Privacy policy
What Pulse collects, what it does with it, and who else ever sees it. Written to be read, not to be got past.
In effect from 18 September 2026. AIPULSEAPP PTY LTD, Australia.
Who we are
Pulse is made by AIPULSEAPP PTY LTD, an Australian company. In this policy, "Pulse", "we" and "us" mean that company, and "you" means the person whose record it is.
Health information is sensitive information under the Australian Privacy Act 1988, which holds it to a higher standard than ordinary personal information. That is the standard this policy is written to, and the Australian Privacy Principles are the rules it follows.
Any question about this policy, or about what we hold about you, goes to mick@aipulseapp.com.
What we collect
Four kinds of thing, and nothing else.
Your account. Your name, your email address, your time zone, and either a password we never store in a readable form or the fact that you signed in with Google.
Data from the devices and services you connect. Daily activity totals such as steps, distance, energy and active time; heart rate, including resting and average; heart rate variability; breathing rate; stress; your sleep, including when you slept, how long, and its stages; and your exercise sessions and how long they lasted.
What you give us. Your answers to the questions Pulse asks, blood test results, and any letter, result or plan you upload from an appointment.
How you use Pulse. Sign-in times, the pages you open, and the browser or device you opened them on. We keep this to run the product and to see that nobody is in your account who should not be.
How we collect it
From you, when you type it or upload it.
From a device or service you connect, and only after you have said yes to it on that provider's own screen. We use a service called Terra to make those connections and to carry the data to us. You choose which providers to connect, and you can disconnect any of them at any time.
We never buy data about you, and we never take it from anywhere you have not connected yourself.
Garmin data in particular
If you connect a Garmin account, Garmin asks you on its own screen exactly what you are agreeing to share. Nothing reaches us until you agree there.
What we do with it: we store it against your record, with the source, the device and the time window kept alongside every single value, so that any number Pulse ever shows you can be opened up to see where it came from. We use it to write the documents Pulse makes for you, and it stays in your history so that a document written next year can look back at this year.
What we never do with it: we do not sell it, we do not give it to advertisers, we do not give it to insurers or employers, and we do not use it to build a profile of you for anybody else's purposes. We do not send it to Garmin's competitors or to any other device provider.
Stopping it: disconnect Garmin inside Pulse, or revoke Pulse's access in your Garmin account. Either one stops any new data reaching us. What already arrived stays in your record until you ask us to delete it, or until your account is deleted — which you can ask for at any time.
What we use it for
Building and keeping your record, which is the product.
Writing the documents Pulse makes for you, and showing you where every number in them came from.
Answering you when you ask us for help, and telling you about something that has gone wrong.
Keeping the product safe and working, and meeting an obligation the law puts on us.
Research, but only if you agreed to it when you joined, and only in a form that does not name you. You can withdraw that agreement by emailing us, and it does not affect anything else about your membership.
Who else ever sees it
We do not sell your information. We do not disclose it for advertising. There is no arrangement under which anybody pays for access to it.
It leaves Pulse in four circumstances, and no others.
Somebody you send it to. You can share a document with a clinician, or with anyone else you choose, by sending them a link. They see the document you shared and nothing else, and you can stop the link working.
The companies that run the product for us, each of which is only allowed to use it to do that job: Supabase, which holds the database and signs you in, on servers in Sydney; Vercel, which serves the website; Terra, which carries data from the devices you connect; Anthropic, whose model writes the prose in your documents; and Google, but only if you chose to sign in with Google.
Where the law requires it, or where we need it to establish or defend a legal claim.
If the company is ever sold or merged, as part of what is transferred — and the buyer would be bound by this policy, and you would be told before anything moved.
The model that writes your documents
The prose in a Pulse document is written by an AI model run by Anthropic, from your data. Anthropic does not use what we send it to train its models.
Pulse never names a condition, never predicts where one of your markers is heading, never tells you what a medicine is doing to you, and never tells you to change what you are doing. Your doctor advises. Pulse records what was seen and tracks what happens next.
Where it is held, and whether it leaves Australia
Your record is held in Sydney. It is encrypted on its way to us and encrypted where it sits, and only the people who need it to run the product can reach it.
Some of the companies above are based overseas, mostly in the United States, and processing your information may involve it being handled there. We only use companies that are contractually held to protecting it.
How long we keep it
For as long as you are a member. Keeping the whole history is the point of Pulse — a document is worth something because it can look back years rather than weeks, so we do not quietly trim or thin out what you gave us.
If you leave, your record stays readable for a limited period so that you can get everything out of it, and is then deleted.
If you start signing up and never finish, everything collected in the meantime is deleted within seven days, and the connection to any device you linked is revoked.
You can ask us to delete your record at any time, and we will, unless the law requires us to keep something — in which case we will tell you what and why.
Seeing it, correcting it, and getting it out
You can ask us for a copy of everything we hold about you, ask us to correct anything that is wrong, or ask us to delete it. Email mick@aipulseapp.com. We will reply within 30 days, and we do not charge for it.
We may need to check who you are first, because the alternative is handing somebody else's health record to whoever asks for it.
Cookies
Pulse sets a cookie to keep you signed in. That is what it is for and that is all it does. There are no advertising cookies and no third-party trackers on this site.
Children
Pulse is for adults. It is not intended for anybody under 18, and we do not knowingly hold a record for one. If you believe we have, email us and we will delete it.
If something goes wrong
If your information is ever exposed in a way that is likely to cause you serious harm, Australian law requires us to tell you and to tell the Office of the Australian Information Commissioner. We will, and we will tell you what happened rather than that an incident occurred.
Complaining
Email mick@aipulseapp.com and we will answer within 30 days.
If you are not satisfied with how we handled it, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au, or on 1300 363 992.
Changes to this policy
If we change it, the date at the top changes with it, and this page always shows the version in effect. Where a change affects what we do with what we already hold, we will tell you directly rather than leave you to find it here.