Privacy policy

1. Who we are

Helix (“Helix”, “we”, “us”) is an iPhone app for sleep, training, food and groups, with a companion Apple Watch app. The data controller is [LEGAL NAME], [ADDRESS], United Kingdom. ICO registration number: [ICO REGISTRATION NUMBER].

Contact for anything about privacy: helixapp.health@gmail.com. This policy covers the Helix app and this website.

2. Data that stays on your phone

Most of what Helix uses is health data, which is special category data under UK GDPR. It is read and worked on on your iPhone and is not sent to us. This includes:

• Data you allow Helix to read from Apple Health — sleep, heart rate, resting heart rate, heart rate variability, workouts and activity — including up to 90 days of history read when you first open the app.
• Sessions you record in Helix, including routes, which never leave your phone, and heart rate.
• Food you log and its nutrition estimates, your scores, baselines, Timetable, Labs and Health records.
• Your subscription status, which stays on your phone and is checked with Apple.

You choose which Apple Health data Helix can read in the iOS permission screen, and can change it at any time in the Health app. If you use iCloud backup, iOS may include Helix’s on-device data in your encrypted device backup; that backup is controlled by you and Apple.

3. Data we store on our servers

Groups and the Feed need a server. We use Supabase for our database and sign-in, in [SUPABASE REGION]. We store only:

• Account: an account identifier, your email address or the relay address from Sign in with Apple, your display name and your member colour and shape.
• Groups: group membership, pacts, streaks, and the metrics you choose to share — set metric by metric. Metrics you don’t share are never sent to us.
• Feed: posts, photos and comments you publish.
• Reports: if you report a user or content, the report and the content concerned.

We do not store push notification tokens, and we do not store your subscription status.

4. Helix AI and meal photos

Helix AI is optional and off until you turn it on in Settings › Privacy and your data › Helix AI. The consent screen shows exactly what is sent before you agree.

• When it is on, your message and a short card of today’s numbers go through Helix’s server to Groq, the AI provider, to produce a reply. Groq processes the request and does not keep it or use it to train models. [CONFIRM ZDR ON]
• Your name, email address and account details are never sent.
• Meal photos are sent to Groq to identify the food, and are not stored by us or by Groq.
• Typed meal descriptions go to Groq only when Helix AI is on.
• Barcode numbers you scan are looked up with Open Food Facts. Only the barcode number is sent.

You can turn Helix AI off at any time; the rest of Helix keeps working.

5. This website and the waitlist

This website uses no cookies, no analytics and no tracking scripts, and loads nothing from other services. Our host, Netlify, may keep standard server logs (such as IP address and pages requested) for a short time for security.

If you join the waitlist, your email address is collected through Netlify Forms. We use it only to tell you when Helix launches, and delete the waitlist within 3 months of launch. You can ask to be removed at any time.

6. Lawful bases

What	Why	Lawful basis
Health data (shared metrics, Helix AI, meal photos)	To provide sharing, coaching and food recognition	Explicit consent: Article 6(1)(a) and 9(2)(a) UK GDPR
Account, group and Feed data	To run your account and groups	Contract: Article 6(1)(b)
Reports and moderation	To keep groups safe	Legitimate interests: Article 6(1)(f)
Waitlist email	To tell you about the launch	Consent: Article 6(1)(a)

Where we rely on consent you can withdraw it at any time. Helix does not make decisions about you with legal or similarly significant effects based solely on automated processing.

7. No ads, no selling, no tracking

• We do not show ads.
• We do not sell, rent or trade your data.
• Helix contains no analytics, advertising or crash-reporting SDKs, and does not track you across other apps or websites.
• We never use Apple Health data for advertising or marketing.

8. Who we share data with

Provider	Purpose	Data
Supabase	Database, sign-in, group sync	Account, group, Feed and shared-metric data
Groq	Helix AI and meal recognition, only with your action or consent	Each request, not kept
Open Food Facts	Barcode lookup	The barcode number only
Apple	Sign in with Apple, App Store payments	As set out in Apple’s privacy policy
Netlify	Website hosting and waitlist	Waitlist email, server logs

Group members see your display name, colour and shape, and only the metrics you choose to share. Payments are handled by Apple; we never see card details. Some providers may process data outside the UK; where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement.

9. How long we keep data

• On your phone: until you delete it in the app or delete the app.
• Account, group and Feed data: while your account is active; deleted within 30 days of deleting your account, and from backups within a further 30 days.
• Shared metrics: removed when you stop sharing them or leave the group.
• Helix AI requests and meal photos: not stored.
• Reports: up to 12 months after they are resolved.

10. Deleting your account

Go to Settings › Account › Delete account. This deletes your account and the data we hold on our servers, removes you from your groups, and revokes Sign in with Apple. Data on your phone goes when you delete the app; your Apple Health data is not affected.

Deleting your account does not cancel an App Store subscription — see Support.

11. Your rights

You have the right to access, correct, erase, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent. Email helixapp.health@gmail.com; we reply within one month.

12. Children

Helix is not for anyone under 16. If you believe someone under 16 is using it, tell us and we will delete the account.

13. Security and changes

Data is encrypted in transit and at rest on our servers, and access is limited to the people who run the service. On your phone, Helix relies on iOS data protection and can be locked with Face ID. If we make a significant change to this policy, we’ll tell you in the app first.

14. Complaints

Please contact us first at helixapp.health@gmail.com. You can also complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113.