EverWell Consumer Health Data Privacy Policy

Last updated: October 13, 2026

This policy is from EverAssistant Inc. ("EverAssistant", "we", "us"), the maker of the EverWell app for iPhone (the "App"). It explains how we handle "consumer health data" as defined in Washington's My Health My Data Act, Nevada's consumer health data law, and similar laws: personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, including inferences. Our general EverWell Privacy Policy covers all other personal information.

1. The short version

• EverWell is built so that your consumer health data stays on your iPhone. EverWell does not sync it to iCloud. EverAssistant never receives it and cannot see it. If you turn on Encrypted Cloud Backup (paid plan, when available), we store an encrypted copy that only your passphrase or recovery key can unlock; we can't read it (Section 4).
• Because the App processes your health information on your device, we treat that as "collecting" it under these laws, and the App asks for your consent first.
• We never sell consumer health data, and we do not share it with anyone, except Apple, and only if you separately turn on Apple Private Cloud Compute (Section 5).

2. Categories of consumer health data, and why we use them

The App processes the following on your device, only to provide the features you ask for (keeping your list, running interaction, amount (your total compared with the published limit), and timing checks, answering your questions, showing wellness notes, reminders, and exports):

• medicines and supplements you add, with doses, timing, and how you take them;
• food and drink entries you add;
• lab results you add from photos, documents, or by typing;
• symptoms, notes, and chat messages you write or say;
• your routine (for example, meal times);
• photos, documents, and voice notes you add;
• Apple Health data you allow EverWell to read, which can include activity, sleep, heart, vital signs and body measurements, nutrition and water, and medications;
• profile details you give during setup: your name, birthday, sex (optional) and race or ethnicity (optional, sensitive; you can choose "Prefer not to say"), used only on your device to greet you and to tailor health information such as reference ranges and risks;
• information EverWell infers from the above, such as alerts, cautions, personal baselines, and summaries; and
• the same kinds of information about other adults you care for, if you create Dependant profiles.

3. Sources

• You, when you add, photograph, upload, type, or say something in the App.
• Apple Health, only for the categories you allow.
• EverWell itself, when it infers information from the above on your device.

4. What EverAssistant itself receives

We do not receive any of the data in Section 2. We do receive a small amount of other information, described in our Privacy Policy: your email, plan, and consent choices if you create an account; your email if you join the waitlist; and anonymous usage statistics unless you turn them off. This information is designed not to reveal anything about your health.

Encrypted cloud backups (paid plan, when available). If you subscribe to EverWell Family + Export and turn on Encrypted Cloud Backup, the App encrypts a backup of the data in Section 2 (except data read from Apple Health) on your device, with a passphrase or recovery key that we never receive, and uploads the encrypted file to Cloudflare, Inc. in Cloudflare R2, in a storage location restricted to the United States. We cannot read it. Because it is stored in the United States, it may be subject to US law, including lawful access requests by US authorities. Even so, we treat these encrypted backups as consumer health data that we collect and store: we ask for your separate consent before cloud backup is turned on, we use them only to let you restore your data, we never sell or share them (Cloudflare only stores them for us under contract), and you can delete them at any time in the App. We keep at most your newest 2 backups and up to 2 GB per account. We also delete them when you delete your account and after a 90-day restore-only window when your subscription ends. Because we cannot decrypt them, we can only give you or delete the encrypted file; the App decrypts it for you on your device.

Anonymous usage statistics. These are on by default, and you can turn them off at any time in Settings. While they are on, the App sends anonymous, fixed event names (for example, "onboarding step completed" or "chat message sent") with a random install identifier, never health details or anything you type. We process them only in de-identified form, we publicly commit not to try to re-identify anyone from them, and our contract with our analytics provider, TelemetryDeck, requires it not to either.

5. Sharing

We do not sell consumer health data, and we do not share it, except:

• Apple Private Cloud Compute (only with your separate consent). If you turn on Apple Private Cloud Compute, your question and the information needed to answer it are shared with Apple so that Apple Intelligence can answer, under Apple's terms and privacy policy. You can turn this off at any time in Settings.

Your own backups. EverWell does not sync consumer health data to iCloud. If you back up or transfer your iPhone with Apple's tools (iCloud Backup, a computer backup, or Quick Start), the information you added yourself can be included in that backup, which Apple or your computer stores under your own settings and agreement with Apple. If you create an encrypted backup file in EverWell, it is locked with a passphrase or recovery key that only you have, and you choose where to save it, which can include a third-party cloud storage service such as iCloud Drive, Google Drive, OneDrive or Dropbox; that provider's own terms then apply. These are your own copies; EverAssistant does not receive or access them, and this is not sharing by EverAssistant.

Categories of third parties: the only third party is Apple (Private Cloud Compute), and only if you turn it on. Cloudflare, Inc. is a processor that stores Encrypted Cloud Backup ciphertext for us in Cloudflare R2 in the United States, only if you turn them on, and cannot read them. Affiliates: we have no affiliates that receive consumer health data. We do not allow any third party to collect consumer health data about you over time and across different apps or websites through EverWell.

6. Your rights

Whether or not your state's law applies to you, you can:

• confirm whether we collect, share, or sell your consumer health data, and access it, including a list of the third parties we have shared it with (as explained above, we hold none of it ourselves; the App shows you all of it, and you can export it at any time);
• withdraw your consent at any time: turn off Apple Private Cloud Compute, encrypted cloud backup, or Apple Health access in Settings, delete your health data in the App, or delete the App;
• delete your consumer health data: in the App, use "Delete all my data" (copies in your own device backups or backup files are under your control, and you can delete them yourself). In Settings you can also delete your encrypted cloud backups. If you ask us to delete information we hold, including encrypted cloud backups, we will delete it from our systems, including our own backups, and tell our service providers to delete it too; and
• review and change your information: you can edit or correct anything in the App at any time.

How to make a request. Use the App, or email [email protected]. We will confirm your identity using your account email, if you have one. You may use an authorized agent where the law allows. Requests are free, up to twice a year. We will respond within 45 days after we confirm your request; if we need more time, we will tell you why, and we may extend this once by up to 45 more days.

Appeals. If we refuse your request, you can appeal by replying to our decision. We will respond within 45 days and explain our reasons. If your appeal is refused, you can contact the Washington State Attorney General (atg.wa.gov), the Nevada Attorney General (ag.nv.gov), or your own state's Attorney General.

We will not treat you differently for using these rights.

7. Changes to this policy

If we make a material change to this policy, we will tell you in the App, and by email if you have an account, at least 30 days before it takes effect. We will not collect or share consumer health data for a new purpose without first asking for your consent. The effective date at the top of this policy shows when it was last changed.

8. Contact

EverAssistant Inc. Our Privacy Officer: [email protected] Website: https://everassistant.io