Privacy policy for LeanOn Patient

In short

Your diary stays on your device. LeanOn Patient has no user account, no server for your entries, no advertising and no tracking. The only transmission to us is the feedback you send yourself. Health data leaves your device only when you export, print or share it.

1. Controller

2. What the app processes, and where

On your device: symptom entries, your own categories, notes, tags, appointments, documents, settings and summaries are stored locally only (in the browser in IndexedDB and localStorage, in the native app in protected app storage). We have no access to them. These are health data under Art. 9 GDPR; the processing happens on your device alone, under your control. If you uninstall the app or clear the site data, the entries are gone for good; export first.

With us: only what you send through the feedback function (section 4).

3. Delivery of the app

Web app (PWA): the app files are delivered through Cloudflare Pages (Cloudflare, Inc., USA, under EU standard contractual clauses). Cloudflare processes your IP address as technically necessary to deliver the page and to fend off attacks (Art. 6(1)(f) GDPR, legitimate interest in secure operation). We store no IP addresses ourselves. The service worker caches app files locally for offline use only.

App Store and Google Play: if you install the app from the Apple App Store or Google Play, Apple Inc. or Google Ireland Ltd. process your account data, the download and, depending on your device settings, crash and usage statistics as independent controllers under their own privacy policies. We receive at most aggregated figures without personal reference. The app itself contains no analytics or advertising SDKs.

Test versions (TestFlight, Play testing): if you take part in a test, Apple or Google process your e-mail address and device data to distribute the test build. We see which of the people we invited have installed it.

4. Feedback: the only transmission to us

When you send feedback we transmit exactly the fields shown to you beforehand: type of feedback, your message, an optional contact, app version, the number of your entries (only the number, never the content), language and time. The Android and iOS apps also transmit the app's build number and, as long as the corresponding switch is on, your operating system version and a device class (for example “Android 14” and “Pixel class”). That switch is on by default; turning it off omits both entirely. An identifier of your device is never transmitted, and the preview before sending always shows you exactly the fields that will be sent.

The feedback is received at Cloudflare (Cloudflare, Inc., USA, under EU standard contractual clauses) and delivered to our mailbox at Google (Google Ireland Ltd.); your IP address is not stored. The legal basis is your consent by sending it voluntarily (Art. 6(1)(a) GDPR). If your message contains information about your health, we process it only to improve the app (Art. 9(2)(a) GDPR). A contact is used only to reply. Feedback is deleted at the latest twelve months after receipt.

5. App permissions

• Microphone: only for dictation, only after your consent and only while you dictate. Speech recognition is done by your device or browser; the audio may be sent to its provider (for example Apple or Google) at that moment. The finished text stays on the device. Everything works by keyboard as well.
• Notifications: optional, only if you switch reminders on; they are generated locally.
• Calendar: the app does not access your calendar. You can export appointments as a calendar file (.ics) that you open yourself.
• Files and photos: only when you add a document to the app yourself; it stays on the device.
• Device health services (Apple Health, Health Connect): not connected at present. Should that become possible, the app will ask for permission separately.

6. Export, print, share

Export, printing and your device's share function hand your data to wherever you send it (printer, file storage, e-mail, messenger). That happens on your initiative alone; check the recipient.

6a. Phrased summary (optional, capable phones only)

On phones that can run it, the summary for a doctor's visit can optionally be phrased by a language model that runs entirely on the phone. The feature is off until you switch it on in the settings. For that, the model is downloaded once from a LeanOn server (about 1.1 GB); the server processes your IP address as technically necessary for delivery (Art. 6(1)(f) GDPR). Diary data never leaves the phone, neither while downloading nor while phrasing. On other phones the summary is available without a model, with the same numbers.

7. No cookies, no tracking, no sharing

The app sets no advertising or analytics cookies, loads nothing from third-party servers and passes no data to third parties. We do not sell data. There is no automated decision-making and no profiling.

8. Children and young people

The app is intended for adults. People under 16 may use the feedback function only with parental consent.

9. Your rights

Since we process no personal data of yours apart from voluntary feedback, your data lives on your device alone. For access, rectification, erasure, restriction, portability or objection regarding feedback data, contact us as stated in section 1. You also have the right to complain to a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA).

10. Security

The connection to the app and for feedback is encrypted (TLS). Protection of locally stored data depends on your device: use a device lock and your operating system's encryption.

11. Not a medical device

LeanOn Patient is a diary, not a medical device. The app does not assess your entries, makes no diagnosis and does not replace medical advice. In acute distress contact your practice or the German out-of-hours service on 116 117; in an emergency call 112.

12. Changes

We update this policy when the app changes. The current version is available in the app and at this address; we announce material changes in the app.

Last updated: September 2026