Privacy Policy
Last updated: 2026-11-11
This policy covers the My Health Engineer (MHE) app on iPhone, Android and the web. We never sell your data, and we never use your app or health data to show you ads.
1. Who we are
My Health Engineer is the registered business name of Keith Young, a sole trader in Ireland (registered business name number 768945), of Hillhead, Ardara, Co. Donegal, F94 C640, Ireland. We decide how and why to use your data, so we are the "controller" under the EU and UK General Data Protection Regulation (GDPR). Contact us at support@myhealthengineer.com.
2. What we collect
- Account: name, email, an optional backup email for two-step sign-in recovery, password (hashed), date of birth, sign-in sessions with IP address and device type, and the versions of our documents you accepted.
- Health data: your health details (such as height, sex, pregnancy, menstrual cycle, conditions and medicines), what you log (such as weight, food and meal names, meal photos, sleep, workouts and readings), your plan and what the app works out from them.
- Steps: if you allow it, the app reads your steps from Apple Health, Health Connect or Samsung Health: daily totals, your past step history, and steps minute by minute to find your walks. We use steps to show your activity, estimate the energy you use and shape your plan. Steps are health data, covered by your health-data consent. The app reads nothing else and writes nothing back. Turn access off in your phone's settings.
- Membership: type, status, dates and price. On our website, Stripe collects your card and billing address. We receive your billing and card countries, never your card number.
- Technical: IP addresses for security, error reports, and analytics if you turn it on.
The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.
Most data comes from you. The rest comes from your phone's health app, Apple or Google sign-in, the app stores, Stripe and your device. We do not collect your precise location, your contacts or an advertising identifier.
An account needs an email, a password (or Apple or Google sign-in) and your date of birth. Plans need your health details and your consent. Paying needs payment details. Everything else is optional.
3. Why we use it, and our legal reason
| What we do | Legal reason under the GDPR |
|---|---|
| Run your account and membership, send service emails | Contract |
| Build your plan, targets, safety checks and reports from your health data | Your explicit consent (Articles 6(1)(a) and 9(2)(a)) |
| Fixing problems and support by our founder or development team (section 4) | Your explicit consent |
| Analytics, news by email, website cookies | Your consent |
| Keep payment records for tax, and answer your requests | Legal obligation |
| Keep proof of your consents and of account deletion | Legal obligation, and our legitimate interest in defending legal claims (Article 9(2)(f) for health information) |
| Prevent abuse, fix errors and log staff access | Our legitimate interest in a safe, working app. Where these records include health data, we rely on your explicit consent (Article 9(2)(a)) |
Health data needs your explicit consent. The GDPR treats health data as special category data. We ask for your consent, separate from our Terms, before you save any health detail, and we record what you agreed to and when.
Withdrawing consent. Withdraw at any time in your account settings or by email. You choose to delete your health data now, or to keep it stored and unused. We erase stored data 12 months after you withdrew, and we email you before we do. If you withdraw by email without choosing, we erase it within one month. Withdrawing does not affect what we did before. It pauses the health features, and it does not cancel your membership.
4. Automatic safety decisions
The app applies fixed rules to your health details to decide which programs, calorie targets and options are open to you. For example, it may close fasting to you because of pregnancy, a condition or a medicine. Email us to have a person review a decision, give your view or challenge it.
Access to member data is limited to our founder or our development team. We use it only to fix problems or when you ask for help. Nobody watches your entries, so do not rely on this for your safety.
5. Who helps us run the app
Service providers help us run the app, mostly acting only on our instructions under contracts that require them to protect your data:
- EU: Supabase (database and file storage), PostHog (analytics, if you turn it on), Sentry (error monitoring) and Brevo (our email list, if you join).
- EU servers with a worldwide network: Vercel (hosting).
- US: RevenueCat (app store purchases), Stripe (website payments), Resend (service emails), Upstash (rate limits), Cloudflare (bot check at sign-up) and Samsung (Samsung Health, if you connect it. Samsung's software sends Samsung your phone model, your mobile network and region codes and our app's name and version, never your steps).
Apple and Google handle sign-in, store purchases and your phone's health app under their own privacy policies. Stripe, Apple and Google also use some data for their own legal duties and fraud checks. If you agree to analytics cookies on our website, PostHog receives data about your website visits, never data from the app. We share data with authorities only when the law requires. If we transfer the business, we tell you first.
When your data leaves the EU or the UK, we rely on the EU-US Data Privacy Framework and its UK extension for certified providers, and on Standard Contractual Clauses with the UK addendum for the rest. Data moving from the UK to us in Ireland and the EU relies on the UK's adequacy regulations for the European Economic Area. Email us for a copy.
6. How long we keep it
- Account and health data: while you have an account, even after your membership ends, unless you delete them.
- Payment records: six years from your last payment, as Irish tax law requires. Once you delete your account, we remove your name, email and IP address from them.
- Proof of your consents and of account deletion, and logs of staff views: six years.
- Error reports, rate limits and analytics events: up to 12 months.
- Addresses that asked not to be emailed, or that bounced: kept, so we never email them again.
- Tester data: until 31 January 2027, unless it belongs to your account.
- Backups: deleted data leaves our backups within six months.
7. Your rights
You can access your data, take a machine-readable copy, correct it, delete it, restrict our use of it, object to uses based on our legitimate interests or to marketing, withdraw consent, and ask a person to review an automatic decision.
In your account settings you can download everything we hold about you, delete types of data, withdraw consent and delete your account. Or email us from your account's address, so we can confirm it is you. We answer within one month. Complex requests can take up to two months more, and we tell you why. Requests are free.
8. Security, age and cookies
We use encrypted connections, private file storage and hashed passwords. If a breach puts your data at high risk, we tell you without undue delay.
MHE is for people aged 18 and over. If we learn that an account belongs to someone under 18, we close it and delete its data, except what section 6 says we must keep.
The app uses cookies to keep you signed in. Analytics is off until you turn it on, and it never includes health values. Our website uses analytics cookies only if you agree in its cookie banner. Our Cookie Policy lists each one.
9. Changes and complaints
If a change to this policy matters, we tell you in the app or by email. If it affects your health-data consent, we ask for your consent again.
Email support@myhealthengineer.com with a question or a complaint. We reply promptly. You can also complain to a regulator at any time:
- Ireland: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, www.dataprotection.ie
- UK: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, www.ico.org.uk