Willow · Privacy Policy

The record is yours.

Willow helps you document lipedema: measurements, symptoms, conservative therapy and photos. That is sensitive material about your own body, and this page explains exactly what stays on your phone, what leaves it, and when. If anything here is unclear, write to us and we will explain it plainly.

Last updated: August 4, 2026

The short version

Your leg photos never leave your phone. They are stored on the device only and excluded from backup, so they are never uploaded and never synced to iCloud.

Almost everything works without an account. Logging, measuring, charts, the evidence checklist and the denial decoder all run on your device. Only the AI report needs a sign-in.

Generating an AI report does send data to a third party. Aggregate statistics go to our AI processor, Anthropic, PBC (the Claude API), only after you agree in the app. No name, no raw daily logs, no photos. Full detail in the next section.

No ads, no analytics SDKs, no tracking, no data selling. Your location is never read.

AI-generated reports and third-party processing

Almost all of Willow's functionality runs entirely on your device. Your daily logs, measurements, photographs, insights, insurance evidence checklist, and denial-letter decoder never leave your device.

One optional feature is the exception: the AI-written report. When you choose to generate a report, and only after you explicitly agree in the app, Willow sends a set of aggregate statistics derived from your data to our server, which forwards them to our AI processor, Anthropic, PBC (the Claude API), to generate the report text.

What we send: your lipedema stage and type, any comorbidities you entered, and summary statistics only - compression days and average hours, manual-lymphatic-drainage and movement session counts, adherence percentage, your circumference trend, left/right asymmetry and volume-change figures, and your average pain, swelling and flare-day counts over the reporting period.

What we never send: your name, your individual daily log entries, your photographs, or your location.

Who receives it and why: Anthropic, PBC processes the aggregate statistics solely to generate your report and returns the text to your device. Anthropic does not use data submitted through its API to train its models. We do not retain the submitted statistics after the report is generated; our server stores only your account identifier and a monthly usage count. Anthropic's handling of API data is governed by Anthropic's commercial terms and privacy policy (anthropic.com), which provide protections equivalent to those described here.

Your control: generating a report is entirely optional. You are shown exactly what will be sent and must agree before anything leaves your device, and you can withdraw that permission at any time in Settings.

Data collected: account identifier (from Sign in with Apple) and a monthly report-usage count, both used only to enforce the fair-use quota. Health data is processed transiently to generate a report as described above and is not stored on our servers.

Where your data lives

Willow stores your logs, measurements, functional scores and settings on your device using SwiftData, and syncs them through your own private iCloud (CloudKit) so they survive a lost phone and appear on your other devices. That sync happens inside your Apple account. We cannot see it and we hold no copy.

Leg photos are the exception, and deliberately so. They are written to your device's local storage, marked as excluded from backup, and never enter iCloud sync or our servers. If you delete the app, those photos go with it.

What we collect, and when

Data	When it leaves your device	Why
Measurements, symptom scores, compression and therapy compliance, functional score, body weight, comorbidities	Only when you tap to generate an AI report. Sent as aggregated statistics plus a circumference trend series	To write the report you asked for
Apple user identifier	When you sign in with Apple to use the AI report	To count your monthly report quota, nothing else
Leg photos	Never. Device only, excluded from backup	Your before and after timeline, for your eyes
Raw daily logs, your name, your notes	Never sent. They stay on device and in your private iCloud	Not needed anywhere else
Denial letter text and photographs of it	Never. Text recognition and decoding both run on your device	An insurance letter is sensitive, so it stays local
Body weight from Apple Health	Only inside the aggregated figures of an AI report, if you generated one	The weight versus legs chart
City name for the swelling forecast	Converted to coordinates for a weather lookup	To fetch a forecast. Typed by you
Subscription status	Handled by Apple	To unlock Pro features. We never see your card

We do not collect advertising identifiers, contacts, browsing history or third-party analytics, and we do not track you across other apps or websites. Willow does not ask for App Tracking Transparency permission because it has nothing to track you with.

Apple Health and your location

Apple Health is read-only, and only body weight. Willow reads bodyMass to draw the weight versus legs chart, and never writes anything back into Health. You can skip the permission entirely and type your weight in; the chart works either way.
Health data is never used for advertising or marketing, and never shared with third parties for their own purposes, in line with Apple's HealthKit rules.
Your device location is never read. Willow does not use Core Location and never asks for location permission. For the swelling forecast, you type a city name, which is converted into coordinates so the weather service can return a forecast for that place.

Who processes data on our behalf

Apple: Sign in with Apple, iCloud sync of your own data, App Store subscriptions, and the weather forecast service.
Google Cloud (US): hosting for the report service and its database. The database holds your account record and a monthly report counter. It does not store the report payload.
Anthropic (Claude): writes the AI report from the aggregated figures we send. Not used to train models.

Each one receives only what its job needs. Data is encrypted in transit and at rest.

Retention and deletion

Everything on your device is deleted when you delete the app. Anything in your private iCloud is removed through your Apple account.
If you signed in for AI reports, we hold your Apple user identifier and a monthly usage count. Ask us and we will delete that account record within 30 days.
Report payloads are not stored after the report is written.
To request deletion or a copy of what we hold, write to the address below. We act within 30 days.

What Willow will not do

We never sell your data and never share it with advertisers. There are no ads in Willow.
Willow does not diagnose lipedema, does not provide medical advice, and does not assert medical necessity. That statement has to come from your clinician.
Willow does not send anything to your insurer, your doctor or anyone else. Every report and appeal draft is exported by you, and shared by you, if and when you choose.
AI output is a summary of your own logged data. It carries that label on every report.

Children

Willow is intended for adults managing their own health. It is not directed at children under 13 and we do not knowingly collect their data.

Changes

We will post changes here and, where they are material, tell you in the app before they take effect.

Contact

Questions about this policy or your data: customer-care@velorahealth.io. We reply within 2 business days.