Asterisk app
Privacy policy
This Privacy Policy explains what personal data the Asterisk app and its servers (the "Service") collect, why, who else sees it, how long we keep it and what you can do about it. Asterisk is an AI health coach, so most of what it handles is health data. The Service is in closed beta.
This is the same text the app shows under About Asterisk and asks you to accept before you start. For visits to this website, see the website privacy policy.
Last updated: 31 October 2026
Who we are
The Service is run by Asterisk Health ("Asterisk", "we", "us"), the data controller for the personal data described here. You can reach us about anything in this policy at support@askasterisk.ai.
What we collect
Account: your email address, the name you give us, how you sign in (email and password, Google or Apple), your language and time zone.
Profile and health data you enter or tell the coach: date of birth, sex, height, weight and body measurements, activity level and goals; meals and nutrition, water, workouts, sleep, habits, mood, symptoms, injuries, health conditions, allergies and food preferences, and medications and doses.
Health Connect or Apple Health, only if you turn it on: steps, active and total calories, resting heart rate, heart rate variability, weight, sleep, workouts and distance. Your phone asks which of these you allow, and we record your consent before the first import.
Conversations and uploads: your messages to the coach and its replies; meal photos you scan (sent for recognition, not stored); documents you add to your profile (we keep the AI summary and a small preview, not the original file); and problem reports you send, which include your recent activity in the app so we can find the fault.
Voice input is turned into text by your phone's own speech recognition (Apple or Google). We receive only the text.
Technical data: app version and platform, your push-notification token, your reminder settings, and server logs with your IP address.
How we use it
To run the Service: store what you log, build and adjust your plans, answer you in the chat, send the reminders and check-ins you have enabled, and let you export or delete your data. To keep it secure: limiting request rates and investigating abuse. To fix problems: reading the problem reports you send and the short-lived records of how the coach handled a request.
We do not sell your data, we do not show ads, we do not track you across other apps, and we do not use your data to train AI models.
The AI coach
The coach is an AI model: Google Gemini, used through Google's API. When you chat, go through the guided setup, scan a meal, upload a document, or when the coach sends you a scheduled check-in, the relevant part of your data — your message, your profile, recent logs and goals — is sent to Google to produce the answer. Google processes it for us as a service provider.
The coach can save things you tell it (for example a meal or a workout) and make some changes to your plans on its own; you can see and undo them. A change prompted by a symptom or with a medical side always waits for your confirmation.
Asterisk cannot work without the AI processing your data. If you do not want that, please do not use the Service.
Legal bases (GDPR)
Where the GDPR applies, we rely on: your explicit consent (Article 9(2)(a)) to process your health data, which you give in the app before you start and which we record with its date and the version of this policy; the contract with you, to provide the Service; our legitimate interests in keeping the Service secure and fixing faults; and legal obligations.
You can withdraw your consent at any time by deleting your account (Account & Security → Privacy & data → Delete account), or by writing to support@askasterisk.ai. Because the coach cannot work without your health data, withdrawing it ends your use of the Service. It does not affect what was done before.
Who else sees it
Only providers that run the Service for us, each bound by data-protection terms:
- Supabase — our database and sign-in (servers in Ireland).
- Hetzner — the servers our backend runs on (in the EU).
- Google — the Gemini AI described above; Firebase Cloud Messaging, which delivers push notifications; and Google sign-in, if you use it.
- Apple — Sign in with Apple, if you use it, and notification delivery on iPhone.
- Resend — sends our sign-in and account emails (EU).
- Open Food Facts — when you scan a barcode we look the product up there; only the barcode number is sent.
We share data with authorities only when the law requires it. Nobody else gets it. The app can make a PDF report for your doctor; it stays on your phone until you choose to share it yourself.
International transfers
Our database and servers are in the EU. Google may process data in the United States and other countries. Where data leaves the European Economic Area, it is covered by the safeguards the GDPR provides, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
Your account and everything you log are kept while your account exists.
When you delete your account (Account & Security → Privacy & data), it is scheduled for erasure: for 30 days, signing in again cancels the deletion. After that we erase the account and all data linked to it, including your problem reports and consent records. Copies in our database backups disappear within 7 days after that, as the backups rotate.
Records of how the coach handled each request are deleted after 7 days. Server logs with IP addresses are kept for about 14 days. Problem reports are kept until you delete your account.
Your rights
Subject to the law where you live, you can access, correct, export and delete your data, object to or restrict some processing, and withdraw your consent. In the app, Account & Security → Privacy & data → Export my data gives you a copy of everything, and Delete account on the same screen erases it; most data can be corrected where you entered it. For anything else, write to support@askasterisk.ai; we answer within one month. You can also complain to your data-protection authority.
Security
Data travels encrypted between the app and our servers, and our database provider encrypts it at rest. Each request can only reach the data of the account that made it, and changes the coach makes are written to an audit log. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.
Age
You must be at least 16 to use the Service. We ask you to confirm your age before you start and do not accept a date of birth under 16. If we learn that a user is younger, we delete the account. If you think a child has given us data, write to support@askasterisk.ai.
Not medical advice
Asterisk is a wellness and coaching tool. It does not provide medical advice, diagnosis or treatment and is not a substitute for a doctor. In an emergency, call your local emergency number.
Changes
When this policy changes in a way that matters, we update the date above and ask for your consent again in the app before you continue.
Contact
Privacy questions and requests: support@askasterisk.ai.