Nucleus Health Privacy Policy

1. Introduction

Nucleus Health (“we,” “us,” or “our”) provides a unified platform — comprising the Nucleus mobile application and this website — for aggregating and analyzing data from Apple Health and third-party wearable devices. We do not manufacture or distribute our own hardware; our role is that of a receiver of authorized data to support your health goals through insights and analytics. This policy explains what personal information we collect, how we use it, and the choices you have, in accordance with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and international data-protection standards including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA). By using the Nucleus app or website, you agree to the practices described in this policy.

2. Our “No-Sale,” Advertising & Apple Health Commitment

No Sale of Data: Nucleus Health does not, and will not, sell your personal information or biometric data to third parties.

No Advertising or Data Mining: We do not use your health, fitness, or biometric data — including any data obtained through Apple HealthKit — for advertising, marketing, or data-mining purposes. Health data is used solely to provide the health-management features you request, consistent with Apple’s HealthKit terms and our obligations under applicable law.

No Cross-App Tracking: The Nucleus app contains no advertising SDKs and does not track you across other companies’ apps or websites. We therefore do not request permission under Apple’s App Tracking Transparency framework.

Data Minimization: We only process data that is reasonably necessary to provide the health analysis and coaching services you have explicitly requested.

3. Information We Collect

Depending on the features you use and the permissions you grant, we may collect the following categories of data:

Apple Health (HealthKit): With your explicit permission, we read health metrics from Apple Health — such as steps, heart rate, heart-rate variability (HRV), sleep, VO2 max, active energy, blood-oxygen saturation, and body weight — to generate your insights. Nucleus only reads from Apple Health; it does not write data back. HealthKit data is processed only to deliver the features you request, is never used for advertising, and is never sold or shared for marketing. You can revoke this access at any time in iOS Settings → Privacy & Security → Health.

Connected Wearables & Platforms: If you link third-party services (for example, WHOOP, Strava, or Garmin), we collect biometric markers (HRV, resting heart rate, oxygen saturation/SpO2), sleep metrics (duration, stages, recovery scores), and physical-activity data (steps, calories, workout types, performance) via secure API mechanisms.

Activity Route Data: The Nucleus app itself does not access your device’s GPS. If you link a third-party service such as Strava or Garmin, we may receive activity-level data (distance, pace, elevation) that those services derived from their own location tracking.

Nutrition & Food Data: Meals you log, barcode scans, and food photos you capture via your camera or photo library for nutritional analysis.

Progress & Body Photos: Physique check-in photos and lab/DEXA report images you choose to capture or upload. Images are sent to our AI provider (Anthropic) only to generate the analysis you request, are not used to train any model, and progress photos are stored on your device.

Voice Input: Audio you record for dictation or to converse with the AI coach. Recordings are transcribed to text by Groq’s Whisper speech-to-text API and are not retained after transcription; only the resulting text is stored with your account.

Account & Subscription Data: Your name, email address, date of birth, and biological sex (some of which may be provided through Apple or Google Sign-In). Subscription status and purchase receipts are processed through the Apple App Store and our subscription provider, RevenueCat. We never receive or store your full payment-card details.

Device & Technical Data: Limited technical information needed to operate the service, such as app version, device model and operating system, and push-notification tokens, together with basic crash and diagnostic logs. We do not use third-party advertising or cross-app analytics SDKs.

4. How We Use Your Information

We use the information we collect solely for the following purposes:

Service Delivery: To provide, personalize, and improve the health insights, analytics, and coaching you request.

Synchronization: To sync and display your metrics across your devices.

Notifications: To deliver the reminders and notifications you have enabled.

Subscriptions: To process and manage your subscription and entitlements.

Security & Legal: To maintain the security, integrity, and reliability of the service and to comply with our legal obligations.

We do not use your data for any purpose incompatible with those above without first obtaining your consent.

5. AI & Automated Processing

To generate insights and coaching, we use trusted third-party artificial-intelligence providers (currently Anthropic for AI analysis and Groq for voice transcription). Only the data necessary to fulfill your specific request is transmitted for processing. These providers are contractually bound to protect your data, to process it solely to return results to you, and not to use it to train their models.

Not Medical Advice: AI-generated insights are provided for informational and general wellness purposes only and do not constitute medical advice. Nucleus is not a medical device and does not diagnose, treat, cure, or prevent any disease or condition. Always consult a qualified healthcare professional regarding any medical concern.

6. Data Retention and Your Controls

Retention Period: We retain your data only for as long as necessary to provide the service or as otherwise required by law.

In-App Account Deletion: You can permanently delete your account and all associated personal and biometric data directly within the app (Settings → Account → Delete Account), or by contacting us. We will complete deletion within 30 days unless a longer period is required by law.

Revoke Access: You may revoke our access to Apple Health (iOS Settings → Privacy & Security → Health) or to any connected wearable through that provider’s settings at any time.

Data Portability: You have the right to request a machine-readable copy of your personal data.

7. Security & Disclosure to Service Providers

Encryption: Data is encrypted in transit using TLS/SSL protocols and at rest using AES-256 encryption.

Limited Disclosure: We share data only with trusted service providers who assist in operating the service and who are contractually bound to maintain strict privacy and security standards equivalent to those described in this policy. Our key providers are Supabase (secure cloud database and authentication), RevenueCat (subscription management), Anthropic (AI processing), and Groq (voice transcription).

High-Risk Guardrails: We do not disclose personal health data to employers, insurance companies, or credit agencies without separate, explicit, and legally binding consent.

8. International Data Transfers

Our infrastructure stores data on secure servers located in the European Union (Frankfurt). Where personal information is transferred across borders, we apply appropriate safeguards — such as Standard Contractual Clauses — consistent with the GDPR and the Australian Privacy Principles.

9. Security Breach Notification

In the event of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme, as well as other regulators where required by law.

10. Children’s Privacy

Nucleus is not directed to children under the age of 16, and we do not knowingly collect personal information from them. If we become aware that we have collected such data, we will delete it promptly. A parent or guardian who believes their child has provided us with personal information may contact us using the details below.

11. Your Privacy Rights & Global Standards

While primarily governed by the Australian Privacy Principles (APPs), we maintain standards aligned with the GDPR (for users in the EEA and UK) and US state privacy laws such as the CCPA/CPRA. Subject to applicable law, you may request to access, correct, delete, or port your personal data, withdraw consent, or object to certain processing. Because we do not sell personal information, there is no “sale” to opt out of, and we will never discriminate against you for exercising your privacy rights. To exercise any right, please contact us using the details below.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you within the app or by email before they take effect. The “Last Updated” date above reflects the most recent revision, and your continued use of Nucleus after changes take effect constitutes acceptance of the updated policy.

13. Contact Information

To exercise your rights to access, correction, or deletion, please contact:

Privacy Officer
Email: contact@getdiced.app
Address: 1/11 Lamrock Avenue, Bondi Beach, 2026 NSW, Australia