Is Heidi Health safe with your data?

Heidi Health

Heidi Health Pty

64/100

Good disclosure · high confidence

Heidi Health earns a B (64/100) because it discloses most of its data practices.

#19

of 216 apps ranked

score · Healthcare avg 33

+31

vs category average

Grade scaleA · 70–100B · 60–69C · 48–59D · 35–47F · 0–34

Heidi Health's policy is unusually specific about clinical data, naming a no-training rule for health information, per-category retention periods, and three security certifications, but it leaves breach notification, output ownership, and AI-output labelling unaddressed, and its legal-basis and special-category commitments appear only in the European section.

What Heidi Health's privacy policy says about your data

Health data excluded from training

The policy states that health information is not used as an input to train, develop or improve any AI model, and that organisation and paid individual plan content is excluded too. Free-plan de-identified content is a stated exception, governed by the separate terms of service.

Retention named per data type

A retention table gives concrete periods: configurable session auto-deletion between 1 and 90 days, account information for the life of the account plus up to 12 months after closure, audio deleted as soon as transcription finishes, and security logs kept at least 12 months.

Security certifications named, breach notice missing

Encryption in transit and at rest, strict access controls and independent security testing are named, alongside ISO/IEC 27001:2022, ISO/IEC 42001 and a SOC 2 Type II attestation. The policy never says whether or how quickly users are told about a data breach.

Gaps in AI and ownership terms

The policy does not say who owns the outputs the platform generates, does not commit to labelling AI-generated content, and addresses biometric data nowhere. Its legal bases and explicit-consent rule for health data are set out only in the European regional section.

What the policy is silent or vague on

Not stated: a way to opt out of training
Not stated: your ownership of generated outputs
Not stated: marking of AI-generated output
Not stated: biometric-data handling

Heidi Health privacy rating

Training-data use1 of 4 disclosed

Keeps user inputs out of model training, or makes training opt-inPartial

Names a way to opt out of or into trainingSilent

Says whether training use differs by plan or tierDisclosed

Lets the user keep ownership of generated outputsSilent

Data-subject rights5 of 5 disclosed

Grants a right to access your dataDisclosed

Grants a right to delete your dataDisclosed

Offers data portability in a usable formatDisclosed

Grants a right to correct your dataDisclosed

Grants a way to object to or opt out of processingDisclosed

Retention and deletion2 of 4 disclosed

States a retention period for your dataPartial

States a deletion timeline after closure or requestDisclosed

Sets a shorter retention for AI conversation logsDisclosed

Commits to collecting only the data it needsPartial

Third-party sharing3 of 5 disclosed

Lists the categories of third parties it shares withDisclosed

References a sub-processor list or data processing agreementDisclosed

Does not sell or share data for advertising, or offers opt-outPartial

Names a safeguard for international data transfersDisclosed

States a standard for government and law-enforcement accessPartial

Transparency1 of 5 disclosed

Discloses that you are interacting with AIPartial

Marks AI-generated or synthetic outputSilent

Enumerates the categories of data it collectsDisclosed

Maps processing purposes to legal basesPartial

Is versioned and dated, with change noticePartial

Sensitive data and children1 of 4 disclosed

Discloses automated decisions and a human-review pathDisclosed

Limits the use of special-category dataPartial

Governs biometric data specificallySilent

States protections for children's dataPartial

Security and accountability2 of 3 disclosed

Describes its security safeguardsDisclosed

Commits to breach notificationSilent

Names a certification or a privacy contactDisclosed

DisclosedPartialSilentAdverseNot applicable

Details

Category: Healthcare
Modalities: text, audio
Processes biometrics: Yes
Policy last updated: Not stated
Region scored: Global / US-default
Last assessed: 2026-10-13

Documents examined

Other healthcare apps

Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.