Privacy Policy

Health Portal 2 (healthportal2.hkraft.uk) is a private, non-commercial web application built and used by one individual to keep track of their own health data. It is not offered to the public, has no sign-up, and has exactly one user: its owner. This policy explains what data the app handles and where it goes.

Data the app handles

The owner's own health data: daily activity, sleep, heart rate, heart rate variability, body temperature, weight and body composition, workouts, blood test results, supplements, and one-off test reports the owner uploads. Some of this comes from wearable and health services the owner has connected to their own account, including Apple Health (via the Health Auto Export app) and Oura. The app only ever reads the owner's own data, using access the owner has personally granted.

How it is used

The data is shown on the owner's private dashboard and used to help the owner review their own health. When the owner asks for an analysis, or uploads a document to be read, relevant data or the document is sent to Anthropic's Claude API to generate the response. No one else sees it, and it is not used for advertising, profiling, or sale.

Where it is stored and who processes it

The app relies on a small number of service providers, each acting only to run it for the owner:

• Supabase, which hosts the app's database and file storage.
• Vercel, which hosts the web application.
• Anthropic, whose Claude API performs the analysis and document reading described above.
• Oura, when connected, as the source of the owner's Oura data.

Each of these handles data under its own terms and privacy policy. Data is not shared with anyone else, and the app uses no third-party advertising or analytics.

Oura data

If the owner connects their Oura account, the app stores the access credentials Oura issues, and the health data it retrieves (such as sleep, readiness, activity, heart rate and workouts), in the private database described above. The credentials are used only to fetch the owner's own data. The owner can disconnect at any time from their Oura account settings, which revokes the app's access, and can ask for the stored Oura data to be deleted.

Security

The app is protected by a password, all traffic uses HTTPS, and service credentials are kept on the server only and never exposed to the browser. No system is perfectly secure, but the app is deliberately kept small and single-purpose.

Retention and deletion

Data is kept until the owner deletes it. The owner can delete any of it at any time, and can stop using or shut down the app entirely.

Contact

Questions about this policy can go to henrik@hjkraft.com.

This policy may be updated from time to time; the date above shows the latest version.