Your health information stays in your control.

Optional home-screen widgets

Quick Dock and Daily Wellness Compass contain shortcuts and general prompts, not health readings. While the Local Conditions widget is installed, HealthScope keeps only its latest displayed temperature, weather label, AQI, air-quality label, resolved locality or postal code, and update time in private app preferences. This widget cache is the only exception to the short in-memory locality cache described below; it never contains raw coordinates or Private Health readings. Removing the last Local Conditions widget clears the cache. Anyone who can see the unlocked home screen may see the locality, weather, and AQI displayed there.

What HealthScope is

HealthScope is an Android wellness, health-information, and personal-record companion. It is not an emergency service, a diagnostic tool, a prescribing service, or a clinical-record system.

Information used by the app

Private Health can store information you choose to enter: Emergency Medical ID details, medication schedules, personal record notes, food and hydration logs, sleep and recovery notes, calibration settings, optional Today-dashboard card choices, and optional wearable-history snapshots. A wearable-history snapshot can include eligible daily totals, optional vitals, a supported workout summary, or a HealthScope Wear asleep/awake interval estimate. These records are encrypted in device storage. Android automatic app backup is disabled for HealthScope.

The public side keeps your onboarding-completion choice, selected medicine country or region, a small cache of research-link metadata and the current daily brief, and up to 30 articles you explicitly save. This ordinary app storage is separate from encrypted Private Health storage. The research cache provides an offline fallback for up to 24 hours; saved articles remain until you remove them, clear article data, clear app storage, or uninstall the app.

With your separate, explicit action, HealthScope can use phone location while the app is open for local weather and air quality; use the phone step sensor and foreground location for a user-started Movement Tracker session; use the camera to scan a food or medicine code; schedule local medication, appointment, and wake reminders; and read only the Health Connect categories that you select and approve. Movement Tracker readings and settings remain in the current session and are not uploaded as a movement record. Depending on what a compatible source app makes available, Health Connect categories can include activity, exercise, sleep, hydration, nutrition, heart rate, heart-rate variability, oxygen saturation, and skin temperature. Pixel Watch users can choose Google Health with Health Connect, and Galaxy Watch users can choose Samsung Health with Health Connect, instead of installing HealthScope Wear. Health Connect readings remain in the current session unless you explicitly enable encrypted local wearable history. Source-app, device, region, and permission support varies. The experimental Health Connect medical-record view checks device capability and Android consent, then shows count summaries only. It does not copy raw FHIR resources into Private Health.

HealthScope Wear is an optional direct companion for supported Wear OS watches. With watch permissions and direct sharing enabled, it can read supported daily steps, distance, calories, floors, elevation, workout metrics, an asleep/awake interval estimate, and heart rate during an explicit live measurement or supported workout. Optional live heart-rate measurement ends after two minutes, or after one minute at 15% battery or lower while not charging. A workout can continue through a visible foreground notification after the screen closes. Direct sleep is an interval estimate, not sleep-stage or clinical tracking, and every metric depends on device capability.

While direct sharing is enabled, the latest supported snapshot and up to six recent reading summaries are held in private, non-backed-up watch storage. The HealthScope tile, watch-face complication, and active-workout notification can display selected values on the watch, where someone who can see the watch or notifications may see them. The snapshot is sent to the matching, identically signed HealthScope phone app through the Wear OS Data Layer. The Data Layer may use encrypted Bluetooth or route end-to-end encrypted data through Google Cloud when Bluetooth is unavailable. Phone readings remain session-only unless you enable encrypted local history. Turning off direct sharing clears the watch snapshot and recent-reading list. Health Connect is not used for this direct route and remains a separate option for Pixel Watch, Galaxy Watch, and other compatible sources.

Internet services and external requests

After you grant location access, current coordinates are sent to Open-Meteo for weather and air quality while HealthScope is open and unlocked. Android location or geocoding services may also process coordinates to resolve a locality or postal code. HealthScope keeps the resolved area only in a short in-memory refresh cache and does not save raw coordinates. Google News RSS research links and source icons can refresh automatically while the app is open; Google may receive the source domain when an icon is requested.

When you request a lookup or open an external result, the relevant query, code, or URL is sent to the selected service. Current examples include Open Food Facts India/global, US FDA openFDA and Health Canada's Drug Product Database for compatible public medicine lookups, official medicine registries that you explicitly open, and an optional validated-interaction proxy configured for a release. Opening the country-medicine section sends only the typed medicine name to the selected official public source when that market has a compatible live lookup; the app does not save the query or attach the phone's location or postal code. For other listed markets, HealthScope does not transmit the medicine name and instead offers an official registry link. The bundled retailer directory is informational only: no medicine query is sent to a retailer, and HealthScope does not request or claim product stock, price, dispensing, delivery, or suitability.

These third-party services can receive ordinary connection information such as an IP address and have their own privacy and retention terms. HealthScope does not attach your Private Health database to these requests. Do not place passwords, payment details, or full medical records in free-text queries.

Encrypted recovery and account sync

HealthScope can create a recovery package encrypted on the phone with XChaCha20-Poly1305 and a recovery passphrase you supply. The passphrase is not stored by HealthScope.

If you configure your own HTTPS WebDAV file URL, account name, and provider-issued app password or token, HealthScope stores the endpoint and credential in device secure storage. It uploads only the encrypted recovery package. The WebDAV provider receives encrypted ciphertext and transfer metadata, not a readable HealthScope record. HealthScope does not operate that provider or hold your passphrase.

Sync stops on a detected two-device conflict and lets you deliberately choose the remote or local copy. You can disconnect the account or delete the remote encrypted package from the app.

Your choices, sharing, and deletion

HealthScope opens the Android share sheet only after you choose to share an Emergency Medical ID, caregiver medication brief, support note, synchronization diagnostic, or encrypted backup. A support note contains the app version and a prompt asking you to describe the issue in the destination app. A synchronization diagnostic contains route/status information, timestamps, selected-category counts, and whether encrypted wearable history is enabled. Neither diagnostic automatically includes health measurements, medicines, private notes, credentials, or device identifiers. Review the recipient and content before sending.

You can remove saved articles or use Clear article data to remove the research cache, daily brief, and saved reading list. You can remove individual records and reminders in Private Health. The Delete Private Health data control removes Private Health data and scheduled reminders from that phone. Delete remote package deletes the encrypted WebDAV file but does not erase a provider's backups, logs, or recycle bin. Disconnect removes configured account details from this phone. You can stop an active HealthScope Wear workout, turn off direct sharing to clear its published snapshot and recent-reading list, remove its tile or complication, revoke watch sensor permissions in Wear OS settings, and revoke Health Connect, camera, location, and notification access in Android settings.

Security and limits

Device encryption and secure storage depend on the phone and operating system. HealthScope requests secure-window protection so its phone screens are excluded from ordinary screenshots, screen recording, and recent-app previews while the app is open. No security measure removes all risk: protect your phone, watch, WebDAV account, recovery passphrase, and backups.

The current phone and Wear OS apps do not include advertising, behavioural-analytics, or third-party crash-reporting SDKs. HealthScope does not sell private-health data, use it for advertising, diagnose, prescribe, order medicine, or contact caregivers automatically. External services may keep their own operational or security logs under their respective policies.

Children

HealthScope is not designed for independent use by children. A parent, guardian, or caregiver should make health and sharing decisions where appropriate.

Changes to this policy

Material changes will be reflected in the app release and in this policy's effective date. This page is the public, non-PDF HTTPS version of the HealthScope privacy policy for Google Play distribution.

Language preference

The public side stores the app language you select in ordinary local app storage. It is used only to present HealthScope in your preferred language. System default follows a supported phone language and otherwise uses English. Clearing app storage or uninstalling the app removes this preference.