1. Scope
This policy describes Elemental for iOS, developed by Hu Shiye. Core recording needs no Elemental account. Optional Metis connects directly to a provider you configure; Hu Shiye does not operate that provider or receive those requests.
2. Information handled
On your device, Elemental handles product names, ingredients, schedules, inventory, intake and skipped doses, wellbeing and personal context, clinical test reports and values, original photos/PDFs, recognized text, drafts, conversations, prepared chat attachments, tool results, web search queries and results, and preferences. You may also authorize HealthKit readings and supply an API key.
3. Local processing and document recognition
Product-label and clinical-report recognition run on-device. After you photograph or choose a product label, or add a test report from a photo or PDF, the recognized values are read on your device and saved only after you review and correct them; importing does not send them to AI. In a Metis conversation, you can add photos, take a photo, or select a PDF, image or UTF-8 text file; CSV and JSON files are not accepted. Photos and PDF pages are prepared as images with detected identity text, faces and barcodes masked on device; text files are prepared as redacted text. You can inspect prepared attachments before sending. With your sending permission, those processed images or text go to your configured provider with your question. Masking and redaction may miss personal information, so check before sending. The optional “Keep selected originals on this device” is off by default; originals stay on your device and are never sent. Adding a chat attachment does not itself create a product or report. Original source files are stored locally and may be included in device or operating-system backups. Elemental has no developer-operated sync or backup server.
4. Apple Health (HealthKit)
With permission, Elemental reads sleep, heart-rate variability, resting heart rate, body mass, step count and active energy. Access is read-only. Readings retain dates, units and sources; missing data is not zero. Health permission alone does not permit sending data to AI. Relevant imported readings may be sent after separate AI permission. The developer does not receive, sell, or use HealthKit data for advertising. Revoke access in Health or iOS Settings; this stops future reads without deleting existing local observations. Settings can clear the local Health cache independently.
5. Record comparisons
Local comparisons describe recorded values. A comparison does not prove that an intake caused a change. Elemental does not diagnose, prescribe, assess medication safety or recommend doses. Check AI output; consult a qualified healthcare professional before medical decisions.
6. Third-party services and permissions
With permission, Metis sends your question, current conversation history, prepared chat attachments and relevant records to your configured HTTPS service. These may include health, fitness, clinical test results and personal context you wrote. Before sending, a confirmation lists the provider, address, model, the data classes that may be sent and this question; you can agree for this send only or agree and remember. Remembered consent covers only the exact HTTPS address and can be revoked on the model service page. You can save several model services and switch between them; each service manages its own address, model and key. One request may involve multiple model and tool calls, with further tool results sent during the run. Continuing or switching providers may resend history. Some dedicated reading tools omit private note fields, but this does not mean all free text is filtered: information entered in questions or readable personal context may be transmitted. Tool permissions has two modes. The default “Require approval” pauses before every tool call, including reads and writes. “Full access” allows supported tools to read and send relevant records and write local Elemental records without asking each time; changes apply at the next tool call. These writes do not add or change Apple Health data. Metis connects to OpenAI, OpenRouter, DeepSeek or a compatible custom HTTPS endpoint, with the protocol set by each service configuration; a routing service may involve downstream providers. The Web search toggle, its network path and data boundary are described in the next section. Provider-side retention, training, account and deletion terms vary; Elemental does not promise zero retention. No advertising SDK, analytics SDK or cross-app tracking is included.
7. Web search (optional)
Web search is off by default and is offered only when the model service is configured with an exact DeepSeek chat endpoint (https, api.deepseek.com, default port and a known chat path); custom or look-alike addresses never get the toggle. When it is on, the model can call an app-executed, read-only search tool: the app uses the current service's DeepSeek API key to send the model-composed query (which may include information you supplied in the conversation) to the fixed address https://api.deepseek.com/v1/tools/search. Each request returns public page titles, URLs and summaries only; no page bodies are fetched, nothing is retried automatically, and at most two searches run per request (failed attempts count). Results appear as web sources, but public pages may be outdated, wrong or contain malicious instructions; they are not your records or medical advice, so check them before relying on an answer. Searches are billed per request, and DeepSeek's search-service terms, retention and region apply. No search runs while the toggle is off, and with Require approval each search asks first.
8. Retention
Current Metis conversations are stored locally and can be reopened, archived or deleted; saved conversations remain until you delete the relevant content or reset local data. Archiving keeps their contents. Deleting a question also deletes its conversation and checkpoint, while records already saved as products, intake or reports remain. Long conversations may have their model context compacted; this is not permanent verbatim memory. Deleting local conversations or keys does not delete provider copies. Stopping or revoking permission cannot retract data already sent. Records are retained locally until deleted through the available controls. iOS backups may contain app data.
9. Export, deletion and permissions
Settings exports a portable ZIP package with saved records, source relationships including file order and source pages, questions and current work checkpoints in records.json. You can include available original photos and PDFs; missing or unreadable originals are listed individually. Full conversations and their chat attachments, HealthKit caches, unsaved inputs and pending tool actions are excluded. The package is not a restorable database backup. It may contain health and other personal information; you share it through the system share sheet. Delete individual records or reset local data using the available controls; Apple Health originals and data received by providers are managed separately. API keys are stored in iOS Keychain and should be deleted in model settings or revoked with the provider. Camera permission supports product labels, reports and Metis chat photos; manual record entry remains available. Notification permission supports optional local reminders. Product deactivation retains history; product deletion can remove associated records as described in the confirmation.
10. Security
Elemental relies on iOS app-container protection and system permission controls. Requests use HTTPS. API keys are stored in iOS Keychain. No storage or transmission system can guarantee absolute security. Keep iOS current and protect your device with a passcode.
11. Children's Privacy
Elemental is not directed to children under 13. Hu Shiye does not knowingly collect personal information from children. Third-party provider eligibility and minimum-age terms also apply.
12. Website and support
These static pages are hosted by Cloudflare Pages. The host may process technical request data such as IP address and browser information to serve and protect the site. These pages contain no analytics script or browser-storage code. If you contact support, your email service and the support mailbox process what you send; do not send API keys or personal health originals.
13. Changes
When features or processing change, this policy may be revised with a new update date. Material changes will be reflected in the app or its App Store information where appropriate.
14. Contact
For privacy questions, contact Hu Shiye at hushiyebrady@gmail.com.