Consumer Health Data Privacy Policy

For users in the United States. Effective: November 3, 2026.

Some US states — among them Washington with its My Health My Data Act, and Nevada — have laws specifically for consumer health data. This policy explains how PostSafe handles such data. It supplements the Privacy Policy, which applies in full.

PostSafe is provided by Josef Werner, Nägelseestraße 11, 79288 Gottenheim, Germany, kontakt@postsafe.eu — “I” in this policy.

1. What consumer health data PostSafe may process

PostSafe does not ask for health information and does not look for it. But the letters you choose to scan can contain it — for example letters and bills from doctors, hospitals, pharmacies or health insurers, which can reveal a condition, a treatment, a medication or simply that you sought care. The same applies to anything derived from such a letter. In detail:

page images and recognized text of the letters you scan or import,
the details read from them: sender, amounts, dates, deadlines, a short summary and the task to be done,
the folder a letter is filed in, and the folder names you choose, for example “Health”,
corrections you make to any of these.

PostSafe collects no health data from anywhere else: nothing from Apple Health, wearables or other apps, and no location data at all.

2. Why it is processed

Only to provide the features you use:

recognizing the text of a letter and understanding it — summary, sender, amounts, deadlines and the task to be done,
suggesting one of your own folders for it,
reminding you of deadlines you have confirmed,
if you have a subscription and have agreed to it: keeping an encrypted emergency copy, and giving your letters back to you if you ask.

Never for advertising, never for profiling, never for training AI models, and never sold.

3. Where it comes from

Only from you: the letters you scan or import, the folder names you create and the corrections you make.

4. Where it is stored and who processes it

Your own iCloud. Your letters are stored on your device and in your private iCloud database at Apple. I have no technical access to them.
To read a letter, its pages and your folder names pass through my server at Supabase (Frankfurt, Germany) to Mistral AI (data centers in the EU). Neither keeps them: my server stores no letter content, and Mistral keeps nothing after processing (zero data retention) and does not use it for training.
The emergency copy — only with a subscription and your separate consent — is an encrypted copy at Supabase in Frankfurt. Each letter is encrypted on your iPhone before it leaves it.

5. Who it is shared with

I do not share consumer health data with any third party, and I have no affiliates. The only recipients are the two service providers above, which process it solely on my behalf and under contract: Mistral AI SAS (France) and Supabase. Apple stores it in your own iCloud. RevenueCat and TelemetryDeck never receive letter content. No third party collects consumer health data about you through PostSafe over time or across other websites or apps. I never sell consumer health data.

6. Your consent

No letter leaves your device before you have expressly agreed. The app asks for this consent right before your first scan, on its own screen, and names both health data and the transfer to Mistral AI. The emergency copy needs a second, separate consent.

You can withdraw either consent at any time in the app’s settings. Withdrawing stops new scans, or new emergency copies; your existing archive stays readable, searchable and exportable.

7. Your rights

Confirm and access. You can find out whether I process your consumer health data and get access to it. Your complete archive is available at any time under Settings → Export data; for anything else, write to me. On request I also tell you everyone the data has been shared with — today, only the service providers in section 5.
Withdraw consent at any time (section 6).
Delete. Settings → Delete account removes your letters from your iCloud and all records on my server in one step; an emergency copy follows 30 days later, or immediately with “Delete emergency copy”. The service providers keep nothing that would have to be deleted.
Appeal. If I decline a request, you can appeal by email with “Appeal” in the subject line. I decide within 45 days and explain the decision. If you disagree with it, you can contact the Washington State Attorney General or the attorney general of your state.

Send requests to kontakt@postsafe.eu. Your identity is verified via your PostSafe account — I do not ask for a copy of your ID. I respond within 45 days; if a request needs more time, I may extend this once by another 45 days and will tell you why. Requests are free of charge, and using a right never leads to a different price or level of service.

8. Changes to this policy

If this policy changes in a way that affects how consumer health data is processed, I will ask for your consent again before the change applies, as section 11 of the Privacy Policy describes. The effective date is at the top of this page.

9. Contact

Josef Werner, Nägelseestraße 11, 79288 Gottenheim, Germany
Email: kontakt@postsafe.eu