Wellness Diary Privacy Policy

Effective date: 16 May 2026　｜　Last updated: June 2026 (added: face-diagnosis feature notes, MediaPipe on-device face-detection technology disclosure)

📱 Wellness Diary collects only the minimum data needed to complete subscriptions and improve the service. Your personal health records are stored on your local device only and are never uploaded to any server.

Wellness Diary (“the App”) is developed by heretcm and is committed to protecting your privacy. This policy explains how the App collects, uses and protects your data.

1. Data we collect

1.1 Data you enter locally on the device (not uploaded)

The following data is stored only in your device’s local storage and is never transmitted to any external server:

Constitution assessment results and TCM constitution analysis (acquired-constitution questionnaire, detailed questionnaire)
Face-diagnosis analysis results: complexion type, skin lustre, lip colour, eye features and facial-condition assessment (text descriptions), plus a low-resolution thumbnail shown on the results page
Daily health logs (sleep hours and quality, water intake, exercise, energy, mood, bowel movements, food warm/cold nature, meal regularity)
Menstrual-cycle records (first day of last period, cycle length, flow)
Five-Movements & Six-Qi innate-constitution calculation records
Seven-day wellness plan progress
Personal settings (date of birth, gender, region, user name)
Personal notes and journal entries
Notification preferences (reminder time)

1.2 Device sensors and system data (processed locally, not uploaded)

Camera (face-diagnosis photo)

The face-diagnosis feature uses the device’s front or rear camera to take a facial photo and performs TCM complexion analysis on-device. It uses the following two technologies, both running fully offline; facial photos are never uploaded to any server:

Canvas API colour analysis: extracts, on-device, the average hue, saturation and brightness of different facial regions (forehead, cheeks, nose tip, lips, eyes), mapping them to the TCM five-organ complexion features (Heart, Liver, Spleen, Lung, Kidney)
MediaPipe FaceLandmarker (Google open-source framework): detects 478 facial landmarks on-device to precisely locate the colour-sampling positions of each organ region and improve accuracy. The model file (about 3.6 MB) is bundled in the app; the detection needs no network connection and sends no data to Google
Live glasses detection: a heuristic based on frame-brightness differences detects glasses before capture and prompts you to remove them, improving accuracy

Full processing flow for the facial photo: camera framing → on-device crop & alignment (to the visible frame area) → MediaPipe on-device landmark detection → Canvas API on-device colour analysis → generate a low-resolution thumbnail for the results page → the original photo is not persistently stored and not uploaded.

Camera (tongue-diagnosis photo)

The tongue-diagnosis feature needs camera access to take a photo of your tongue. The photo is analysed on-device in base64 form by the native CoreImage framework (reading colour, coating and moisture); after analysis the photo is not saved to your photo library and is not uploaded to any server (except when using the AI tongue-diagnosis feature — see Section 1.3).

Camera and flash (pulse detection, rPPG)

The pulse-rhythm assisted-recording feature uses the rear camera and flash in two stages, applying remote photoplethysmography (rPPG) to help record heart rate (BPM) and pulse-rhythm features, as a reference for TCM pulse self-observation.

① Guided preview stage

Before the actual measurement, the App shows the rear camera’s live view (native camera preview layer) in the centre of the screen and turns on the flash to help you press your finger correctly onto the lens. The App analyses each frame’s brightness and colour distribution (the ratio of the red and green channels) on-device to detect whether your finger has steadily covered the lens; once confirmed, it moves to the measurement stage automatically.

The live camera view is shown only on your screen; it is not stored or uploaded
The brightness and colour analysis (finger detection) is done entirely on-device and involves no personally identifiable data
The flash turns on during this stage and turns off automatically if you do not proceed to measurement

② Measurement stage (about 30 seconds)

The flash shines on your finger while the camera detects the tiny changes in the green light channel caused by capillary blood flow, helping record pulse-rhythm features as a reference for TCM pulse self-observation. During measurement, the mean of the green channel is continuously monitored to see whether your finger leaves the lens: if it does, data collection pauses immediately until the finger is pressed back, to keep the signal clean.

All camera image data is analysed on-device in real time only; it is not saved to your photo library and is not uploaded to any server
The flash turns off automatically when measurement finishes
Camera permission must be granted before use; the system will show an authorization prompt
You can revoke access anytime in iOS “Settings → Privacy & Security → Camera”; after revoking, the camera-based pulse feature will be unavailable, but you can use Apple Watch instead

Motion sensor (pulse-measurement compensation)

During pulse measurement, the App uses the device’s built-in accelerometer (CoreMotion) to detect hand movement. Hand shake changes the camera’s optical path and affects PPG signal quality; the motion data is used to compensate for such interference in real time and improve heart-rate accuracy.

Accelerometer data is used on-device only during measurement (about 30 seconds), released immediately afterwards, and is not stored or uploaded
The motion sensor does not collect location, step count or any fitness-activity data

Apple HealthKit (optional)

If you choose to authorize it, the App can read heart-rate and pulse-rhythm data from the Apple Health app or Apple Watch, as an aid for TCM pulse self-observation. The App does not write any data to HealthKit and does not upload HealthKit data to any external server. HealthKit access is optional and you can revoke it anytime in iOS system settings.

Home-screen widget data sync

The home-screen widget exchanges data with the main app through an iOS App Group shared container. The shared content includes: today’s date, sleep hours, water intake, whether you exercised, and your logging streak. This data is passed only within your device and involves no network communication.

1.3 Subscription-purchase data

When you use Pro subscription features, the following data is processed via third-party services:

Subscription status and entitlements: RevenueCat verifies whether your subscription is active; data includes an anonymous user ID, subscription product identifier, purchase timestamp and renewal status.
Payment data: Handled directly by the Apple App Store; neither Wellness Diary nor RevenueCat ever touches your credit-card details.
Device platform info: Operating-system version and App Store region, used for subscription verification.

2. System permissions required

Permission	Purpose	Required?
Camera & flash	① Face diagnosis: take a facial photo, on-device Canvas API colour analysis + MediaPipe landmark detection to derive TCM five-organ complexion features; supports front and rear cameras ② Tongue diagnosis: take a tongue photo, on-device CoreImage colour analysis ③ Pulse preview: show the live camera view, guide finger placement, on-device brightness detection to confirm placement ④ Pulse-rhythm recording: rPPG green-channel analysis of heart rate and pulse-rhythm features, flash-assisted lighting; finger state is monitored throughout and pauses if the finger moves away	Optional (other features still work if declined; pulse detection can use Apple Watch instead)
Motion sensor	Detects hand movement during pulse measurement to compensate the PPG signal in real time and improve heart-rate accuracy	Optional (the compensation step is skipped without an accelerometer; basic measurement is unaffected)
Apple Health (HealthKit)	Reads Apple Watch heart-rate and pulse-rhythm data as an aid for pulse self-observation (read-only, no writing)	Optional
Notifications	Sends daily wellness-logging reminders (time customizable in settings)	Optional (can be turned off in settings)

3. Third-party services

Service	Purpose	Data collected	Privacy policy
Apple App Store	In-app purchases and payment processing	Purchase transaction records (managed by Apple)	apple.com/legal/privacy
RevenueCat	Subscription management and verification	Anonymous user ID, subscription status, purchase records, device platform info	revenuecat.com/privacy

The App does not use the following services:

Behavioural analytics (e.g. Firebase Analytics, Mixpanel, Amplitude)
Crash-reporting services (e.g. Crashlytics, Sentry)
Cloud backup or data-sync services
Social-media tracking pixels (e.g. Facebook Pixel)

About advertising

The free version of the App displays Google AdMob ads. AdMob collects device identifiers and ad-interaction data to serve relevant ads, in accordance with the Google Privacy Policy. After upgrading to Pro, ads are removed entirely.

The App uses Apple’s SKAdNetwork framework for ad-attribution measurement; this framework does not transmit personally identifiable data.

4. How we use data

The limited data we collect is used only to:

Verify and manage your Pro subscription
Prevent subscription fraud
Provide TCM constitution analysis and wellness suggestions on your device
Send daily logging reminders when you consent
Improve the App’s features and stability

We do not sell, rent, or share your data with advertisers for targeted advertising in any way.

5. Data security

Your local health data on the device is protected by iOS’s native security architecture (Data Protection API) and encrypted with your device passcode and the Secure Enclave.

Subscription-related data is transmitted and stored encrypted by RevenueCat under its security standards. RevenueCat is certified to the SOC 2 Type II security standard.

6. Data retention

Local health records: stored on your device until you clear them in the App settings or uninstall the App.
Face-diagnosis photos: after capture they are cropped and aligned, undergo on-device landmark detection and colour analysis, and a low-resolution thumbnail is kept for the results page; the original photo is not persistently stored to the photo library and not uploaded to any server.
Tongue-diagnosis photos: used only for immediate on-device analysis after capture; not saved to the photo library and not uploaded to any server.
Pulse camera view: the live imagery during preview and measurement is used only for on-the-spot local analysis (brightness detection, rPPG signal extraction); no image file is retained.
Motion-sensor data: used in real time during measurement (about 30 seconds) and released immediately afterwards; not retained in any form.
Subscription records: RevenueCat retains purchase records under its policy to support refund enquiries and subscription restoration.
Widget shared data: updated with each daily log, stored in the device App Group container, and cleared automatically on uninstall.

7. Children’s privacy

The App is not directed to children under 13 and does not knowingly collect children’s personal data. If we become aware of such a case, please contact us and we will address it immediately.

8. Your rights (Hong Kong Personal Data (Privacy) Ordinance, Cap. 486)

You have the following rights:

Access: you may access the subscription-related data held by RevenueCat.
Delete local data: you can delete all local health records and personal settings on the device with one tap in the App via “Settings → Clear all data” (the system asks for confirmation first; this cannot be undone); uninstalling the App also permanently deletes all local data.
Revoke Camera/HealthKit access: you can revoke camera or Apple Health access anytime in iOS “Settings → Privacy & Security”.
Unsubscribe: you can cancel your subscription anytime in Apple settings; it will not renew after it expires.
Data enquiries: to access or delete the subscription data held by RevenueCat, please contact us.

9. Disclaimer

Wellness Diary is only a personal health-record and wellness-reference tool; it does not provide medical diagnosis, treatment advice, or prescriptions. The TCM wellness content in the App (including tongue- and pulse-diagnosis results) is for cultural and knowledge reference only and cannot replace professional medical advice. If you have health concerns, be sure to consult a qualified physician.

10. Policy updates

If this Privacy Policy is materially changed, we will update the “Last updated” date at the top of the page. Material changes will be notified in the App. We recommend reviewing this policy periodically.

Contact us

For any questions about this Privacy Policy or to exercise your personal-data rights, please contact:

Email: heretcm@gmail.com

We will respond within 30 days of receiving your enquiry.