How to choose
a private health app.

Why this matters more for health than for anything else

A health record is the most personal thing you will ever type into a phone, and the hardest to take back. A leaked password can be changed. A leaked diagnosis cannot. The questions below sort apps that are built to keep a record from apps that are built to collect one.

The eight questions

1. Where does the record live? On the phone, in the app's cloud, or both? The honest answer names the provider and the country. "Securely in the cloud" is not an answer.
2. Is it encrypted on the phone itself? Not just in transit. Look for the name of the method and where the key is kept.
3. Does it work offline? A record that needs a signal is a record you may not have in a hospital basement.
4. Can you export everything, on the free plan? If leaving means losing the record, you are not a customer, you are a hostage.
5. Can you delete your account, and what happens to backups? A date and a method, written down.
6. Who pays? If you are not paying, somebody is, and the usual answer is advertisers who would like to know what you wrote.
7. Does any AI read your record, and does anything sync in from a watch or another service? Each of those is another party with a copy.
8. Who can see a shared profile, and can you take it back? A carer should see what you choose, for the time you choose.

And one more: does it say plainly that it is not a medical device and does not diagnose? An app that scores your health is making medical claims; ask who is accountable for them.

Where to find the answers

On the app's own privacy policy and on any plain-language privacy page it publishes. A good policy names each company that touches the data, where each is, and how long each keeps it. Check the app's privacy label on the App Store or Google Play against what the policy says; the two should agree.

Biojrnl's answers

Biojrnl's record lives on your phone first, in an encrypted database (SQLCipher) whose key sits in the phone's own keychain; cloud backup is a switch you choose to turn on, held in the European Union by a named provider. It works offline. Export is on every plan including free; deleting the account erases the record after a 30-day change-of-mind window, on a timetable the policy sets out. It is paid for by subscriptions, shows no adverts, sells nothing, uses no AI on the record and syncs nothing in from watches or other services. A guest sees only the areas you choose for the time you choose; a co-manager sees the whole profile until you remove them. It is not a medical device and does not diagnose. Every one of those sentences is written out, with what each provider receives, on the privacy page, the privacy policy and the subprocessors list.

This guide is about keeping your own notes. It is not medical advice. If you are unwell, speak to a qualified clinician; in an emergency, contact the emergency services.