Legal
Privacy Policy
Masala Health is an on-device personal health tracker. The app collects and stores the following categories of information locally on your iPhone:
The website quiz is separate from the iPhone app. Quiz answers are kept in the current browser tab; they are not submitted with an email signup or saved by this website. Closing or reloading the tab clears them.
If you submit an email address, it is sent to Kit, our email service provider, for confirmation and email delivery. Confirming subscribes you to the educational guide and two follow-up emails described on the signup form. Each email includes an unsubscribe link. A separate signup form for our records-and-visit campaign lets us count confirmed subscriptions from that form in Kit. This identifies the signup form, not an individual advertising click, and direct or shared visits may also use it. Email addresses and subscription status are not sent to Google Ads. Kit also handles subscription status and email interaction information under its privacy policy. Do not include medical records or health details in an email signup.
Optional homepage advertising measurement (updated October 17, 2026). The homepage loads a Google Ads tag only if you choose “Allow measurement.” It helps us understand whether an ad leads to a click through to the App Store. A click is not proof of an installation, app activity, or purchase. Google may receive an advertising click identifier, the homepage address, an App Store click event, IP address and browser/device information, and may store advertising cookies. We limit the URL to recognized campaign names and advertising click identifiers; we do not send arbitrary URL text or referring-page URLs in our tag configuration. Google processes this information under its privacy policy.
If you allow measurement, App Store links on an advertising landing visit include our Apple provider token and a fixed campaign label for records/labs, general health tracking, or unclassified advertising traffic. Apple uses these links to report aggregate first-time downloads under its privacy policy. We do not put your email address, health information, Google click identifier, or search query into these links. The keyword-group label comes only from a short list of keywords we chose for our ads. We do not store it in cookies or browser storage. Declining measurement or sending Global Privacy Control/Do Not Track leaves these App Store links untagged. Apple may delay or withhold small counts. These reports do not reveal whether you opened or used the app, and the app contains no advertising tracking SDK.
We disable personalized advertising, enhanced conversions and analytics storage in this tag, and enable Google’s restricted data processing control to prevent use for remarketing lists. We do not send email addresses, quiz answers or results, health records, or app activity to Google Ads. Advertising tags are not loaded on the quiz, its thank-you or guide pages, or in the iPhone app.
Your measurement preference is stored in this browser for up to 180 days. You can decline without losing access to the site or app, or change your choice using “Advertising measurement preferences” in the homepage footer. Withdrawal stops future tag loading and clears the tag's first-party advertising cookies on this site; it does not erase information already received by Google. We also disable measurement when the browser sends Global Privacy Control or Do Not Track. Blocking cookies or scripts may prevent measurement.
The website host receives ordinary web requests, which can include an IP address and browser information; this is separate from the app's on-device storage. Quiz advertising measurement remains disabled: quiz answers and results are not sent to Google or Meta. Email confirmation counts are measured separately in Kit, not inferred from a visit to a public guide or thank-you page.
After first-time setup, or later in Settings, you can choose to open our website and sign up for occasional educational health tips and Masala Health product updates. You can skip signup without losing any app features. Accepting this policy does not subscribe you. This list is separate from the website guide signup described above; signing up for a guide does not by itself consent to this newsletter.
The signup form sends only the email address you enter to Kit, our email service provider, for confirmation and email delivery. Kit records the form you used and subscription and confirmation status. We do not send your app profile, health records, quiz or survey answers, account, installation or device identifiers with the email, and we do not join the newsletter list to app data or survey responses. An email address is personal information; the newsletter is not anonymous.
You must confirm using the email Kit sends before receiving the newsletter. You can unsubscribe in any newsletter. We use your email only to operate this subscription, not for personalized health advice, ad audiences or data brokerage. Kit processes subscription, delivery and email-interaction information under its privacy policy. Website and email infrastructure may also process IP addresses, browser information and operational logs; these are not attached to product-survey answers by us.
We retain the email while you are subscribed. Unsubscribing stops newsletter delivery; minimal suppression records may remain so we do not resubscribe you accidentally. For deletion of your subscriber information, contact privacy@masalahealth.co from the subscribed address. Deleting the app does not unsubscribe you or delete your separate Kit subscription. Please do not enter health details in the signup form.
Almost everything. Health records, lab history, visit notes, any audio recorded by an earlier build, profile data, and AI conversation history stay on your iPhone, where iOS encrypts them at rest through its built-in file protection. None of this is uploaded to our servers or any third-party cloud; the few things that can leave your device are listed under “What leaves the device” below.
There is no Masala Health account, no sync server, and no backup service. If you lose or erase your device, that data is gone unless you maintain an encrypted local iPhone backup through iTunes/Finder.
The following information may leave your device, only when you initiate the relevant action:
You can keep an optional, editable “About me” brief on your iPhone, with background and current circumstances you choose to provide. Saving or pasting text into that brief does not send it anywhere. In Ask, you can choose whether to include the brief and additional record sources in a question. The brief is self-reported context, not a verified clinical record.
When you use the Ask feature, the app constructs a prompt from the relevant context in your records. Before that prompt leaves your device, an on-device redaction step replaces names with neutral aliases (for example, "Person A"), converts specific dates into relative references (for example, "about 3 months ago"), and removes identifiers such as Social Security, medical record, and account numbers, email addresses, phone numbers, street addresses, and ZIP codes. Clinical values, units, and lab codes are preserved so the answer is useful. This redaction meaningfully reduces the risk of re-identification, but it is a best-effort safeguard rather than a formal de-identification — some health context still leaves your device.
The redacted prompt is sent over HTTPS through our relay to Gemini Enterprise — Google's HIPAA-eligible enterprise AI platform, hosted on Google Cloud in a US region. Under our Gemini Enterprise terms, Google processes the redacted prompt to generate a response and does not use your prompts or the model's responses to train its models. Google may retain the redacted prompt for a limited period for abuse and misuse monitoring before deleting it, as described in Google Cloud's service terms. Our relay forwards the request without storing it and keeps only operational metadata — timestamp, status, latency, and model name — never the contents of your prompts or responses. The response is returned to your device and stored locally.
The redacted prompt may include the following categories of information, with names aliased, dates relativized, and SSN/MRN/account numbers, email addresses, phone numbers, street addresses, and ZIP codes stripped before sending:
Selected text can contain sensitive details, including beliefs or circumstances you type or paste. Redaction reduces identifying details but does not make health context anonymous. Ask provides a preview of the outgoing context; choosing a new conversation lets you change its source choices without carrying earlier turns forward.
We do not send full record exports or unredacted personal health information to any AI service.
Under each AI answer you can tap thumbs up or thumbs down. This is optional, and nothing is sent unless you tap. When you do, the app sends us exactly four values and nothing else:
The rating does not include your question, the answer, any health information, a name, an account or device identifier, or any free text, and it is not linked to anything else we receive. Our server stores only those four values and does not record your IP address with them. As with any internet request, the connection itself necessarily passes through our hosting provider’s network infrastructure, which may briefly see an IP address in its own operational logs; we do not use or link it to the rating. Your own thumbs choice is also saved on your iPhone next to the saved conversation so you can see what you tapped; deleting the conversation deletes it. We use ratings only in aggregate to judge whether AI answers are helpful.
Settings → Help & feedback offers a short, voluntary product survey about getting started and what to improve. Nothing is sent until you tap Send answers. We receive exactly five fields: the survey name, your selected getting-started answer, your selected improvement answer, app version, and calendar day in UTC. You may skip either question. The form has no free-text or email field and sends no name, health records, app profile, account, installation or device identifier, or timestamp finer than a day.
Responses are sent securely to our Supabase hosting provider and stored separately from email subscriptions. We use them only to improve the app, do not join them to other datasets, and do not use them for advertising or tracking. Our application does not store your IP address with the responses. Network infrastructure necessarily processes IP addresses and may keep operational logs; we do not use those logs to identify survey respondents. Individual survey rows are automatically removed by a daily retention job after 90 days; provider backups may retain deleted rows until their normal backup expiry. We may keep aggregate counts that do not identify respondents.
Because no respondent identifier is collected, we cannot locate an individual anonymous response by name or email to delete it on request. Written feedback notes elsewhere in Settings remain on your device unless you explicitly export and share them; they are not uploaded by this survey.
If you choose to share a person summary, a doctor checklist, pre-visit questions, or an export of your data — via iMessage, Mail, or any other app — that content leaves your device through the iOS share sheet, exactly as you'd expect when sharing any document. You control what is shared, with whom, and when.
If you connect a health system through MyChart, the app signs you in to that system and downloads your records over HTTPS directly from your provider to your iPhone. The sign-in step passes the authorization code through our relay so that the client secret never has to sit on your phone; no health data travels that path. If you connect a wearable training service using an access token you supply, the app reads your recovery figures — heart-rate variability, resting heart rate, and sleep — along with your workouts, measured training capacity, and planned training schedule from that service.
These connections pull data in. We do not push your records out to them, and you can disconnect either one at any time in Settings.
Masala Health integrates with Apple HealthKit to read the health data you have authorized. We use this data solely to power the features you see in the app — tracking, trending, your Heart Age, and the Ask layer. The app also writes strength-training sessions you log back to Apple Health, so they count toward your activity and are available to your other health apps; it writes nothing else.
These restrictions are required by Apple and reflect our actual practice.
The app no longer records medical appointments. Visit recording, transcription into visit notes, and AI visit summaries have been removed. The only remaining use of the microphone is speaking a question instead of typing it.
If you recorded a medical visit in an earlier beta build, that audio is still on your device so you do not lose access to it. It stays stored locally and encrypted at rest by iOS, and nothing is added to it. You can play it back and delete it from the visit it belongs to, or delete every remaining recording at once in Settings under Privacy & data.
Masala Health is designed to be used by an adult managing health records for themselves and their family, which may include minors. The app is not directed at children under 13 as independent users, and we do not knowingly collect personal information directly from children under 13. Pediatric health records managed within a family profile are subject to the same on-device storage and protections described above.
Your data lives on your device for as long as the app is installed. You can clear your About me brief and delete individual records, profiles, conversations, and any remaining recordings from within the app at any time, and Settings has controls that delete all remaining audio or all AI-generated summaries at once. Deleting the app removes all locally stored data.
Because we do not operate a cloud backend for your health data, we cannot recover it once deleted.
If we make material changes to this policy, we will update the effective date above and post a notice in the app at next launch. Continued use of the app after the updated effective date constitutes acceptance of the revised policy.
Questions about this policy or your data:
Masala Health
privacy@masalahealth.co
Terms of Use
Masala Health is not a medical device and is not a substitute for clinical care. Nothing in the app — including AI-generated responses, calibrated thresholds, screening prompts, or any other output — constitutes medical advice, diagnosis, or treatment. Always consult a qualified healthcare provider with questions about your health.
The thresholds, reference ranges, and screening prompts in the app are drawn from published guidelines and studies, calibrated for South Asian populations where evidence supports it. They are informational tools, not clinical determinations.
Masala Health grants you a limited, non-exclusive, non-transferable, revocable license to use the app on Apple devices you own or control, for personal, non-commercial use, subject to these terms and Apple's App Store terms.
You may not copy, modify, distribute, sell, or reverse-engineer any part of the app.
You own your health data. We claim no rights to the records, recordings, notes, or any other content you store in the app. The app is a tool; the data is yours.
To the maximum extent permitted by applicable law, Masala Health and its developers are not liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the app, including any clinical decisions made in reliance on app output.
The app is provided "as is" and "as available" without warranty of any kind, express or implied.
These terms are governed by the laws of the State of California, without regard to conflict of law principles. Any disputes will be resolved in the courts of Santa Clara County, California.
If any provision of these terms is found unenforceable, the remaining provisions remain in full effect.