LighterLiver Privacy Policy
The short version
What you enter stays on your phone. There is no account, no login, and no LighterLiver server holding your health information. We cannot see your results unless you send them to the research study.
Your health information leaves your phone in only two ways: in your phone's own backup, if you use one, and in a copy or summary you choose to share. If you enter a clinic code, the app checks it with our server. Your results are never part of that check.
Who we are
LighterLiver is made in Australia by an independent developer. In this policy, "we" and "us" mean the maker of LighterLiver and its research study team. If a company takes over the app, this policy will say so and name it.
What is stored, and where
Your record is stored in the app's own storage on this device. That covers blood results, scans, weights, symptoms, medications, appointments, drinks, activity, the food choices you make and your settings.
Report photos are read and then discarded. If an older version of the app kept one, it is stored with your record.
The app adds no encryption of its own. It relies on your iPhone's protection, which needs a passcode to work. If your phone is unlocked, someone holding it can read your record, the same as your photos.
If your phone backs up to iCloud or a computer, the backup includes your record and any usage log, with anything copied in from Apple Health. That is how your record reaches a new phone.
Apple holds the key to an iCloud backup unless you turn on Advanced Data Protection. A computer backup can be read by anyone using that computer, unless you tick "Encrypt local backup". You can leave LighterLiver out of iCloud Backup in your iCloud settings. Then save your own copy from Settings in LighterLiver.
The camera and your reports
When you photograph a pathology report or choose one from your photo library, the text is read on this device using Apple's built-in text recognition. The image is not kept, and not sent to us or to anyone else.
The values it reads are put into the form for you to check. Automatic reading makes mistakes, which is why nothing is saved until you have looked at it.
Apple Health
If you connect Apple Health, the app reads your weight, steps, exercise minutes, workouts, heart rate, walking pace, walking and running distance, flights of stairs, and, if you have set them in Health, your date of birth and sex. On newer phones it also reads the breathing disturbances your Apple Watch records while you sleep, and the sleep apnoea notifications Apple sends. You are asked by iOS first, you choose what to allow, and you can change it at any time in the Health app.
What the app reads from Health becomes part of your record: your activity, the weights you add, and your date of birth and sex if the record lacks them. It goes where your record goes, into your phone's backup and any copy or summary you share. It reaches us only if you send your files to the research study. Weights you chose not to add are remembered so you are not asked again. A copy you save keeps only their dates.
Separately, you can turn on "Save my measurements to Apple Health". This is off unless you switch it on. When it is on, the app writes the measurements you have typed in yourself into Apple Health: weight, waist, blood pressure and height. That keeps your health record in one place. Nothing is estimated or invented, and your blood results, notes, photos and diary are never written to Health. Turning it off removes what the app added. Your records in the app are unaffected.
Copies you make yourself
Saving a copy of your record produces a file containing your health information in readable form. Where it goes is your choice. The app hands it to iOS and iOS asks you. Treat it the way you would treat a letter from your specialist.
The summary you create for an appointment works the same way.
Voucher codes
If your clinic or a study gives you a code, the app asks lighterliver.com whether the code is still valid. The first time, it sends the code and a random id made on this phone. The id is not your name and is not linked to you. It stops one phone using a code many times over. It is kept in the phone's secure storage, so it stays if you delete the app and install it again. After that, the app sends only the code, once a day, so a withdrawn code can be switched off. Apart from Apple's purchase system, this is the only time the app talks to a server.
Like any request to a website, the check carries your phone's internet address, called an IP address. The site keeps a scrambled form of the id, which cannot be turned back into it, with the date you first used the code, for 400 days. It keeps a scrambled form of your internet address for up to one day, to stop one connection using up a code. None of this shows your name or anything from your health record. The daily check keeps nothing.
lighterliver.com runs on Cloudflare, a company based in the United States with servers in many countries. So these notes may be held outside Australia, including in the United States. Cloudflare may also keep its own records of requests, to run and protect its service.
Emails to us
If you email us, for help, to ask for an invitation or to set up a clinic, we get your email address, your name if you give it, and what you write. We use it only to reply to you and to deal with any complaint. Please do not send health information. If you do, we use it only to answer you.
Email to lighterliver.com passes through Cloudflare on its way to our mailbox, and our mailbox may be held outside Australia. We keep emails only as long as we need them for that.
Usage tracking and the research study export
Turning on usage tracking, in Settings or by joining the research study, keeps a log on this phone of which screens you open and when. It notes that you made an entry, such as a weight or a drink, but never the value, your name or anything you type. It does note which food styles you choose, which could hint at your background. An export adds your results, medicines, diary, diagnosis, sex and birth year, not your name, under a random id made on this phone. You can turn it off or export it any time.
If you are enrolled in the study, the summary you export is your appointment summary, with your name, your study number and your usage file's random id added so the study can match both to you. It also carries a short digest of your usage log, if tracking is on. Nothing leaves your phone until you choose to share it.
Payments
Purchases are handled by Apple. We never see your payment details. Apple tells the app one thing, whether this Apple ID currently has access, and the app stores nothing else about it.
What we do not do
No advertising. No advertising identifiers or trackers. No third-party analytics SDK watching what you tap or sending it off your phone. Your data is never sold, and never shared with anyone for marketing.
Some screens link out to other websites. They open in your browser, where that site's own terms and privacy policy apply, not ours.
Your rights
Because your record lives on your phone, you already hold it. You can read all of it, correct any of it, export it and delete it. Deleting the app, or Reset all my data in Settings, removes the record and any report images kept with it. Offloading the app instead keeps the record.
Some things stay. Your phone's backups keep their copy until they are replaced. Copies you saved or shared stay where you put them. What the app saved to Apple Health stays too. To remove it, turn off saving to Health first, or delete it in the Health app. Your phone may also keep up to four small notes in its secure storage: the voucher id, and the dates you used your free appointment summary and your free reads of a blood report and a scan report. None of them holds a result.
Apart from that, we hold only emails you send us, the voucher notes above, and any study files you send, which carry your study number and site. To ask about anything we hold, to correct it, or to make a privacy complaint, email support@lighterliver.com. We will deal with it within 30 days. If you are not happy with our reply, or do not get one, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Children
LighterLiver is for adults. It is not designed for, and should not be used by, anyone under 18.