Effective 29 August 2026.
This self-hosted application accesses Google user data only after the user grants OAuth consent. It requests read-only access to Google Health health metrics and measurements, activity and fitness, and sleep data.
Authorised data is used solely to provide the user-facing feature of copying the user's health history into the Open Wearables destination selected and controlled by the operator. It is not used for advertising, profiling, sale, surveillance, or training general-purpose AI models.
The importer stores an encrypted Google refresh token, a last-sync checkpoint, aggregate progress counts, the latest value for each available category and a bounded 24-hour chart series in its private persistent volume. Full health records pass through memory in batches and are sent only to the configured Open Wearables instance; the importer does not retain a second full health-record database. No Google user data is shared with unrelated third parties. The authenticated dashboard loads Chart.js from jsDelivr to draw charts; the application does not intentionally send chart data to jsDelivr.
The encrypted connection state is retained until the operator uses the authenticated POST /disconnect control or removes the persistent volume. Disconnecting revokes the Google token and deletes importer state. Records already copied into Open Wearables are controlled by that separate self-hosted service and must be deleted there if desired.
The service is intended to run behind HTTPS. OAuth credentials, API keys and administrator credentials are supplied as deployment secrets, never embedded in source. Administrative routes require authentication, tokens are encrypted at rest, and logs contain aggregate counts rather than health values.
The application's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and the Google Health API Developer and User Data Policy.
Questions and deletion requests for this deployed instance can be sent to [email protected]. Security issues in the software can be reported using the repository's security policy.