On-Device AI and Your Health Data: What Stays on Your Phone

Every health app asks you to make a bet. That the company won’t get breached. That it won’t share your data with advertisers. That “anonymized” really means anonymous.

On-device AI changes some of those odds. It doesn’t change all of them, and you should be wary of any app that claims otherwise. Including us. So this post explains what on-device processing actually buys you, what the real risks look like, and exactly where Pinnacle Pulse sits.

Cloud vs. On-Device: The Actual Difference

Most AI features work like this: your data goes to a server, a model runs there, and the result comes back.

On-device inference flips that. The model runs on your phone’s own hardware, using frameworks such as Google’s TensorFlow Lite (now LiteRT) or Apple’s Core ML. The input never needs to leave the device for that calculation.

For things like forecasting from your logs or checking your pose before a scan, modern phones handle this well. For very large models, like reconstructing a detailed 3D body from photos, the cloud is still the practical option.

Why Health Data Deserves Extra Caution

The risks aren’t hypothetical.

Sharing for advertising. In 2023, the FTC took enforcement action against GoodRx for sharing users’ sensitive health information with advertising platforms, and the proposed order banned it from sharing health data for ads.

Weak legal coverage. Many people assume HIPAA covers their fitness and tracking apps. It generally doesn’t. HIPAA applies to covered entities like providers, health plans and their business associates, not most consumer apps.

Re-identification. “Anonymized” data is weaker protection than it sounds. A study in Nature Communications by Rocher et al. (2019) estimated that 99.98% of Americans could be correctly re-identified using 15 demographic attributes.

In the EU, data concerning health is a special category under GDPR Article 9, which means processing it is prohibited unless a specific exception applies, such as explicit consent. That’s a good model for how carefully this data should be handled everywhere.

And peptide logs are more sensitive than most. They can reveal medical conditions, compounds with uncertain legal status, and a lot about your body. You should know where they live.

What Stays on Your Phone in Pinnacle Pulse, and What Doesn’t

An earlier version of this post overstated how much stays local. Here’s the accurate picture, based on our app privacy policy.

Processed on your device only:

• EvoEngine forecasts. Predictions run with TensorFlow Lite on your phone, and no health data is sent to servers to generate them.
• Pose detection during body scans, using Google ML Kit.

Stored locally, and synced to the cloud when you’re signed in:

• Your profile, daily metrics, protocol logs, baseline data and blood panels are stored on your device. When account sync is active, they’re also stored in Google Firebase linked to your account, so you can restore them and compare progress across devices.

Processed in the cloud:

• Body scan photos. After you allow it, they’re uploaded to fal.ai for 3D reconstruction. A copy of the photos, the resulting 3D models and your measurements are stored in Firebase.
• Skin scan photos are not sent to fal.ai, but they are stored in Firebase after you allow it.

What we don’t do:

• We don’t sell your personal information.
• The app has no analytics or crash-reporting SDKs and no advertising tracking.

Data sent to Firebase is encrypted in transit, and cloud-stored data is encrypted at rest. You can delete individual scans, and deleting your account removes your associated Firebase data.

Is that “your data never leaves your phone”? No. It’s a hybrid. The parts that would be most valuable to an advertiser, your forecasts and behavioral analytics, either stay local or don’t exist. The parts that need the cloud to work, or that you’d want backed up, sync to an account you control.

We think that’s an honest trade-off. You should decide for yourself.

Questions to Ask Any Health App

Use these whether you’re evaluating us or anyone else:

1. Which features run on the device, and which send data to a server?
2. Which third parties receive data, and for what?
3. Is there an analytics or advertising SDK in the app?
4. Can I use it without an account, and what changes if I do?
5. How do I delete my data, and does deleting the account delete the cloud copies?

If an app can’t answer those clearly in its privacy policy, that tells you something.

How to Read App Store Privacy Labels

Both app stores now show a privacy summary before you install, and it’s worth thirty seconds.

On the App Store, Apple’s privacy labels sort data into groups such as “Data Used to Track You,” “Data Linked to You” and “Data Not Linked to You,” or show “Data Not Collected.” On Google Play, the Data safety section is where developers describe what their app collects, what it shares and how it handles your data.

Two things to keep in mind. First, these summaries are written by the developer. They’re useful, and the stores expect them to be accurate, but they’re a starting point, not an audit. Second, a short summary can’t capture nuance like “this photo is only uploaded after you tap Allow.” Read the label to spot red flags quickly, then read the privacy policy for anything that matters to you.

The biggest red flag on a health app is anything in the tracking category. Health data and ad tracking shouldn’t share a sentence.

Your Rights If You’re in the EU

If you live in the EU, GDPR gives you concrete rights over your data, and they apply to health apps too. Three are especially useful:

Access. Under Article 15, you can ask a company to confirm whether it processes your personal data and to give you a copy, along with information like the purposes and who it’s shared with.

Erasure. Article 17 gives you the right to have your data deleted in a number of situations, for example when it’s no longer needed or you withdraw consent. There are exceptions, so it isn’t absolute, but for a consumer health app it usually applies.

Portability. Article 20 lets you receive data you provided in a structured, commonly used, machine-readable format when processing is based on consent or a contract and carried out by automated means.

Using these rights is usually as simple as emailing the contact listed in the privacy policy. If an app makes that hard to find, that’s information too.

A Five-Minute Privacy Check (Illustrative)

Here’s a fictional walkthrough of evaluating a health app before you trust it with your logs. The app is invented for the example.

You find a sleep and supplement tracker with great reviews. Minute one: you check its App Store label and see “Identifiers” and “Usage Data” listed under data used to track you. That’s already a yellow flag for a health app.

Minute two: you open the privacy policy and search for “advertising,” “partners” and “sell.” The policy says data may be shared with “marketing partners to personalize your experience.”

Minute three: you search for “delete.” There’s a deletion request form, but nothing about whether deleting your account also removes backups or data already shared with partners.

Minute four: you check whether it works without an account. It doesn’t.

Minute five: you decide. For a step counter, you might shrug. For a log of what you inject, how you sleep and what your blood work says, that’s a pass.

The same check takes five minutes on any app, including ours.

Common Mistakes

Assuming HIPAA protects you. For most consumer apps, it doesn’t. Read the app’s own policy.

Trusting the word “anonymized.” As the re-identification research above shows, that word carries less weight than it seems to.

Granting every health permission by default. Apple Health and Health Connect let you choose data types. Share what the app actually needs for features you use.

Deleting the app and assuming the data is gone. Removing an app from your phone usually doesn’t delete what’s synced to the company’s servers. In our case, cloud-synced data persists until you delete your account, which is why account deletion exists.

Never reading the policy at all. You don’t have to read every word. Search for the handful of terms above and you’ll learn most of what matters.

The Trade-Offs of Going Local

On-device AI isn’t free. Models have to be small enough to ship in an app and run in a phone’s memory. They can’t learn from pooled user data the way cloud models can, which slows improvement. And they use battery.

For a forecasting engine working from your own logs, those limits are acceptable. For 3D reconstruction, they’re not, yet, which is why that piece runs in the cloud. We’d rather tell you that than pretend otherwise.

If you want to see how scans actually work under the hood, read 3D body scanning with your phone. And for the data that matters most for decisions, see our guide to blood panels for biohackers.

This article is for general information and isn’t legal advice. Pinnacle Pulse’s data practices are governed by our current privacy policy, which takes precedence over this post.

FAQ

Does Pinnacle Pulse send my health data to the cloud?

Partly. EvoEngine forecasts run on your device. When you're signed in, your logs, metrics and blood panels sync to Google Firebase, and body scan photos are sent to fal.ai for 3D reconstruction after you allow it. Our app privacy policy lists every flow.

Does HIPAA protect data in health and fitness apps?

Usually not. HIPAA applies to healthcare providers, health plans, clearinghouses and their business associates. Most consumer wellness apps fall outside it, although the FTC can still act against unfair or deceptive data practices.

Can anonymized health data be traced back to me?

Often, yes. Research published in Nature Communications estimated that 99.98% of Americans could be correctly re-identified in any dataset using 15 demographic attributes.