Privacy Policy

Last updated: 2026-10-21

This policy covers the Human System app for Windows, distributed through the Microsoft Store; the Human System app for iPhone and iPad, distributed through Apple’s App Store, including that same app running on an Apple silicon Mac; and this website. Where the app behaves differently on the two, the text says so: “On Windows” for the Microsoft Store app, and “On iPhone, iPad and Mac” for the App Store app. The section This website covers hsys.me itself. State consumer health data laws (Washington, Nevada) are covered by our separate Consumer Health Data Privacy Policy.

The short version

Human System is a single-user health record that runs entirely on your own device: a Windows computer, an iPhone, an iPad or a Mac. There is no Human System account and no Human System server, and Geekdojo, the publisher, never receives your health data. Your record stays on your device, and the database that holds it is encrypted — opening it takes your password or recovery code. (Uploaded documents and exports are protected differently on Windows and on Apple devices; see below.)

Three things can leave your device because of Human System, and each only when you ask for it:

1. A document you choose to send for extraction goes to the AI provider you have selected — Anthropic or OpenAI — using an API key you supply from your own account with that provider.
2. Whatever your own AI assistant reads, if you choose to connect one (such as Claude or Codex). This is possible on Windows only, and is off unless you turn it on.
3. A request to refresh the substance catalog goes to GitHub, to download a public reference data file. That request contains no personal data.

Human System itself transmits nothing else. There is no telemetry, no analytics, and no usage reporting of any kind. Buying the app or starting its trial happens through the store you got it from, not through us; see Purchases and the trial. The app’s window is drawn by a component of your operating system, with its own data practices: Microsoft Edge WebView2 on Windows, and WebKit on iPhone, iPad and Mac; see Microsoft Edge WebView2 and WebKit below.

Who we are

Human System is published by Geekdojo, and is offered in the United States only.

• Support: +1 (888) 201-0085 (telephone calls only — this line does not receive text messages)
• Email: info@geekdojo.com

What the app stores, and where

Everything the app knows about you is stored on the device you installed it on, inside storage that belongs to the app alone.

On Windows, that is the app’s own Windows package folder:

%LOCALAPPDATA%\Packages\Geekdojo.HumanSystem_<id>\LocalState\Geekdojo\HumanSystem\

where %LOCALAPPDATA% is normally C:\Users\<you>\AppData\Local and <id> is a short identifier Windows assigns to the package. That folder contains:

On iPhone, iPad and Mac, it is the app’s own container, the private storage Apple’s systems give each app:

<app container>/Library/Application Support/com.geekdojo.HumanSystem/

It holds the same default/, profiles/, documents/ and logs/ described above, with no webview2 folder. The app keeps nothing in the container’s Documents folder and does not share its files with the Files app, so your record does not appear in Files or in iCloud Drive. On iPhone and iPad, other apps cannot read another app’s container. On a Mac, the container is inside your user account’s Library folder (~/Library/Containers/), where software you have given Full Disk Access can read it.

• Kept out of backups. The app marks that folder, and everything in it, to be excluded from backups: iCloud Backup and computer backups of an iPhone or iPad, and Time Machine on a Mac. Apple describes this setting as guidance to backup software rather than a guarantee, which is one reason the documents in it are encrypted too (see below). The consequence is that if your device is lost, replaced or restored, your record is lost with it: an export is the only copy you can make. The app says so on its first screen and in Settings → Export & import.
• WebKit’s own files. WebKit, which draws the app’s window, keeps its own working files elsewhere in the container, outside the folder above.
• Files you pick to upload. When you choose a file in the app, WebKit can place a temporary copy of it in the app’s temporary folder. The app deletes those copies itself once a document upload or an import has used them, and otherwise at the next launch.

We do not receive any of this. There is no server it is copied to, no backup service it is synchronised with, and no mechanism by which the publisher could read it.

What “encrypted” does and does not cover

This matters, so it is stated precisely rather than reassuringly.

Your database is encrypted. The SQLite database holding your health record is encrypted on disk with the Adiantum cipher, applied to every page. The key is a random 32-byte key generated on your device; it is never written to disk in the clear. What is written is a copy of it sealed under a key derived from your password with Argon2id. Opening the database requires that you present your password or your recovery code at that moment. The application does not store your unlock secret in Windows DPAPI, the Windows Credential Manager, the Apple Keychain, or any other keystore, offers no “remember me”, and does not unlock with Face ID or Touch ID.

On iPhone and iPad, the database files also get iOS data protection. The app asks iOS to give the files that hold your databases the “complete unless open” protection class, under which iOS keeps a file unreadable while the device is locked unless the app already has it open. Uploaded documents and the log are not given that class; the documents are protected by the app’s own encryption, below.

On iPhone, iPad and Mac, your uploaded documents are encrypted. Lab PDFs, scans and photos that you upload are stored in documents/, each file encrypted with XChaCha20-Poly1305 under a key derived from the same key that encrypts your database. Opening them therefore takes the same password or recovery code, and one profile’s documents cannot be opened with another profile’s key. What the encryption does not hide: each file’s name on disk is a hash of its contents rather than the name you gave it (the original filename is kept inside the encrypted database), and the number of files, their sizes and their type (PDF or image) are visible to anything that can read the container.

On Windows, your uploaded documents are not individually encrypted. Lab PDFs and scan images that you upload are stored as ordinary files in documents\, readable by anything running as your Windows user account. Their filenames on disk are content hashes rather than the names you gave them (the original filename is kept in the encrypted database), but the file contents themselves are in the clear. If you want those files protected at rest, use full-disk encryption such as BitLocker.

The key sidecar file is plaintext, and it has to be. It holds your sealed key, so it cannot itself be sealed under that key. Its contents are safe — the sealed key is an authenticated ciphertext — but the file does disclose your profile display name and which kinds of unlocker exist (password, recovery code). It contains no health data. It is the same on every platform: human-system.db.profile.json, beside each database.

On iPhone, iPad and Mac, files you export are encrypted under a passphrase you choose. The “Export everything” feature asks for a passphrase of at least 12 characters and writes your entire record, every document you uploaded included, as one file encrypted under it. The file is a standard age file: anyone who has the passphrase can open it with age’s own tools, without this app, and decrypted it is a ZIP archive of readable JSON plus your documents. Nobody can open it without the passphrase, you included, and there is no way to reset or recover a forgotten one: if you forget it, that export cannot be opened. Keep the passphrase somewhere other than the file. You choose where the file goes in the system’s save panel — on the device, in iCloud Drive or another location — and the app keeps no second copy.

On Windows, files you export are not encrypted. The “Export everything” feature produces an ordinary ZIP archive containing your entire record in readable JSON, plus every document you uploaded. That file is your health record in the clearest possible form. Store it accordingly, and keep it out of any cloud folder or code repository you would not put medical records into.

If you lose your password

If you lose both your password and your recovery code, your record cannot be recovered — not by you, and not by us. There is no escrow, no second copy of your key, and no reset we can perform. This is a consequence of the design, not an oversight.

What leaves your device

1. Document extraction, via Anthropic or OpenAI

This is one of the two paths by which your health information can leave your device (the other, on Windows only, is your own AI assistant), and it runs only when you upload a document and choose to extract it. It works the same way on every platform.

You must supply your own API key, from your own account with the provider you choose, in the app’s Settings. You select one provider at a time — Anthropic or OpenAI — and each document you extract is sent to that one provider only. Until a key is saved, this feature does nothing and no request is made. The key is stored encrypted on your device, is never written to the app’s log, and is never included in any response the app serves.

If you use OpenAI, create a restricted key. The app needs exactly one permission on an OpenAI key: Responses (/v1/responses). Every other capability can be set to None. A key limited this way cannot be used to run up charges on anything else if it is ever exposed. The Settings screen explains how to create one.

On iPhone and iPad you can also scan a paper document with the camera or choose a photo from your library. A scan becomes a PDF, and a photo is re-encoded as a JPEG with its location and every other piece of image metadata removed; that PDF or JPEG is what is stored and, if you extract it, sent. The app asks for the camera only to scan, and does not ask for access to your photo library: you choose a single photo in Apple’s picker.

When you run an extraction, the following is sent to the provider you selected — https://api.anthropic.com for Anthropic, or https://api.openai.com for OpenAI:

• The document itself — the full PDF or image file you uploaded.
• The filename you uploaded it under.
• The label you gave it — whether you marked it a lab report, a DEXA/body-composition report, or something else. This is embedded in the instructions sent with the request.
• The list of marker keys your installation defines — short identifiers such as hdl_c or igf_1. These are the names of measurements, not your measurements.
• Fixed instruction text — the extraction prompt, the permitted vocabularies, and the structure the reply must match. These are the same for every user and every document.

That is the complete list. The app adds nothing about you to the request: not your profile name, and no other lab result, dose, note or metric from your record. The instructions explicitly direct that patient names, dates of birth, addresses, medical record numbers, account numbers, insurance details and provider names must not be copied out of the document into the returned data.

But the document goes as it is, including whatever is printed on it. A lab report ordinarily has your name, date of birth and medical record number on it. The app does not redact the document before sending it. If you do not want the provider to see that information, redact the file before uploading it, or do not use extraction for that document.

The request is made under your account with that provider, with your key. The provider’s handling of it — including how long it is retained and whether it is cached — is governed by that provider’s own terms and privacy policy, and the relationship is between you and the provider. We are not a party to it and receive nothing from it.

Nothing is saved without your review. The extraction returns proposed rows. Nothing is written to your record until you read each proposed value next to the page it was taken from and accept it.

2. Your own AI assistant, if you connect one

On Windows, Human System can let an AI assistant that you run — such as Claude or Codex — connect to your record on your own computer, so the assistant can import records for you and read your record to do it. This connection is off by default. It stays off until you deliberately turn it on by setting up an access token, and when it is on, every request must present that token.

Once you connect an assistant, it can read and change your record. It can read your overview, alerts, markers, results and interventions, and it can add or update records through the import tools. Whatever the assistant reads is then part of your conversation with it, and is sent to that assistant’s provider (for example Anthropic or OpenAI) under your own account with them, governed by their terms and privacy policy.

Human System does not decide what your assistant sends to its provider, and does not see your conversation. We receive nothing from this connection. To stop it, remove the access token; the connection is refused from then on.

On iPhone, iPad and Mac there is no such connection. The app runs no network server there: its pages are served from inside the app itself, to its own window and nothing else, so there is nothing an assistant could connect to.

3. The substance catalog, via GitHub

If you press “refresh” on the substance catalog in Settings, the app downloads a public reference data file from GitHub, on every platform. This request is user-initiated only — there is no automatic or scheduled fetch — and it carries no personal data: it is an anonymous download of a public file. Connections on this path are restricted to GitHub’s own hosts.

4. Microsoft Edge WebView2

On Windows, Human System’s window is rendered by Microsoft Edge WebView2, a component of Windows that Microsoft installs and updates. WebView2 is Microsoft’s software, not ours, and like Edge it may send diagnostic data and security checks to Microsoft according to your Windows privacy settings. Human System does not send your record through it: the app’s pages are served from your own machine, and the app does not direct WebView2 to any outside address. WebView2 keeps its own working files in the webview2\ folder listed above.

5. WebKit, on iPhone, iPad and Mac

On iPhone, iPad and Mac, Human System’s window is rendered by WebKit, Apple’s web engine, which is part of the operating system. WebKit is Apple’s software, not ours, and is governed by Apple’s terms and your device’s settings. Human System does not send your record through it: the app’s pages are served from inside the app itself, at an address only the app answers, with no network server, and the app lets its window load nothing else. A web link you tap in the app opens in your browser instead.

6. Purchases and the trial

Buying Human System, or starting its free trial, is done through the store you got it from — Apple’s App Store or the Microsoft Store — under your account with that store and its terms. The app never sees your payment details.

• On iPhone, iPad and Mac, the 7-day free trial and the one-time unlock are in-app purchases made with Apple. To decide whether the app is unlocked, it asks Apple’s StoreKit, on your device, which of the two your Apple Account owns, and works out when the trial ends from the purchase date Apple reports.
• On Windows, the trial and the purchase are Microsoft Store licences, and where the app checks which one you hold, it asks the Microsoft Store.

These checks go to the store, not to Geekdojo, and carry none of your health data.

7. Crash reports your device may share

Human System contains no crash reporter. Your operating system has its own, under your control:

• On iPhone, iPad and Mac, if you have turned on Share with App Developers in your device’s Analytics settings, Apple may share crash reports and other diagnostic data about the app with us, as the developer, under Apple’s terms. That sharing is Apple’s, and you can turn it off in the same setting.
• On Windows, Windows may send crash data to Microsoft under your Windows diagnostic data settings, and Microsoft may make reports of it available to us as the publisher.

8. Nothing else

Specifically, and verified in the source:

• No telemetry. The app contains no analytics SDK, no crash reporter, no metrics exporter and no beacon. It does not report that it was launched, what you clicked, or that it crashed.
• No analytics. The user interface loads no third-party scripts, fonts, stylesheets or images. Everything it renders is served by the app itself, from your own device. There is no tag manager and no advertising network.
• No account. There is no Human System account, no sign-in to any server of ours, and no OAuth or single-sign-on provider. Your password and recovery code are created and verified entirely on your own device. The only check made beyond your device is the store’s, described in Purchases and the trial.
• No update check. The app does not contact any server to look for a new version. Updates are delivered by the Microsoft Store on Windows, and by the App Store on iPhone, iPad and Mac.
• No email, no push notifications, no webhooks. The app sends no messages anywhere.

The App Store privacy label

Apple’s App Store asks every app to declare what data it “collects”, and counts data as collected when it is sent off the device and kept longer than it takes to answer the request. Human System’s label therefore lists Health, Name, and Photos or Videos as data linked to you, used for app functionality, and no tracking. The reason is extraction: a document you choose to extract — which may carry your name, and may be a scan or photo — goes to the AI provider you selected, under your own account, and that provider may keep it for a period under its terms. It does not mean Geekdojo receives it: we do not.

Children

Human System is not directed at children and is not intended for use by anyone under 13. We do not knowingly collect information from children — in fact the app transmits nothing to us about anyone. The only information about the app that can reach us is the crash and diagnostic data your operating system may share under your own settings, described in Crash reports your device may share.

This is not medical software

Human System organises and displays health information that you enter or import. It is not a medical device. It does not diagnose, treat, cure or prevent any disease, and it does not provide medical advice. It is not a clinic, a laboratory, or an advice engine. Interpretation of anything it displays belongs to your physician.

Your rights over your data

Because your data never leaves your device except as described above, exercising rights over it is a matter of using the application rather than contacting us:

• Access and portability — Settings → “Export everything” produces a ZIP containing every row and every document, in readable JSON. On iPhone, iPad and Mac that ZIP is inside a file encrypted under a passphrase you choose.
• Correction — every value in the record is editable in the app.
• Deletion — delete records in the app, or remove the app, which deletes the whole folder described above.

Removing the app DELETES your record, permanently. Your data is stored in the app’s own storage, and the operating system removes it with the app: on Windows, uninstalling removes the app’s package folder; on iPhone and iPad, deleting the app removes its container. (Offloading the app, an iPhone and iPad storage option, keeps its data.) There is no copy anywhere else, no backup held by us, and no way to undo it. On a Mac, removing the app may leave its container in your Library folder; deleting that container deletes the record.

Export first if you want to keep anything. The app can write your whole record to a single file you choose, and that file is yours and is not affected by removing the app.

This is deliberate. Removing a health app should remove the health data, not leave an encrypted copy on a disk you believe you have cleared.

We cannot delete your data for you, because we do not have it.

This website

This section is about hsys.me, not the app. The app contains no analytics; this website does count visits.

• Page-view counting. hsys.me uses GoatCounter to count page views. It stores nothing in your browser — no cookies, no local storage — and does not store your IP address. It records the page, the referring page, your browser and operating system, your language, your screen width, and a country derived from your IP address. See GoatCounter’s privacy policy for how it handles that data.
• Hosting. The site is served by GitHub Pages. GitHub receives the ordinary request information any web host receives, including your IP address, under GitHub’s privacy statement.
• Nothing else. There are no forms, no accounts, no advertising, and no third-party fonts. Nothing you do on this site reaches the app or your health record.

Changes to this policy

If this policy changes, the updated version will be published at the same URL and the “Last updated” date at the top will change.

Contact

• Telephone: +1 (888) 201-0085 (calls only; no text messages)
• Email: info@geekdojo.com