Health Journey is operated by Milan Mijatovic (“Health Journey,” “we,” or “us”). This policy explains how we collect, use, disclose, retain, and delete personal information, including consumer health data.
Consumer health data privacy notice
Weight measurements, body measurements, goals, trends, and related inferences may be consumer health data under applicable US state laws. We do not sell personal information or consumer health data, use it for targeted advertising, or provide it to data brokers.
Categories collected
- Account and identity: email address, authentication provider identity, verification state, and session records.
- Profile: birth date, height, optional sex selection, display unit, language, theme, and daily-summary preference.
- Consumer health data: weight observations, dates and times, starting weight, daily summaries, trends, goals, targets, progress, and results.
- Shared Goals: sharing display name, membership, consent record, invitations, supported goal configuration, and the goal-scoped values described below.
- Technical and support data: IP address and request metadata processed for delivery and security, device/app diagnostics, support communications, and account-deletion workflow records.
Sources and purposes
- You provide account, profile, weight, goal, sharing, and support information directly.
- Your device supplies timezone, app/device diagnostics, and ordinary network metadata.
- Google supplies basic account identity when you choose Google Sign-In.
- Health Journey derives summaries, trends, normalized progress, and goal results from the records you provide.
We use this information only to provide the service you request: authenticate accounts; store and display your records; calculate summaries, trends, and goals; operate the sharing choices you make; send transactional messages; complete deletion; secure the service; prevent abuse; respond to support and rights requests; and diagnose reliability problems.
Shared Goals
Shared Goals are optional and goal-scoped. After you review the sharing boundary and explicitly choose Agree & join, current members may see your sharing name, supported goal and normalized progress, change, result, and one effective daily weight per calendar date inside the shared window.
Members do not receive your raw observations, timestamps, entry counts, sources, edit history, profile details, email, unrelated goals, or history outside that window. We do not share consumer health data with affiliates. The only person-to-person disclosure is the Shared Goal data you explicitly choose to share with the other members of that goal.
Anyone with an active single-use invite link can attempt to accept it. Acceptance requires authentication, a review of the sharing boundary, and an explicit Agree & join action. Leaving removes your detailed shared data and access to other members’ data while your underlying personal records remain in your account.
Service providers
We use processors only to operate the requested service and require them to process information on our behalf. The current providers are:
- Railway: application hosting, PostgreSQL storage, encrypted database backups, and private Android release storage. Account, profile, health, sharing, and deletion-workflow records are stored there.
- Cloudflare: DNS, website and web-app delivery, API proxying, security, and rate limiting. Cloudflare processes ordinary network and request metadata.
- Google: optional Google Sign-In. Google supplies the account identity you authorize; we do not send weight or goal data to Google for authentication.
- Resend: verification and password-reset email delivery. Resend receives the destination email address and transactional delivery content and metadata.
- Sentry: application error monitoring, not health-record storage. Diagnostic events are subject to application redaction controls and may include device, app-version, request, and error context needed to diagnose failures.
Better Auth is self-hosted inside the Health Journey API; it is software we run, not a hosted identity provider receiving a separate copy of your records. Providers may process data in the United States and other regions where they operate. We apply the safeguards required for the transfer where applicable.
Legal bases
Where a law requires a legal basis, we process core account and health records to provide the service you request, Shared Goal disclosures based on your specific affirmative choice, security and limited diagnostics for our legitimate interest in operating a reliable service, and records required to meet legal obligations. You may withdraw a Shared Goal sharing choice by leaving the goal. Withdrawal does not affect processing already completed.
Account deletion
You can request deletion in the app at You → Account → Delete account. The deletion request covers the account, profile, weight history, goals, Shared Goal participation, provider identity, and active sessions. Shared goals created by the account may end or continue under a neutral name according to their lifecycle; other members keep their own private data.
Provider-backed deletion may remain pending for up to 30 days while durable retry processing completes. The public status route uses a private, high-entropy receipt and returns no account or health information.
After completion, the service retains only limited hashed and operational deletion data—such as hashed provider subject and receipt credentials, provider kind, stable status/failure metadata, deadlines, and timestamps—to block an old identity from recreating a deleted account and to audit deletion reliability. It does not retain the raw receipt, email, access tokens, provider user identifier, Shared Goal content, or health data in that record.
Retention and backups
- Account, profile, health, and goal records remain while your account is active or until you delete them through available product controls.
- Authentication sessions expire after 30 days of inactivity or are revoked earlier by sign-out, password reset, or account deletion.
- Transactional email, support, security, and diagnostic records are retained only as long as reasonably needed for delivery, support, fraud prevention, reliability, and legal obligations.
- Active production records are removed through the account-deletion workflow. Copies in archived or backup systems are isolated from ordinary use and deleted or aged out under the provider schedule; where Washington law applies, this process will not exceed six months from an authenticated deletion request.
Your rights and choices
- Confirm whether we process your information and request access to it, including applicable recipients.
- Correct profile information and edit or remove manual weight records.
- Review Shared Goal data before joining and withdraw future sharing by leaving.
- Delete your account and consumer health data through the authenticated self-service flow.
- Appeal a refusal by replying with the subject “Privacy appeal.” We will provide a written decision and any applicable regulator contact.
Send access, correction, withdrawal, recipient-list, or appeal requests to support@usehealthjourney.com. We may verify your identity using your existing account or other reasonable information. Applicable requests are handled without undue delay and within the period required by law; Washington consumer-health requests are handled within 45 days, subject to one permitted extension.
Age eligibility
Health Journey is for adults aged 18 and older. We do not knowingly permit children or minors to create accounts. Contact us if you believe an ineligible person supplied personal information.
Security and changes
We use access controls, encrypted transport, restricted production credentials, token-safe logging, and data-minimizing product boundaries. No system can guarantee absolute security. We will update this policy before using consumer health data for a materially new category or purpose and will request affirmative consent where required.
Contact
Health Journey is operated by Milan Mijatovic. Contact support@usehealthjourney.com for support, privacy questions, rights requests, or legal notices.