Is Heidi Health safe with your data?
Heidi Health
Heidi Health Pty
Weak disclosure · high confidence
Heidi Health earns a D (40/100) because it leaves much about its data practices unstated.
#159
of 211 apps ranked
40
score · Healthcare avg 39
+1
vs category average
Heidi Health's privacy policy is detailed on data categories, recipients and localization but relies on adjectives rather than named controls for security, gives no retention numbers, and stays silent on training opt-out mechanisms, synthetic output marking, automated decisions, biometrics, children and breach notification.
What Heidi Health's privacy policy says about your data
Training use is narrow and product-scoped
The only no-train statement covers PHI in Heidi Evidence, while de-identified health information is expressly used to improve the Platform, and no opt-out mechanism is named.
Rights are stated but not operationalized
Access, correction, erasure and portability appear as things you may ask for via a contact address, without a named self-serve mechanism, so most rights indicators sit at half.
Security language is adjectival
"Robust encryption, stringent access controls, and continuous threat monitoring" names no protocol, key length or certification, and there is no breach-notification commitment anywhere in the text.
No adverse clauses
Nothing in the policy reserves a harmful behaviour: no perpetual content licence, no refusal to delete, no indefinite retention as policy, and no selling without opt-out.
What the policy is silent or vague on
- Not stated: a way to opt out of training
- Not stated: whether training use differs by plan
- Not stated: your ownership of generated outputs
- Not stated: a deletion timeline after closure or request
Heidi Health privacy rating
Details
- Category
- Healthcare
- Modalities
- text, audio
- Processes biometrics
- Yes
- Policy last updated
- 2024-10
- Region scored
- Global / US-default
- Last assessed
- 2026-08-13
Documents examined
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.