Voke
Menu

Privacy policy

Last updated: [Date of publication]

Draft — needs legal review before publishing.

1. Who we are

Voke is an iPhone app and web service that shows you your own health data and lets you share chosen parts of it with people you invite. It is operated by [Company legal name], [registered address], [Province/State], [Country] (“Voke”, “we”, “us”).

For privacy questions or requests, email [email protected]. Our privacy officer is [Name or title of the person responsible].

This policy covers the Voke iPhone app, the website at voke.co and the services behind them, including the connection Voke offers to AI apps. It doesn’t cover the apps and services you connect to Voke, such as Apple Health, Google, or an AI app you choose to connect; their own policies apply to them.

2. What we collect

2.1 Your account

  • Your name, or the name you choose to show to people in your circles.
  • The email address Apple gives us when you sign in with Apple. It’s often a private relay address. We don’t show it to other users.
  • Your Apple account identifier, which Apple provides so we can recognise you when you sign in.

Voke has no passwords. You sign in with Apple only.

2.2 Health data you connect

You choose which sources to connect, and within each source which data Voke may read.

  • Apple Health. With your permission on your iPhone, Voke reads data from the Health app, which can include data from Apple Watch and other apps that write to it. Your iPhone uploads it to Voke.
  • Google Health. If you connect your Google account, Voke’s server reads the Google Health data you approve on Google’s consent screen, which can include data from Fitbit and Pixel Watch devices.

Depending on what you allow, this can include sleep and sleep stages, heart rate, heart rate variability, resting heart rate, blood oxygen, breathing rate, temperature readings, steps, distance, floors, active minutes, workouts, body measurements, nutrition, mindfulness minutes, cycle tracking and heart rhythm notifications.

We also record which device or app each reading came from (for example “Apple Watch” or “Fitbit”), so Voke doesn’t count the same thing twice.

From this data Voke works out derived values such as daily summaries, naps, heart events, activity entries and scores.

2.3 Your devices

When you sign in on an iPhone, the app creates a security key on that device. We store its public half, a label for the device and when it was used, so we can confirm that requests and uploads really come from your phone. If you allow notifications, we store your device’s notification token.

2.4 Your sharing

Your circles, who’s in them, invites you sent, which categories and levels you share with each circle or person, and whether you let other people’s AI see your data.

We keep a log each time another person or an AI reads your data: who read it, which categories, at what level, for which dates and when.

2.5 AI features

  • Ask Voke. The questions you ask and the answers you get. We don’t store the health data the assistant looked up to answer; it reads it again each time.
  • Morning summary. The summary written for each morning.
  • Connected AI apps. Which AI apps you’ve connected, the categories each may read, whether each may read people in your circles, and when each was connected, first used and disconnected.
  • Your AI setting. Whether you’ve turned AI features off.

2.6 Technical data

Our servers keep operational logs, such as request times, error codes and job outcomes. They’re written so they don’t contain health values. We don’t use analytics, advertising or tracking tools in the app or on the website.

2.7 If you contact us or join the beta list

If you email us, we keep your email address and what you send us. [Confirm which tool stores support email, and add it to section 6.]

If you ask for a beta invite on the website, we keep your email address and when you signed up. We use it only to invite you to the TestFlight beta and to email you about the beta. The website stores it with Cloudflare, and a copy goes to a private Discord message to the Voke team so we can send your invite. To invite you, we give your email address to Apple, which sends the TestFlight invitation.

3. How we use it

We use your data only to:

  1. Show you your own health data, summaries and scores.
  2. Show the data you choose to share to the people you choose.
  3. Answer your questions in Ask Voke and write your morning summary, if you use AI features.
  4. Let AI apps you connect read the categories you approved.
  5. Keep your account secure: confirm requests come from your devices, stop misuse and investigate problems.
  6. Run, fix and improve the service. For example, we check how long syncing takes or why a job failed. We don’t use your health data to build or train AI models.
  7. Reply to you and send service messages, such as a notice that an AI app was connected to your account.
  8. Meet legal obligations.

We don’t sell your data, use it for advertising, or share it with data brokers.

4. Legal bases

  • Consent for health data, which the GDPR treats as a special category of data (Article 9(2)(a)). You give it when you connect a source, and you can withdraw it by disconnecting the source in Apple Health or your Google account, or by deleting your Voke account.
  • Consent for sharing with people you invite, and for AI features.
  • Contract for running your account and the service you asked for.
  • Legitimate interests for keeping the service secure and working, where this doesn’t override your rights.
  • Legal obligation where the law requires us to keep or disclose data.

5. Who can see your data

5.1 You

You can see all of your own data.

5.2 People you share with

Nobody sees your health data until you join or create a circle and choose what to share. When you join a circle, every category starts off. For each circle, and for each person in it if you like, you choose a level per category:

  • Score: scores only.
  • Summary: scores plus daily totals.
  • Detail: scores, daily totals, charts, sessions and minute-by-minute data.

Body measurements and heart rhythm events are never shared, whatever you choose. People in your circles see your display name. They never see your email address or your device and account identifiers.

When you lower a level, remove someone, leave a circle or delete it, they lose access straight away.

5.3 AI

  • Ask Voke and the morning summary read your data on your behalf. Ask Voke can also read data people in your circles share with you, but only where they’ve turned on “Let their AI see this too” for you. See section 7.
  • AI apps you connect can read only the categories you approved, and people in your circles only where those people allowed it.

5.4 Voke staff

We don’t look at your health data. Our systems process it automatically to run the service. Staff could access it only to fix a problem you’ve asked us to help with, for security reasons, or where the law requires, and only as far as needed. [Confirm the operator’s internal access process.]

5.5 Legal requests

We disclose data to authorities only when Canadian law, or law that applies to us, requires it. Where we can, we tell you first.

5.6 Business transfers

If Voke is sold or merged, your data may transfer to the new owner, who must keep to this policy or ask for your consent to any change.

6. Service providers

These companies process data for us, only to provide the service:

  • Amazon Web ServicesWhat they do: Hosting, database, encrypted storage, encryption keys and backupsWhere: Montréal and Calgary, Canada
  • AppleWhat they do: Sign in with Apple, notifications to your iPhone, TestFlight beta distributionWhere: [Apple’s locations]
  • Vercel (AI Gateway)What they do: Routes Ask Voke and morning summary requests to an AI model provider, with zero data retentionWhere: United States
  • AI model providers reached through VercelWhat they do: Run the AI model that writes Ask Voke answers and morning summaries, with zero data retentionWhere: United States
  • CloudflareWhat they do: DNS and hosting for voke.co, and storage for beta sign-up email addresses. It doesn’t see your health dataWhere: Global
  • DiscordWhat they do: Tells the Voke team about each new beta sign-up, with the email addressWhere: United States
  • [Email provider]What they do: Support email and beta updatesWhere: [Location]

Google and Apple Health are sources you connect, not our service providers. Their own privacy policies cover what they do with your data.

7. AI features

7.1 Ask Voke and the morning summary

When you ask Ask Voke a question, or when Voke writes your morning summary:

  • Your question, earlier messages in that conversation, and the health data the assistant looks up are sent to an AI model provider through Vercel’s AI Gateway.
  • Every request is sent with zero data retention: the provider must not keep the data after answering or use it for training. If no provider can serve the request that way, the request fails rather than going elsewhere.
  • Requests are processed in the United States. If the answer reports it was served outside that region, Voke discards it.
  • For the morning summary, Voke’s code picks the readings and works out the trends; the AI only writes a one-sentence summary and two or three suggestions.
  • Answers are plain text. Voke strips links and images from them.

7.2 AI apps you connect

You can connect an AI app that supports the Model Context Protocol (MCP), such as Claude or ChatGPT. You approve each connection on your phone and choose which categories it can read. The connection is read-only.

Data your AI app reads is sent to the company that runs it, under your account with them. Their privacy policy and data retention apply, not ours, and Voke’s zero data retention setting doesn’t apply to them. Check their settings, for example whether they use your chats for training.

Every read by an AI app, and by Ask Voke, is logged, and you can see the log in the app. You can disconnect an AI app at any time in your account settings, and it stops working straight away.

7.3 Turning AI off

AI features are on when you create an account. You can turn them off with one switch, “Use AI features”, in your account settings. Turning it off:

  • disconnects every AI app you connected;
  • deletes your Ask Voke chats and morning summaries;
  • deletes other people’s Ask Voke messages that used your data; and
  • stops everyone else’s AI, including Ask Voke for people in your circles, from reading your data.

7.4 When someone stops sharing

If a person stops sharing a category with you, leaves your circle, or turns off AI for you, Voke deletes your Ask Voke messages that used their data.

8. Apple Health (HealthKit)

  • Voke reads HealthKit data only after you allow it on your iPhone, and only the types you allow. You can change this at any time in the Health app or in Settings.
  • Voke doesn’t write anything to Apple Health.
  • HealthKit data is never used for advertising or marketing, and never sold, including to advertising platforms, data brokers or information resellers.
  • HealthKit data isn’t stored in iCloud.
  • HealthKit data is used only to provide Voke’s health features to you, the people you choose to share with, and the AI features you use. It’s disclosed to third parties only with your consent, or to the service providers in section 6 who process it for us under contract.

9. Google user data

If you connect your Google account, Voke asks Google for read-only access to the Google Health data types you approve. Voke uses this data only to show it to you, to show it to people you choose to share with, and for AI features you use and approve.

Voke’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, Voke:

  • uses Google user data only to provide or improve user-facing features that are visible in the app;
  • transfers it to others only to provide those features with your consent (sharing with people you invite, AI features you use and AI apps you connect), for security, to comply with law, or as part of a merger or sale with notice to you;
  • doesn’t use it for advertising, and doesn’t sell it;
  • doesn’t let people read it, except with your consent, for security, to comply with law, or for internal operations where the data has been aggregated and anonymised; and
  • doesn’t use it to train general AI or machine learning models.

When you connect Google, Voke imports up to 365 days of history. If you remove Voke’s access in your Google account, Voke stops reading new data. Data Voke has already imported stays in your Voke account until you delete your account. [Planned: disconnecting and deleting a source from inside Voke.]

10. Where your data is stored and transferred

Voke stores your data on Amazon Web Services in Montréal, Canada (ca-central-1). Encrypted backups are kept in Calgary, Canada (ca-west-1). Encryption keys stay in Canada.

Some processing happens outside Canada:

  • Google sends your Google Health data from its own servers.
  • Apple processes sign-in and delivers notifications.
  • Ask Voke and morning summary requests are processed in the United States by Vercel and an AI model provider.
  • An AI app you connect processes data wherever its operator does.

Data processed in another country is subject to that country’s laws, and authorities there may be able to access it. For people in the EU, EEA, UK or Switzerland, Canada has an adequacy decision for commercial organisations under PIPEDA. Transfers to the United States rely on [Standard Contractual Clauses / the EU–US Data Privacy Framework, as applicable to each provider].

11. How we protect it

  • Your own key. Each account has its own data key. Your health data, your Ask Voke chats, your morning summaries and your Google sign-in tokens are stored encrypted with keys derived from it (AES-256-GCM). The data key is itself encrypted by a key held in AWS Key Management Service, and is never written to disk unencrypted.
  • Encrypted in transit. Connections to Voke use TLS.
  • Not end-to-end. Voke’s server decrypts your data while it works, to compute scores, serve it to people you share with and answer AI questions. Voke’s operators could technically access it; section 5.4 says when they would.
  • Signed devices. Each iPhone you sign in on holds its own key in its Secure Enclave. Uploads from Apple Health are signed with it, and actions like deleting your account, removing a circle member or signing out other devices need a fresh signature from the device.
  • Least access. Only the Voke service can use the encryption keys. Every use of a key is logged by AWS.

No system is perfectly secure. If a breach affects your data, we’ll tell you and the authorities as the law requires.

12. How long we keep it

  • Your account and health dataKept: Until you delete your account
  • Data from a source you disconnect outside VokeKept: Until you delete your account
  • Ask Voke chatsKept: 30 days after each message, then deleted
  • Morning summariesKept: Until you turn off AI features or delete your account
  • Sharing log (who read your data)Kept: [365 days / until you delete your account]
  • Google change notificationsKept: [7 days after processing]
  • Beta sign-up email addressesKept: Until the beta ends or you ask us to remove yours
  • Server logsKept: 30 days
  • Database backupsKept: Up to 35 days
  • Off-site backupsKept: 30 days

Backups hold only encrypted health data. When you delete your account, your data key is destroyed, and within 7 days no copy of the key exists anywhere, so the encrypted data left in backups can’t be read.

13. Deleting your account

You can delete your account in the app: open your account from the top of the Feed, tap Delete account and confirm. Instructions without the app are at /delete-account.

When you delete your account:

  1. Straight away, you’re signed out everywhere, removed from every circle, and nobody can see your data any more. Circles you ran are handed to the longest-standing member.
  2. Voke revokes its access to your Apple and Google accounts.
  3. Voke deletes your health data, chats, summaries and sharing settings, and destroys your data key.
  4. Within 7 days, no copy of your key exists in any backup, so your data can’t be read anywhere.

You can sign up again later with the same Apple account, as a new account with no data.

14. Your rights

Depending on where you live, you may have the right to:

  • access the personal data we hold about you and get a copy;
  • correct it;
  • delete it;
  • withdraw consent;
  • object to or restrict some processing;
  • get your data in a portable format;
  • complain to a privacy regulator.

Email [email protected]. We’ll answer within 30 days. We may need to confirm it’s you, for example by asking you to send the request from the app or the email on your account.

  • Canada: you can complain to the Office of the Privacy Commissioner of Canada or [the provincial commissioner, for example Alberta’s Information and Privacy Commissioner].
  • EU, EEA, UK: you can complain to your local data protection authority. [EU/UK representative, if required.]
  • US states: we don’t sell or share personal data for targeted advertising. Residents of states with consumer health data laws, such as Washington, have the rights set out in [our consumer health data notice].

15. Children

Voke isn’t for anyone under [18]. We don’t knowingly collect data from children. If you think a child has an account, email us and we’ll delete it.

16. Changes

If we change this policy, we’ll update the date at the top. If a change affects how your data is used or shared, we’ll tell you in the app before it takes effect.

17. Contact

[Company legal name] [Address] [email protected]