Pandola Privacy Policy
Pandola helps you follow the care plan your doctors give you, especially after a hospital stay or procedure. It turns the plan into daily check-offs, charts and alerts, using your health records and the data on your iPhone. This policy explains what information the app uses, where it’s kept, when it leaves your iPhone, and the choices you have.
This is a beta. Features may change, and we’ll update this policy when they do (see “Changes to this policy”).
The short version
- Your health information stays on your iPhone. Pandola has no account system and no database of your health data. We don’t run a server that stores it.
- It leaves your iPhone only for features you choose: connecting a health system or a glucose sensor account (FreeStyle Libre, Dexcom or Nightscout), using a cloud AI, or looking up a medicine’s barcode. Each is described below.
- Pandola AI (beta) is used only if you turn on AI. For the features you use (reading your care plan, explaining lab results, Coach replies, including recent health events, and suggesting visit questions), it sends a de-identified summary to the Grok model from xAI (operated by SpaceX Super Intelligence LLC) through our server. Messages you type to the Coach are sent as you write them. Our server passes the request along and adds our xAI key. It isn’t designed to keep the content.
- Demo Mode uses a made-up sample patient. In Demo Mode, nothing about you is sent anywhere.
- We don’t sell your data, don’t use it for advertising, and don’t include any analytics, advertising or tracking code in the app.
1. Information the app uses
Apple Health
With your permission, the app reads the following from Apple Health:
- activity: steps, exercise minutes, active energy, workouts;
- heart: heart rate, resting heart rate;
- body: weight, blood pressure, blood glucose, body temperature, blood oxygen;
- sleep and dietary energy;
- your date of birth and sex;
- health records you’ve added to the Health app: lab results, conditions, medications, immunizations, allergies, procedures and clinical notes such as discharge instructions.
You choose which of these to allow in iOS Settings. The app writes only two things to Apple Health, each only if you allow it: your waist circumference, when you enter it, and glucose readings from a sensor account you connect (see below).
Health systems you connect
If you connect a health system or patient portal in the app, your records come directly from that health system to your iPhone, over its secure (SMART on FHIR) connection. Your sign-in happens on the health system’s own page; the app doesn’t see your password.
Glucose sensor accounts
You can connect one glucose sensor account in the app: FreeStyle Libre (through LibreLinkUp), Dexcom (through Dexcom Share) or your own Nightscout site. These connections go directly between your iPhone and that service. Nothing goes to Pandola.
- FreeStyle Libre (LibreLinkUp): your LibreLinkUp email and password are stored in the iOS Keychain on your iPhone and sent only to Abbott (LibreView). Readings come from Abbott to your iPhone.
- Dexcom (Dexcom Share): your Dexcom username, password and region are stored in the iOS Keychain on your iPhone and sent only to Dexcom. Readings come from Dexcom to your iPhone.
- Nightscout: your site address and optional token are stored on your iPhone (the token in the iOS Keychain) and sent only to your Nightscout site, over a secure (https) connection. Readings come from your site to your iPhone.
Readings are kept on your iPhone for 90 days and saved to Apple Health if you allow it. LibreLinkUp and Dexcom Share are services run by Abbott and Dexcom, not by Pandola, and their own privacy policies apply.
Pandola can pause the FreeStyle Libre or Dexcom connection for everyone, for example if Abbott or Dexcom ask us to. The app learns this from the same file it already checks once a day for guidance updates (below); nothing about you is sent to check it. While paused, the app doesn’t contact Abbott or Dexcom; your sign-in and readings stay on your iPhone, and the connection picks up again when it’s switched back on. If the file can’t be reached, the connection keeps working.
Information you enter
- Medicines you add, including from a photo or barcode of the label. You can keep any of these private: a private medicine stays on your iPhone, and is left out of your care-team report, your visit summary, and everything sent to any AI, including the Coach, plan reading and visit questions. If you type its name into a Coach message, that message is still sent as you wrote it. You can also note a medicine you’re only thinking about starting: it isn’t sent to any AI, and it appears in your care-team report and visit summary, when you send them, unless you keep it private. If you add a medicine you’re thinking about starting to your questions for your next visit, the question stays on your iPhone and isn’t sent to any AI. It’s included in your care-team report and visit summary only when you send them.
- Medicines from your health records can’t be made private, since your health system already has them. They’re still included in your reports and in what’s sent to any AI you use.
- Care plans or discharge instructions you add from paper, a photo or a file.
- Goals, check-offs, notes and health entries you add (some can be marked private).
- Changes you make when you check your plan, and your own alerts.
- Allergies, past surgeries or procedures, and vaccines you add, medicines you mark as stopped, and problems you mark as resolved. These stay on your iPhone only, and their history still shows in Insights and the Timeline. Marking a medicine stopped or a problem resolved doesn’t change your health system’s record.
- Health events you log with “Not feeling well?”: what’s going on, when it started, any over-the-counter medicines you’re taking for it, and any appointment. These stay on your iPhone. While an event is ongoing, its over-the-counter medicines also show on your medicine list. You can edit or delete an event at any time. If a medicine you keep private is listed under the same name on a “Not feeling well?” entry, it’s left out of your reports and what’s sent to any AI. If you type its name anywhere else on the entry, such as in your own words or the appointment place, it’s still included.
- Measures you pin to Today, the goals that come with them, their reminders, and your nutrition goals. These stay on your iPhone.
- Questions for your next visit, ones you write and suggestions you keep. Your question list stays on your iPhone and is kept with each visit on the Timeline.
- Your waist measurement, if you enter it (in the health check-in, on Insights or in the Coach). It’s saved to Apple Health if you allow the app to write waist circumference there; otherwise it stays on your iPhone. Apart from glucose readings from a sensor account you connect, this is the only thing the app writes to Apple Health.
- Dose times you set for your medicines, and their reminders. Reminders are scheduled on your iPhone; nothing is sent to a server.
- Screenings, vaccines and check-ups you mark as done (the date, where you had it, and your notes). These stay on your iPhone.
- Messages you type to the Coach.
Photos and scans
Photos of labels or paper instructions are read on your iPhone using Apple’s built-in text recognition. Medicine-label photos aren’t kept. Scans of paper care plans are kept on your iPhone as a document so you can look at the original later. You can remove them.
Demo Mode
Demo Mode shows a made-up sample patient with made-up health data, so you can try the app without using your own information. In Demo Mode, the app doesn’t use your Apple Health data or health records. If you use an AI feature in Demo Mode, only the sample patient’s made-up information is sent.
During the beta, we ask testers to use Demo Mode unless we’ve agreed otherwise with you.
2. Where your information is kept
Everything above is stored on your iPhone, in the app’s own storage:
- Your app data (care plan items, check-offs, goals, medicines you added, uploaded plans, the AI’s reading of your plan, your corrections and alerts) is stored with iOS file protection. It’s encrypted when your iPhone is locked.
- API keys you enter for your own AI accounts are stored in the iOS Keychain.
- App lock (on unless you turn it off): Face ID, Touch ID, your iPhone passcode or your 4-digit app code is checked on your iPhone. The app code is stored only in the iOS Keychain on your iPhone and is never sent anywhere. Notifications on your lock screen never name a medicine or condition (for example, “Time for your medicine. Open the app to see which one.”).
- Records from connected health systems are kept on your iPhone so the app works without downloading them again.
- Health information guidance (MedlinePlus links, USPSTF screening and CDC vaccine guidelines) comes built into the app and is matched to your record on your iPhone. Nothing about you is sent anywhere to look it up. About once a day the app checks pandola.io for a newer version of this guidance and downloads it if there is one; that request carries nothing about you or your health, only what any download does (your IP address, which our host sees). The same check also tells the app whether the FreeStyle Libre and Dexcom connections are paused (above).
- Screenings and vaccines you hide are remembered on your iPhone only.
- Your health plan (insurer, plan name, group, member ID and dates), when your health system shares it through Apple Health, is kept on your iPhone and shown in Profile. It isn’t sent to any AI. “Find a doctor” opens your plan’s own directory in Safari, an ordinary visit to the plan’s website. Pandola doesn’t see your benefits, costs or claims.
- Vital signs from your health records (such as blood pressure and weight measured at visits) are shown in My Record, alongside your labs.
- PDFs you share to the app (for example, Export PDF from the Health app) are read on your iPhone. Only the results you choose to add are kept, on your iPhone; the PDF itself, and the name and date of birth printed on it, are not kept. You can remove an import at any time (My Record → Labs → Added from PDFs).
We have no copy of any of this. If you back up your iPhone to iCloud or a computer, iOS may include the app’s data in that backup, protected by Apple’s backup encryption. Apple Health data is backed up only as Apple describes for the Health app.
3. When information leaves your iPhone
Information leaves your iPhone only in these cases:
| What you do | What’s sent | Where it goes |
|---|---|---|
| Connect a health system | Your sign-in (on the health system’s own page) and record requests | That health system |
| Connect a glucose sensor account: FreeStyle Libre (LibreLinkUp) or Dexcom (Dexcom Share) | Your sign-in for that service, and requests for your readings | Abbott (LibreView) or Dexcom, under its own privacy policy |
| Connect your own Nightscout site | Your token, if you use one, and requests for your readings | Your Nightscout site |
| Use the Coach or plan reading with Apple Intelligence or the built-in coach | Nothing; this runs on your iPhone | Nowhere |
| Use the Coach or plan reading with your own API key (Claude, OpenAI or Grok) | See “What the AI features send” below | Directly to that company (Anthropic, OpenAI or xAI), under your account and their terms |
| Use Pandola AI (beta) | See “What the AI features send” below | Our server (a Cloudflare Worker), which forwards it to xAI (operated by SpaceX Super Intelligence LLC), for its Grok model |
| Tap Explain these results on a lab draw (after agreeing) | See “Explaining your lab results” below | Pandola AI (through our server to xAI) or your own AI provider (Anthropic, OpenAI or xAI). Never Apple Intelligence: this feature isn’t offered on the iPhone’s own AI |
| Look up a medicine by barcode | Only the drug code from the barcode | The U.S. FDA’s public drug directory (openFDA) |
| (Automatic, once per medicine) Learn what kind of medicine it is, e.g. a blood pressure medicine, and check whether a medicine you added is in the reference database | Only the medicine’s name or its RxNorm code, nothing about you. This includes a medicine you’re thinking about starting. A medicine isn’t looked up while you keep it private | The U.S. National Library of Medicine’s RxNorm service (RxNav / RxClass) |
| (Automatic, about once a day) Check for updated guidance, and whether the Libre and Dexcom connections are paused | Nothing about you: a plain download of the latest guidance file | Pandola’s website host (pandola.io) |
| Tap “Read the full recommendation” on a screening or vaccine | Nothing from the app. Safari opens the USPSTF or CDC page, an ordinary visit to that website | The U.S. Preventive Services Task Force or CDC website, under its own privacy policy |
| Tap “Find a doctor” for your health plan | Nothing from the app. Safari opens your plan’s own directory, an ordinary visit to that website | Your health plan’s website, under its own privacy policy |
| Tap “Learn more” on a condition, medicine or lab | Nothing from the app. Safari opens the MedlinePlus page, an ordinary visit to that website | The U.S. National Library of Medicine’s MedlinePlus site, under its own privacy policy |
| Send a report or update to your care team or family | Whatever is in the report | Wherever you choose to send it, using your iPhone’s share sheet |
| Send TestFlight feedback | Your feedback, screenshots and crash reports | Apple and us, through TestFlight |
Health events from “Not feeling well?” are included in your care-team report only when you send that report. They’re never included in family sharing or family updates.
Your open visit questions are included in your care-team report and visit summary only when you send them.
4. What the AI features send
Reading your care plan (“Read my plan”)
Plan reading is off until you agree. The app asks first and names the AI provider it will use. Before anything is sent, the app de-identifies the text on your iPhone.
What’s sent:
- your age (90 or older is sent as “90 or older”);
- your current conditions;
- your home medicines and their directions;
- the instructions in your care plan;
- your discharge instructions, if your record includes them;
- the names of the screening and vaccine guidelines (USPSTF and CDC) that may apply to you, such as “Lung cancer screening”, so the AI can say which instructions carry them out. These are chosen from your age, sex and conditions, so they can hint at your health history.
What’s removed first:
- your name, and the names of family members, caregivers, emergency contacts and your employer;
- phone and fax numbers, including your clinic’s;
- email addresses, web addresses and IP addresses in the text;
- medical record, account, visit, claim, insurance, Medicare and Medicaid numbers, Social Security numbers, license, vehicle and device serial numbers, and any other long ID number;
- your date of birth;
- street addresses and cities. ZIP codes are cut to their first three digits, or replaced with “000” where those three digits cover a small population.
What may still be included:
- dates written in your instructions, such as appointment or discharge dates;
- the names of your clinicians and hospital.
De-identification works by recognizing common formats, so it may not catch every identifier written in an unusual way.
What comes back is checked on your iPhone against your plan’s own words before the app uses it. You can see it under “What [the AI] found”, and you can turn plan reading off in Settings; turning it off deletes the AI’s reading from your iPhone.
Explaining your lab results (“Explain these results”)
Only when you tap it on a lab draw, and only after you agree the first time (asked again if you switch AI providers). It works only with Pandola AI or your own AI key; Apple Intelligence isn’t used. The app sends:
- your age (90 or older is sent as “90 or older”) and sex;
- for each result in that draw: the test name, value, unit, the lab’s reference range and the lab’s flag (for example “High”), and the category the app files it under (for example “Blood sugar”);
- the CDC, MedlinePlus and USPSTF facts that apply to those categories (for example the CDC’s fasting blood sugar ranges).
It does not send your name, birth date, the date of the draw, or the lab’s name. Every number in the answer is checked on your iPhone against your results and those facts; a statement with any other number is left out. Explanations are kept on your iPhone. You can turn this off in Settings; turning it off deletes saved explanations from your iPhone.
The Coach
When you chat with the Coach using a cloud AI (your own key or Pandola AI), the app sends:
- your messages, as you type them;
- a short health summary to give the Coach context: your age and sex (not your name), your conditions, medicines (except ones you keep private), recent results, visits and activity.
- your care plan’s instructions, so its answers follow your plan first;
- the USPSTF and CDC screening and vaccine guidelines that may apply to you, with their published wording and their status in your records (for example “none found in your records” or “last done Jan 2026”), so the Coach can cite them.
- your health events from “Not feeling well?” (ongoing ones and ones from the last 30 days), as context you reported yourself. They’re de-identified on your iPhone first (no name, phone numbers or ID numbers) and sent only if you’ve given the separate AI agreement. Lab explanations still never use Apple Intelligence.
Questions like “Should I get the shingles vaccine?” or “How often should I get my A1C checked?” are answered on your iPhone from the guidelines, without any AI.
When you tell the Coach about something that belongs in your record (a new medicine, a flu shot at a pharmacy, a relative’s condition), it shows a card that opens the matching form, filled in with what you said. Nothing is added until you check it and save; what you add stays on your iPhone. With a cloud AI, the Coach offers it a list of these “add” actions; your messages are sent as before, and nothing extra about you is sent. With Apple Intelligence, the card is worked out on your iPhone.
Coach messages are not run through the de-identification described above, so please don’t type information you don’t want sent, like your name or contact details.
Suggested questions for your visit
On Insights, the app suggests questions to ask at your next visit. If you agreed to AI in setup, Pandola AI or your own cloud AI (Claude, OpenAI or Grok) writes them. Otherwise Apple’s on-device model writes them on your iPhone, or the app uses built-in rules, and nothing is sent.
When a cloud AI writes them, the app sends only a list of facts: your results, conditions, medicines and care plan instructions, and the names of the screening and vaccine guidelines that may apply to you. The list is de-identified on your iPhone first (no names or ID numbers) and is sent only under the same agreement you give for reading your care plan. Your question list itself stays on your iPhone.
5. Pandola AI (beta) in more detail
Pandola AI lets beta testers use AI without their own API key. It works like this:
- The app sends the request to our server, a Cloudflare Worker, with a beta access code that proves it comes from the beta app. The app never holds an xAI key.
- Our server adds our xAI key and forwards the request to xAI (operated by SpaceX Super Intelligence LLC)’s Grok model.
- xAI’s answer goes back the same way to your iPhone.
What each party sees and keeps:
- Our server sees the de-identified request and the answer as they pass through. It only forwards the request and response; it does not log request or response bodies (there is no
console.logof that content) and is not set up to store the content of requests or answers. - Cloudflare, which runs our server, sees your iPhone’s IP address and standard connection details. It may keep limited connection logs as described in Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/
- xAI (operated by SpaceX Super Intelligence LLC) receives the request from our server, so it sees our server’s address, not your iPhone’s. By default, xAI retains API requests and responses for up to 30 days for abuse and security auditing, then deletes them. xAI does not train on API inputs or outputs without explicit permission. See xAI’s Security FAQ: https://docs.x.ai/developers/faq/security, and xAI’s Enterprise Terms of Service: https://x.ai/legal/terms-of-service-enterprise.
We use limits on how often the service can be used, to prevent misuse. These may count requests per device or app installation. They don’t involve your health information.
6. How long information is kept
We describe only what we can honestly control:
| Where | How long |
|---|---|
| On your iPhone | Until you delete it in the app, turn the feature off, or delete the app. Deleting the app removes the app’s data from your iPhone. It doesn’t remove data in Apple Health, which is managed by Apple. |
| Our server (Pandola AI) | The content of requests and responses is not stored or logged by our Worker; it only forwards them. |
| Cloudflare | Connection logs, as described in Cloudflare’s privacy policy. |
| xAI (operated by SpaceX Super Intelligence LLC) (Pandola AI) | By default, up to 30 days for abuse and security auditing, then deleted. xAI does not train on API data without explicit permission. See the Security FAQ linked above. |
| Your own AI accounts (Claude, OpenAI, Grok with your key) | As described in that company’s terms for your account. |
| Health systems you connect | Your records stay with your health system as they always have. |
| FDA barcode lookups | The FDA’s public service receives only the drug code; see the FDA’s policies. |
| TestFlight | As described by Apple’s TestFlight terms; feedback you send is kept by us for the beta. |
7. What we don’t do
- We don’t sell or rent your information.
- We don’t use your information, or any data from Apple Health, for advertising or marketing.
- We don’t include analytics, advertising, crash-reporting or tracking software in the app. The app uses only Apple’s own frameworks.
- We don’t share your information except as described in this policy or as you choose, for example when you send a report to your care team.
- We don’t use Apple Health data for anything other than the features you see in the app.
8. Your choices
- Apple Health: change what the app can read in iOS Settings → Health → Data Access & Devices.
- AI: choose Apple Intelligence (on your iPhone), the built-in coach (no AI), your own API key, or Pandola AI (beta) in the app’s AI settings. Plan reading and lab explanations each need your separate agreement, which you can withdraw at any time.
- Demo Mode: use the app with a made-up patient instead of your own information.
- Health events: edit or delete any “Not feeling well?” entry in the app at any time.
- App lock: turn it off or on in Profile → Privacy. If you forget your app code, set a passcode on your iPhone; the app then opens with your passcode or Face ID, and nothing you added is lost.
- Connected health systems: disconnect them in the app at any time; their cached records are deleted from your iPhone.
- Delete your data: remove items in the app, or delete the app to remove everything it stored.
Because we don’t keep your health information on our servers, we generally can’t look it up, correct it or delete it for you. It’s on your iPhone, under your control. For questions about data held by xAI, Cloudflare or your own AI provider, contact them directly or reach out to us and we’ll help.
Depending on where you live, you may have rights under consumer health privacy laws (for example, in Washington, California or Nevada). Contact us to exercise them.
9. Security
The app keeps your data in iOS’s protected app storage, encrypted when your iPhone is locked, and keeps API keys in the iOS Keychain. Connections to health systems, AI providers and our server use encrypted (HTTPS) connections. No system is perfectly secure, so please keep your iPhone protected with a passcode. You can also lock the app itself with Face ID, Touch ID, your passcode or a 4-digit app code.
10. Health information and medical advice
Pandola is a personal tool for following your own care plan. It isn’t a medical device, doesn’t diagnose or treat, and doesn’t replace your doctor or care team. Alerts in the app repeat lines from your own care plan, or reminders you set yourself; they aren’t medical advice. In an emergency, call 911.
We aren’t your healthcare provider. This policy explains our own practices; it isn’t a notice of privacy practices from your health system or health plan.
11. Children
The beta is meant for adults 18 and older. We don’t knowingly collect information from children.
12. Changes to this policy
We’ll update this policy as the beta changes. When we make a material change, especially to what’s sent off your iPhone or where, we’ll update the effective date and tell testers in the TestFlight release notes, and in the app where it matters.
13. Contact us
Questions or requests about privacy:
Email: privacy@pandola.io
Pandola.IO LLC