Linnea Privacy Policy — Linnea · Arctura Technologies

Linnea is a personal wellness companion. This policy explains what information the app handles, why it is needed, where it goes, and how to export or delete it. It covers the Linnea apps for iPhone, Apple Watch and Android and the Linnea service. “Linnea,” “we,” and “us” refer to Arctura Technologies Inc., the Ontario (Canada) corporation that owns and operates Linnea.

1. Information we handle

Account information. Email address, or the identifier provided by Apple or Google sign-in, authentication tokens, internal user ID, device push token, app version, locale, and time zone. So that you can log from widgets, controls, Siri and Shortcuts, notification actions, Live Activities and Apple Watch, Linnea creates signing keys on your devices. The public part of each key, its type, and the dates it was registered, last used and expires are stored with your account, so that the service can check that an entry comes from your device. The private keys stay on your device. We do not receive the password for a third-party sign-in account.

Profile and wellness information. Your first name, if you give one. Date of birth, sex, height and weight: you can enter them yourself, or — if you allow Linnea to read them — Linnea fills them in from Apple Health or Health Connect for you to confirm or change, and only the values you confirm are saved. Dietary pattern, allergens and foods you avoid, which Linnea asks for when you first open the meal plan. Daily goals for water, protein, energy, steps, exercise, active energy, sleep and mindfulness, which goals you pin to Today, and whether your exercise and active-energy goals follow your Apple Watch Activity rings (the ring values are read on your device and are not stored). The medications and supplements you add: name, whether you take each one on a schedule or as needed, the times, and an optional note; Linnea does not ask for doses, and a dose entered in an earlier version stays in your account and appears only in your data export. Medications you choose to import from Apple Health (names and times only). Reminder schedules (type, days, times, on or off); the notification text is fixed and is not stored per reminder. Onboarding choices.

Logs and user content. The entries you log: food and drinks (including whether a drink counts toward your water), water, medications and supplements (taken or skipped), exercise, sleep (with bedtime and wake time for nights you log yourself), mood (a pleasantness level from 1 to 7, optional emotion labels and optional context tags such as work or family), and symptoms (the symptom and its severity); weight and body measurements (body fat, waist, height), blood pressure and pulse, blood glucose (with meal timing) and body temperature (with where it was measured); notes; the time of each entry and where it was made (for example the app, a widget, Siri, Apple Watch, a notification, a Home Screen quick action, the share sheet or Visual Intelligence); doses you mark as skipped from a notification or a Live Activity; photos submitted for food recognition, including a picture from Visual Intelligence, which is sent only when you tap “Recognize this meal”; and audio submitted for voice logging. On iPhones that can transcribe speech on the device, the recording stays on the device. Otherwise the audio is sent for transcription and is not persisted by Linnea after that request. The resulting transcript may be stored with the log. Linnea no longer collects menstrual cycle phase; values recorded with an earlier version are kept and shown read-only.

Reading Apple Health (iOS). With your permission, Linnea reads these types from Apple Health on your device: sleep, steps, active energy, exercise minutes, workouts, heart rate, resting heart rate, heart rate variability, respiratory rate, blood oxygen, mindful minutes, weight, height, date of birth, sex, and state of mind; blood pressure, blood glucose, body temperature and water recorded by other apps or devices; on iOS 26 or later, the medications you choose to share; and, if you turn on “Follow Activity Rings”, your Activity ring goals. Linnea uses them on your device for your daily score, goals, trends and category pages. Your account stores only: daily totals (sleep minutes, steps, active energy, workout minutes, mindful minutes, and resting and average heart rate for each day); your workouts and nights of sleep as entries in your timeline — for each workout its type, name, duration, start time rounded to the quarter hour and the name of the app or device that recorded it; for each night its time asleep, wake time rounded to the quarter hour and the name of the app or device that recorded it — which Linnea updates or removes when they change in Apple Health; the profile values you confirm when Linnea fills them in; and the names and times of medications you import. Heart rate variability, respiratory rate, blood oxygen, state of mind entries, your Activity ring goals, readings from other devices and water recorded by other apps are used on your device and are not stored in your account. Other Apple Health samples, such as individual heart-rate readings, sleep stages or the exact start and end of a workout, are not uploaded. The service rejects uploads shaped like raw Health samples.

Saving to Apple Health (iOS). With your permission, Linnea saves the entries you log to Apple Health: food and its nutrients, caffeine, alcoholic drinks, water (including drinks that count toward water), workouts and nights of sleep you log yourself (a night is not saved if another source already recorded it), state of mind and symptoms; weight, body fat, waist circumference, height, blood pressure, heart rate, blood glucose (including values you confirm from a scanned lab report) and body temperature. When you edit or delete an entry, Linnea updates or deletes what it saved. Linnea does not save medications or doses to Apple Health, does not save back entries that came from Apple Health, and never saves entries you log for a family member. The Linnea app on Apple Watch saves the water, mood and blood pressure entries you make on the watch to Apple Health, with the permission you give on the watch. You can stop saving any category in You › Apple Health or in the Health app; your entries are still saved in Linnea. Apple Health keeps what Linnea saved under Apple’s terms; deleting your Linnea account does not remove it, and you can delete it in the Health app.

Health Connect (Android). With your permission for each data type, Linnea reads from Health Connect: steps, active calories burned, heart rate, resting heart rate, sleep, exercise sessions, mindfulness sessions and weight; and respiratory rate, oxygen saturation, blood pressure, blood glucose, body temperature and hydration recorded by other apps (hydration only if you turn on counting water from other apps). Linnea uses them for your daily score, goals, trends and category pages. Raw Health Connect records stay on your device. Your account stores only daily totals, your exercise sessions and nights of sleep as timeline entries (with the same fields as for Apple Health above), and the profile values you confirm. With your permission, Linnea also writes the entries you log to Health Connect: nutrition (including caffeine), hydration, and exercise and sleep sessions you log yourself; weight, blood pressure, blood glucose (including values you confirm from a scanned lab report) and body temperature. When you edit or delete an entry, Linnea updates or deletes what it wrote. Linnea does not write mood, symptoms or medications to Health Connect, does not write back records it read from Health Connect, and never writes entries you log for a family member. Linnea never sells this data and never uses it for advertising. Apart from the service providers in section 4 that process it for you, it reaches other people only in a daily summary you choose to share with members of your family. You can withdraw any permission at any time in the Health Connect app; Linnea stops reading or writing that data type from then on. Linnea keeps no copy of the raw records, so nothing is left to delete on the device; the daily totals and entries already in your account stay until you export or delete them, and all of them are deleted with your account. Records Linnea wrote to Health Connect stay there until you delete them in Health Connect.

Health records. If you use Records, you can keep lab results, visits, medications, allergies, conditions and surgeries, vaccinations, family history, files and an emergency card, with photos, scans and PDFs attached. Records are encrypted on your device before they are uploaded, with keys that only you and the people you share them with hold; the service stores the encrypted data and cannot read it. The service can see only the structure: account and record identifiers, which folder a record is in, when it was created, changed or deleted and by whom, the sizes of the encrypted data and attachments, key versions, who holds a key to which folder, and, for lab results, tags that show which items belong to the same trend without showing what they are. Names, values, units, reference ranges, dates, notes, file names and the contents of attachments are never visible to the service. When you scan a document, text recognition runs on your iPhone. The emergency card can include emergency contacts you pick with the system contact picker; Linnea does not read your address book. A visit you add to your calendar is added by the system calendar editor; Linnea does not read your calendar. Visit summaries are created as PDFs on your device and go only where you send them. To open your records on a new device, you approve it from a device where you are signed in, or you enter your recovery code. The service keeps a copy of your records key only in a form that your recovery code unlocks, and Linnea does not have your recovery code: if you lose all your devices and your recovery code, your records cannot be recovered.

Family. If you use Family, you can create a family of up to six people or join one by invitation. The service stores the family’s name, each member’s display name (chosen by that member), roles, membership status and dates, who invited whom, and invitation codes while they are valid (invitation links are stored only in a form that cannot be read back). Linnea does not send invitations by email or text message; you share the link or code yourself. Members with their own account choose what they share, and with which members: their Linnea score, medication status (how many scheduled medications were logged — never names, doses or times), sleep duration, steps, weight trend, their emergency card and records folders they pick. Only the items you choose are shown, and only to the members you choose; shared records and the emergency card stay encrypted and are opened on the recipients’ devices. Care alerts are optional and are turned on by the member they are about, for the family members that member chooses: if a scheduled medication is still not logged 30 minutes after its time, those members are told only that a medication has not been logged — never its name, dose or time. Greetings are five fixed phrases; there is no free-text messaging. Family notifications show only the kind of event, never a name, a medication or a value. A managed member is a profile a family organizer keeps for someone who does not use Linnea themselves, such as a child or an older parent. A managed member’s name, relationship, date of birth, colour, the entries and records logged for them and their care plan are encrypted on the device of the person who enters them and can be opened only by the organizer and the co-managers the organizer adds. Entries logged for a managed member are never saved to your Apple Health or Health Connect and are never sent to an AI provider.

Apple Watch. The Linnea app on Apple Watch shows today’s progress, reminders and your medication list, which it receives from your iPhone and keeps in the watch app’s protected storage. Watch complications and notifications show counts and status only. Entries you make on the watch — water, a meal by voice, mood, blood pressure and medications taken — are sent to your account like entries made in the app. A meal you dictate on the watch is read on your iPhone; it is sent to an AI provider only after you open it on the iPhone and only if you have allowed AI features.

Derived information. Linnea scores and their five parts (sleep, intake, activity, mind and body, routine), history, trends, weekly, monthly and yearly reviews, meal plans and shopping lists, weekly digests, “Linnea Noticed” observations, Ask Linnea answers and other AI-assisted results. Heart rate variability and resting heart rate may be used on your device to calculate the mind-and-body part; only the resulting scores are stored. AI results display a versioned notice, in your language, that they are general wellness information, not medical advice.

Diagnostics and product analytics. Linnea sends crash and performance reports to Sentry and usage events to PostHog. A usage event names what happened (for example, a screen was opened or an entry was saved) and may say what type of entry it was (for example “water” or “mood”), where it was made (for example a widget) and whether the device was offline. Events never include values, medication names, notes, what you typed or searched, or information about other people. The analytics identifier is random for each installation, and Linnea does not link events or crash reports to your account. A central scrubber removes health fields and contact details before transmission. Analytics and crash reporting are on unless you turn them off in You › AI features and data use; your choice is also saved to your account so that the statistics described in section 2 leave you out.

On your device only. Search runs on your device; the search index and your recent searches are not uploaded. Widgets read today’s score, its parts and counts from storage that the app shares with its widgets on your device. The Lock Screen, widgets, controls, Live Activities and notifications show counts and status only — never medication names, doses, measurements or diagnoses. Entries you make from widgets, controls, Siri and Shortcuts, notification actions, Live Activities or Apple Watch are sent to your account like entries made in the app. Siri requests are handled by Apple; Linnea receives only what it needs to save the entry. A picture that Visual Intelligence gives Linnea stays on your iPhone until you tap “Recognize this meal”; if you cancel, it is deleted. Raw Apple Health and Health Connect records stay on your device, as described above.

2. Purposes

Authenticate the account and synchronize the user’s own records.
Calculate scores, trends, reminders, exports, and requested AI features.
Save the entries you choose to Apple Health or Health Connect, and keep them in step when you edit or delete them.
Show the reminders you set, using fixed notification text that never includes a medication name, a dose or a number.
Check that entries made from widgets, controls, Siri, notification actions, Live Activities and Apple Watch come from your device, and reject repeated or altered requests.
Keep health records and managed members’ information encrypted, and show the items you choose to the family members you choose, including the care alerts you turn on.
Produce aggregate statistics about how the service is used — for example, how many accounts log on three or more days a week, or what share of entries are made outside the app. Only totals are produced; they are not sent to analytics providers, and accounts that turned analytics off are left out.
Verify Apple or Google Play subscription entitlements without receiving payment-card data.
Protect the service, enforce rate limits, diagnose failures, and prevent abuse.
Answer support, privacy, export, correction, and deletion requests.

3. AI processing

Requested AI features send only the information needed for that request to OpenAI or Anthropic. Depending on the feature, that can include: the text, photo or audio you submit for logging; your question and the entries and daily totals it relates to (Ask Linnea); your goals, dietary preferences and allergens, an age range, a body-size range and daily totals (meal plans); daily totals and scores (reviews, “Linnea Noticed” and activity suggestions). Linnea does not send your name, email address, date of birth or exact age. Personal information placed directly in a note, question, photo, or recording will be part of that request. Health records, anything logged for a managed member and what family members share with you are never sent to an AI provider.

Some requests are handled on your device and are not sent to an AI provider: on iPhones with Apple Intelligence, Linnea reads typed entries on the device, and on iPhones that can transcribe speech on the device, voice recordings stay on the device. If the device cannot handle a request, it is sent as described above. Daily totals that come from Apple Health or Health Connect are included in an AI request only after you have allowed AI features, and only to produce the result you asked for.

Our commercial API arrangements do not permit these providers to train their general models on Linnea API data by default. Provider security and abuse-monitoring logs may be retained for up to 30 days under their standard API terms, unless a shorter approved retention setting applies.

We ask before we send. The app explains in plain language, inside the app, what an AI feature will send and which provider receives it, and asks for your permission before the first such request. Nothing is sent to an AI provider until you agree. You can withdraw that permission at any time in You › AI features and data use; the AI features then stop sending, and the rest of Linnea — logging, your daily score, trends, reminders, search, records, family, plan editing and export — keeps working. Ask Linnea answers only from your own entries and daily totals.

Equal protection. We share personal information with an AI provider only under written commercial terms that bind the provider to confidentiality, to appropriate technical and organisational security measures, to processing the data solely to return the result of your request, and to protections materially equivalent to those described in this policy. These providers act as processors on our instructions; they are not permitted to use your information for their own purposes.

4. Processors and disclosures

Supabase hosts authentication, databases, storage, and server functions in the United States. OpenAI and Anthropic process requested AI features. Apple processes subscriptions, provides Apple Health on iOS, handles Siri requests, and delivers push notifications to iPhones (a wake-up signal or fixed notification text, never health content); Google processes Google Play subscriptions, provides Health Connect on Android (reading and, with your permission, writing), and delivers push notifications to Android devices (Firebase Cloud Messaging carries only a wake-up signal, never health content); Google or Apple may provide sign-in when selected. Sentry and PostHog process scrubbed diagnostics when enabled. These providers act for the stated service purposes. What Linnea saves to Apple Health or Health Connect at your request is then held by that service on your device, under Apple’s or Google’s terms. We may also disclose information when legally required, to protect users or the service, or as part of a business transfer with notice and applicable safeguards.

In a family, information is disclosed to other members only as described in section 1: every member sees the family’s name and the members’ display names, roles and status; the items you share, your emergency card and the records folders you share are shown only to the members you choose; and a managed member’s information is available only to that profile’s organizer and co-managers. What another member has already seen or saved cannot be recalled.

Linnea does not sell personal or consumer health data, use it for targeted advertising, or track activity across other companies’ apps or websites.

5. Storage, security, and international transfers

Account data is stored in the United States. This means information from Canada and other launch regions can be processed under United States law. Database rows are protected by default-deny row-level access controls, and the local device cache is encrypted. Health records and managed members’ information are also encrypted end to end: they are encrypted on the device with keys the service does not hold, and the service stores only the encrypted data. The keys that open your records stay on your devices; the service holds only a copy locked with your recovery code. You can also lock Records on your device with Face ID, Touch ID, fingerprint or face unlock, or your device passcode; the emergency card is kept outside that lock so that it can be shown on your unlocked device in an emergency. Entries you make while offline are kept in encrypted storage on your device until they are uploaded. If you are signed out, they stay on the device for the same account and are uploaded when you sign in again; they are deleted if a different account signs in. The signing keys used by widgets, controls, Siri and Apple Watch are kept in the device keychain and never leave the device. No Internet service can promise absolute security; Linnea limits access and data fields instead of making that promise.

6. Retention

Account records are kept while the account exists. Generated AI artifacts that are no longer referenced are purged after 90 days. Data-export files are deleted after seven days; each download link expires after one hour. Operational caches and rate-limit records expire automatically. Records of requests from widgets, controls, Siri and other system surfaces, kept to block repeated requests, are deleted after 7 days. Device signing keys expire after 90 days and are revoked when you sign out. When you delete a health record, its content and attachments are deleted; a marker without content, used to remove it from your other devices, is deleted after 30 days.

When you leave a family or are removed from it, your access to it ends at once and sharing in both directions stops. When the organizer deletes a family, its managed members’ profiles are kept for 30 days so that their managers can view and export them, and are then deleted; the organizer can also delete a managed member’s profile at any time.

When you delete your account, it is deactivated at once and deleted 24 hours later, together with its application data, including your health records and their attachments. You can cancel on the confirmation screen before you leave it. If you organize a family with other members, the organizer role passes to another member; a managed member’s profile that nobody else manages is deleted with your account. Deleting your account does not cancel an App Store or Google Play subscription and does not remove what Linnea saved to Apple Health or Health Connect. Residual encrypted backups are isolated from normal use and age out under the hosting provider’s backup cycle.

7. Choices and rights

The app provides You › Export all data and You › Account › Delete account. If you use Records, the export decrypts your records on your device and adds them, with their attachments, to the exported file, which is not encrypted. Because health records are encrypted with keys Linnea does not hold, a readable copy of them can be produced only in the app. Apple Health permissions can be changed in the Health app or iOS Settings, and Health Connect permissions in the Health Connect app; you can also stop Linnea saving any category in You › Apple Health or You › Health Connect. AI features and analytics can be turned off in You › AI features and data use. You choose what you share with family members in You › What I share, and you can stop sharing or leave a family at any time. If you cannot open the app, email privacy@arcturatech.com from your account address and we will delete the account and its data. Depending on where the user lives, additional rights may include access, correction, portability, objection, withdrawal of consent, restriction, and complaint to a privacy regulator. We will verify a request before acting on it and will not discriminate for exercising a privacy right.

8. Children

Linnea is not directed to children under 13 and is not available where a higher minimum age for independent digital consent applies unless a parent or guardian provides legally valid consent. A parent or guardian may keep a managed member profile for a child in Family; the child does not use Linnea and has no account, and the profile is encrypted and available only to its organizer and co-managers, as described in section 1. Add only people whose health information you are entitled to keep. The organizer can delete a managed member’s profile at any time. Contact support if a child’s account should be removed.

9. Changes and contact

Material changes will be dated and presented in the app before they take effect where notice is required. The controller is Arctura Technologies Inc., Unit 10, 1338 Wellington Street West, Ottawa, Ontario K1Y 3B7, Canada. Privacy questions, complaints, and rights requests — including matters for the designated Privacy Officer — can be sent to privacy@arcturatech.com. The in-app support route (support@arcturatech.com) reaches the same monitored inbox. Washington consumer health requests follow the separate Consumer Health Data Policy.