Mobile Privacy

Effective date: July 21, 2026

This policy describes how the Outliyr mobile app (“the App”) handles information. It supplements our general Privacy Policy, which covers outliyr.com and all Outliyr LLC services. Where the two overlap, this mobile-specific policy governs App behavior.

1. What the App collects

Account information. When you sign in, the App authenticates against your existing Outliyr account. This is your email, account ID, and session token.

Health data from Apple HealthKit. With your explicit permission, the App reads the following data types from Apple HealthKit:

  • Cardiovascular: heart rate variability (HRV), resting heart rate, walking heart rate, active heart rate, blood pressure, recovery metrics
  • Respiratory: respiratory rate, blood oxygen (SpO2)
  • Sleep analysis
  • Mindfulness / mindful minutes
  • Activity: steps, active energy, basal energy, exercise minutes, stand hours
  • Body composition: weight, body fat percentage, lean body mass
  • Cardiorespiratory fitness: VO2 max

Camera and biometric information (Mirror scans). If you use the optional Mirror scan feature, the App uses your device camera. It captures still photographs of your face or tongue and derives measurements from them. This is biometric information. Section 2 describes it in full.

Voice (Daily Pulse). If you use the optional Voice Check-in feature, the App records a short voice sample. It derives voice characteristics from that sample. This is also biometric information and requires your explicit consent.

Daily pulse check-in. Any values you enter in the daily pulse check-in are stored against your Outliyr account. Examples include energy, mood, sleep quality, and notes.

Device and diagnostic data. Standard iOS diagnostic information, when provided by iOS. This includes device model, iOS version, app version, and crash reports.

2. Camera, face, and tongue (Mirror) scans

Mirror scans are optional, and they collect biometric information. The App asks for your explicit consent before any scan runs.

When you start a Mirror scan, the App uses your device camera. It captures still photographs of your face or tongue. From those photographs it computes facial-geometry measurements, such as symmetry, proportion, and alignment ratios.

The App does not create or store a facial recognition template or faceprint. It does not use these scans to identify or authenticate you.

The App uses Mirror scan photographs and their derived measurements only to produce the wellness summaries you request. Examples include observational visible-feature notes and apparent-age estimates.

Storage and retention. Mirror scan photographs are uploaded to a temporary, time-limited storage bucket (Cloudflare R2). They are deleted after processing. A failed deletion is queued for retry rather than abandoned.

The measurements and results we derive from a scan are kept while your account is active. They are permanently deleted when you withdraw biometric consent or delete your account.

Third-party AI vision providers. To analyze the photographs, the App sends them to approved third-party AI vision providers. These are currently Groq, Google AI Studio, and OpenRouter as a fallback gateway, all in the United States. They operate under contract terms that prohibit training on the images and require zero-data-retention routing.

Outliyr does not sell, lease, trade, or profit from your biometric information.

Consent. You can grant or withdraw biometric consent at any time in the App. It lives under Me, then Settings, then the biometric consent control in Privacy and Security. Withdrawing consent stops all new voice and Mirror biometric capture.

3. How the App uses this data

Health and check-in data is used solely to:

  • Display your personal dashboard, trends, and correlations
  • Generate insights tied to your daily pulse check-in
  • Surface patterns between your interventions and measured outcomes

We do not use your HealthKit data for advertising, marketing, or any purpose unrelated to providing the service you signed up for.

4. How the App stores and transmits data

HealthKit data read by the App is transmitted over TLS (HTTPS) to Outliyr’s servers and stored against your account. Data at rest is encrypted. Access is restricted to your authenticated sessions.

The App does not write any data back to Apple HealthKit.

5. What the App does not do

  • We do not sell your health or biometric data. Ever.
  • We do not share your HealthKit data with third parties for advertising, marketing, analytics, research, or any other purpose.
  • We do not use your HealthKit or biometric data to derive targeting audiences.

6. Third-party infrastructure

The App runs on Outliyr’s own infrastructure. It uses standard hosting, error monitoring, and analytics tools to stay reliable. Those tools process account and usage data, not HealthKit data. Our general privacy policy lists these providers.

HealthKit data is processed only by Outliyr and is not passed to any third-party provider. Mirror scan photographs are the one exception, described in section 2. They go to approved AI vision providers under no-training, zero-data-retention terms, then are deleted.

7. Your control over your data

  • Withdraw biometric consent at any time: in the App under Me, then Settings, then the biometric consent control in Privacy and Security. This stops all new voice and Mirror capture.
  • Revoke HealthKit access at any time: iOS Settings, then Privacy & Security, then Health, then Outliyr, then toggle off any data category.
  • Delete your account and all associated data: email hello@outliyr.com or use the in-app account deletion flow. We permanently delete all of it within 30 days. That includes synced HealthKit data, your Mirror and voice results, your account, and your check-ins.
  • Export your data: request a copy of all data we hold about you by emailing hello@outliyr.com.

8. HIPAA

Outliyr is not a HIPAA-covered entity, and the App is not a medical device. The App is intended for personal health tracking and informational purposes only. It is not a substitute for professional medical advice, diagnosis, or treatment.

9. Children

The App is not intended for users under 13. We do not knowingly collect data from users under 13.

10. Changes to this policy

We will update this page when the App’s data practices change. We revise the effective date at the top when we do.

11. Contact

Questions about this policy or your data: