Your health record should not become someone else's asset.

The current Well Becoming app is designed so the sensitive record remains encrypted on your device. The service verifies identity but does not receive the record or hold its decryption key.

Privacy here is not a vague promise. It is a set of concrete choices about where information lives, what leaves the device and who can unlock it.

StorageThe health record lives in the browser's local storage on the device where you use the app.
EncryptionThe record is encrypted with AES-GCM 256. The key is derived from the passcode you set using PBKDF2 with 250,000 iterations.
RecoveryThere is no service-held recovery key. If you lose the passcode and do not have a backup, the service cannot decrypt the record for you.
Sign-inSign-in proves identity. It does not carry the encrypted health record between devices.
BiometricsSupported Apple devices can unlock through a passkey using Face ID or Touch ID, with passcode fallback.
AIThe app does not silently send the record to an AI model. A review pack is text you choose to copy into another tool.
AnalyticsThe app contains no analytics, tracking pixels or third-party advertising scripts.
PortabilityA JSON export and import moves your record between installations. Each installed copy has its own local storage.

What reaches a server

Authentication information reaches the sign-in service. In the owner's current early-access setup, an iPhone Shortcut sends selected Apple Health aggregates to a private graph so the app can read them after sign-in. Meal-photo analysis is off by default and only works when a user supplies their own endpoint and key.

What this page does not claim

This is a technical description of the current product, not a blanket claim of HIPAA, GDPR, medical-device or other regulatory compliance. The applicable obligations depend on who offers the service, which markets it enters and how each data flow is operated.

Before public launch

A complete legal privacy notice, terms of service, retention policy, incident process and region-specific data map will be required. They should be written against the deployed architecture and actual business entity, not copied from a generic template.

Request early access