HealthSync — Privacy Policy
Last updated: 20 September 2026
HealthSync has no server. Your health data goes from your iPhone to the destination you chose, and nowhere else.
The app reads your Apple Health data on your phone, writes it into a file, and puts that file where you told it to — a folder on your device, iCloud Drive, a network share, or your own Google Drive. Nothing is sent to the developer. Nothing is sent to a third party. There is nowhere else for it to go.
There is no server, no account and no analytics
There is no HealthSync account, no sign-up, no sign-in to us, and no analytics, crash-reporting or advertising code of any kind. We operate no servers, so we hold none of your data — not your health data, not your name, not your email, not an identifier for your device. We could not look at your data if we wanted to.
The app makes network connections in exactly one situation: when you have connected a Google account, it talks to Google's Drive API to upload your files. If you use a local folder, iCloud Drive or a network share instead, it makes no outbound connections at all.
What it reads from Health, and why
| What | Why |
|---|---|
| Health and fitness data — steps, energy, heart rate, sleep, workouts, body measurements, nutrition, symptoms and the other types HealthKit exposes | This is the data being exported. It is read and written into your daily file, and used for nothing else. |
| Characteristics — date of birth, biological sex, blood type, skin type, wheelchair use | Recorded once in each file, so the export is interpretable later without a separate lookup. |
| Background delivery | Lets iOS wake the app when new Health data arrives, so the export happens without you opening the app. |
Read-only. The app requests no permission to write to Health and never adds, edits or deletes anything there.
iOS deliberately never tells an app which read permissions you granted. If you decline a type, the app simply sees no data of that type and carries on. You can change or revoke any of it at any time in Settings → Privacy & Security → Health → HealthSync.
Where your data goes is your choice
You pick the destination, and it is the only place files are written.
Once a file arrives at that destination, this policy stops governing it and the policy of wherever you sent it takes over. A file in your Google Drive is subject to Google's terms; a file on a network share is subject to whatever protects that share. These files contain your health data in detail — every sample, with times and devices — so it is worth being deliberate about where you point the app and who else can reach it.
If you connect a Google account
This section applies only if you choose Google Drive as the destination.
The app requests a single Google permission,
https://www.googleapis.com/auth/drive.file. That scope grants access
to only the files the app itself creates. It cannot list, read,
open or modify anything else in your Drive — not your documents, not your photos,
not files another app put there. It creates one folder, writes daily files into
it, and reads back the names and dates of those same files to know which days it
has already uploaded.
The app also reads your email address, once, purely to show you which account is connected. It is stored on your device and sent nowhere.
Limited Use
HealthSync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically: data obtained through Google APIs is used only to provide the export feature you asked for, is never transferred to anyone except as necessary to provide that feature, is never used for advertising, and is never sold. No human reads it — it does not reach us at all.
Your Google credentials
The app never sees your Google password. Sign-in happens in a system-provided browser window that the app cannot read. Google returns a token, which is stored in the iOS Keychain on your device and used only to upload your files. It is never transmitted anywhere but Google.
You can revoke the app's access at any time at myaccount.google.com/permissions, or by disconnecting the account inside the app, which deletes the stored token.
Deleting your data
Deleting the exported files is a matter of deleting them wherever you sent them — your Drive folder, your share, your phone. We cannot delete them for you and cannot see them.
Uninstalling the app removes everything it holds on the device: the stored Google token, the folder you picked, its activity log and its record of which days it has uploaded. Nothing is held anywhere else, so there is nothing left for us to delete.
Children
HealthSync is not directed at children, and collects nothing from anyone.
Changes
If this policy changes, the date at the top changes with it.