Privacy Policy

Last updated: November 9, 2026

OpenVitals is a local-first Android app for viewing health and fitness data from Health Connect.

This policy applies to the OpenVitals Android app published under the package name tech.mmarca.openvitals by Mittetulundusühing Hale (MTÜ Hale), a non-profit association registered in Estonia, registry code 80677610.

Privacy contact: hello@hale.ngo

Summary

OpenVitals is designed to keep health data on your device.

• No account is required.
• No health data is uploaded to OpenVitals servers. There are none.
• The app has no internet permission. Android itself stops it from using the network.
• No ads are shown.
• No analytics SDKs are included.
• No health data is sold or shared with third parties.
• OpenVitals reads Health Connect data only after you grant the relevant Android permissions.
• OpenVitals writes to Health Connect only through something you start or switch on: saving an entry, recording an activity, running an import, adding a medical record, syncing from another phone, or the distance backfill setting.
• Data leaves the phone only over Bluetooth, to a second phone you paired yourself, or in a file you choose to export or share.
• On the phone, OpenVitals shares your body profile with OpenWatch and receives your watch's state and heart rate from it, if you have OpenWatch (see "OpenWatch On The Same Phone").

Data OpenVitals Accesses

If you grant permission, OpenVitals may access the following data from Health Connect:

• Activity data, including steps, distance, exercise sessions, exercise routes, floors climbed, elevation gained, speed, power, cadence, active calories burned, and total calories burned.
• Sleep data, including sleep sessions, duration, and sleep stages.
• Heart and recovery data, including heart rate, resting heart rate, and heart rate variability.
• Body data, including weight, height, body fat, lean body mass, bone mass, body water mass, and basal metabolic rate.
• Nutrition and hydration data, including hydration, meals, calories, and macronutrients.
• Mindfulness session data, when supported by Health Connect on your device.
• Vitals data, including blood pressure, oxygen saturation, respiratory rate, body temperature, skin temperature, blood glucose, and VO2 max.
• Optional cycle tracking data, including menstruation, ovulation tests, cervical mucus, basal body temperature, intermenstrual bleeding, and sexual activity. This access is grouped as a sensitive Health Connect permission category and is used only after you grant those permissions.
• Medical records, on Android 14 and newer where Health Connect offers them: vaccines, allergies, conditions, medications, lab results, procedures, visits, vital signs, pregnancy, social history, personal details, and practitioner details. Each category has its own permission. See "Medical Records".

OpenVitals only accesses the categories you choose to grant in Health Connect.

Outside Health Connect, and only for the features you use, OpenVitals may also access:

• Your location, while you record an activity with GPS. See "Activity Recording".
• Bluetooth, to reach a heart rate strap or bike sensor, or a second phone.
• Files you pick: an Apple Health export, a CSV file, a route or workout file, an offline map pack, an elevation tile, a medical records file.
• The camera, only while you scan the QR code of a health card. See "Medical Records".

How Data Is Used

OpenVitals uses granted Health Connect data to show dashboards, charts, summaries, lists, details, home screen widgets and reports. It also derives figures on the device from that data, such as readiness, Body Energy, sleep scores and caffeine estimates.

The one-tap onboarding option can request write permissions up front. A granted write permission is used only by the actions listed in the summary. If a needed write permission has not been granted yet, the app asks for it before it writes, so Health Connect remains the source of truth.

If you enable hydration, mindfulness or cycle reminders, OpenVitals uses locally stored reminder preferences and granted Health Connect data to decide when to show an on-device reminder. Cycle reminders use a neutral wording unless you choose otherwise. Reminder notifications are generated locally on your device and are not sent to a server.

The app does not use health data for advertising, profiling, credit decisions, insurance decisions, employment decisions, or any purpose unrelated to showing your health data back to you.

What OpenVitals Writes To Health Connect

• Entries you log or edit: activities, hydration and drinks, nutrition, body measurements, vitals, mindfulness sessions, cycle entries, workout plans.
• Activities you record in the app, with their route and sensor samples.
• Records from an import you run: an Apple Health export, a CSV file, a route or workout file.
• Records received from another phone, when you run a phone-to-phone sync on both phones.
• Medical records you import or type in. See "Medical Records".
• One distance record per day derived from your steps and stride length, if you switch on distance backfill. Switching it off removes them.

Records OpenVitals wrote can be edited or deleted in the app. Records written by other apps are read-only.

Medical Records

On Android 14 and newer, where Health Connect offers medical records, OpenVitals can show, import and export them. Health Connect stores them in the FHIR format. OpenVitals asks for these permissions only inside its Medical records area, never together with other permissions, and each category has its own permission.

• Viewing. Records are shown as Health Connect holds them. OpenVitals does not interpret them. It flags a lab value as high or low only when the lab did.
• Importing. You pick a file: a FHIR file, a CDA document, an Apple Health or Estonian health portal export, or a SMART Health Card. The file is read on the device, and its records are written to Health Connect. Records in an older format are converted on the device first. A health card's signature is not checked, because that needs the internet, and its records say so.
• Scanning a health card. You can scan a card's QR code with the camera. OpenVitals asks for the camera only when you tap Scan. Each picture is read on the device and then dropped. None is saved or sent. Before it writes, OpenVitals compares the person named in the file with the records already on the phone, and asks you to confirm when they differ. The import report counts what was written, held back or refused, by record type and reason. It holds none of your records' content, no names and no file names.
• Entering. Vaccines, allergies, medications and conditions you type in are written to Health Connect.
• Exporting. An export is a FHIR file created on the device. It leaves the phone only if you save or share it.
• Saved documents. When you import a file, you can choose to keep a copy of it. The choice starts off every time. A kept copy stays in the app's private storage and is not backed up. It can hold more than the records taken from it, such as names, identifiers and notes. Opening it hands it to a viewer app on your phone. Deleting a document does not delete its records, and deleting records does not delete the document.
• Phone-to-phone sync. When you select medical records in Sync with another phone, all your medical records are copied to the other phone, whatever range you choose. Saved documents are not copied.

OpenVitals can delete only the medical records it wrote. Records from other apps stay read-only.

Activity Recording

While you record an activity, OpenVitals uses location to build the route, and motion sensors and Bluetooth sensors you added to measure steps, heart rate, power, speed and cadence. A notification shows that a recording is running. The recording is kept in the app's private storage until you save it to Health Connect or discard it. If you switch on the CoMaps integration, OpenVitals reads turn guidance from the CoMaps app on your phone to show it during the recording and, if you choose, keeps it with the activity on the device.

OpenWatch On The Same Phone

If OpenWatch, the companion app that pairs watches and scales, is installed, OpenVitals talks to it on the phone through OpenLink, an interface that works only inside the phone. Nothing travels over a network. OpenWatch lists OpenVitals under its Connected apps, where any part of this can be switched off.

• Your body profile (birth year, sex, height, weight, resting and maximum heart rate) is kept the same in both apps, so you enter it once. The more recent change wins.
• OpenVitals shows the watch OpenWatch syncs on its dashboard (name, battery, last sync) and can ask OpenWatch to sync it.
• While you record an activity, OpenVitals asks OpenWatch to keep the watch streaming and receives its heart rate, which is recorded with the activity like a heart rate strap's. The stream stops when the recording ends.

Phone-To-Phone Sync

Sync copies Health Connect records from one phone to another over a paired Bluetooth link. Before any record moves, both phones show the same six-digit code, and you confirm on both that they match. That tells you no other device sits in between. The records are then encrypted between the two phones with a key made for that one sync, on top of Bluetooth's own encryption. You choose how far back to sync and which categories to send. Medical records always sync in full. No server or account is involved. Each phone keeps a plain-text report of its last sync in the app's private storage. If a sync stops, the reason in it is masked like any error text.

Imports, Exports And Reports

An Apple Health export you pick is copied into the app's private storage and analysed there before you choose what to import. The copy is removed after a successful import, when the analysis fails, or when you pick another export. A copy you never came back to is removed when the app next starts, once it is a day old.

Exports (routes, workouts, reports, CSV files) and import reports are created on the device and leave it only if you save or share them. An import report holds counts, record types, units and reasons, and the importer's log with its error text masked. It holds no record's value or time, no names, no file names and no file locations. The workouts an Apple Health import brought in without their route are listed on the import card and kept in the app's private storage, never in the report.

Data Sharing

OpenVitals does not sell, rent, transfer, or share your health data with third parties.

OpenVitals does not include advertising SDKs or analytics SDKs.

Local Storage

Health Connect remains the source of truth for the health data it has a record type for. OpenVitals also keeps, in its private storage on your device:

• App preferences, such as units, language, theme, widget order, goals, reminder settings, timer settings, your body profile, paired device settings, acknowledged permission prompts, and the cycle tracking contexts and age band you declare.
• A local database with your drink catalog, cached daily summaries that make the charts fast (up to two years), the Body Energy timeline, and the cycle journal: the pain, mood, energy, symptoms, notes, pregnancy-test results, temperature disturbances and cervical sensation you log per day, and the cycles you exclude from estimates. Health Connect has no record type for these. It also holds the list of medical documents you chose to keep. The journal stays until you delete a day's entry, delete the journal in Settings, or clear the app's data. It moves to another phone only through Sync with another phone, when the cycle category is selected on both phones.
• Files: a recording in progress or not yet saved, a staged Apple Health export, offline map packs and elevation tiles you imported, medical documents you chose to keep, the last sync report, the last Apple Health import report, and the last crash report.

If reminders are enabled, Android may restore the local reminder schedule after a device restart. OpenVitals uses the notification permission for reminders, active recording notifications and sync notifications.

OpenVitals opts out of Android's cloud backup. When you move to a new phone, Android can copy the app's data across; the crash report and the import and sync reports stay behind. The shipping app manifest removes inherited Android network permissions, including INTERNET.

Diagnostics

OpenVitals sends no crash reports by itself. After a crash it keeps one report on the phone: the device model, the app version and the error trace, with numbers, dates, addresses and identifiers in the error text masked. In debug and nightly builds it also holds the app's log at the crash, with device addresses, identifiers, file locations, dates and error details masked; a release build holds no log. Report an issue puts it into an email draft together with the app's current log, masked the same way, and nothing is sent unless you press send. Once the report has gone into an email, a copy or a file it is deleted, and it is not kept past seven days either way. Debug and nightly builds can also export the app's log when you ask for it, with device addresses, identifiers, file locations, dates and error details masked. Release builds cannot. Reports the app copies are marked sensitive, so Android keeps them out of the copy preview.

Data Retention And Deletion

Health data in Health Connect is controlled by your device and Health Connect settings. Records OpenVitals wrote there stay after you uninstall the app. You can delete them in the app before that, or from Health Connect's own settings at any time.

You can revoke OpenVitals permissions at any time from Android Settings or Health Connect settings. After permissions are revoked, OpenVitals can no longer access the revoked data. Summaries it cached earlier stay on the device until you clear them.

You can delete all local OpenVitals data by clearing the app's storage in Android settings or uninstalling the app.

Security

OpenVitals relies on Android and Health Connect permission controls to protect access to health data. Its local data sits in app-private storage, which other apps cannot read. You can also require your device unlock to open the app.

Because OpenVitals works locally and does not upload health data, there is no OpenVitals cloud account or cloud health-data store.

Children

OpenVitals is not directed to children and is not designed for child-directed use.

Changes To This Policy

This privacy policy may be updated when OpenVitals changes how it accesses, uses, stores, or shares data. The "Last updated" date above will be changed when this policy is updated.

Contact

For privacy questions, contact:

hello@hale.ngo

---

Generated from PRIVACY.md. Edit it there; changes made here are overwritten.