Willow · Privacy Policy

The record is yours.

Willow helps you document lipedema: measurements, symptoms, conservative therapy and photos. That is sensitive material about your own body, and this page explains exactly what stays on your phone, what leaves it, and when. If anything here is unclear, write to us and we will explain it plainly.

Last updated: July 18, 2026

The short version

Your leg photos never leave your phone. They are stored on the device only and excluded from backup, so they are never uploaded and never synced to iCloud.

Almost everything works without an account. Logging, measuring, charts, the evidence checklist and the denial decoder all run on your device. Only the AI report needs a sign-in.

Generating an AI report does send data. It sends aggregated numbers, with no name, no raw daily logs and no photos. We say so here because we say so in the app.

No ads, no analytics SDKs, no tracking, no data selling. Your location is never read.

Where your data lives

Willow stores your logs, measurements, functional scores and settings on your device using SwiftData, and syncs them through your own private iCloud (CloudKit) so they survive a lost phone and appear on your other devices. That sync happens inside your Apple account. We cannot see it and we hold no copy.

Leg photos are the exception, and deliberately so. They are written to your device's local storage, marked as excluded from backup, and never enter iCloud sync or our servers. If you delete the app, those photos go with it.

What we collect, and when

Data	When it leaves your device	Why
Measurements, symptom scores, compression and therapy compliance, functional score, body weight, comorbidities	Only when you tap to generate an AI report. Sent as aggregated statistics plus a circumference trend series	To write the report you asked for
Apple user identifier	When you sign in with Apple to use the AI report	To count your monthly report quota, nothing else
Leg photos	Never. Device only, excluded from backup	Your before and after timeline, for your eyes
Raw daily logs, your name, your notes	Never sent. They stay on device and in your private iCloud	Not needed anywhere else
Denial letter text and photographs of it	Never. Text recognition and decoding both run on your device	An insurance letter is sensitive, so it stays local
Body weight from Apple Health	Only inside the aggregated figures of an AI report, if you generated one	The weight versus legs chart
City name for the swelling forecast	Converted to coordinates for a weather lookup	To fetch a forecast. Typed by you
Subscription status	Handled by Apple	To unlock Pro features. We never see your card

We do not collect advertising identifiers, contacts, browsing history or third-party analytics, and we do not track you across other apps or websites. Willow does not ask for App Tracking Transparency permission because it has nothing to track you with.

Apple Health and your location

Apple Health is read-only, and only body weight. Willow reads bodyMass to draw the weight versus legs chart, and never writes anything back into Health. You can skip the permission entirely and type your weight in; the chart works either way.
Health data is never used for advertising or marketing, and never shared with third parties for their own purposes, in line with Apple's HealthKit rules.
Your device location is never read. Willow does not use Core Location and never asks for location permission. For the swelling forecast, you type a city name, which is converted into coordinates so the weather service can return a forecast for that place.

Who processes data on our behalf

Apple: Sign in with Apple, iCloud sync of your own data, App Store subscriptions, and the weather forecast service.
Google Cloud (US): hosting for the report service and its database. The database holds your account record and a monthly report counter. It does not store the report payload.
Anthropic (Claude): writes the AI report from the aggregated figures we send. Not used to train models.

Each one receives only what its job needs. Data is encrypted in transit and at rest.

Retention and deletion

Everything on your device is deleted when you delete the app. Anything in your private iCloud is removed through your Apple account.
If you signed in for AI reports, we hold your Apple user identifier and a monthly usage count. Ask us and we will delete that account record within 30 days.
Report payloads are not stored after the report is written.
To request deletion or a copy of what we hold, write to the address below. We act within 30 days.

What Willow will not do

We never sell your data and never share it with advertisers. There are no ads in Willow.
Willow does not diagnose lipedema, does not provide medical advice, and does not assert medical necessity. That statement has to come from your clinician.
Willow does not send anything to your insurer, your doctor or anyone else. Every report and appeal draft is exported by you, and shared by you, if and when you choose.
AI output is a summary of your own logged data. It carries that label on every report.

Children

Willow is intended for adults managing their own health. It is not directed at children under 13 and we do not knowingly collect their data.

Changes

We will post changes here and, where they are material, tell you in the app before they take effect.

Contact

Questions about this policy or your data: customer-care@velorahealth.io. We reply within 2 business days.