Privacy Policy

Effective October 5, 2026

Health Peak — the website health-peak.net and the iPhone app — shows you your own data from Apple's Health app: personal records, health metrics, workouts on a map and a wellbeing index. This page says what data we receive, what we do with it and how to delete it.

In short: data reaches us only through your own action, is used only to show it back to you, is never sold, never shared with advertising networks or data brokers, and never used for advertising or tracking. You can delete all of it from your profile at any time.

Who is responsible

The data controller is Kirill Petrachev. For any question about your data, write to kirnet1982@gmail.com.

What data we receive

• Account data: name, email address, a one-way hash of your password (if you signed up with one), and the time of your last visit.
• Health data: activity (steps, distances, energy, flights climbed), heart rate and its variability, sleep, weight and other body measurements, blood oxygen, running, cycling and swimming metrics, and workouts.
• Workout routes: GPS tracks — your precise location along a workout, with the time and speed at each point.
• The whole export. If you upload the archive the Health app produces ("Export All Health Data"), the site imports all of it — every record type the file contains, including date of birth, sex and the clinical document export_cda.xml. The unpacked archive is kept on the server as well.
• Support messages: if you write to our Telegram bot — your messages, plus your Telegram name, username and chat identifier.
• Technical data: the IP address, time and address of each request go into the web server log, as on any website.

Where it comes from

• An export uploaded in your profile. You choose the file and send it yourself.
• The iPhone app. The app reads Health with your permission and works entirely on the device. Data leaves the phone only after you connect a website account and confirm it on the consent page — only to your own account, and only while the connection is on. Without a connection the app sends us nothing.
• Sign in with Google or Apple. From them we receive your name, email address and account identifier.

What it is used for

To show you the dashboard: records, metric charts, workout maps, heart rate zones and the wellbeing index; to let you sign in; to answer you in support. Nothing else.

• We show no advertising and do not use your data for it.
• We do not sell your data or share it with advertising networks, data brokers or third-party analytics services.
• We keep our own statistics of visits to public pages (landing, sign-in, sign-up, this policy): page address, referrer, country, device and browser type. It is stored only on our server, with no cookies and no sharing with third parties. The dashboard, workout links and Health data never reach it. There are no third-party trackers on the site or in the app.
• We do not use your data to train models or to build profiles for third parties.

Who can see it

• You — after signing in.
• Anyone you give a link to. A workout can be shared: anyone holding the link sees it — the route on a map, time, distance, speed, heart rate zones and the device name. Your name and email are not shown. The link works until you revoke it in your profile or in the workout itself.
• The service administrator. An administrator can open a user's dashboard read-only, to look into a support request or a fault. Every such viewing is logged. The administrator also sees the list of accounts (name, email, time of last visit) and support conversations.

Third-party services

We do not pass Health data to anyone. While the site works, though, your browser or our server talks to these services:

• Google and Apple — if you sign in through them. They learn that you signed in to our site.
• Telegram — if you write to support. Messages travel through Telegram and are stored by it under its own terms; staff replies are sent through Telegram too.
• OpenStreetMap — the map under a route. Your browser loads its tiles from OpenStreetMap servers, which see your IP address and the area of the map you are looking at. The route itself is not sent to them.
• Bunny Fonts — the page font is loaded from fonts.bunny.net; that server sees your IP address.
• Hosting — the site and its database run on a server rented from Contabo GmbH. The server is located in France (European Union).
• Email delivery — address confirmation and password reset emails go through it; it receives your email address.

Cookies

Only the necessary ones: a session cookie (to keep you signed in), a form-protection cookie, "remember me" if you ticked it, and your chosen language. Your chosen theme is kept in the browser and never sent to the server. There are no advertising or analytics cookies: visit statistics work without them.

How to delete your data

• Delete the account — in your profile, under "Delete Account". Removed at once: the account, every imported record, workouts and routes, uploaded archives and unpacked files, shared workout links, and app connections. If you signed in with Google or Apple, we revoke the access they granted us.
• Delete uploaded files — in your profile, next to the export. This removes the files on the server (the archive and the unpacked export, route files included); records already imported into the database stay. To erase those too, delete the account or write to us.
• Disconnect the app — in your profile, under "Connected apps", or in the app itself. The app then sends nothing further; data already sent stays in the account.
• Revoke a shared workout link — in your profile or in the workout itself.

Important: a record you delete in Health on your phone stays on the site — the app does not tell us about deletions. To erase it here, delete the account or write to kirnet1982@gmail.com.

Support conversations are not deleted automatically with the account: they lose their link to it but remain with us and in Telegram. We delete them on request.

How long it is kept

• Account and Health data — for as long as the account exists. There is no automatic expiry.
• Backups. A copy of the database is made with every update of the site; the last ten are kept. Deleted data leaves them as older copies are replaced by newer ones.
• Server logs hold technical entries (request addresses, errors, account numbers); we do not write Health data into them.
• A suspended account is not deleted: its data stays until you or we delete the account.

Security

The site and the app's uploads use HTTPS only. Passwords are stored as hashes. The app receives its own access key, which you can revoke in your profile, and never learns your password. Only the controller has access to the server.

Your rights

At any time you can view your data on the site, correct your name and email in your profile, delete data in the ways described above, and ask us what data we hold about you or to delete it — by writing to kirnet1982@gmail.com. We answer within 30 days. If you believe your rights have been infringed, you may complain to the data protection authority in your country.

Children

The service is not intended for children under 16, and we do not knowingly collect their data. If you learn that a child has created an account, write to us and we will delete it.

Not a medical service

Health Peak is not a medical device, makes no diagnoses and gives no medical advice. The wellbeing index, heart rate zones and the other calculations are reference estimates from your own data. For health questions, see a doctor.

Changes

If this policy changes, we will publish the new text on this page and update the date at the top. We will announce material changes — a new purpose for the data, for instance — in advance, to the account's email address.