How Udapt handles your data

1 What Udapt reads from Apple Health

With your permission, Udapt reads sleep, heart rate variability, resting heart rate, heart rate, wrist temperature, body weight, height, date of birth, biological sex, walking, running, cycling and swimming distances, workouts (including the runs, rides and swims other apps and devices save to Apple Health), dietary energy logged in other apps, and menstrual cycle dates — to build each day's plan. None of this ever leaves your phone. It is read from Apple Health, used to calculate that day's plan, and discarded; other apps' workouts are counted in your plan but not copied into Udapt.

Morning reading. If you turn on the morning reading in Settings, Udapt also asks to read your mindful sessions and the heartbeat timings your Apple Watch saves during a Breathe session. It asks only when you save the setting turned on, uses only Apple’s own Breathe sessions and Apple Watch heartbeats, and works out a heart rate variability reading from them on your phone. Like everything else here, they never leave your phone.

2 What Udapt writes to Apple Health

When you finish a logged workout, or a session of My own plan, Udapt saves it to Apple Health as a workout entry so it appears in the Health app alongside your other activity. A strength workout logged on iPhone is saved with its type and duration only (no estimated calorie burn, since Udapt has no way to measure that accurately). A run, walk, ride or swim that Udapt records, and a strength workout recorded on your Apple Watch, is saved with what your iPhone or Watch measured during it: distance, heart rate, active energy and, outdoors, your route.

Location. With your permission, during a run, walk or ride recorded on your iPhone, Udapt uses your location to measure distance and pace and to save your route to Apple Health. It's used only while that session is running, it isn't kept by Udapt, and it's never sent anywhere.

3 Cycle data

If Apple Health has at least two logged menstrual cycles, Udapt can, by default, compare your heart rate variability and resting heart rate against your own normal for that phase of your cycle rather than an overall average. You can turn this off in Settings. A separate, off-by-default setting adds a small calorie allowance in the luteal phase. Cycle data is used only in this on-device calculation and never leaves your phone.

4 What Udapt stores on your device

Your onboarding profile (date of birth, sex, height, weight, activity level, goals, training days and places, home equipment, level, and your running, cycling or swimming plan), your health check answers (five yes-or-no questions about your heart, fainting or dizziness, heart-rate medicine and any limits your doctor has set, plus whether you’ve told Udapt your doctor has cleared you), morning check-ins, workout logs, runs, rides and swims, unwell and travelling days, the bone builder, food logs, protected joints, any exercise substitutions you've chosen, and My own plan (the exercise plan you enter from your physio, doctor or rehab team, with the sessions and notes you log against it) are saved in a file on your phone only. This file is encrypted at rest by iOS, and is explicitly excluded from iCloud Backup — it never leaves your device, including if you back up your phone. This follows Apple's own App Review requirement that personal health information isn't stored in iCloud.

5 Photo and voice food logging

If you take or choose a photo of a meal, or describe it out loud, Udapt uses Apple's on-device intelligence to identify what's in it and estimate portion sizes. The photo, the audio, and the model all run entirely on your phone — nothing is ever sent anywhere. The model only identifies foods; the actual calorie and nutrient numbers always come from the same on-device food database a manual search uses, and you review and edit everything before it's logged. This only works on devices that support Apple Intelligence; Udapt simply hides the feature where it doesn't.

6 The one exception: barcode scanning

If you scan a food's barcode, the barcode number — and only the barcode number, never a photo or any information about you — is sent to Open Food Facts, a nonprofit, open food database, so it can identify the product. This is disclosed the first time you use the feature. Searching for food by name never leaves your device.

7 Subscriptions and payment

Udapt is offered as an auto-renewing subscription, handled entirely by Apple's App Store — Udapt never sees or stores your payment details. Apple provides Udapt with a cryptographically-verified record of your subscription status, which is checked on-device; no subscription or purchase data is sent to any server Udapt operates, because Udapt operates none.

8 What Udapt does not do

Udapt contains no third-party analytics SDKs, no advertising networks, and no trackers of any kind. There is no account or sign-in of any kind. There is nothing to opt out of, because nothing is being collected.

Apple Watch. If you use the Udapt app on your Apple Watch, your iPhone sends today’s plan to your Watch, and the Watch sends back what you do there (finished workouts, runs, rides and swims, your check-in answers, including whether you did your morning Breathe reading, swaps and where you’re training), directly between your own devices using Apple’s Watch connection. Nothing goes to a Udapt server. The Watch keeps a small copy of today for its complications, kept out of backups like the rest of Udapt’s data.

Widgets. If you add Udapt’s widgets to your Home Screen or Lock Screen, the app keeps a small copy of today’s plan (readiness, workout name, today’s run, ride or swim, today’s calories and protein) in a storage area shared only with its own widgets, on your iPhone. On the Lock Screen these values are hidden while your iPhone is locked. Like the rest of Udapt’s data, it’s kept out of iCloud Backup. Delete all my data clears it. While a workout is running, a Live Activity shows the current exercise, set and rest timer on your Lock Screen and in the Dynamic Island; it ends when you finish or cancel the workout.

Siri and Shortcuts. Asking Siri or a shortcut for your readiness, or to log your usual breakfast, needs your iPhone to be unlocked first, so nobody can hear your readiness or change your food log from a locked phone.

Links to other websites. Some buttons open another website or app when you tap them — for example Watch on YouTube on an exercise, a research paper, or this website. Udapt doesn’t send anything about you: a YouTube link contains only the exercise’s name as a search. Once you’re on that site or app, its own privacy policy applies.

9 Sharing your data

We don't share, sell or rent your data to anyone — there is no data on our servers to share in the first place. The only parties who ever touch anything are:

If you use Share my sessions in My own plan, Udapt makes a plain list of your logged sessions on your phone and hands it to the share sheet. It goes only where you choose to send it (for example, a message to your rehab team). Udapt never sends it anywhere itself.

10 Deleting your data

Settings → Delete all my data permanently removes your profile, health check answers, check-ins, workouts, runs, rides and swims, unwell and travelling days, the bone builder, food logs, protected joints, exercise substitutions and My own plan (with its logged sessions) from your phone, along with the widgets’ copy of today. It also clears your Apple Watch: your iPhone sends it an empty plan, which replaces the Watch’s copy of today when the two next connect, and any workouts, runs or check-ins the Watch hadn’t yet sent are cancelled rather than saved. This does not touch anything already stored in Apple Health — manage or delete that separately in the Health app, since it belongs to you, not to Udapt.

11 Children's privacy

Udapt is for adults aged 18 and over. When you first open it, Udapt asks “Are you 18 or older?”. This is your own answer: Udapt does not check it and does not send it anywhere. Only a Yes is kept, as a small file on your iPhone that is not backed up, so you are not asked every time; a No is not stored. If the date of birth saved in Udapt shows you are under 18, Udapt does not read Apple Health or show a plan, and you can delete what Udapt saved on your iPhone. Settings → Delete all my data also removes the saved Yes. Udapt does not knowingly collect information from anyone under 18.

12 Security

Your data benefits from iOS's standard app sandboxing, file-level encryption, and exclusion from iCloud Backup. Because there is no Udapt server or account, there is no central database of users' data that could be breached on our end.

13 Changes to this policy

If this policy changes, the "Effective" date above will change. Material changes will be reflected in the App Store listing's version notes.

14 Contact

Questions about this policy or your data can be sent to info@isafenet.app.