Innios Health Privacy Policy

1.1 Information you provide in the app

Depending on how you use Innios, you may provide:

• Profile information, such as name, birth date, biological sex, and height or weight if entered.
• Health and wellness logs, such as symptoms, cycle, hydration, nutrition, sleep, exercise, vitals, medications, appointments, and notes.
• Optional attachments, such as photos you choose to add to entries.
• Reminder and notification preferences.
• Data you enter in support or feedback forms, such as title, description, and optional email.

1.2 Information collected automatically in limited cases

When you submit feedback through the app, we also send technical metadata such as:

• App version and build number.
• Platform or OS type and locale.
• Basic device model information.
• Submission timestamp.

We use information to:

• Provide core app features such as logging, reminders, profile management, and insights.
• Store and restore your records on your device.
• Generate exports and backups that you request, and run automatic scheduled backups when you connect a supported cloud destination.
• Respond to support requests and improve app reliability when feedback is submitted.

• Primary app data is stored locally on your device.
• Local backup files are saved in the app documents area on your device when you run backup.
• Exported files such as CSV or PDF are created on-device, then shared only when you explicitly share them.
• If you move or share exported or backup files to external services like email or cloud storage, those services process data under their own policies.
• If you connect Google Drive, iCloud Drive, or OneDrive as a cloud backup destination, backups are encrypted on your device before they leave it and are uploaded automatically, on the schedule you choose, to your own cloud account — never to Innios servers. Innios can reach only the files it creates there and keeps the seven most recent backups for each profile.
• A backup can be restored only with its recovery key. For Google Drive on Android, the key is kept in Google Play services Block Store and syncs to your Google account only when it can be end-to-end encrypted; otherwise it stays on your device and the app offers a recovery code to save. For Google Drive on iPhone, iPad, and Mac and for OneDrive, the key is stored as a file in the same cloud account as the backups. For iCloud Drive, the key is kept in iCloud Keychain. Innios never receives your recovery key.

By default, insights and analysis run on your device.

Cloud backups are an optional, user-enabled feature. If you connect Google Drive, iCloud Drive, or OneDrive, Innios encrypts backups on your device before uploading them automatically to your own account on the schedule you choose. Innios does not receive the backup contents or recovery key.

We share data only in the following situations:

• Feedback submission: Feedback content, optional email, and technical metadata are sent to our feedback API endpoint so we can process requests.
• Model download, if used: If you choose to download an on-device AI model, your device connects to the model host, Hugging Face, to download model files.
• Cloud backup provider: If you connect Google Drive, iCloud Drive, or OneDrive, that provider stores your encrypted backups under its own terms and privacy policy. For Google Drive on iPhone, iPad, and Mac and for OneDrive, the recovery key file is also stored there.
• Google Drive authorization on Android: The authorization step passes through Innios infrastructure so backups can continue in the background. Only authorization tokens pass through it; health data, backup contents, and encryption keys do not. Backups travel directly from your device to your own Google Drive. Innios stores nothing from this step. OneDrive and every provider on iPhone, iPad, and Mac authorize directly with the provider.
• User-initiated export or share: If you export and share files, data is shared with the destinations or apps you select.
• Legal or safety reasons: If required by law or to protect rights and safety.

We do not sell personal information or share personal or health data with third parties for advertising. Cloud providers receive encrypted backups only when you connect them, and process them under their own terms and privacy policies.

Innios may request access to:

• Internet (INTERNET) for feedback submission, optional model download, and cloud backups you connect.
• Notifications (POST_NOTIFICATIONS) to send reminder notifications.
• Vibration (VIBRATE) for notification behavior.
• Boot completed (RECEIVE_BOOT_COMPLETED) to restore scheduled reminders after reboot.
• Photos or files via the system picker only when you choose to add an image or select a backup file.

You can manage permissions in your device settings.

Your rights and choices include the ability to:

• Edit or delete logs in the app.
• Remove profile photos and other in-app content you added.
• Delete backup files stored on your device.
• Understand that deleting data in the app does not delete copies you previously exported or stored elsewhere.
• Disconnecting a cloud backup destination stops new uploads. It does not delete backups or recovery key files already in your cloud account; you can delete those from the account itself, such as the ‘Innios Backups’ folder in Google Drive or ‘Apps/Innios Backup’ in OneDrive.
• Deleting a profile removes that profile’s recovery key from your device, Google Play services Block Store, and iCloud Keychain, but does not delete backups or recovery key files already stored in a cloud account.
• Know that feedback submissions already sent to our support backend may be retained for support, security, and recordkeeping purposes, then deleted according to operational needs.

We use reasonable technical and organizational measures to protect information. No method of storage or transmission is 100% secure.

Cloud backups are encrypted on your device before upload, but the security of your cloud account and any recovery code or key you save remains your responsibility. Use a device passcode or biometrics, keep your OS updated, enable strong cloud-account security, and carefully control access to exported or backup files.

Innios is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the app's support channels.

If you believe a child has provided personal information, contact us at support@innios.app and we will review and take appropriate action.

If you submit feedback, connect a cloud backup destination, or use third-party infrastructure such as model hosting or email or cloud services you choose, data may be processed in countries other than your own and may have different data protection rules. Innios’ own infrastructure — the feedback endpoint and the Android Google Drive authorization step — runs in the United States.

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date.

If you have questions or concerns about this Privacy Policy or your data, please contact us at support@innios.app.