Consumer health data privacy policy
This policy covers the consumer health data that the Two Tails app collects. We provide the protections and choices described here to every user, wherever they live. This separate notice also serves Washington's My Health My Data Act (RCW 19.373), which protects Washington residents and people whose consumer health data is collected in Washington. Two Tails is run by Gregory Lum, an individual developer in Washington State, reachable at greg@greglum.com.
Health data we collect and why
- From Apple Health, only if you connect it: workouts (activity type, start and end times, and the app or device that recorded them), each workout's active energy and average heart rate, and your daily step totals for the last 7 days.
- From Oura, if you connect the integration when it becomes available: daily readiness, sleep and activity scores; main-sleep average heart rate variability; temperature deviation; blood oxygen percentage; stress and recovery time; and profile age and biological sex, when available. The snapshot is limited to 30 days.
- Workouts you log: exercises, sets, reps, weight, duration, distance, times, and notes.
- Classes from Google Calendar that you mark attended: the event's title, start and end times, and Google event id, saved as a workout.
We use this data only to sync it between your household's devices and show it to the members of your household. We do not use it for advertising, marketing, or profiling, and we do not sell it.
Where it comes from
- Apple Health on your iPhone, after you give permission.
- Your own Oura account, after you give permission.
- What you type into the app.
- Your own Google Calendar, after you connect it.
What we share and with whom
All of the health data above is shown to every member of your household, including people who join later. The app tells you this and asks before you join a household and before you connect Apple Health or Oura.
We share it with no other third party and have no affiliates. Amazon Web Services stores it for us as our processor, only to run the app.
Optional AI features never send the health records listed above to a model. Our server removes workout, fitness, and Apple Health fields before a feature reads a request. Imported Oura snapshots are not sent to AI. Your chosen text or the list item names used by a feature may mention health. Those inputs go to Amazon Bedrock, operated by Amazon Web Services as our AI processor, only after cloud AI consent. They are not stored or used to train models, as described under AI drafts.
Your rights and how to use them
- Confirm and access: see your data in the app, or email us for a copy and a list of everyone we have shared it with.
- Withdraw consent: tap "Stop sharing Apple Health" in the Fitness tab, disconnect Oura in Fitness, or disconnect Google Calendar in the Calendar tab. Leaving your household stops new Oura imports but keeps the snapshot already shared until it expires. Disconnect Oura to remove that snapshot too.
- Delete: delete your account in the app, or email us. Deleted data leaves our backups within 35 days. Oura snapshots have no point-in-time backups and expire within 30 days; expired rows are hidden while automatic deletion can take longer. Disconnecting removes snapshots from the active database before provider revocation.
To make a request, email greg@greglum.com from the address on your account, or tell us how you sign in so we can confirm the account is yours. You do not need a new account. We answer within 45 days and do not charge. Any shorter deadline required by law still applies.
Appeal: if we decline your request, reply to our answer with "Appeal" in the subject. We will tell you in writing within 45 days what we decided and why. If we deny your appeal, people protected by Washington's law can complain to the Washington State Attorney General using the online complaint form.