Last updated: October 3, 2026
In short: Patients never need an account. Requesters verify their email address (no password) before creating links, so every request can be traced to a confirmed address. We do not collect, receive, view, or store your health, fitness, or activity data at any point. That data is read from Apple Health or Health Connect on your own device, compiled into a report on your own device, and emailed directly from your own email account to the clinician who sent you the request link. Our servers never see it. We do keep anonymous, aggregate counts of app usage — described in Sections 3 and 5 — to understand whether the Service is working, but these contain no data that could identify you, a patient, or a clinician. We store a requester's verified email with the links they create and show them how many times each link was opened and sent (Sections 3A and 5), but never who opened or sent it. Before anything is shared, the app shows you exactly where your data will go and lets you report a request you don't trust (Section 5A). We never see the health data itself.
HealthMailer is a mobile application and companion website (together, the "Service") that lets a clinician request specific, passive health and activity data from a patient, and lets that person send it directly by email, without the patient ever needing to create an account.
The Service is provided by Clinician People Ltd ("we", "us", "our"), a company registered in England and Wales under company number 15880511, with its registered office at 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. This Privacy Policy explains what information the Service processes, why, and the choices and rights available to you. If you have any questions, you can reach us at info@clinicianpeople.com.
Patients never need to register, sign in, or create a profile to open a request link or send a report.
Requesters must verify their email address before creating links, using a one-time link we send by email. We do not use passwords. This deters people from posing as a patient's clinician, because every link can be traced to a confirmed address. What we store for verified requesters is described in Section 3A.
A clinician generates a request using our website. To do this, they provide:
These details are sent to a signing service we operate, which uses them to create a unique, cryptographically signed link. This link — and not our servers — is what carries the request. Request links contain no patient reference or any other patient information: the same link can be shared with every patient, and the requester knows who sent each report from the email address it arrives from. Apart from the requester's own account and link records described in Section 3A, this information exists only inside the signed link itself, which is held on the requester's and recipients' own devices (for example, in a text message or email).
To protect this free service from automated abuse, our signing service temporarily keeps a record of the IP address and timestamp of link-creation requests, on a short, rolling basis, purely to detect unusual request patterns. This record is not linked to any patient, health data, or the content of any request.
Separately, each time a request link is successfully created, we increment an anonymous, aggregate daily counter (for example, "14 links were created today"), along with a matching counter for each data category requested (for example, "sleep data was requested 6 times today"). These counters contain no email address, IP address, or anything else that could identify who created the request or who it is for — they are simple running totals we use to understand overall usage of the Service, and are not a script or tracker running in your browser (see Section 8).
If you verify your email as a requester, we store:
For each link you create while verified, we also store the link itself (so you can copy, share or renew it from any device), a random link identifier, when it was created and when it expires, the data categories and time period requested, an optional name you give it, and running totals of how many times it has been opened and how many reports were sent (see Section 5).
Links contain no patient information, so none of this relates to any patient. We never store health data, and we never know which patients opened or sent a link. Please don't include patient details in a link's name.
We use this information to provide your link dashboard (lawful basis: performance of a contract with you). We send product update emails only if you opt in (lawful basis: consent), and you can unsubscribe at any time using the link in any such email or by contacting us. We do not sell, rent, or share requester information with anyone, other than the infrastructure providers described in Section 8 who process it on our behalf.
When you open a request link on your phone, the HealthMailer app verifies it entirely on your own device — checking that it hasn't expired and hasn't been tampered with. This check does not involve contacting our servers.
The app then asks your device's operating system (Apple Health on iOS, or Health Connect on Android) for permission to read only the specific categories of data named in the link, for the specific time period requested. This is a read-only permission — HealthMailer cannot add, change, or delete anything in Apple Health or Health Connect.
The requested data is compiled into a report (a CSV file) entirely on your device. Nothing is uploaded to us, and nothing is transmitted anywhere, at this stage.
When you choose to send the report, HealthMailer hands it to your own email app, already addressed to the recipient named in the link. Your email app sends it from your own email account, over your own connection. At no point does this report, or the health data inside it, pass through our servers or infrastructure. We have no ability to see, intercept, retain, or recover it.
To understand whether the Service is actually being used — for example, whether links that are created are also opened, and whether reports that are started are actually sent — the app sends a small number of one-word usage signals to our servers at key moments: when a request link is opened, when Apple Health/Health Connect permission is granted or denied, and (on devices where this can be determined) whether sending a report was completed, cancelled, or failed.
For links that aren't tracked, each of these signals contains nothing beyond the single word describing which moment occurred. It does not include your email address, the recipient's email address, the health data itself, your device's advertising identifier, or any other value that could identify you, the request, or the patient it relates to. We have no way of connecting one of these signals back to a specific request, device, or person — we only ever see a running total, such as "142 permission grants and 9 permission denials so far today." This is not a third-party analytics or advertising SDK; it is a direct, first-party call to our own signing infrastructure, with no persistent device identifier and no cross-app or cross-session tracking of any kind.
Tracked links. If the link you received was created by a verified requester, the app tells you this before you send. For these links only, the "link opened" and "report sent" signals also include a random identifier for the link (not for you), so the requester can see running totals of how many times their link was opened and how many reports were sent (on Android, how many times a mail app was opened). The same link is shared with many patients, so these totals never show who opened or sent it. The identifier does not include your health data, your email address, or any device identifier, and we do not store your IP address with it. The permission granted or denied, and send cancelled or failed, signals are never linked to a link, even for tracked links.
Because your email app does not report back to HealthMailer once it has taken over, we still have no way of confirming whether an email was actually sent or received by mail servers after your device handed it off — this signal only reflects whether you completed, cancelled, or backed out of the on-device send step. On Android, the operating system does not tell any app whether a message was actually sent from within another app, so the corresponding signal there only reflects that your chosen mail app was opened.
Someone could pretend to be your clinician to get your health data. To help you avoid this, before the app asks for any permission it shows you the email address your data will be sent to, what is being requested, and a warning if the address is a personal email account (such as Gmail or Outlook) rather than an organisation's address. Only continue if you know and trust the address.
If you don't trust a request, you can tap "Report this request" and choose a reason from a short list. The report contains only the requester's email address from the link and the reason you chose. It contains nothing about you or your health data, and we do not store your IP address with it. We use reports to investigate misuse and may block an email address or domain from creating links.
The app downloads a list of blocked addresses (as scrambled, one-way codes, not readable addresses) and checks each request against it on your phone. Downloading the list sends nothing about you or the request. If a request is from a blocked address, the app won't continue.
While a report is being prepared, the app may hold it briefly in your device's memory or private app storage so it can be attached to your outgoing email. This copy is automatically cleared as soon as you send the report, or if you cancel or back out before sending. HealthMailer does not retain a copy after that point, and does not back up, sync, or export this data anywhere else.
Depending on what a clinician requests, and what is available on your device, the categories of data covered by this Service may include particularly sensitive information, such as heart and cardiovascular measurements, sleep, or clinical vitals. This is treated as "special category data" under data protection law. Because this data is read, compiled, and sent entirely on your own device, and never reaches our servers, we do not process, store, or have access to it in any form — the protections described in this Policy for the request link (Sections 3–4) apply equally, and with the same emphasis, to sensitive categories of data.
Our website does not use advertising or analytics cookies, does not run analytics or advertising scripts, and does not track visitors across sessions or across other websites. The only information submitted through the website is the link-creation request described in Section 3 and the requester account information described in Section 3A, including the anonymous, aggregate counter increment described there — which happens on our servers as a byproduct of creating the link, not through any script running in your browser.
Like any website, ours is served through third-party hosting and cloud infrastructure providers, who may process standard technical information (such as IP address, browser type, and request timestamps) as an ordinary part of operating that infrastructure and keeping it secure. We do not use this information for analytics, profiling, or marketing purposes.
If you verify your email as a requester, our website uses your browser's local storage to keep you verified on that browser (using Google Firebase Authentication). This storage is strictly necessary to provide a feature you have asked for, and is not used to track you. If you do not verify your email, none of this storage is used.
The HealthMailer app does not contain any third-party advertising SDK, analytics SDK, or crash-reporting tool that transmits data to us or to anyone else. We do not sell, rent, or share personal data or health data with advertisers, data brokers, or any other third party. We never receive health data, and requester account information is used only as described in Section 3A.
The only network calls the app makes to our own servers are an update-availability check and a block-list download (Section 5A), the usage signals described in Section 5 (which, for tracked links only, include a random link identifier), and a report if you choose to make one (Section 5A). None involves a third-party SDK, an advertising identifier, or any data that identifies you or your health.
We do not retain health data or report contents, because this information is never sent to or stored by our servers — it exists only within the signed link itself and on the devices of the people using it. The only information we retain is the short-lived, IP-based security record described in Section 3, which is kept only for as long as needed to protect the signing service from abuse, on a rolling basis.
We also retain the anonymous, aggregate daily usage counters described in Sections 3 and 5 indefinitely, in order to understand overall usage trends over time. Because these counters are never linked to any individual, request, or device, there is nothing within them that identifies, or could reasonably be used to identify, any person.
Reports of misuse (Section 5A) are deleted after 24 months, and blocked addresses stay blocked until we lift the block. For verified requesters (Section 3A), each link record is deleted 90 days after the link expires. Requester accounts are deleted when you ask us to, or automatically after 24 months without use. If you opted in to product update emails, we keep a record of that consent for as long as we need to show it was given.
Depending on where you are located, you may have rights under data protection law (such as the UK General Data Protection Regulation and the Data Protection Act 2018, or equivalent laws elsewhere) to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Because HealthMailer is designed so that we do not collect or hold your health data or a persistent record of your requests, there is typically nothing on our systems to access or delete beyond the limited security record described in Section 3. If you have a requester account, you can export or delete your account and link history from your dashboard at any time, or by contacting us.
If you believe we hold information about you and would like to exercise any of these rights, or if you have a concern about how we handle information, please contact us at info@clinicianpeople.com. If you are in the UK and remain unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), or the equivalent supervisory authority in your jurisdiction.
The Service may be used by people and organizations in different countries, and our infrastructure providers may operate servers in jurisdictions other than your own. Because we do not transmit or store your health data, its processing occurs on your own device and remains subject to your own device's operating system and settings, rather than being transferred internationally by us.
Requester account information (Section 3A) is stored with Google Firebase in the United States (Google Cloud region us-central1). This transfer is protected by Google's data processing terms and the safeguards approved under UK data protection law for international transfers.
The Service is intended for use by clinicians and the adult patients they work with. It is not directed at children, and we do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us so we can address it.
HealthMailer is a transport tool: it helps compile and send data that already exists on your device, at the request of a clinician. It does not analyze, interpret, diagnose, or offer any medical opinion on the data it helps you send, and should not be relied upon for any medical decision-making.
We may update this Privacy Policy from time to time, for example to reflect changes to the Service or to applicable law. If we make material changes, we will update the "Last updated" date above. We encourage you to review this page periodically.
If you have any questions about this Privacy Policy or how the Service handles information, please contact:
Clinician People Ltd (company number 15880511)
82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE
info@clinicianpeople.com