Privacy Policy

Last updated: 25 October 2026. See what changed.

PULS3 is made by PULS3 PTY LTD (ACN 696 197 412) in Australia. This policy explains what data the app handles, what leaves your phone and why, who else touches it, and what you can delete. We wrote it to be read, not skimmed past.

1. The short version

2. Data the app collects

• Health and activity data you allow, from Apple Health on iPhone or Health Connect on Android, and, if you connect it, your Oura Ring.
• Your profile and preferences: goals, fitness level, life stage, pregnancy or postpartum status, health conditions you choose to share (such as a thyroid condition, PCOS, endometriosis or hormonal contraception), situations such as being a parent, shift work, recovering from an injury or being in a sports season, sexual or urinary health details you choose to share, medicines and supplements you add or that the coach saves when you mention one in chat (with their doses, times, and the doses you mark as taken or missed), communication style, and reminders.
• Your coaching interactions: chat messages, logged actions, plans, and meal or household settings you enter, including details about household members such as names, ages, and allergies.
• Your email address, and phone number if you give one, when you register.
• Service health reports, app step records, and optional product analytics, described in sections 6 and 7.

You sign in before you start, on iPhone and on Android. Your email address and the choices you make during sign-up are tied to your account on our servers. Your health data and your chat history are not tied to your identity there, apart from the cases this policy names.

Before PULS3 uses any health details, the app asks for your agreement on its own screen, “Your health details”, separate from the Terms. We record your answer, the version of that screen, and the time. Until you agree, the app does not read Apple Health, Health Connect or Oura, sends nothing to the AI model, and backs nothing up. Coaching needs these details, so the app cannot coach you without that agreement.

3. What stays on your phone

The app's working memory is local: the health database, chat history, coaching plans, agent memory, and preferences all live in on-device storage. Apple Health data is read on your phone with your permission and stays in that local database. If you allow it, PULS3 adds the check-ups and follow-ups you choose to your phone's calendar. PULS3 doesn't read your other events. Your calendar app, and any service it syncs with, such as iCloud or Google, keeps those events under its own terms. Health Connect data on Android is handled the same way. Section 3A has the details. If you allow it, the app also writes the energy, protein, carbohydrate, and fat of meals you log into Apple Health. You can export all local data as JSON, and you can delete all local data, in Settings.

3A. Health Connect on Android

On Android, PULS3 reads health data from Health Connect, Google's health data store on your phone. PULS3 asks for each type of data on Health Connect's own permission screen. You choose which types to allow, and you can allow some and refuse others.

PULS3 only reads. It does not write to Health Connect. The types it can ask for are steps, distance, exercise sessions, sleep, heart rate, resting heart rate, heart rate variability, active calories, weight, body fat, VO2 max, nutrition, and menstruation. It asks separately for access to data older than 30 days, and the app works without it.

The raw records stay on your phone. When you talk to your coach, the app sends short summaries, such as last night's sleep time, your 7-day step average, your resting heart rate trend, or the day of your cycle. It does not send the raw record stream. The summaries go over TLS to our server, which passes them to the model provider that writes your reply, as section 4 explains. By default we do not keep them on our server after the reply. If you opt in to conversation review, we keep your coaching messages and replies for up to 30 days, as section 4 explains, and a small PULS3 team may read them. Turning that choice off deletes them.

We use Health Connect data only to run the coaching you see in the app: your plan, your explanations, and your replies. We do not sell it. We do not use it for advertising or to work out what ads to show you. We do not use it to train AI models. We do not give it to anyone for their own use. People at PULS3 read it only if you opt in to conversation review, if you send us a report that includes it, if the law requires it, or to keep the service secure.

The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.

To stop PULS3 reading a type of data, open Health Connect, choose App permissions, then PULS3, and turn the type off. PULS3 checks your permissions every time you open it, and it stops using anything it can no longer read. To remove the copies PULS3 holds, use "Delete all local data" in Settings. That does not delete your records in Health Connect. They belong to you and to the apps that wrote them, and you manage them in Health Connect.

4. Coaching conversations and the cloud model

Generating a coaching reply needs a cloud model. When you send a message, your phone sends the conversation and the context the coach needs (relevant parts of your profile, goals, the medicines and supplements you have added, recent health summaries from Apple Health or Health Connect, and, for dinner ideas, for each person you cook for, whether they are an adult or a child, their age band, diet type and allergies, and the foods, spice level and textures they like or refuse (not their names or medical notes), the foods in your pantry and freezer, the names of dinners your household usually has or has made before, and how long you have to cook) to our server, which passes it to a company that runs the model, either through OpenRouter or directly to Anthropic. Today the models come from OpenAI, Anthropic and Google. OpenAI models run first on Microsoft Azure or Amazon Bedrock. Anthropic models run on Anthropic's own servers in the United States. Google models run on Google. The exact model and host can change as we improve the product. Your life stage, and the health conditions and situations you choose to share, go to the coaches they matter for, so their advice suits you and stays safe. Pregnancy, trying to conceive, cycle conditions such as PCOS, and menopause details are used for coaching only while the matching switch is on in Settings, under Health contexts. Answering during setup, answering the questions under “About your body” in Settings, or ticking an item under “What applies now” in Settings, such as pregnant, PCOS or HRT, turns the matching switch on. Turning a switch off turns it off, and those details then stop being used for coaching. The app's own safety checks on your phone still take a pregnancy into account when the switch is off, so they can keep advice safe; that check stays on your phone. Your medicines and supplements go with your coaching messages unless you turn off “Let coaches use My Regimen” in Settings. Apart from that, the list stays on your phone. It is not backed up, and our server keeps no copy of it. The app can ask for tonight's dinner ideas before you open it, so they are ready when you look. It does this only if you have opened PULS3 in the last 3 days.

We do not keep a readable server copy as part of the model request. If you sign in, the separate sync feature can keep an encrypted backup of the conversation, as section 5 explains. Our server keeps account-linked daily model usage totals for billing and capacity planning. These totals include the model, request and failure counts, token totals, and reported cost. They stay until account deletion. We also keep unlinked per-request service-health records, such as the request time, model route, token count, speed, status, and error code, for up to 90 days. Neither record contains message text, health readings, or health topics. We can keep service totals that no longer identify you. The model providers process your message to produce the reply. We set each model request to deny data collection for training. Requests that go through OpenRouter go only to AI providers that agree not to keep them or train on them, including when OpenRouter falls back to another endpoint, and a request fails if no provider meets these rules. Anthropic keeps requests we send to it for up to 30 days for safety and abuse monitoring, and may keep a request its automated safety systems flag for up to two years. It does not use them to train its models. PULS3 does not collect, use, or sell personal data to train large language models.

OpenRouter can keep non-text request metadata, such as the model, token counts, and latency. We do not send it your PULS3 account identifier.

Signed-in people can separately choose to share new coaching messages and replies for up to 30 days. A small, restricted PULS3 team may review this content to find bugs, confusing steps, and quality or safety problems. This content can include health details. Our server removes photos before it saves a copy, but keeps any text the app read from a photo, such as the results on a lab report. We reduce common direct identifiers, such as email addresses and phone numbers, before human review. We also audit each access. Each saved copy includes your signed-in account reference and a random PULS3 device identifier so we can diagnose and delete the right copies. This choice is off by default. Refusing it does not limit the app. Turning it off stops new capture and asks our server to delete saved copies linked to your account.

Some coach abilities call other services through our server:

• Web search sends the search query to Brave Search.
• Reading a web page sends that page's address to Jina Reader.
• Food lookups check our own nutrition database first, then USDA FoodData Central, using the food name. A barcode you scan is looked up in our own copy of the Open Food Facts product database.
• A meal photo you log goes with the request to the model so it can estimate what is on the plate. We do not keep the photo on our server, and conversation review does not keep photos.
• On iPhone, a photo you send in chat goes with your message to the model. Before it leaves your phone, the app tries to cover faces, email addresses, phone numbers, and lines of text that mention things like an address, date of birth or Medicare number. It can miss some, such as handwriting. When you send a photo as a lab report, the app still covers those parts of the picture, but it also sends the text it reads from the report, which can include your name and other details printed on it, so the model can read your results.
• On iPhone, when you add a lab report on the Labs screen, as a PDF, a photo or pasted text, the app first asks whether you agree to send it. If you do, the whole report goes to the model as it is, so it can read your results. The app does not cover anything on it, so it can include your name and other details printed on the report. Conversation review does not keep it. You check each result before the app saves it, and saved results can go with later requests to the model when they are relevant.
• On iPhone, when you add a note from a clinician visit, such as a visit summary, an appointment transcript or an email from your provider, pasted or chosen as a file, the app first tells you the note will leave your phone. If you continue, the whole note goes to the model as it is, so it can list the actions in it. It can include your name and other details written in it. Conversation review does not keep it. Nothing changes in your plan unless you choose an action. The app saves the actions you add and the short quotes from the note shown with them, and these can go with later requests to the model.
• On iPhone, a photo of your fridge, pantry or spice rack goes with a request to the model, along with the names of groceries you bought recently, so it can read what food is there. You can take it to fill in your kitchen, or to get dinner ideas from what you have. This request can go directly to Anthropic (section 12). From version 1.9, the iPhone app no longer sends your household's allergies with the photo. Instead, it checks the foods the model found against them on your phone and asks you about any that match. Earlier iPhone versions and the Android app still send the allergies with the photo. The app does not store the photo. When you take it to fill in your kitchen, the app saves the foods the model found to your pantry list, marked unconfirmed until you check them. When you take it for dinner ideas, the foods it found then go with a dinner-ideas request, as described at the start of this section.
• UV and air quality use your approximate location. Before it leaves your phone, the app rounds it to about one kilometre. That rounded location goes to Open-Meteo through an authenticated request to our server, which keeps it in a short cache that expires within six hours. When the coach checks your location, for example to suggest something outdoors, it sees the same rounded location. Our servers never receive your exact location. The app uses it on your phone to sort nearby clinics, and the clinic search itself goes to Apple Maps. This only happens if you allow location access.
• Recipe images send the recipe title to an image model via OpenRouter.

Each of these sends only what the feature needs, and none of them includes your name or contact details.

5. Account, backup, and sync

When you sign in, with Apple or with Google, two things happen:

• We store your registration: email address, phone number if given, your region, your consent choices, and basic anti-abuse records. This lives on our registration server so we can verify you and contact you about PULS3. If you sign in with Google, Google tells us your email address and a stable account identifier. We do not get your Google password, contacts, or any other Google data. On Android, the app asks you to sign in before you start.
• The app backs up your conversations and household food settings (household members, allergies, food notes, pantry and grocery lists, goals) to our sync server so you can restore them on a new phone. The sensitive fields are encrypted on your phone before upload, and the server stores the encrypted form: message text and conversation titles, household members' names, allergies, medical notes and food notes, and the names of pantry and grocery items. Other details are not encrypted. These include when each message was sent, a household member's age and role, your cooking time, cooking confidence and kitchen equipment, and each pantry or grocery item's quantity, category, aisle, status, use-by date and when it was added or changed. Backups are stored with Cloudflare, in its Oceania region or its United States region. If your App Store country or your phone's region is Australia or New Zealand, new backups go to the Oceania region; everywhere else uses the United States. Older backups move to the Oceania region after you update the app, usually within a day; a few accounts need a manual move.
• On Android, your conversations stay on your phone, apart from the model call in section 4 and the optional conversation review. Backup and restore are not available on Android yet.

Until you sign in, no backup happens and no registration exists.

6. Service health reports

After you accept this policy, the app sends a small set of service health reports to Sentry, whether or not you turn product analytics on. They tell us the app is working, and they are how we find out when it is not. They are:

• crashes, hangs, and app start problems, including whether the app's local database opened;
• sign-in failures and recoveries, as a short reason code;
• failures to obtain the token the app needs to reach our model service;
• purchase and restore failures, as a short reason code;
• slow or failed calls to our model service, as timing buckets.

These reports contain technical details such as the device model, operating system, app version, whether the install came from the App Store, TestFlight or Google Play, error route, reason code, and timing. A masked replay can be attached to an error. It hides text and images. They never contain conversation text, health readings, health topics, safety check results, your email address, your Apple identifier, or your account identifier.

Each report carries a one-way hash of the random PULS3 device identifier, so we can count how many phones a fault affects. The hash cannot be turned back into the identifier. If you have turned product analytics on, we could match a report to analytics from the same phone. We do not match it to your account or email, and we do not use it for advertising. Deleting all local data resets the device identifier and the hash with it. We remove URL queries and request headers before a report leaves the app.

After a crash, you can choose to send us a written note. The note is attached to the crash report in Sentry. The screen asks you not to include health or contact details.

App step records. After you accept this policy, the app also sends app step records to our server, whether or not you turn on product analytics. Each record names one part of the app and one step in it, from a fixed list. The parts are the coach, your plan, dinner ideas, how dinner went, the food log, movement, goals, the weekly review, the body log, Apple Health connection, Oura, sharing, notifications, subscriptions, settings, feedback, setup, and sign-in. The steps are opened, started, worked, failed, and left unfinished. A failed or unfinished step can carry a short reason, such as no connection, timed out, permission declined, or cancelled. A sign-in record can also say whether you chose Apple or Google, and which screen asked you to sign in. For how dinner went, a record says only whether you answered, not what you answered.

A few records mark points in setup: the first time you open the app, the introduction, your answer to the product analytics question and any later change to it in Settings, reaching and passing the sign-in screen, each setup stage, your first plan, and coming back on a second day.

App step records never contain what you typed, logged, or said to your coach. They contain no health readings and no health topics. The body log is one part of the app, so a record does not show whether you logged sleep, weight, mood, or a symptom. Each record carries the app version and the time it happened. We store only the date and a 15-minute time slot, not the exact time.

Before you sign in, a record carries a separate random code for this phone. Our server keeps only a keyed hash of that code. When you sign in, we link this phone's records to your account, so we can see where the app fails for a person and fix it. We do not use app step records for advertising, and we do not share them with anyone else.

To check that records come from a real copy of PULS3, the app asks Apple for a device check token, and our server confirms it with Apple. Apple receives that token, not your records.

We delete app step records after 90 days. Deleting your account deletes them sooner, including records this phone sent before you signed in. If you stop using your health details, the app stops sending records about the food log, movement, the body log, Apple Health, and Oura.

7. Optional product analytics

PULS3 asks before it collects product analytics. The choice is off by default. If you agree, the app records events such as screens viewed, actions, timing, outcomes, app version, performance, and broad health areas you open. It also includes your answer when the app asks how dinner went: whether you had the dinner you picked, made something else, ate out, or didn't have it. It does not include conversation text, health readings, photos, or contacts. The events carry a random PULS3 device identifier and, when you are signed in, an account identifier. On iPhone, the device identifier can remain in the Keychain across a reinstall. On Android, it is removed when you uninstall the app. Delete all local data removes it on both. Events upload in batches to our server.

We use this data only to operate and improve PULS3. It tells us what works, what people use, and where they get stuck. Short event samples expire within 7 days. The server also keeps account-linked daily totals. Account deletion removes those linked totals. We can keep totals that no longer identify you.

You can change this choice in Settings. Turning it off stops new collection and deletes queued events from your phone. Refusing it does not limit the app.

Our website

puls3.app counts visits two ways. Neither sets a cookie, saves anything that outlasts your browser tab, or follows you to other sites. Neither identifies you, and neither is connected to the app or to a PULS3 account.

• Our own counter records a page view when you open a page, and a tap when you tap an App Store button. For each one, it keeps the page, the site that sent you (just its domain, never the full address), the campaign, source, and medium labels in the link you followed (a medium label is a short word such as "paid" or "social"), whether the link carried a TikTok click ID (we record only that one was there, never the ID itself), and, if you opened the page inside the Instagram, Facebook, or TikTok app, which app's browser it was. We work that out on your device and send only the app's name, never the rest of what that browser sends. Your browser keeps those same labels in session storage, which belongs to that one tab. We send them with page views and taps on our pages in that tab, so a tap on a later page counts for the source that brought you. If you restore a session, the browser can bring the tab's session storage back. It ends when you close the tab for good. We never store the labels with you. All of this is kept as daily totals, never tied to you. We don't use any of these labels to identify anyone. If your browser sends Do Not Track or Global Privacy Control, we record nothing for that visit. To stop one browser from sending us too many of these at once, our server holds a keyed hash of your IP address for up to two hours, then discards it. That hash is never stored alongside the counts above.
• Cloudflare Web Analytics also counts visits. Cloudflare's own description: it records the page you open, the site that sent you, your browser and device type, and your country, as totals.

8. Oura Ring (optional)

On iPhone, if you connect Oura, you approve access on Oura's own site. Our server completes the sign-in with Oura, and later renews or revokes the access, so Oura's secret key never ships in the app. It passes the access back to your phone and does not store it. The app then pulls your daily readiness and sleep data from Oura's servers straight onto your phone, where it is stored with your other health data. Our server never fetches your Oura data. When you ask the coach, short summaries of it, such as your readiness score and recent sleep, go with your message, as section 4 explains. The access token is stored in the iOS Keychain. You can disconnect Oura in Settings at any time; disconnecting revokes the token.

9. Emails we send

• A waitlist invite, only if you joined the waitlist on our website. It is a fixed template with your invite and an unsubscribe link.
• Weekly report email, only if you turn it on. Your phone builds a summary of the week that ended (counts of planned and completed movement, sleep, and food items, plus a behaviour-language description of your training week). Our server turns that into an email and sends it, then discards the content, keeping only delivery records. Every one has an unsubscribe link.
• A check-in email if you have been away, only if re-engagement messages are on. It is a generic template and contains no health data.
• A service notice when we need to tell you about a change to how your data is handled. It goes to every account, even if you turned our other emails off, and it never promotes anything. We keep a record that we sent it to you (which notice and when, not its content) until you delete your account.

All email is delivered by Resend. Resend processes your email address and the content of each message in order to deliver it.

10. Feedback you send us

If you submit feedback in the app, our server stores the feedback text with your app version, device model, and user identifier for up to 90 days. Linear, the issue tracker our team works in, gets only a note that feedback arrived: its category, severity, app version, and a reference number. It never gets what you wrote.

When you flag a coach reply with a thumbs-down, you can choose to attach that conversation to your report. This is off by default; turning it on is your consent for that one report. The attached messages can include health details, are not sent to Linear, and are read only by a small PULS3 team to understand what went wrong. Attached conversations expire within 90 days.

11. Purchases

On iPhone, subscriptions are handled by Apple through the App Store. Apple processes the payment; we never see your card details. StoreKit gives the app verified subscription status so it knows what you have bought. If you are signed in when you buy, the purchase carries an account code that the app works out from your PULS3 account, so the purchase can later be matched to your account. The code is not your name, email or Apple ID, and Apple keeps it with the purchase. Apple also tells our server when a PULS3 subscription on iPhone starts, renews, ends, or is refunded or revoked. Our server checks that each message is signed by Apple. The iPhone app does not yet report your purchase to our server, so these messages are not matched to any account and change nothing. Each one is logged for 30 days with a one-way fingerprint of the purchase and no link to your account, so the same message is never handled twice. Three things about your purchases reach our server from the app. App step records (section 6) note when you open the subscription screen, start a purchase, finish it, or leave it unfinished. If you turn on product analytics, analytics also records which plan you picked: monthly, annual, or family. If you claim a founding offer, the app sends Apple's signed record of your download so we can check you are eligible, and we store the offer code and plan against your account. None of this includes a price, a receipt, or payment details. It is deleted when you delete your account.

On Android, subscriptions are handled by Google through Google Play. Google processes the payment, and we never see your card details. When you buy or restore a subscription, the app sends the purchase token Google Play gives it to our server. Our server asks Google to confirm it. When Google tells our server that a subscription has changed, for example renewed, cancelled, refunded or revoked, our server asks Google for its current state. Each of those messages is logged for 30 days, with a one-way fingerprint of the purchase and no link to your account, so the same message is never applied twice. We keep a record linked to your account: the product, a one-way fingerprint of the purchase token, the state of the subscription (such as active, in a grace period, cancelled, refunded or revoked), when it ends, when we last confirmed it with Google, and a one-way fingerprint of what Google reported. We use it only to know whether you have paid access, so the same subscription works after you reinstall or change phone. We delete your purchase records with your account. Google keeps its own order records under its policy. After you delete your account, we keep a one-way fingerprint of your Google Play purchase token, with no link to you. We use it to recognise that purchase if it is restored later.

12. Who else touches your data

Most of these services run in the United States. Model requests can go directly to Anthropic and run in the United States. This includes coaching messages, meal photos you log, kitchen photos, and lab reports, along with the text the app reads from them. Anthropic keeps these requests for up to 30 days for safety and abuse monitoring, longer if its safety systems flag them, and does not use them to train its models. If Anthropic is unavailable, a request can go through OpenRouter instead. Requests that go through OpenRouter to OpenAI models go first to a Microsoft Azure endpoint in the European Union, then to endpoints in the United States. If those are busy, OpenRouter can send a request to another endpoint that meets the same no-training and no-retention terms, which may be in another country. Requests that go through OpenRouter to Google models go wherever OpenRouter routes them, and we do not limit them to a region.

We do not sell personal or health data. We do not share it with advertisers or data brokers. No service in this table receives more than the table says.

13. Your controls

• Export all local data as JSON in Settings.
• Delete all local data in Settings. This wipes the local database, reminders, cached sign-in state, the random PULS3 device identifier, local retention counters, and queued usage events.
• Delete your account in Settings. This deletes your registration, encrypted sync backups, account-linked analytics and model usage totals, conversation review copies, and your Google Play purchase records.
• Stop using your health details in Settings, under Your health details. PULS3 then stops reading Apple Health, Health Connect and Oura, sends nothing more to the AI model, stops backups and analytics, and cancels the reminders it set up. Coaching stops until you agree again. Data already stored stays until you delete it.
• On Android, turn off any type of Health Connect data for PULS3 in Health Connect, under App permissions. PULS3 stops using that type the next time you open it.
• Turn off “Let coaches use My Regimen” in Settings to stop the coaches using your medicines and supplements. Nothing is deleted. Reminders for medicines and supplements show a general title on your lock screen, not the name of what you take, unless you choose to show the name for that item.
• Turn product analytics off in Settings. This stops new collection and clears queued events from your phone.
• Service health reports and app step records (section 6) are not controlled by the analytics setting. Neither contains health readings or anything you wrote. Deleting your account deletes app step records from our server. Deleting all local data clears records still waiting on your phone and resets the identifier they carry.
• Turn conversation review off in Settings. This stops new capture and asks our server to delete saved copies linked to your account.
• Disconnect Oura in Settings.
• Turn the weekly report email off in Settings or via its unsubscribe link.
• Turn re-engagement messages off in Settings.

14. Retention

Local data stays until you delete it. Sync backups and registration stay until you delete your account. So does a record of each service notice we sent you (which notice and when, not its content). Optional conversation review copies expire within 30 days. Turning that choice off asks our server to delete them sooner. Short product analytics samples expire within 7 days. Account-linked daily analytics and model usage totals stay until account deletion. We can keep totals that no longer identify you. Unlinked model service-health records expire within 90 days. Service health reports in Sentry expire within 90 days. App step records expire within 90 days. Feedback records, including any conversation you choose to attach to one, expire within 90 days. Both website counters keep daily totals only, and neither identifies you. Google Play purchase records stay until you delete your account. Logs of Google's subscription change messages expire within 30 days and carry no link to you. Logs of Apple's subscription messages also expire within 30 days and carry no link to you. After you delete your account, we keep a one-way fingerprint of your Google Play purchase token, with no link to you. We use it to recognise that purchase if it is restored later.

15. Security

Sensitive backup fields are encrypted on your phone before upload. Tokens live in the iOS Keychain on iPhone and in Android's encrypted app storage on Android. Server traffic uses TLS. No system is perfect; keep your device updated and protected with a passcode.

16. Australian privacy law

We are an Australian company and handle personal information, including health information, under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You can ask us for access to the personal information we hold about you, ask us to correct it, or complain about how we handled it. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

17. US consumer health data laws

Washington, Nevada, and Connecticut have laws that protect consumer health data. Our Consumer Health Data Privacy Policy lists the health data we collect, where it comes from, who receives it, and how to see, stop, correct, or delete it, including how to appeal our decision. We give those rights to every user, wherever they live. Send requests under that policy to [email protected].

18. Household members and children

You can add household members, including children, to plan food for your household. Their details (name, age, role, allergies, medical notes, food notes) are entered by you, live on your phone, and are included in sync backups if you sign in on iPhone. Names, allergies, medical notes, and food notes are encrypted on your phone before upload; age and role are not. The app also keeps, on your phone, which dinners you picked and what each person ate, so it can suggest better ones. Only add details you are entitled to share.

18A. Who PULS3 is for

PULS3 is built to coach adults. You must be 18 or older to create a PULS3 account, as our Terms of Use say.

On iPhone, if your Apple Health date of birth shows you are under 18, the app asks you to confirm your age. If you confirm it, the app won't coach you, and it suggests talking to an adult you trust. On Android, if you choose "Under 18" when the app asks your age, it won't plan meals for you, and the coach applies stricter safety limits to its replies.

If you are under 18, or you think someone under 18 is using PULS3, email [email protected]. We will delete their account and everything our servers hold for it, as section 13 describes. To remove what is stored on the phone, use Delete All Local Data in Settings, or delete the app.

19. Not medical care

PULS3 is a coaching app. It does not diagnose or treat anything, and it is not a medical device. For medical concerns, see a qualified professional.

20. Changes to this policy

When this policy changes in a way that matters, we will tell you in the app or by email before the change applies, and this page will show the new date and what changed.

20A. What changed

25 October 2026

• From version 1.9, a kitchen photo on iPhone no longer sends your household's allergies. The app checks the foods the model finds against them on your phone. Earlier iPhone versions and the Android app still send them (section 4).
• A kitchen photo can give you dinner ideas from what you have (section 4).
• Dinner ideas: what goes with each request, which app steps are recorded, the dinner answer in optional analytics, and what stays on your phone (sections 4, 6, 7 and 18).

16 October 2026

• When you add a lab report on the Labs screen, or a note from a clinician visit, the app asks you first. If you agree, the whole document goes to the model so it can read it (section 4).
• We will now tell you in the app or by email before a change that matters, and this section lists what changed (section 20).
• A service notice about how your data is handled goes to every account by email, and we keep a record that we sent it until you delete your account (sections 9 and 14).

14 October 2026

• Meal photos, kitchen photos and lab reports can go directly to Anthropic (section 12).
• A kitchen photo goes with your household's allergies and the names of groceries you bought recently, so the model can read what food is there (section 4).

13 October 2026

• Our server completes the Oura sign-in and passes the access back to your phone without storing it (section 8).
• Conversation review keeps no photos.
• New switches for calendar and Health contexts.
• Apple App Store subscription messages reach our server (section 11).

12 October 2026

• Kitchen photos on iPhone.
• Conversation review can include text read from photos you add to a chat.
• Purchase records (section 11).

11 October 2026

• You must be 18 or older to use PULS3 (section 18A).

10 October 2026

• Some requests now go directly to Anthropic. It keeps them for up to 30 days for safety and abuse monitoring, longer if its safety systems flag them, and does not use them to train its models (sections 4 and 12).
• The policy names the health conditions and situations the coaches receive.
• My Regimen, meal photos and barcode lookups.
• Sign in with Google on iPhone.

For earlier versions, email [email protected].

21. Contact

Privacy questions and deletion requests: [email protected].