Total Health Privacy Policy

Last updated: October 30, 2026

Developer: Ethan Haire (an individual developer)

The short version

Most of what you record in Total Health (workouts, food, weight, measurements, sleep views, journal entries and settings) stays on your phone. If you create an account, a small set of information is stored on our servers so friends, the leaderboard and shared calendars work. If you choose to link with a trainer, the specific categories you approve are also stored on our servers so that trainer can view them. We do not sell your data, show ads, or track you across other apps or websites.

What stays on your device

Workouts, exercises, food logs, saved foods and meals, weight and body measurements, journal entries, reminders, lab markers you import, themes, goals, your profile photo, tutorial and hint history, and app settings. We cannot see them. Backup files you export are files you choose where to save. The Health Summary feature lets you copy or share your own data yourself; the app does not send it anywhere.

Apple Health

With your permission the app reads data from Apple Health, such as weight and body measurements, sleep, heart rate and heart rate variability, respiratory rate, blood oxygen, wrist temperature, active and resting energy, workouts, and optionally clinical lab records. It writes weight, body fat, lean body mass and period days that you log in the app. This data is used to show you your own trends. It is not uploaded to our servers, with one exception: if you link with a trainer and approve a category (see "Trainer mode"), the weight and workout information in that category is uploaded for that trainer. We do not use Apple Health data for advertising or marketing, we do not sell it, and we do not disclose it to anyone other than a trainer you approve. You can change access any time in Settings > Health > Data Access & Devices.

If you create an account

We store your email address (used to sign in), your password in a protected form handled by our sign-in provider, a display name you choose, an invite code, your friend connections and blocks, leaderboard values (your best lifts with exercise names and repetitions, and your workout and food streaks with dates), and the last 60 days of your workout calendar, including the workout names you typed, so friends can see them. Workout names are free text, so avoid typing anything you would not want a friend to read.

Friends see your leaderboard values and calendar only after a friend request is accepted. Someone you send a friend request to, or who sends one to you, can see your display name and invite code while it is pending. People you block cannot see your data.

You can delete your account in the app (Profile > Delete Account). That removes your account and the data above from our database. Information on your phone is not affected. Accounts that are never confirmed by email are deleted automatically after 7 days.

Shared food database

When you save or edit a food, its name, brand and nutrition values may be added to a shared database used by other people. Other people cannot see who added or used a food. While your account exists, our database keeps a private record of which shared foods you used and any edits you suggested. Deleting your account removes those records; usage counts stay without your account attached.

Trainer mode

Trainer mode is for adults only. Trainers and trainees must be 18 or older and confirm this in the app.

If you are a trainee: you link with a trainer by entering their code and confirming you are 18 or older. Nothing is shared at first. A trainer can ask to see a category, and you approve or decline each category separately. In this version the categories are weight (date and value) and workouts (date, name, duration, exercises, sets and the values you track, such as weight, repetitions, time or distance). Notes, injury information, food, sleep, heart rate and lab markers are not shared. When you approve a category, a copy is uploaded to our servers and that trainer can view it, read only. The trainer sees your display name, not your email. You can stop sharing a category, end the link, or choose "Stop sharing and delete" at any time, and the stored copy is deleted. You can see which trainer looked at which category and when (the log is kept for 90 days). You can have only one trainer at a time.

If a trainer's subscription ends, their access stops at once, and the stored copy of your data is deleted about 7 days later (our daily cleanup can take up to a day longer) unless they renew. The same applies if a trainer moves to a smaller plan that no longer covers you. If you delete a weight entry or workout on your phone, the app removes it from the stored copy too. Your data on your phone is not affected.

If a trainer cannot take new trainees, you can choose to let them know you tried; only if you tap that button does the trainer see your display name, and the request is removed after 30 days.

If you are a trainer: you apply in the app and we review applications. When we review an application, the developer can see your display name, email address and message. We store your application (your message, age confirmation, acceptance of the trainer terms, and our decision), your trainer code, your plan, your subscription status and expiry date, and the transaction identifier Apple provides. To limit repeated free trials, once you start a trial we also keep a scrambled, one-way code made from your email address. It cannot be turned back into your email, and it is kept 24 months even if you delete your account. Apple processes the payment; we do not receive card details. Trainers may use trainee information only to coach the trainee who shared it. Deleting your account does not cancel an Apple subscription; you cancel it in your Apple subscription settings. We can revoke a trainer's access at any time.

Feedback

If you send feedback, we receive the message and basic device information (device model and iOS version). You must be signed in to send it. It is emailed to the developer and removed from our database after delivery. The email stays in the developer's mailbox until deleted.

Food search and barcode lookup

When you search for a food, the search words are sent to our server, which asks USDA FoodData Central for the results. Our function does not save the search words, but our hosting provider's request logs may record them (see "Abuse prevention and server logs"). When you scan a barcode, the barcode number is sent directly from your phone to Open Food Facts to look up the product.

Abuse prevention and server logs

To stop spam and overload, we keep network addresses (or a scrambled version of them) for up to about 2 days when you send feedback, search for foods, or enter a trainer code. We also keep short-lived counters tied to your account identifier, for up to about 2 days, that limit how often some actions (such as sharing data with a trainer, viewing a trainee, or applying to be a trainer) can be repeated. Our hosting provider also keeps standard request logs for a limited time, which can include the address requested, your network address, approximate location, device type, and your account identifier. Our sign-in provider keeps session records for your signed-in devices, including a network address and device description, until you sign out or delete your account.

Services we use

Supabase: stores account and trainer data, runs the shared food database, and passes food searches to USDA on your behalf.
Resend: sends account emails (confirmation and password reset) and feedback notifications to the developer.
USDA FoodData Central: receives your food search words from our server.
Open Food Facts: receives barcode numbers from your phone.
Cloudflare: hosts our website, the email-link page and this policy.
Apple: Apple Health, the App Store, subscriptions and in-app tips.

How long we keep things

Account data: until you delete your account.
Unconfirmed accounts: deleted after 7 days.
Feedback: removed from our database after it is emailed.
Network address records and usage counters: up to about 2 days.
Trainer access log: 90 days.
Records that a trainer was full, and trainer waitlist requests: 30 days.
Shared trainer data: until you revoke, end the link or delete your account; if a trainer's access ends, about 7 days after it ends unless they renew.
Trainer free-trial record (scrambled email code): 24 months, kept even after account deletion.
Backups: deleted accounts may remain in the developer's private backups for up to 30 days.
Provider request logs: a limited time set by the provider.

Camera, photos, notifications, tips

The camera is used only to scan barcodes; images are not saved or sent. Your profile photo and theme photos stay on your phone. Reminders are scheduled on your phone; the app does not use push notifications. If you tip the developer, Apple handles the payment and the app receives no card details.

Your choices and rights

You can delete your account, revoke Health access, stop sharing with a trainer, turn off notifications, or delete the app at any time. To ask what we hold about your account, to correct it, or to request deletion, email support@getmytotalhealth.com; we aim to reply within 30 days. Depending on where you live, you may have additional rights under local privacy laws, and you can use the same address to exercise them.

Security

Connections to our servers are encrypted, and access to stored data is limited by rules enforced in the database. No system is perfectly secure, and we cannot guarantee absolute security.

Children

Total Health is not directed to children under 13, and we do not knowingly collect information from them. If we learn we have, we will delete it. Trainer mode is for adults 18 and older.

Changes

We will update this page and the date above when our data practices change.