Google Health privacy notice

This notice covers LifeCORE Today's optional Google Health/Fitbit connection. It does not describe separate Home Assistant OAuth clients or every other LifeCORE feature.

Information accessed

With the owner's authorization, LifeCORE requests Google Health's read-only activity-and-fitness scope. Enabled exercise reads select exercise identifiers, activity type, start and end times, active duration and recording method, within a requested window of no more than the preceding 30 days. LifeCORE adds import and review metadata. Heart-rate access and storage remain disabled. Sleep, location tracks and unrelated health categories are outside this connection's enabled collection.

Check steps requests today's daily aggregate from the Google/Fitbit wearable source family. It displays the day, a step total or unknown result, source family, check time and quality. The source can include Google and Fitbit wearable trackers; it is not represented as exclusively Fitbit data.

Purpose and controls

Exercise summaries support the owner's private activity history, duplicate/matching review and enabled fitness-plan decisions. Automatic exercise checks are limited to the enabled foreground Fitness workflow. Steps provide context only and do not create workout credit or change saved plans. Checking steps requires an explicit action; it does not enable background step collection.

Storage and retention

The current wearable repository encrypts authorization credentials and saved wearable evidence in the owner's designated private Google Sheets destination. The server decrypts what it needs to perform authorized operations. Saved exercise evidence is flagged for owner retention review after one year; this is not automatic deletion.

Today's step results remain in the active interface's memory and are cleared on applicable navigation, hiding, clearing, day changes and connection changes. This feature does not save step totals to Drive, the application database, browser storage, exports or AI prompts. The separately developed server-based step-history trial is fictional and is not authorized real-data collection.

Services, access and disclosure

Google processes authorization and Health API requests and hosts the designated private records. LifeCORE runs on the OpenAI Sites hosting platform with Cloudflare infrastructure; authorized application requests and responses pass through hosting infrastructure. Application access is restricted to the configured owner. This does not mean hosting operators cannot process operational metadata.

Wearable code does not intentionally log tokens or raw provider payloads. Hosting/provider logging and retention are separate from application-level handling; this notice makes no promise of zero infrastructure logs, forensic erasure or independently verified backup recovery.

The Google Health feature does not send exercise summaries or step totals to AI models, advertising services or data brokers. Google Health data is not sold or used for advertising or general-purpose AI training. LifeCORE Today's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and removal

The application's disconnect action stops local ingestion and removes its stored wearable access and refresh credentials. Existing saved exercise history is preserved; disconnecting does not itself delete history. Owner-directed record removal is separate and must be handled through the applicable review process. No immediate deletion from all provider logs, prior versions or backups is promised.

The owner may also revoke access in Google Account's third-party connections settings. Google project-wide revocation can affect other clients sharing the same project, so it should be reviewed before use. This notice does not authorize changing a separate Home Assistant connection.

Questions and changes

Contact Josh Hickey at joshkhickey@gmail.com with access, correction, removal or privacy questions. Material changes to enabled data access or use require an updated notice and applicable authorization before collection expands.