Privacy Policy

Last updated: October 17, 2026

For consumers in the United States, see also the Consumer Health Data Privacy Policy.

This privacy policy explains how personal data is processed when the HeadAIche app (the “app”) and the website at headaiche.app (the “website”) are used. The app processes data concerning health within the meaning of Art. 9(1) GDPR. This processing generally takes place on the device; the cases in which data leaves the device are described individually below.

1. Controller

The controller is the provider of the app and the website, a sole trader (natural person):

Philipp Epple
Palmenwaldstraße 58
73733 Esslingen
Germany

Contact: contact@headaiche.app · further details in the legal notice

2. Data protection officer

An external data protection officer has been designated. Contact:

c/o Philipp Epple
Palmenwaldstraße 58
73733 Esslingen
Germany
Email: privacy@headaiche.app

3. Principles

Processing on the device. Entries, episodes and the personal analysis are stored and calculated on the device. There is no user account. Content from the app only reaches the provider’s services when feedback is sent (4.8), “Send data” is switched on (4.9) or the user sends it to the provider themselves, for example by email (5.2); for crash reports via Apple, see 4.11, and for web pages opened from the app, 4.12.
Purpose limitation and data minimization. Which areas are recorded and which data sources are connected is chosen individually during setup and later in the profile.
Control in the app. Export, withdrawal and deletion are possible within the app itself (sections 4.10 and 8).

A complete absence of any data transfer is expressly not claimed. Data leaves the device when weather data is retrieved (4.5), when an export or PDF report is actively shared (4.7), when feedback is sent and with test versions via TestFlight (4.8), when data is sent voluntarily (4.9), with crash reports via Apple (4.11) and when web pages are opened (4.12, 5).

4. Processing in the app

The core of the app is recording one’s own health and everyday data and analyzing it personally on the device (the “core purpose”). For this, explicit consent is obtained during setup, separately from accepting the terms of use:

“I consent to HeadAIche recording my health and everyday data on my iPhone and using it for my personal analysis, as described in the privacy policy.”

Without this consent, no recording begins. Feedback (4.8) and the voluntary sending of data (4.9) are not part of this consent; each is based on its own consent. A summary of this information can also be read in the app without an internet connection.

Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR.
Record: The time, version and wording of the consent and of any withdrawal are stored on the device (Art. 7(1) GDPR).
Withdrawal: at any time in the app — during setup via “Privacy” at the top of the screen, afterwards under Profile → Data & legal → Privacy. The consequences are set out in section 4.10.

4.2 Data processed

Depending on the areas selected, the app processes:

information provided during setup: biological sex, how often headaches occur, answers to questions about warning signs, the areas selected and the user’s own assessment of each area, days off;
cycle and medication, if selected: for example period start, pregnancy or breastfeeding, aura, hormonal contraception, smoking, and the name, strength and intake of medications;
daily information: whether headaches occurred, assessments of, for example, sleep, tension, activity and hydration, and amounts, for example of caffeine, alcohol or skipped meals;
episodes: start, end, intensity, location, type and note;
notes: the journal (free lines about the day), responses to an assessment and a saved feedback draft (4.8);
values from Apple Health and weather data (4.4, 4.5) and the personal analysis calculated from them (4.3).

Storage period: until consent is withdrawn or the app is reset (4.10).

Corrections: A changed daily entry, a retracted period start or a changed value from Apple Health does not overwrite the earlier entry; it is added as a new entry (a “retraction”). The earlier entry remains in the app’s storage and in the export. Changes to episodes are logged with the time. Individual entries cannot currently be deleted selectively — deletion is complete, via withdrawal or reset. The journal is an exception: a journal entry that is cleared is permanently deleted.

4.3 Personal analysis

From the entries, the app calculates an assessment of the current day — a named state, such as “Not much going on” — and the order of the areas contributing to it. For this, the app uses a learning method (machine learning): from the person’s own history, it estimates how strongly individual areas coincide with that person’s headache episodes. Only the state is displayed in this version; the order of the areas is part of the analyses in the export (4.7) and in the data sent (4.9).

The calculation takes place exclusively on the device. It uses only the user’s own data and the model’s default settings shipped with the app.
No number, percentage or score is displayed, and no statement is made about whether or when symptoms will occur in future.
Legal basis: as in 4.1 — the analysis is part of the core purpose.

For its classification as profiling, see section 7.

4.4 Apple Health (read-only)

If an area is set up with Apple Health as its source, the app requests read permission via iOS. Depending on the selection, sleep, state of mind, period start, workouts, steps, water intake and caffeine are read.

Access is read-only; no data is written to Apple Health.
The values read are stored and processed on the device as entries. In the export they appear with the name of the respective data source, often a device name. If “Send data” is switched on, they are transmitted without these names (4.9).
The permission can be revoked at any time in the iOS settings. The original data in Apple Health is not affected by withdrawal or deletion in the app.
Legal basis: as in 4.1.

4.5 Weather (location sent to Apple)

If the weather area is active, the app retrieves weather data for the current location via Apple WeatherKit — only while the app is open and at most about every three hours. For this, the app uses the location permission “While Using the App” and requests a one-time, low-accuracy location fix (about one kilometer). This location is sent to Apple.

Daily values (air pressure, temperature, humidity, wind) and the time zone are stored. Location coordinates are not stored; they are only used while the app is in use, including for sunrise and sunset in the sky display.
For the required source attribution, the app loads Apple’s weather logo; in doing so, the IP address is transmitted to Apple. The “Legal attribution” link opens a page from Apple only when tapped.
The number of retrievals is technically limited. The recipient is Apple; Apple WeatherKit’s terms apply.
Legal basis: Art. 6(1)(a) GDPR (choice of the weather area and location permission in iOS); combining it with health data is part of the core purpose (4.1).

4.6 Reminder

The optional daily reminder is scheduled as a local notification on the device. No push service is used, and no content is transmitted.

4.7 Export, PDF report and ID

Under Profile → Data & legal → Privacy, a copy of the stored data can be created as a JSON file (Art. 20 GDPR): entries, episodes, profile, record of consent, an unsent feedback draft (without images), past analyses and the journal.

The file is created on the device and passed on via the iOS share sheet. The user decides on the recipient and any further processing. The temporary file is deleted afterwards.
PDF report: Via the share icon in History or under Profile → Data & legal → Report as PDF, a report for a doctor’s appointment can be created: for a chosen period, headache days, episodes with intensity, duration, type and location and — depending on the selection — notes on episodes, days with medication intake and period starts. Analyses from the load model and the journal are not included. A name entered appears only in this file and is not stored. The file is created on the device, passed on via the preview and the iOS share sheet and deleted afterwards; it contains no ID.
ID: Every export contains a random ID that is generated on the device at the first export or when “Send data” is switched on. It links exports from the same device, contains no device or personal characteristics and is only transmitted automatically as part of sending data (4.9). It can be regenerated in the app; it is deleted on withdrawal or reset — if a deletion of the data sent is pending, only once that deletion is complete (4.10).

4.8 Sending feedback

Under Profile → Help out → Feedback, feedback on the app can be written: a title, a text and up to four images, such as screenshots. “Save” keeps a draft on the device. Only “Send” transmits the feedback to the provider; once it has been sent successfully, the draft on the device is deleted. Sending is voluntary; no feedback is sent automatically.

Data transmitted: title, text and images, as well as the app version with build number, the iOS version, the device type (e.g. “iPhone”), the language and region setting, and the time. Images are reduced in size beforehand and transmitted without capture metadata such as location or time. The app does not add a name, an email address or an ID of the person or device.
Purpose: handling the feedback and improving the app.
Legal basis: consent given by sending (Art. 6(1)(a) GDPR; for reading the technical details on the device, Section 25(1) of the German TDDDG). Images and free text may contain health information; for such information, sending is at the same time explicit consent under Art. 9(2)(a) GDPR.
Recipients: The feedback goes to a service operated by the provider at Cloudflare (processor under Art. 28 GDPR). Cloudflare stores it, without the images, in a database, primarily in Western Europe. The images are sent only as attachments to an email that Cloudflare delivers, together with the rest of the feedback, to the provider’s mailbox at Apple (iCloud Mail). The IP address is not stored with the feedback; Cloudflare processes it technically for delivery, stable operation and to prevent abuse (legal basis as in 5.1). For transfers to third countries (USA), see 5.1 and 6.
Storage period: at most 12 months after receipt — in the database and in the mailbox.
Withdrawal and deletion: Consent can be withdrawn at any time with effect for the future, informally via “Feedback” in the app or by email to contact@headaiche.app; the feedback concerned is then deleted. As sent feedback is not linked to a person or device, its title or the approximate time is enough to identify it.
Test versions (TestFlight): For an invitation by email, the provider processes the invited person’s email address and, where applicable, name in App Store Connect. During the test, Apple automatically makes usage information such as installs and sessions, device details (model, device identifier, iOS version, language) and crash reports available to the provider there, regardless of the setting in 4.11. Both serve to carry out the test (Art. 6(1)(b) GDPR). Feedback sent via TestFlight, for example with a screenshot, is made available to the provider there by Apple, together with further technical details and linked to the invitation details; the purpose, consent given by sending and withdrawal are as above (Art. 6(1)(a) GDPR, for health information Art. 9(2)(a) GDPR). All of this is stored until the end of the test phase; the provider then deletes feedback and testers in App Store Connect. Anything that cannot be deleted there is retained by Apple under its own rules (Apple, “TestFlight & Privacy”). The recipient is Apple (section 6).

4.9 Voluntary sending of data to improve the app

Under Profile → Help out, sending data can be switched on with the “Send data” switch. It is voluntary and switched off by default. It is not required to use the app; without it, all functions remain available unchanged.

“Send data” is only offered if the App Store country or region of the Apple Account is in the European Union. For this, the App Store country is only queried on the device; it is neither stored nor transmitted. If the App Store country changes to a country outside the EU, the app stops transmitting; data already sent can still be deleted.

Purpose: With the histories sent, the provider checks how well the app’s load model works for different people. To do this, the histories are recalculated with the current and with new versions of the model, errors are looked for, and the model’s rules and default settings are improved for future versions of the app. The data is not used for any other purpose — in particular not for advertising or studies — and it is not published; that would require new consent.
Data transmitted: an extract of the export (4.7), namely
- the daily information (4.2), medication intakes by type and amount, and period starts,
- episodes with start, end, intensity, location and type,
- values from Apple Health — depending on the selection, sleep, state of mind, period start, workouts, steps, water intake and caffeine — and daily weather values (air pressure, temperature, humidity, wind),
- from setup and profile only what the model uses: how often headaches occur, the user’s own assessment of each area, the meals recorded and the days off; also the areas selected with the type of their data source and the start of recording, the day boundary and the time zone,
- the app’s analyses, including model values that are not shown in the app, responses to an assessment (without text), and the app and model version,
- the ID (4.7) and the records of the consent to sending data and of the acceptance of the terms of use.
Names of medications and names and identifiers of data sources and devices are not transmitted; they are replaced by placeholders that only the device can resolve. Also not transmitted are the journal, notes and other free text (including feedback) and the other setup information, such as biological sex, aura, smoking, warning signs, pregnancy and contraception.
Process: While “Send data” is switched on, the app transmits the current state at most once a week when it is opened. It replaces the state transmitted before; only the latest state is stored per ID. What is sent is an extract of the export (4.7); the export shows the underlying data.
Pseudonymized, not anonymous: The data contains no name, no contact details and no device identifier, only the app’s random ID. Through this ID or with additional knowledge about a person, it could nevertheless be linked to that person; it therefore remains personal data. The provider does not combine it with other information about a person, except to deal with a request for access or deletion. Anyone who passes on an export also passes on the ID.
Recipient and storage location: The data is sent to a service of the provider at donate.headaiche.app, hosted by Cloudflare, Inc. (processor, section 6), and stored there in storage located primarily in Western Europe. Processing by Cloudflare in other countries, including the USA, cannot be ruled out; for transfers to third countries, see 5.1 and 6. The IP address is not stored with the data sent; Cloudflare processes it only technically, for delivery and to prevent abuse (legal basis as in 5.1). The data is analyzed by the provider. For this, the provider may use a third-party AI service (based in the EU, with processing also in the USA; section 6) that does not use the data to train its models. Beyond that, it is not passed on to third parties and not sold.
Legal basis: explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR; for reading the data on the device, Section 25(1) of the German TDDDG), obtained when “Send data” is switched on and separately from the consent to the core purpose (4.1). The time, version and wording are stored on the device and transmitted with the data sent (Art. 7(1) GDPR).
Switching off, withdrawal and deletion: Switching “Send data” off stops the transmission; data already sent remains stored until it is deleted, at most until the storage period expires. “Delete sent data” withdraws consent: the app then stops transmitting and has the data sent deleted; without an internet connection, it does so the next time it is opened and shows when the deletion is complete. Withdrawing the consent to the core purpose and resetting the app also end sending data and have the data sent deleted (4.10). If the ID is regenerated (4.7), the data sent under the old ID is deleted; if sending data is switched on, it continues under the new one. The lawfulness of processing carried out before the withdrawal is not affected (Art. 7(3) GDPR). Insights that have already been incorporated into a version of the model, such as changed default settings, contain no data about individual persons and remain.
Storage period: until withdrawal, at most 24 months after the last transmission; the data is then deleted automatically. If the app is deleted while the data sent is still stored, deletion via the app is no longer possible; until the period expires, the provider deletes the data on request to contact@headaiche.app, stating the ID. The ID is contained in every export (4.7); without it, the data sent cannot be found.

4.10 Withdrawal and deletion

Withdrawal of consent (Profile → Data & legal → Privacy): recording and analysis end, and all local app data is permanently deleted — entries, episodes, profile, analyses, journal, a feedback draft including its images and the export ID; the daily reminder is switched off. If “Send data” is switched on, sending ends, and the data sent is deleted (4.9); until the deletion is confirmed, the app keeps only the ID needed for it. Otherwise, only the record of consent and withdrawal, without health values, is kept until the app is reset. The lawfulness of processing carried out before the withdrawal is not affected (Art. 7(3) GDPR).
Reset (“Delete all data & reset app” at the end of the profile): deletes all data, including the record. If “Send data” is switched on, sending ends, and the data sent is deleted (4.9); until the deletion is confirmed, the app keeps only the ID needed for it. Otherwise, only device settings without any health reference, such as the appearance, are kept.
Uninstalling: When the app is deleted, iOS removes the app data from the device. If the data sent was not deleted beforehand, it remains stored with the provider until it is deleted on request or the period in 4.9 expires.
Not covered are the original data in Apple Health, copies shared by the user (exports, PDF reports), feedback already sent (deletion under 4.8) and device backups. App data may be contained in backups set up via iOS (such as iCloud Backup); the device’s settings apply to these.

4.11 No advertising, no tracking services

The app contains no third-party libraries and no third-party analytics, advertising or tracking services. Health data is not used for advertising and is not sold. If sharing with app developers is enabled in the iOS settings, Apple provides the provider with crash reports. For test versions via TestFlight, 4.8 applies.

4.12 Web pages from the app

The app opens the full legal texts at headaiche.app in the browser built into iOS. The data of a normal page visit is processed (section 5.1); the app does not transmit any identifiers or content in doing so.

5. Processing on the website

5.1 Hosting and server log data

The website is delivered as a static site via Cloudflare Workers (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When the website is accessed, Cloudflare processes the technically necessary data transmitted by the browser: IP address, date and time, page accessed, browser identifier (user agent) and the previously visited page (referrer).

Purpose: delivering the site, stability, detecting and fending off attacks.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning service).
Transfers to third countries: Cloudflare may also process data in the USA. This is based on the EU-US Data Privacy Framework, under which Cloudflare is certified, and on standard contractual clauses. A data processing agreement under Art. 28 GDPR is in place.

5.2 Contact by email

When a message is sent to contact@headaiche.app, the information transmitted (email address, content, time) is processed in order to handle it. The message is forwarded via Cloudflare Email Routing to a mailbox of the provider at Apple (iCloud Mail).

Legal basis: Art. 6(1)(b) or (f) GDPR; if a message voluntarily contains health information, additionally Art. 9(2)(a) GDPR.
Storage period: until the matter has been fully dealt with, unless statutory retention periods require otherwise.

5.3 Cookies, tracking, fonts

The website sets no cookies and does not embed any analytics, advertising or tracking services. Fonts and all other content are loaded from headaiche.app itself; no third-party content is embedded. A consent banner is therefore not required (Section 25(2) of the German TDDDG).

6. Recipients

Recipient	Purpose	Based in
Apple Inc. / Apple Distribution International Ltd.	Distribution of the app, including test versions via TestFlight (invitation, usage information and crash reports, feedback sent there; 4.8), weather data (WeatherKit), crash reports depending on iOS settings, the provider’s mailbox for contact emails and sent feedback (iCloud Mail)	USA / Ireland
Cloudflare, Inc.	Hosting of the website, receipt and storage of sent feedback, storage of sent data, forwarding of emails	USA
Third-party AI service	Assistance with analyzing sent data (4.9), without use for training its models	Ireland (EU), processing also in the USA
Data protection officer (section 2)	Advice and monitoring under Art. 39 GDPR; personal data only where necessary for these tasks in the individual case	Germany

Cloudflare processes the data as a processor (Art. 28 GDPR) only to provide its services and on the provider’s instructions, is contractually bound to the level of protection required by data protection law and does not use the data for advertising or marketing.

For transfers to the USA, Apple and Cloudflare rely on the EU-US Data Privacy Framework and standard contractual clauses.

The AI service processes the data under its own terms and relies on standard contractual clauses for transfers to the USA.

7. Profiling and automated decisions

The personal analysis (4.3) is profiling within the meaning of Art. 4(4) GDPR, as it evaluates personal aspects — in particular health.

It is not an automated decision within the meaning of Art. 22 GDPR with legal or similarly significant effects: the app makes no decision about the user and does not carry out anything on its own. It displays a state. The analysis is not a medical judgment and not a diagnosis; the user decides on any health-related steps.

The analysis can be influenced through one’s own entries: every correction is taken into account.

8. Rights of the data subject

Data subjects have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), as well as the right to withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object: Where processing is based on Art. 6(1)(f) GDPR, the data subject may object to it at any time on grounds relating to their particular situation (Art. 21(1) GDPR).

As the provider has no access to the data stored in the app, these rights are exercised for app data directly in the app: viewing in the app itself, a copy via the export (4.7), rectification via corrected entries (4.2), erasure via withdrawal or reset (4.10). Sent data (4.9) is an extract of the export; it is deleted with “Delete sent data”, and the provider gives information about it on request, stating the ID. For all other requests, a message to contact@headaiche.app is sufficient.

There is also a right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

Additional information for users in the United States, the United Kingdom and Canada is set out in sections 11 to 13.

9. Minimum age

Use requires a minimum age of 18. During setup, together with accepting the terms of use, the user confirms having reached this age. Only this confirmation is stored, with its time and version — on the device at most until the app is reset (4.10) and, if “Send data” is switched on, also in the data sent (4.9); no date of birth is collected. Legal basis: Art. 6(1)(b) GDPR for concluding the agreement under the terms of use, (f) for the legitimate interest in being able to prove the acceptance and the confirmation. If it becomes known that data of a younger person has reached the provider, for example via feedback or sending data, it is deleted insofar as it can be attributed. A message to contact@headaiche.app is sufficient.

10. Changes to this policy

This policy is updated when the processing changes or the legal situation requires it. The current version is available at https://headaiche.app/en/privacy/ (German version: https://headaiche.app/datenschutz/); the app links to it. The “last updated” date above identifies the current version.

11. United States

This section supplements this policy for consumers in the United States, including under the Connecticut Data Privacy Act and the Texas Data Privacy and Security Act.

Sending data: “Send data” (4.9) is not offered in the App Store in the United States.
Categories and purposes are described in sections 4 and 5. Health data is sensitive data; it is processed only with consent (4.1, 4.8).
Recipients: service providers acting on the provider’s behalf (hosting, email; section 6).
No sale, no targeted advertising, no profiling for decisions that produce legal or similarly significant effects.
Large language models: The provider does not collect, use or sell personal data for the purpose of training large language models.
Rights: to confirm and access, correct, delete and obtain a copy of personal data, and to opt out of targeted advertising, sale and profiling (none of which take place). Requests can be made in the app (section 8) or by email to contact@headaiche.app. The provider responds within 45 days, extendable once by 45 days with notice.
Appeal: If the provider declines a request, an appeal can be made by replying to the decision with the word “Appeal”. The provider decides in writing within 45 days. If the appeal is denied, the decision states how to contact the attorney general of the consumer’s state.
Tracking: No third party collects personal information about users’ online activities over time and across different websites or online services through the app or the website.
Consumer health data (Washington, Nevada): see the Consumer Health Data Privacy Policy.

12. United Kingdom

For users in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply. References to provisions of the GDPR refer, for these users, to the corresponding provisions of the UK GDPR.

Feedback and sending data: Feedback (4.8) and “Send data” (4.9) are not offered in the App Store in the United Kingdom.
Complaints to the provider: Complaints about the processing of personal data can be sent to contact@headaiche.app (section 164A of the Data Protection Act 2018). Receipt is acknowledged within 30 days.
Complaints to the supervisory authority: There is also a right to complain to the Information Commission, ico.org.uk (section 165 of the Data Protection Act 2018).
Transfers: Transfers to recipients in the European Economic Area (section 6) are based on the UK adequacy regulations for the EEA; transfers to Apple and Cloudflare in the USA (section 6) are based on the safeguards in section 6; Cloudflare, Inc. is also certified under the UK Extension to the EU-US Data Privacy Framework.

13. Canada

Sending data: “Send data” (4.9) is not offered in the App Store in Canada.
Person responsible: The provider, Philipp Epple, owner (section 1), is responsible for compliance with Canadian privacy law and is the person in charge of the protection of personal information under the law of Québec. Contact: contact@headaiche.app.
Processing outside Canada: Data that leaves the device (sections 4.5 and 4.8) is processed outside Canada and Québec: by the provider in Germany and by Apple and Cloudflare (section 6), including in the USA. There, it may be accessible to courts, law enforcement and national security authorities under local law. A privacy impact assessment has been carried out for this. A data processing agreement is in place with Cloudflare; Apple’s terms apply to Apple (section 6).
Profiling and location: The personal analysis (4.3) assesses health-related characteristics on the device (profiling, section 7). It is only activated by the consent to the core purpose (4.1). The location is only used if the weather area is selected and location access is allowed in iOS (4.5).
Handling of personal information: Only the provider has access to feedback sent (4.8). Storage periods and deletion are set out in sections 4.8 and 4.10. Security incidents are recorded and, where required by law, reported to the competent authority and the persons concerned.
Complaints: Complaints and requests can be sent to contact@headaiche.app; they are answered in writing. There is also a right to complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) and, for persons in Québec, to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).