Your health record should not become someone else's asset.

The current Well Becoming app is designed so the sensitive record remains encrypted on your device. The service verifies identity but does not receive the record or hold its decryption key.

Privacy here is not a vague promise. It is a set of concrete choices about where information lives, what leaves the device and who can unlock it.

StorageThe health record lives in the browser's local storage on the device where you use the app.
EncryptionThe record is encrypted with AES-GCM 256. The key is derived from the passcode you set using PBKDF2 with 250,000 iterations.
RecoveryThere is no service-held recovery key. If you lose the passcode and do not have a backup, the service cannot decrypt the record for you.
Sign-inSign-in proves identity. It does not carry the encrypted health record between devices.
BiometricsSupported Apple devices can unlock through a passkey using Face ID or Touch ID, with passcode fallback.
AIThe app does not silently send the record to an AI model. A review pack is text you choose to copy into another tool.
AnalyticsThe app counts that it was opened, with Umami on our own server: no cookie, no IP address, and never a screen, a search or anything from your record. It contains no tracking pixels or advertising scripts.
PortabilityA JSON export and import moves your record between installations. Each installed copy has its own local storage.

What reaches a server

Authentication information reaches the sign-in service. An iPhone Shortcut, set up at onboarding, sends selected Apple Health aggregates to your private graph so the app can read them after sign-in. Meal-photo analysis is off by default and only works when a user supplies their own endpoint and key. A visit count reaches our own statistics server each time the app opens; it carries nothing from the record.

What this page does not claim

This is a technical description of the current product, not a blanket claim of HIPAA, GDPR, medical-device or other regulatory compliance. The applicable obligations depend on who offers the service, which markets it enters and how each data flow is operated.

Where the detail lives

This page describes the architecture. The privacy notice says what the website itself collects and why, and the terms set the boundaries of the service. All three are written against the deployed system, not copied from a template, and each carries the date it last changed.

Request access

Keep it private. Put it to work.

Ask for an account and we'll set the record up on your device, with you, under a passcode only you know.

Request access