parties. We store only a city or region-level label derived from your location.
2.8 Voice messages
You may send voice messages to the Telegram bot at any time. These are processed as follows:
• Audio is sent to OpenAI's Whisper API for transcription
• The transcript is stored and analysed by the mental health agent
• The original audio file is deleted within 24 hours of receipt
We never store your voice audio permanently.
2.9 Telegram interaction data
When you interact with the Health OS Telegram bot, we store:
• Messages you send (text and transcribed voice)
• Responses and briefings delivered to you
• Interactive responses (check-ins, slider values, RPE ratings)
This data forms your daily log and is used to personalise future recommendations.
2.10 Mood and subjective data
Via the evening sync, you provide:
• Mood, energy, and stress ratings (1–10 sliders)
• Training completion and RPE (rate of perceived exertion)
• Supplement adherence
• Optional free-text or voice notes
This data is stored and used to build your longitudinal health model.