Privacy

HC Sync processes health records that your app users choose to share, on your behalf. Records are stored in US Supabase Postgres and deleted automatically 13 months after their start time. You decide what is collected and why; HC Sync processes it only to run the service.

Last updated: 2026-11-04. Source for the 2026 service details: HC Sync page details.

Operated by Shahar Frish, Israel. Contact: shaharfrish6@gmail.com.

HC Sync stores health records that your app's users choose to share, on your behalf. You (the developer) decide what is collected and why; we process it only to run the service.

What does HC Sync store?

• Health Connect records your app uploads: type, start and end time, values, the id Health Connect gave the record, and the app that wrote it.
• The user id you assign. We never see names, emails or phone numbers unless you put them in that id. Don't.
• Your project name, a hash of your secret key, your webhook URL and signing secrets.

Where and how is data stored?

• Database: Supabase Postgres in AWS us-east-1, encrypted at rest. API: Vercel, region iad1 (US East). Traffic is HTTPS only.
• We read your data only to answer your API, webhook and MCP requests, and to debug a problem you report. We don't sell it, share it for advertising, or use it to train models.
• Error logs record error codes, not health values.

How long is data retained?

• Records are deleted automatically 13 months after their start time.
• DELETE /v1/users/{id} erases one user's records at once and blocks their device token. DELETE /v1/project erases the project and everything in it.
• Deletion notifications are attempted as records.deleted and user.deleted events. Delivery is not guaranteed: Signed events with ids for dedupe. Queued events retry in order every 5 minutes, on sync or replay, for up to 7 days. The queue holds 500 events per project; new events are discarded when full. Record writes and event queuing are separate, so a failure between them can lose an event. REST exposes current records, but cannot recover missed deletion events.

What data does the website collect?

We count page views by path and referring site only: no cookies or device fingerprints. For anonymous project creation and contact submissions, we store hashed IP addresses and hourly counters for rate limiting; stale counters are removed on subsequent requests. The email you give when creating a project is used for limit warnings, outage notices and billing, nothing else. If you send the "Check my app" form, we keep what you typed (including your email) to reply to you, and delete it on request.

How is signup and contact data processed?

Shahar Frish, Israel, is the controller for project signup and website contact data, separately from processing app users' health data on your instructions. Contact shaharfrish6@gmail.com.

• Project name, email and account/service metadata: to create and operate projects, send service and limit notices and manage billing; lawful basis is performance of our contract with you, or legitimate interests in administering an organizational account where you represent that customer.
• Contact form email, app details and message: to answer your request and discuss the service; basis is steps at your request before a contract, or legitimate interests in answering business enquiries.
• Hashed IP and hourly counters: to prevent abuse; basis is legitimate interests in protecting the service. Path/referrer counts help us understand website use without cookies or device fingerprints.
• Billing records required by law: basis is compliance with legal obligations. Payments are handled by the merchant of record shown at checkout.

We retain account contact data while the project is active, then delete it on project deletion unless needed for an unresolved dispute or legal duty. Contact enquiries are retained while the enquiry is active; request deletion when no longer needed. Rate-limit counters are cleared as described above. Records needed for a legal duty are kept for that duty's applicable period; restricted dispute records only until resolution.

You may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Email the address above; we respond within one month. If law permits an extension for a complex request, we explain why within that month. We may ask for proportionate identity verification. You may complain to a competent data protection supervisory authority, including in your habitual residence, workplace or where an alleged infringement occurred, or the UK ICO where applicable. Health-data requests should go to your app provider; we assist them under the DPA.

Signup email is required by the signup form to operate and contact you about the project. Contact form data is supplied by you. We use the providers below, with US storage and relevant transfer terms in the DPA; checkout processing is described by the merchant's own notice. We do not make solely automated decisions with legal or similarly significant effects using signup or contact data.

Which subprocessors support HC Sync?

See our subprocessor list: Vercel (hosting), Supabase (database, US), and our merchant of record shown at checkout (payments, never health data). The DPA provides 30-day advance notice and objection rights.

What roles and child-directed restrictions apply?

• You are the controller of your users' health data; HC Sync is your processor and acts only on your API calls. Data is stored in the US. The DPA is incorporated into the Terms for every customer, with applicable EU SCCs and UK Addendum by reference.
• Child-directed integrations involving users under 16 are prohibited unless agreed with us in writing.

What Health Connect disclosures must your app make?

Your app must ask the user for each Health Connect permission and show a privacy policy that says data goes to your servers through HC Sync. Use of Health Connect data must follow the Health Connect permissions policy, including its limits on advertising and data sales.