Privacy Policy

Last updated October 1, 2026 · Just Hale LLC

Hale is operated by Just Hale LLC ("Hale," "we," "us") and is built privacy-first. Here's what's collected and how it's handled.

Who can use Hale. Hale is for adults 18 and older; we don't knowingly collect data from anyone under 18. If we learn an account belongs to someone under 18, we block it at once and end every sign-in on it, including on an Apple Watch. A blocked account cannot be used. What was already on it stays stored until it is deleted, and we delete the account and everything in it when asked at hello@allhale.app.

What's stored: your account (your name, your email, a hashed password and, if you sign in with Apple or Google, that provider's identifier for you); your date of birth (used to confirm you're 18+, and, as your age, to tailor your Digital Twin, Protocols and weekly digest — see AI processing); your plan and its billing status; which version of these terms you accepted and when, and whether you have opted out of announcement emails; the health markers you add and their history; the facts Hale's AI picks out of your chats to remember, each of which you can see and delete in Privacy & Data; what you write under Personalization in Settings; your protocols, including the About-you answers a plan was built with; your chat history; and any message you send us through Support. Markers, memory, Personalization, protocols, and chats are all encrypted at rest on our servers — chats are stored on your account so your conversations follow you between devices, and a copy is kept in your browser so the app works offline. Health information is sensitive data and is treated accordingly.

Signing in with Apple or Google. If you sign in with Apple or Google we receive your email address and name from them to create your account. We don't post anything to those accounts or read anything else from them. We keep the provider's identifier for your account so we recognise you the next time you sign in and, for Apple, an encrypted token that is used only to withdraw Hale's access to your Apple ID when you delete your account.

Apple Health and Apple Watch. In the Hale iPhone app you can connect your Apple Watch. Hale reads its readings from Apple Health on your iPhone, and only after you tap Connect Apple Watch and give permission on the iOS permission screen, where you choose each category. Hale then reads only the categories you allow: resting heart rate, walking heart rate, heart rate variability, VO₂ max, steps, active energy, exercise minutes, respiratory rate, blood oxygen, breathing disturbances during sleep, wrist temperature, sleep (total, deep and REM), body weight, blood pressure, blood glucose and water intake. Apple Health keeps these categories for your iPhone and for other apps as well as for your Watch, so a reading Hale receives may have been recorded by one of them — your iPhone's step count, say, a weight you entered by hand, or a reading from a blood pressure cuff, glucose meter or water-tracking app that writes to Health. When a new version of Hale reads a category you were not asked about before, iOS asks you first, and declining it changes nothing for the categories you already allow. Hale never writes anything to Health, and never adds, changes or deletes anything there.

Once you connect, Hale syncs automatically. When Apple Health receives new readings (for example, when your Watch syncs to your iPhone), iOS can wake Hale in the background, even if the app is closed, and Hale sends a summary of each category to your Hale account: one value per day, with older history as weekly or monthly averages. When you first connect, and from time to time after that, Hale reads back up to two years so your history is complete. Hale also syncs when you open the app and when you tap Sync now. Apple Health can't be read while your iPhone is locked, so a sync that finds it locked waits for the next one. So that it can sync in the background, the app keeps a copy of your Hale sign-in session in your iPhone's Keychain. That copy stays on that iPhone only: it is never synced to iCloud Keychain and does not move to another device, even one restored from a backup. It is removed when you sign out or delete your account in the app, and otherwise the next time the app finds that our server no longer accepts it.

Hale on Apple Watch. If you install Hale on your Apple Watch, it reads Health on the Watch itself, only after you give permission on the Watch, and only these categories: heart rate, resting and walking heart rate, heart rate variability, VO₂ max, steps, active energy, exercise minutes, sleep, blood oxygen, respiratory rate, wrist temperature and water intake. Like the iPhone app, it reads only and never writes anything to Health. The Watch sends its live readings — the latest reading of each, and today's running totals so far — straight to your Hale account over its own connection (through your iPhone, Wi-Fi or cellular); you can turn this off with Upload live Watch data in Hale's Settings on the Watch. It does this while Hale is open on the Watch and also in the background — about once an hour, or as often as the review schedule you choose, whenever watchOS allows it — and a new review may be written then. If you turn on the daily review notification, the Watch shows the first lines of your latest review in a notification at the time you pick; that notification is created on the Watch itself and is not sent through any notification service. It does not send your history; that still comes from your iPhone. Hale keeps the Watch's latest live readings on your account, encrypted at rest, with the time they arrived, and today's running totals also update today's figure on the matching markers. They are used, with the rest of your data, to show your numbers and to write the short health review on your Watch; that review is kept only in our server's memory, for up to a day, and is never saved as a chat. For Hale's watch face complications, the Watch keeps a small copy of what they show — the first sentence of your latest review, your plan progress, your resting heart rate and the first stat on your Hale home screen — in storage shared only between Hale and its complications on that Watch; Hale never sends it anywhere, and it is erased when the Watch signs out. The Watch app also keeps the last summary, review and readings it showed you, on that Watch only, so it can still show them when it is offline, and erases them when it signs out. The Watch has its own sign-in to Hale, separate from your iPhone's. When Hale on your signed-in iPhone sets up the Watch, our server issues a sign-in just for that Watch; your iPhone passes it to the Watch over Apple's encrypted connection between the two and keeps no copy of it once the Watch has it, and the Watch keeps it in the Watch's Keychain, on that Watch only. Your iPhone's own sign-in is never sent to the Watch. The Watch's sign-in can reach only what the Watch app needs — your name, email and plan, your summary and health review, Ask Hale, ticking off your plan, its settings and uploading its readings — and cannot change your account, export your data or delete anything. We store only a scrambled (hashed) form of it, with the Watch's name, an identifier for that installation of Hale, when it was set up and last used, and the settings you choose on the Watch. When you sign a Watch out yourself, we also remember that installation's identifier, so your iPhone does not sign it back in by itself; setting it up again (Pair again on the Watch) clears it, and deleting your account erases it. It ends after 90 days without use, and you can end it any time: Sign out of this Watch on the Watch, Sign out this Watch in Settings › Account › Hale on Apple Watch, or signing out of Hale on the iPhone that set it up. It also ends when you change or reset your password or change your email, and deleting your account erases all of it. Your data export includes the Watches signed in to your account (never their sign-ins) and their latest live readings.

Those readings are stored on your Hale account under the matching markers, encrypted at rest, exactly like a value you type in yourself. Hale also records when your last sync happened and, if an Apple Watch was among the sources, the words "Apple Watch" (never its model), so My Data can show you what is connected. Health data obtained through Apple Health is never used for advertising or marketing, never sold or shared with data brokers, and never written to iCloud. It is used only to provide Hale's features to you, and it is not disclosed to any third party except our AI provider, which processes it on our behalf to generate your responses (see AI processing below).

You can stop automatic sync at any time with Stop automatic sync on the Apple Watch card in My Data, and you can withdraw Hale's permission itself in iOS Settings › Health › Data Access & Devices › Hale. Readings that have already synced stay on your account until you delete them in My Data or delete your account, and deleting your Hale account erases everything Hale stored from Apple Health (see Backups for the copies kept for recovery). Deleting a marker also deletes the Watch's live reading of it, and Hale stops filing that category from Apple Health and your Watch until you add a value for it yourself.

AI processing: to answer you, and to generate your insights, Digital Twin forecasts, protocols, weekly digest and the health review on your Apple Watch, your messages and the relevant parts of your health data — markers, memory facts, protocols, what you tell Hale about yourself in About you, and your age (worked out from your date of birth, never the date itself) — are sent to our AI provider (Anthropic) solely to generate that response. This includes readings synced from Apple Health and your Apple Watch, where they are relevant. Anthropic processes them on our behalf and does not use them to train shared models. Your data is never sold.

Email: we send account email (email verification, password resets and notices about changes to your account) and, if you don't opt out, occasional product announcements. Every announcement has a one-click unsubscribe. Email is delivered by our email provider (Postmark), which receives your address and the message to deliver it. Messages you send us through Support, with the address you give, are also delivered to our support inbox, which is hosted by Google Workspace.

Payments. Subscriptions are handled by Stripe. When you start checkout we give Stripe your email address, your name and your Hale account id so it can create your billing record. Your card details go directly to Stripe and Hale never sees or stores them. We keep Stripe's references for your customer record and your subscription, and your plan, its status and its renewal or end date. Deleting your account cancels the subscription; Stripe keeps the billing records it is required to keep by law.

Analytics. Hale counts a small set of product events — things like a sign-up, a chat sent, or a lab uploaded. These are stored as daily totals only: a name, a date and a number. They carry no account id, no IP address and nothing about you, so they cannot be tied back to any person. There are no third-party analytics or advertising trackers in Hale.

Cookies and browser storage. Hale uses cookies only to sign you in: a session cookie that lasts up to 90 days after your last visit and keeps you signed in, and, while you sign in with Apple or Google, a short-lived security cookie that is removed when sign-in finishes. There are no advertising or analytics cookies. Hale also keeps some of your data in your browser's own storage on that device — a copy of your chats, your About-you answers, the targets you set for markers, the last Digital Twin result, cached insights and your display settings — so the app is fast and works offline. Deleting your account from a browser removes them from that browser, and Clear cached data in Settings › General removes the cached copies and keeps your chats, About-you answers and settings.

Logs. Our servers keep operational logs: the requests they receive, errors your browser reports to us, and a record of sensitive actions such as an export or a deletion. These can include your account id, your email address and the subject line of a message you send to Support. They are held by our hosting provider (Render) for a limited time under its own retention schedule, and are used only to run and secure Hale.

Voice input. If you use the microphone button, your browser or device turns your speech into text with its own speech-recognition service (for example Apple's in Safari and on iPhone, or Google's in Chrome), under that company's terms. Hale receives only the text, and never receives or stores the audio.

Links and images. The Shop and the product cards in chat show images from, and link to, third-party retailers and brand sites. Those sites receive your IP address when an image loads or you follow a link, and are governed by their own privacy policies.

Notifications. If you turn on browser notifications, we store that browser's push address and keys so we can send you re-test reminders and your weekly digest. They are delivered through your browser's own push service. Turning notifications off, signing out in that browser or deleting your account removes them.

Your rights & control: view, export, and delete your markers, memory, and chats, and permanently delete your account anytime from Privacy & Data, which erases your data from our live database immediately (see Backups for the copies kept for recovery). Depending on where you live, you may have additional rights (access, correction, deletion, portability) under laws such as GDPR and CCPA/CPRA.

Uploads: lab panels you upload are sent for one-time extraction and not retained as files — only the values you choose to save are kept.

Backups. So that Hale can recover from a failure, copies of its database are kept for a limited time. Our hosting provider takes a daily snapshot of the server's disk and keeps each one for at least seven days under its own retention schedule. Hale also makes its own nightly backup, stored on a separate computer that Hale controls, with full-disk encryption, and deletes each copy when it is 30 days old. Your markers, memory, protocols and chats stay encrypted inside those copies, exactly as in the live database. When you delete your account it is removed from the live database immediately; it is gone from Hale's own backups within 30 days, and from the hosting provider's snapshots when those expire. Backups are used only to restore Hale after a failure.

Security: we use reasonable safeguards (encryption, hashed passwords). No system is perfectly secure; if a breach affecting your data occurs, we will notify you as required by law.

Contact. For privacy requests — access, correction, deletion, or any question about this policy — email hello@allhale.app and we'll respond within 30 days.