Birll Health / Consumer Health Data Privacy Policy

Birll Health — Consumer Health Data Privacy Policy

Effective: 26 October 2026

This policy is for consumers in Washington (My Health My Data Act, RCW 19.373) and Nevada (NRS 603A.400–603A.550). This separate document describes the consumer health data Birll Health collects, where it comes from, how it is used and shared, and how you exercise your rights. Our general Privacy Policy is a separate document.

1. Categories of consumer health data we collect, and the purpose and use of each

Your email address is collected to run your account. The data above is stored against your account and is therefore linked to you.

Core consent. Birll asks for one explicit required consent to collect and process the health data you provide or permit for core tracking and AI-powered wellness insights. This is separate from Apple Health permission, optional account backup and the default-off permission to share Claude chat content. Withdrawing core AI-processing consent pauses access and returns to privacy review; it does not erase existing records. Rights requests remain available at info@birll.com even when signed out.

How the data is processed. Reports, food features, plans and lab processing retain Apple Intelligence on your iPhone. Private Cloud Compute is unavailable in this build because its entitlement is not enabled; no requests are sent to it. Account data is held in Supabase for the service's sign-in, storage and sync paths.

Where Claude chat is available in your build and you enable it, Birll AI chat uses Claude from Anthropic. Model availability and higher-tier access depend on the service configuration. Your messages, permitted earlier turns and eligible attachments pass through an authenticated Supabase chat proxy to Anthropic only after a separate, versioned, default-off permission for your signed-in account. AI Processing Consent and AI Data Access category switches separately control stored wellness context. Access to the app requires recorded core AI-processing consent; category switches still limit the stored context. Stored clinical categories, clinical write tools, cycle and stress readings are excluded from Claude. User-authored messages can still contain health details; these exclusions do not guarantee removal of sensitive text.

Chat photos also require AI-processing consent. The app checks them on your phone and blocks photos identified as clinical, unknown or unreadable. Passing photos are sent as resized, metadata-stripped JPEGs, not just extracted text. The check cannot guarantee detection of every sensitive detail. The proxy does not log or persist message/reply content; saved conversations and permitted chat attachments have separate account storage. The Anthropic API secret stays on the server. We do not sell consumer health data or use it for advertising.

2. Categories of sources

• You — what you enter, record, photograph, or ask.
• Apple HealthKit, with your permission granted in iOS.
• Bluetooth sensors you pair during a live workout (heart rate, cycling power, cadence).
• Your iPhone's GPS, while you record an outdoor workout.
• Optional connected services you authorize, where offered in your build: Oura, WHOOP, Strava, Polar or Withings. Available data and requested permissions are shown during authorization; a listed connection is not a claim of public availability or provider approval.
• Derived from the above by the app — recovery, sleep, and effort scores, and trends.

Open Food Facts and the USDA FoodData Central database return facts about foods, not about you; they are not sources of consumer health data.

3. Categories of consumer health data that is shared

We do not sell consumer health data. The recipients below receive data only for the features and permissions described here. A feature being described does not mean every optional service is available or activated in your build.

• Supabase — sign-in, database, private attachment storage and the authenticated chat proxy. Structured reproductive health and lab results are not backed up to the account. User-authored messages or attachments can contain those details.
• Apple — route map tiles and route-import geocoding receive coordinates as described by the general Privacy Policy. These requests carry no account name or identifier. HealthKit reads and Apple Intelligence processing run on your phone; Private Cloud Compute is unavailable in this build.
• Anthropic, for Claude chat only — messages, permitted Claude conversation turns, eligible photos and consented, switched-on stored wellness context. Stored lab results, medications, conditions, allergies, clinical records and clinical memories, cycle tracking and stress readings are excluded from Claude's stored-data access. This exclusion does not promise to remove health details you type or attach. The separate sharing permission is required even for a general conversation with no stored wellness context.

Anthropic's commercial API handling is separate from Birll's proxy logging and account storage. Its policies describe provider retention and exceptions; Birll does not promise zero retention or unconditional exclusion from model training. Read Anthropic's official commercial privacy information about model training, retention and its Commercial Terms.

4. Third parties and affiliates with whom consumer health data is shared

• Affiliates: none. Birll Health has no affiliates.
• Service recipients: Supabase, Inc. for hosting/sign-in/storage and the chat proxy; Apple Inc. for the platform/map services above; Anthropic for separately permitted Claude chat only.
• Connected-service providers, where authorized and available: Oura, WHOOP, Strava, Polar and Withings separately process your provider account, authorization and the API requests needed for the connection. Review that provider’s permissions, terms and privacy policy before connecting.
• No advertising, analytics or tracking software collects consumer health data across other websites or online services through Birll Health.

5. How to exercise your rights

You have the right to confirm whether we collect, share, or sell consumer health data about you and to access it; to withdraw consent to its collection and sharing; and to have it deleted.

In the app, immediately, using your existing account:

• Access and confirm — Settings › Privacy & Data › Export Health Data produces a JSON file containing your cloud data and the records kept only on your device, lab results included. It is a text file: photographs and scanned lab documents are not in it, and the file states its own scope in its opening lines.
• Review and change — review records in the app and use the available edit or delete controls for entries you create. Records managed by Apple Health or another source may need to be changed there.
• Withdraw Claude chat permission — Settings › Birll AI › Where Birll AI runs › Allow Claude chat. Turning it off stops new Claude requests; it does not delete content already sent. The permission is versioned and belongs to your signed-in account; earlier AI-processing consent does not grant it.
• Withdraw core AI-processing consent — Settings › Birll AI › AI Data Access: turn off AI Processing Consent. App access pauses and returns to privacy review; consent must be given again to continue. Category switches can instead limit stored context while core consent remains on. The separate Claude sharing switch can be turned off without withdrawing core consent. Private Cloud Compute remains unavailable in this build.
• Withdraw consent to cloud storage — Settings › Privacy & Data › Cloud Sync. Turning it off stops the app uploading health data to your account, on every path: the periodic sync, the sync when you open or leave the app, the background refresh, and the catch-up after your phone reconnects. It does not remove what was uploaded before you turned it off — use Delete below for that — and it does not stop crash reports, which carry no health data.
• Withdraw HealthKit and location permission — in iOS: Health › Sharing › Apps › Birll Health, and Settings › Privacy & Security › Location Services › Birll Health.
• Delete — Settings › Account › Delete All Data erases your health data on this device and in your cloud account, including your saved workout routes and any crash report not yet sent; Settings › Account › Delete Account also removes your sign-in. Deletion in our database is immediate. What the app saved into Apple Health — weight, blood pressure, blood glucose, water, nutrition, mindful sessions and workouts — belongs to Apple's Health app and is deleted there; we cannot reach it. The app’s deletion confirmation describes active database and device records; it does not establish that separate service-provider backup copies have already been erased. When you ask us to delete, we notify affected recipients/processors as required by Washington (RCW 19.373.040(1)(c)(i)(B)) and Nevada (NRS 603A.515(1)(b)). Removing account data or disabling chat is not a guarantee of immediate erasure from Anthropic's systems; its commercial retention terms and legal/safety exceptions are separate.

By email, for anything the app's controls do not cover: write to info@birll.com from the email address on your account, which is how we authenticate the request. We may ask for further information if we cannot authenticate it. We respond without undue delay and within 45 days of receiving the request; if a request is complex we may extend once by a further 45 days and will tell you why within the first 45. Responses are free up to twice a year.

Appeal. If we refuse to act on a request, reply to our decision, or email info@birll.com with the subject "Appeal", within a reasonable time after receiving it. We answer appeals in writing within 45 days, with our reasons. If we deny an appeal, you may complain to the Washington State Attorney General (https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy) or the Nevada Attorney General.

Changes to this policy. We notify you of material changes through the app and by email to the address on your account before they take effect. We will not collect, use, or share additional categories of consumer health data, or use it for additional purposes, without first disclosing them and obtaining your affirmative consent.