Privacy Policy
Wellness awareness only
ONESS is not a medical device. It does not diagnose, treat, cure, or prevent any disease. The Service is intended for general wellness awareness only and is not a substitute for professional medical advice.
In one minute
Your health data lives in your Apple Health app. With your explicit permission, ONESS reads a defined list of signals to compute your Oxygen Adequacy Score. ONESS writes mindful sessions, breath-work workouts, and camera-PPG heart-rate samples back to Apple Health — nothing else. Readings are stored on our own EU servers (Hetzner, Germany), keyed only by a one-way hash of your user ID. We share your data with no one. You can delete your account from inside the app.
Contents
1. Who we are
ONESS is operated by Aoshi Health ("we", "us", "our"). The legal entity form is being finalised (Dutch BV formation in progress Q4 2026 → Q1 2027). Contact us at privacy@aoshihealth.org.
2. What ONESS does
ONESS is a wellness awareness iOS application. It reads health-related signals from your Apple Watch and iPhone (via Apple HealthKit), optionally queries public environmental data (air quality via the Dutch government's Luchtmeetnet.nl network), and computes an Oxygen Adequacy Score (OAS, 0-100) plus trend insights.
3. Data we READ from Apple Health
With your explicit, per-category consent through Apple's HealthKit permission sheet, the App reads these types from Apple Health:
Core OAS inputs
| Data type | HealthKit identifier | Why |
|---|---|---|
| Oxygen saturation (SpO₂) | HKQuantityTypeIdentifierOxygenSaturation | Primary input to the OAS |
| Heart rate | HKQuantityTypeIdentifierHeartRate | Activity and stress context |
| Heart rate variability (SDNN) | HKQuantityTypeIdentifierHeartRateVariabilitySDNN | Autonomic recovery signal |
| Respiratory rate | HKQuantityTypeIdentifierRespiratoryRate | Breathing pattern context |
| Step count | HKQuantityTypeIdentifierStepCount | Activity level over the last hour |
| Sleep analysis | HKCategoryTypeIdentifierSleepAnalysis | Overnight recovery + sleep duration |
Demand-model profile inputs (read once)
| Body mass | HKQuantityTypeIdentifierBodyMass | Personalises VO₂ demand estimate |
| Height | HKQuantityTypeIdentifierHeight | Same |
| Active energy burned | HKQuantityTypeIdentifierActiveEnergyBurned | 7-day activity baseline |
| Biological sex | HKCharacteristicTypeIdentifierBiologicalSex | BMR equation input |
| Date of birth | HKCharacteristicTypeIdentifierDateOfBirth | BMR equation input (age) |
Fitness vitals surfaced on the Dashboard
| VO₂max | HKQuantityTypeIdentifierVO2Max | Fitness-trend indicator |
| Resting heart rate | HKQuantityTypeIdentifierRestingHeartRate | Trend card |
| Walking heart rate average | HKQuantityTypeIdentifierWalkingHeartRateAverage | Trend card |
| Cardio recovery (1 min) | HKQuantityTypeIdentifierHeartRateRecoveryOneMinute | Trend card |
Respiratory + clinical lab data (opt-in Lifespan tab)
| FEV1 (spirometry) | HKQuantityTypeIdentifierForcedExpiratoryVolume1 | Lifespan field |
| Peak expiratory flow rate | HKQuantityTypeIdentifierPeakExpiratoryFlowRate | Lifespan field |
| Clinical lab records | HKClinicalTypeIdentifierLabResultRecord | Auto-fill HbA1c, Hemoglobin via FHIR Observations |
| Clinical vital-sign records | HKClinicalTypeIdentifierVitalSignRecord | Auto-fill blood pressure via FHIR |
You can see the full requested set at any time in iPhone Settings → Health → Data Access & Devices → ONESS. Revoking any category stops ONESS reading it immediately.
Focus Session metadata (opt-in Sync-tab feature, Build 78+)
When you start a Focus Session (Workout, Meditation, Meal, Commute, Outdoor, Focus, or Custom), ONESS records the session type, the start and end timestamps, the computed OAS trace for that window, and — if you choose a "Custom" session type and type a label — your free-text label verbatim. This data is stored on our own EU servers (Hetzner, Germany) under the same one-way-hashed user ID posture as everything else, so you can view your session history on a bigger screen via the admin dashboard. Sessions remain on your device even if the server upload fails; the server copy is a convenience, not a dependency. You can delete all session data by deleting your account.
4. Data we WRITE to Apple Health
With your explicit consent, ONESS writes these types back to Apple Health:
| Data type | HealthKit identifier | When written |
|---|---|---|
| Mindful sessions | HKCategoryTypeIdentifierMindfulSession | End of each Meditation session you complete |
| Workouts (Mind and Body) | HKWorkoutTypeIdentifier | End of each Breath Works session |
| Heart rate | HKQuantityTypeIdentifierHeartRate | After a successful camera-based PPG reading. Each sample is tagged ONESS.source: camera_ppg. |
ONESS writes no other data types.
5. Device-level permissions we request
| Permission | Why |
|---|---|
| Camera | On-device PPG reading. Frames are processed on-device; brightness samples never leave the phone. |
| Location (While Using) | Dashboard Air Quality card. Your coordinates are routed by the ONESS backend to Luchtmeetnet.nl (RIVM, inside the Netherlands) or OpenWeatherMap (modelled CAMS data, everywhere else). Coordinates are rounded to ~1 km and never stored on our servers. |
| Notifications | Daily reminders. Opt-in. |
6. Data we DO NOT collect
- Your name, email, address, or phone number unless you volunteer them.
- Precise GPS traces or location history. The Air Quality card uses your current position for a single lookup; we never store or map your movements.
- Advertising identifiers (IDFA).
- Device tracking across other apps or websites.
- Photos, contacts, calendar, microphone.
- Apple Health data beyond the types listed in §3 and §4.
7. How we store your data
- Infrastructure: Hetzner Falkenstein (Germany, EU). TLS 1.3 for every connection.
- Edge: Cloudflare EU edge, under a 2021 SCCs Module 2/3 DPA. TLS terminates at Hetzner, not Cloudflare. No PII in headers or URL parameters.
- Profile store: SQLite on an encrypted volume, keyed by user ID.
- Time-series store: InfluxDB, keyed by
sha256(user_id)[:16]. The plaintext user ID is never written to the time-series store. - Backups: GPG-encrypted to Backblaze B2 EU-Central. Deleted on account deletion within the next backup cycle.
- Audit log: append-only JSONL, hashed user ID only. IEC 62304 §8.2 traceability for the OAS model.
- Auth tokens: short-lived JWTs (default 60 minutes) in iOS UserDefaults on your device.
8. Data we share
Default: we share nothing with anyone. No ads. No brokers. No analytics vendors.
Limited exceptions:
- Apple: Sign in with Apple authenticates you. We receive a per-user opaque identifier and (optionally) a hashed email relay. See Apple's Privacy Policy.
- Hetzner (Germany): hosts our backend. Sees traffic, cannot decrypt application payloads.
- Cloudflare (EU edge): proxies HTTPS. Under 2021 SCCs DPA.
- Backblaze B2 (EU-Central): receives GPG-encrypted backups. Cannot decrypt.
- Luchtmeetnet.nl (RIVM — Dutch government): when your coordinates are inside the Netherlands, your current location is forwarded, in session, to compute the Dashboard Air Quality card. No account identifier.
- OpenWeatherMap (CAMS-based modelled air quality): when your coordinates are outside the Netherlands, your current location is forwarded, in session, to compute the Dashboard Air Quality card. Coordinates are rounded to ~1 km before being sent. No account identifier. Operated by OpenWeather Ltd (UK).
- Apple App Store / TestFlight: delivers the app and crash reports (stack traces, not user data).
- Legal compulsion: we comply with lawful subpoenas; we challenge overbroad requests and notify you where law permits.
9. Your rights
You can, at any time and without justification:
- See the data we hold: email privacy@aoshihealth.org. 30-day response SLA.
- Export your data in JSON.
- Delete your account directly from the App: Settings → Account → Delete my account → type DELETE. Propagates immediately to the profile store and InfluxDB; the next backup cycle removes records from encrypted backup blobs.
- Withdraw HealthKit access in iPhone Settings. HealthKit toggles are governed solely by iOS; we cannot force-revoke.
- Lodge a complaint with your supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens.
EU / EEA / UK — GDPR specifics
- Legal basis for processing health data: explicit consent (Art. 9(2)(a)).
- DPIA completed and filed; DPO contact: privacy@aoshihealth.org.
- No third-country primary-data transfers. Cloudflare edge: 2021 SCCs Module 2/3 with signed TIA.
California — CCPA
We do not sell personal information. "Do Not Sell My Personal Information" requests are honored as no-ops.
10. Children
ONESS is not intended for users under 16. We do not knowingly collect data from users under this age. Contact us if you believe a child has used the Service and we will delete the data.
11. Security
- In transit: TLS 1.3.
- At rest: AES-256 full-disk encryption; GPG-encrypted backups.
- Authentication: Sign in with Apple. No passwords stored. Session JWTs HS256-signed, ≥32-char secret.
- PII minimisation: time-series keyed by hashed user ID.
- Audit log: hashed user ID + input hash per prediction.
- Breach notification: 72-hour notice per GDPR.
12. Changes to this policy
Material changes will be announced in-app at least 14 days before taking effect. Version history: github.com/PrakashTaiwan/oness-o2-engine · docs/legal/PRIVACY_POLICY.md.
13. Contact
- Privacy: privacy@aoshihealth.org
- Support: support@aoshihealth.org
- Postal: Aoshi Health, c/o — address published upon BV formation at aoshihealth.org/privacy.
14. Jurisdiction
Governing law: Netherlands. Disputes heard by the competent court in Amsterdam.