myPolar Privacy Policy

Last updated: November 7, 2026
Version: 5
Effective: on publication in the app
Change: myPolar is now provided by Anastasia Shapovalova as an individual (section 1).

The short version

• myPolar is a self-tracking app for people whose mood is unstable. It is a wellness tool. It is not a medical device, it does not diagnose, and it does not replace your doctor.
• The data you record in myPolar is health data. We treat all of it as sensitive.
• We never sell your health data and never use it for advertising. What you record in the app and data from Health Connect or Apple Health never reach advertising platforms, data brokers, insurers, employers or pharmaceutical companies.
• We use your data to run the app for you. Other people see it only when you choose to share a specific part of it with a specific person, and you can stop at any time.
• Voice notes are transcribed on our own servers. We do not send your diary or your voice to outside AI companies, and we do not use your diary, voice recordings or transcripts to train models.
• Research is your choice. If you agree, a de-identified copy of part of your data goes to a separate research database that only myPolar uses, for our own clinical research and to improve our own algorithms. Data from Health Connect and Apple Health is not included. Nobody outside myPolar gets access to it. Saying no changes nothing in the app.
• Our product analytics see which screens are opened, but never what you write, how you feel, what you take, or any health values.
• Marketing is separate and optional. On our website, with your consent, we use Google Analytics and advertising cookies such as the Meta Pixel. If you leave your email on our website and tick a separate box, we may use it to show you myPolar ads on social networks. The email of your myPolar account is never used for ads. The app itself has no advertising trackers.
• If a clinic, doctor or organization gives you access to myPolar, it sees only that its access is being used — not your data.
• You can export your data and delete your account in the app. Deletion is immediate.

1. Who we are

myPolar is operated by Anastasia Shapovalova, an individual based in Tel Aviv, Israel ("myPolar", "we", "us").

We are the controller of your personal data, and the owner of our databases for the purposes of the Israeli Privacy Protection Law, 5741-1981.

Privacy contact: privacy@mypolar.ai. General contact: hello@mypolar.ai.

This policy covers the myPolar mobile app on Android and iOS, the website at mypolar.ai and its subdomains, and emails we send you (together, the "Service"). It is part of our Terms of Service. How we use cookies on the website is described in our Cookie Policy.

2. Who myPolar is for and where it is available

• myPolar is for adults 18 and older. We do not knowingly collect data from anyone younger. If we learn that an account belongs to someone under 18, we will delete it.
• myPolar is offered in the countries listed in our Google Play and App Store listings.
• myPolar is not offered in the Russian Federation. We do not distribute the app there, do not market it there, and do not accept payments there. The app is available in Russian because many of our users in Israel and elsewhere speak Russian.

3. What myPolar is and is not

myPolar helps you notice patterns in your own sleep, activity, mood and medication. It shows statistical hypotheses about your own history, for example "your mood tends to drop after two short nights". These are correlations in your data. They are not a diagnosis, a prediction of an episode, or medical advice. See our Medical Disclaimer.

myPolar is not an emergency service. If you are in danger or thinking about harming yourself, contact your local emergency number now (for example 911 or 988 in the US; 101 or ERAN 1201 in Israel; 112 in the EU; 999 or Samaritans 116 123 in the UK).

We are not a "covered entity" under the US HIPAA law. Your doctor may be. When your doctor receives data from you through myPolar, their own legal and professional duties apply to it.

4. What data we collect

We collect only what the features you use need.

Camera. When you add a medication by scanning its package, the photo is processed on your device and never leaves it. If the package has a barcode, only its number is sent to our server to look the medication up. If not, the text recognised on the package is sent once to our server, where our own model (not a third-party AI service) picks out the medication name and dose; the text is not stored or logged. For packages from Israel, our server may look the name or barcode up in the public drug registry of the Israeli Ministry of Health; this request does not include anything that identifies you. Only the name and dose you confirm are saved.

Microphone. The app records only while you hold the record button. There is no background listening.

We do not collect your contacts, SMS, call logs, the content of other apps or precise GPS location. We do not store your IP address in our database.

5. How we use your data and on what legal basis

Your health data is a special category of personal data. We process it only with your explicit consent (GDPR Art. 9(2)(a); Israeli Privacy Protection Law), which you can withdraw in Settings → Privacy & data.

If you withdraw a consent, the feature that depends on it stops. Withdrawal does not affect processing that already happened.

None of the marketing consents is required to use myPolar.

6. Automated processing: hypotheses, tags and crisis signals

Some features work automatically. We want you to understand how.

Hypotheses. Our software compares your own data across days, for example whether short sleep tends to come before lower mood. It shows a hypothesis only when the pattern is statistically significant in your own history. It does not decide anything for you.

Tags. When you write or dictate a diary entry, our software suggests tags such as "trigger" or "medication". You can accept, change or delete them. Tags can be wrong.

Crisis signals. myPolar watches for two kinds of signals:

1. Several warning signs together over about 36–48 hours, for example much shorter sleep than usual, a sharp drop in activity, a worse resting heart rate or heart-rate variability, missed doses, or check-ins marked as very bad. One bad night is not enough.
2. Explicit words about self-harm or suicide in your diary text or voice transcripts. To detect them, our software checks your diary entries against a list of phrases reviewed by clinicians. No person at myPolar reads your diary to do this.

When a signal is detected, you see support resources first. If you turned on crisis alerts for a person in your circle, that person receives a short notification that a possible crisis signal was detected (at most once every two hours), and another one if the signal is then confirmed by you or by someone in your circle. The notification says only that there is a signal, its severity and its time. They never see your diary text, transcripts or what triggered the signal.

Crisis signals are not an emergency service. Nobody at myPolar watches your data in real time. A notification can be wrong, late or not delivered — for example if a phone is off or has no connection.

You can turn crisis alerts off for each person in your circle at any time. You can ask us to explain how a signal was produced and contest it; a person will review your request.

These features do not make decisions with legal effect about you.

7. Health Connect and Apple Health

If you connect Health Connect (Android) or Apple Health (iOS), we read only the data types you allow, only for the features below, and we do not write data back.

We do not request any other types. If a new feature needs another type, we will update this table and ask for the permission in the app.

With your permission we may read data from the past and in the background, so that your history is complete and crisis signals keep working when the app is closed.

Data from Health Connect and Apple Health is never used for advertising or marketing, never sold, never shared with data brokers, and never used to decide on credit, insurance or employment. We share it with other people only when you turn on sharing for them (§8). It is not copied to the research database and is not used to develop our algorithms beyond the features you use (§11). You can revoke these permissions at any time in your phone settings; the data we already received stays in your account until you delete it.

8. Who receives your data

People you choose. You can invite a doctor and a support person. For each person you choose which layers they see:

• a doctor can see your state and metrics, medication, and — only if you turn them on — your diary and sensitive categories;
• a support person can see your state and receive crisis alerts.

When you share with someone, they receive the data and become responsible for how they use it. You can change or stop sharing at any time. Stopping prevents future access; we cannot recall what the person has already seen, copied or written into their own records.

Service providers. We use companies that process data on our behalf, under contracts that forbid them from using it for anything else:

Marketing partners. Only for the purposes in §10 and only with your consent:

If we add another advertising platform, we will list it here and in the Cookie Policy before using it. These partners act as independent controllers for some of this data and use it under their own privacy policies. They never receive what you record in the app, data from Health Connect or Apple Health, your diagnosis, medication, check-ins, diary, crisis events or anything about your circle.

Notification content is kept minimal on purpose: a crisis notification says that there is a signal and when, not why.

We do not use outside AI companies. Voice transcription and text tagging run on our own servers.

Clinics, doctors, organizations and other partners. We work with partners who give people access to myPolar — through a partner code, a longer free period, or places in myPolar paid for by a clinic or organization. When you use such access:

• the partner learns that its code or place was used and whether the place is still active, and sees reports on how its places are used in aggregate;
• the partner does not see your check-ins, diary, health data, medication or crisis events. A doctor from that clinic sees your data only if you invite them into your circle and turn on layers for them (above);
• the screen where you activate the access tells you exactly what the partner sees.

Partners who are not your doctor or support person never receive your health data from us.

Nobody else. We do not share your health data with advertisers, data brokers, insurers, employers, pharmaceutical companies or outside researchers. The research database (§11) is used only by myPolar.

Legal requests. We disclose data only when the law requires it, we challenge requests that are overbroad, and we tell you unless we are legally prohibited from doing so.

If myPolar is sold, merged, transferred or closes. Your data will move only to a company that commits to this Privacy Policy (for example, a company set up to run myPolar in place of Anastasia Shapovalova), including the promises in this section and in §11. We will tell you in advance and give you time to export and delete your data. If we close the service, we will give you at least 60 days' notice and a way to export, and then delete your data.

We never sell your health data, we have never sold it, and we never use it for advertising.

9. Product analytics

To understand which parts of the app work and which do not, we collect limited usage events using PostHog, hosted in the EU. Analytics are off until you agree — we ask in the app.

What analytics can see: which screens and features are opened, from a fixed list (for example "home", "charts", "check-in started", "subscription screen"); the app version; the operating system version.

What analytics never see: anything you write or say; your states, scores or intensities; your medication; your health values; crisis events; whom you share with; your name or email; your IP address; your precise location or time zone.

How we keep it separate from your account: analytics use a random identifier created on your device, not your myPolar account ID. The time of each event is shifted by a random amount fixed for your device, so analytics cannot show exactly when you use the app.

You can turn analytics off in Settings → Privacy & data.

10. Marketing and advertising

We promote myPolar online. We do it in a way that keeps your health information out of it: advertising never uses what you record in the app, data from Health Connect or Apple Health, or the fact that you have a particular condition. The app itself contains no advertising or marketing trackers and does not use your phone's advertising ID.

On our website (mypolar.ai), if you accept analytics or marketing cookies in the cookie banner:

• Google Analytics shows us how visitors use the website — which pages are visited, for how long and where visitors came from;
• the Meta Pixel, Google Ads and similar tools tell us which ads bring people to the website and let us show our ads to people who visited it (remarketing).

We do not place these tools on pages where you sign in, activate a sponsored place or manage your account. You can change your choice at any time with the "Cookie settings" link at the bottom of every page. Details are in our Cookie Policy.

Emails. If you agree to receive news from us — in the app or on our website — we send emails about myPolar, its features and offers. These are emails from us only; we do not send emails on behalf of other companies. Every email has an unsubscribe link. Service emails about your account, security and changes to our documents are sent regardless.

Ads using an email you left on our website (custom audiences). When you leave your email on our website — for example to join the waiting list or get news — you can tick a separate box, not pre-selected, to let us show you myPolar ads on social networks. Only then do we upload that email in hashed (scrambled) form to Meta, Google or other advertising platforms, so that they can show you our ads and find people with similar interests. We send only the hashed email — never anything about your health, and never whether you use the app.

The email of your myPolar account is never uploaded to advertising platforms, and we do not combine the website list with what you do in the app.

You can withdraw this consent at any time with the link in our emails or by writing to privacy@mypolar.ai; we will remove you from future uploads and ask the platforms to delete the list.

Social media. When you interact with our pages, posts or ads on social networks, we see what you choose to make public — your profile name, picture, comments, messages and reactions — and we may answer you. Social networks also give us reports about how our ads perform. We do not search social networks to find out whether someone has a health condition, and we do not combine social-media information with your health data.

11. Research and improving our algorithms

It is your choice. We ask you separately, in the app, with a dedicated research consent. "Allow" and "Do not allow" are equally easy, nothing is pre-selected, and saying no changes nothing in the app or your subscription. Your doctor and support person cannot decide for you. You can change your answer at any time in Settings → Privacy & data.

What it is for. The research database is used only by myPolar, for two purposes:

1. Our own clinical research — to understand which combinations of medication, side effects, triggers and other factors come before changes in mood in people with unstable mood. Formal clinical studies start only after approval by an independent ethics committee, which will be named in the research consent.
2. Improving our own algorithms — for example, making hypotheses more accurate and crisis signals more reliable, with fewer false alarms.

What it is not for. We do not sell research data, license it, or give access to it to anyone outside myPolar — not to universities, hospitals, pharmaceutical or insurance companies, or other businesses. If we ever want to share research data with anyone outside myPolar, we will ask you for a new, separate consent first; your current consent does not cover it. Results may be published only as statistics about groups of people (at least 10 people per group), never about an individual.

How your data is protected. If you agree, a copy of some of your data passes through a one-way de-identification step into a separate research database, hosted in a separate environment, with no route back to the app. In that copy:

• your name, email, phone, device and push identifiers, the identities of people in your circle and any other direct identifiers are removed;
• your account ID is replaced with a research code. The key that produces the code stays in the production environment and is never stored with research data;
• dates are shifted by a fixed random number of weeks, and your date of birth is reduced to the year;
• diary text, voice recordings, transcripts, free-text notes, your doctor's notes and information about alcohol, drugs or gambling are never included.
• data from Health Connect and Apple Health — sleep, steps, heart rate, heart-rate variability, weight, cycle, workouts and mindfulness — and anything calculated from it are not included. We will not use wearable data for research until an independent ethics committee has approved it and you have agreed to it in a new consent.

What may be included: your state check-ins and their scores, medication names, doses and intake times, side effects, crisis-signal events that are not based on wearable data, year of birth, sex and a generalized region. The research consent lists the exact data.

Access to the research database is limited to myPolar staff and contractors who need it for these purposes, who are bound by confidentiality and are forbidden from trying to identify anyone. We treat the research copy as personal data protected by this policy, not as anonymous data.

Withdrawing. If you withdraw, no new data of yours is added from that moment, at the latest within 30 days. Data already added cannot be found and removed, because it is no longer linked to your account; it may still be used in analyses already under way. Deleting your account has the same effect and also destroys the link between your account and the research code.

12. How long we keep your data

If your subscription ends, your history stays available to you and crisis alerts keep working. Deleting the app from your phone does not delete your account; use Settings → Delete account. Deleting your account does not cancel a subscription bought through Google Play or the App Store; cancel it there.

13. Security

We encrypt data in transit and at rest. Your email address is encrypted separately with keys managed in a key-management service. Access to production data is limited to people who need it. Our logs do not contain your diary, health values, medication or email. You can protect the app with a PIN or biometrics.

No system is perfectly secure. If a security incident affects your data, we will tell you by email and in the app without undue delay, explain what happened, and notify the authorities when the law requires it.

14. International transfers

We are based in Israel. The European Commission recognizes Israel as providing adequate protection for personal data. Our main hosting is in the United States. When data moves from Israel, the EU or the UK to another country, we rely on adequacy decisions, the EU–US Data Privacy Framework, Standard Contractual Clauses or the conditions of the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, as applicable.

15. Your rights

Depending on where you live, you can:

• access your data and export it in a machine-readable format (in the app);
• correct it;
• delete it (in the app, Settings → Delete account);
• withdraw any consent at any time;
• object to or restrict processing;
• contest an automated result and ask for a person to look at it;
• complain to a supervisory authority — in Israel, the Privacy Protection Authority; in the EU, your national data protection authority; in the UK, the ICO.

Write to privacy@mypolar.ai. We reply within 30 days. We may ask you to confirm that the request comes from you. We will not treat you differently for using your rights.

US residents. We never sell health data. When you accept marketing cookies on our website or agree to ads by email, this may count as "sharing" personal information for cross-context behavioral advertising, or as "targeted advertising", under California and other state laws. You can opt out at any time with the "Do not sell or share my personal information" link at the bottom of our website, with the link in our emails, or by writing to us. We honor the Global Privacy Control (GPC) signal of your browser as an opt-out. If you live in Washington, Nevada or another state with a consumer health data law, see our Consumer Health Data Privacy Policy at mypolar.ai/consumer-health-data.

16. Changes to this policy

We keep every version of this policy. If we change it in a way that affects how your data is used, we will show you the new version in the app and ask for your agreement before you continue. Smaller wording changes are published with a new date.

17. Contact

Anastasia Shapovalova (myPolar), Tel Aviv, Israel
Privacy: privacy@mypolar.ai · General: hello@mypolar.ai · mypolar.ai