Privacy · last updated 1 September 2026
Hormone Helper is built for people whose medical record can be used against them. That is not a marketing line; it is the reason for nearly every decision below.
The short version: everything you enter stays on your phone. Nothing is uploaded, synced, or backed up to us. An account is required to use the app, but it is a separate thing from your record — the account proves who may ask our server a question, and your medications, doses and results never travel with it.
Your medications, doses, schedules, supplies, lab results, day logs, trackers, milestones, photos, notes, letters and the places you have on file are stored on this device and nowhere else.
We cannot read any of it. There is no server copy to subpoena, sell, leak or hand over, because there is no server copy.
Photos you attach to a milestone, keep as documents, or send in the chat stay in this app's own storage on this device. The images themselves are never uploaded and never included in an export. When you scan a medication label, the reading happens on the phone and the image is discarded once the fields are filled.
One exception, and only when you choose it: if you attach a photo to a message for the assistant while the assistant is on, the words the phone reads off that photo travel with your message so the assistant can answer about them. The photo does not. The chip above the message says so before you send.
Budulai is on by default in the full app, and the questionnaire shows you exactly what that means before you send a word. You can turn him off in one tap at any time; the exact text that would be sent is always readable under Privacy and terms. Nothing leaves the device without an account and the assistant switched on.
With him on, he also keeps short notes about things you tell him — a pharmacy that keeps losing your prescription, an interview coming up — so he can ask after them later. They are stored on this phone, shown in My profile, and every one can be deleted. You can switch that off there.
When it is on, a summary of your record travels with your question: your medications and schedules, how much you have left, your logged doses, your lab values with any target range you entered, what the app has worked out about supply and timing, and the few things you chose to tell it about yourself when you set the app up.
Your free-text notes, your photos, your milestones and your documents are never included. You can see the precise text at any time under Privacy and terms, and you can turn the assistant off again whenever you like.
The service that answers your questions runs on hardware we operate. Your question and the record summary are held in memory for as long as it takes to answer and are not written to disk.
Three things are stored: your account's identifier, this phone's notification token if you allow notifications, and the short text of any notification queued to be sent to you, until it is sent. That is the whole list.
An account is required. It holds an email address, or the identifier Apple or Google gives us if you sign in that way, and nothing else. It is never linked to your medical record, because your medical record never reaches us.
Signing in with Apple or Google tells them that you use an app; it does not tell them anything about what is in it, and it does not tell us anything about you beyond an address to identify the account by.
You can delete it from inside the app. Deleting it erases the account, this phone's notification token and anything queued for you.
If you photograph an ID, an insurance card, a court order or a letter, that image is stored on this device in the app's own storage and nowhere else.
It is left out of both export files on purpose, so that handing someone your data never hands them your identity documents. It is never sent to the assistant: Budulai is told that a document of that kind exists, and nothing whatsoever about what it says.
Deleting everything deletes these with it.
Off unless you turn it on, and used only to find things near you — a pharmacy, a clinic, a place that draws blood, a community centre. Your position is never stored on a server, never attached to your record, and never shared.
With the switch on and the assistant on, the name of your town and region — never your position — is included with your questions, so the assistant can talk about what is nearby. Turning location off again costs you nothing else in the app.
If you add someone to Your people from your Contacts, only the name and number you pick are copied into the app. Nothing else is read from your contacts, and the list never leaves this phone. The assistant is told the names and roles of your people so it can suggest telling someone by name; it is never given their numbers.
Payment goes through Apple; we never see your card. Apple gives the app a receipt that says whether a subscription is active, and our server checks that receipt with Apple before answering as the full app. We keep no payment details. Managing or cancelling happens in your Apple account settings, and cancelling never touches what is on this phone.
Reminders the phone can work out — a dose, a refill, an expiry — are scheduled on the device and need no network.
If you allow it, the assistant can also send notifications when it notices something in your record worth raising. That means the summary is read on the server as described above. Every notification, from either source, reads "Check your notes" on the lock screen while unlabeled notifications are on, which is the default.
No analytics. No advertising, and no advertising identifiers. No tracking across apps or websites. No third-party trackers of any kind. No sale or sharing of anything, under any circumstance, to anyone.
We do not ask for your gender, your legal name, or a marker on any document. The app has no field for them because it does not need them.
Hormone Helper is not directed at children under 13 and we do not knowingly collect anything from them.
Export everything, in a readable file and a data file, from the Safe tab. Delete everything from the same place; it is immediate and there is no archive.
For anything else, write to [email protected].
If this policy changes in a way that affects what leaves your device, you will be asked again before anything new is sent. Quiet expansion of what gets collected is precisely the thing this app exists to avoid.