Privacy Policy

Your Records Stay Under Your Control

Your records are stored on your iPhone, encrypted. The App does not send them to the Provider, and the Provider cannot access them through the App. The App has no account system and no Provider-operated server or cloud service for your records.

The App has no advertising network, analytics SDK, or third-party crash-reporting SDK.

Information Processed on Your iPhone

The App stores information that you choose to enter or add, which may include:

• The date your HSA was opened, the account holder's birth date, and a Medicare start date
• Who your health plan covers (self-only or family coverage), by month
• Receipts for medical expenses: the provider, the patient's name, what it was for, the date of service and the date paid, the amounts, how it was paid, and your confirmation that the receipt is itemized and the expense qualifies
• Reimbursements (money you take out of your HSA to cover a qualified medical expense you paid for yourself): dates, amounts, the receipts each one covers, and notes such as confirmation numbers
• Contributions: dates, amounts, source, tax year, and notes
• Photos, scans, PDFs, and other files you select, and the text the App reads from them
• Settings you choose, such as the yearly return for the Shoebox growth illustration

The App uses this information on the iPhone to provide the recordkeeping, totals, tax summary, backup, and sharing functions you select.

Reading Receipts on Your iPhone

When you scan a receipt or add a photo or file of one, the App reads its text using Apple's on-device text recognition to suggest the provider, dates, and amounts for you to check. The reading happens on the iPhone. The App does not send receipts or their text to the Provider or to any text-recognition or AI service.

Information the Provider Does Not Receive Through the App

The Provider does not receive or maintain a copy through the App of:

• Receipts, reimbursements, contributions, or any other record entered in the App
• Photos, scans, PDFs, or other documents stored in the App
• Backup recovery codes or the readable contents of encrypted backups
• Tax summaries you create
• Location or advertising identifiers
• App activity for advertising or behavioral analytics

The App does not sell personal information, track users across apps or websites, or use information for advertising.

Subscription and Purchases

Subscriptions are sold and billed by Apple. Apple processes your payment and account information under Apple's privacy policy. The App checks whether a subscription is active by asking Apple's StoreKit on your iPhone. It does not send your records to Apple or to the Provider to do this. Apple provides the Provider with sales and subscription reports, which do not include your records.

Support Communications

If you choose to email hsa-support@synodospath.com, the Provider receives the information and attachments you include through Google Workspace so that it can respond to your request. A support email is separate from the App's records. The "Contact support" option in the App does not attach any records.

You decide what to include. Please don't send receipts or other medical documents unless they're needed to answer your question. Contact support to request deletion of a support communication. The Provider will explain if it cannot complete a request because it must retain information to meet an applicable legal obligation.

Photos, Files, and Camera

The App accesses a photo or file only after you select it through Apple's system picker. A selected item is copied into the App's encrypted storage. The original item remains wherever you previously stored it unless you delete it there separately.

Camera access is requested only when you choose to scan a paper receipt. You can decline camera access and continue adding receipts from photos or files. You can change this permission in iOS Settings.

The App does not send notifications.

Encryption and Apple Device Backups

The App encrypts your records before storing them. The key that unlocks them is kept in your iPhone's Keychain for this device only. It is never copied to iCloud or into an iPhone backup.

The App does not operate its own cloud backup or synchronization service. If you use iCloud Backup or a computer backup, iOS may include the App's encrypted files, but not the key. Restoring such a backup to a new iPhone therefore does not, by itself, bring your records back. Use an HSA Assistant backup and its recovery code instead. Apple device backups are provided by Apple and governed by Apple's terms and privacy practices.

HSA Assistant Backups, Tax Summaries, and Sharing

You may create an HSA Assistant backup file. The App encrypts the backup and shows a recovery code once. You need both the file and the code to restore it. The destination you choose for the file, such as iCloud Drive, another storage provider, email, or Files, may retain the encrypted file under its own terms and privacy practices.

The Provider cannot access a backup or its recovery code through the App and cannot recover a lost recovery code. Anyone who obtains both the backup file and its recovery code may be able to restore its contents. Keep the code separate from the file.

When you create a tax summary PDF or share a record, iOS sends a copy to the application, person, printer, or storage location you select. That destination may process or retain the information under its own privacy practices. Review the document and destination before sharing.

Links

The App links to this Privacy Policy, its Terms of Use, Apple's license agreement, and Apple's subscription settings. Opening a link leaves the App and connects your device to that website. The App does not attach or transmit your records to the website.

App Store and Diagnostic Information

Apple collects information needed to operate the App Store under Apple's privacy policy. Apple may also provide the Provider with aggregated App Store information and, depending on Apple's processes and your settings, crash or diagnostic information. TestFlight may provide diagnostic information for beta builds. This information does not give the Provider access to the records stored in the App.

Retention and Deletion

Your information remains in the App until you:

• Edit or remove a record in the App
• Restore a backup, which replaces what is in the App
• Choose "Delete all app data" in Settings, which removes all records and returns the App to its first-run setup
• Delete (not merely offload) the App from the iPhone

Some records can't be removed once you've confirmed them, so that your totals stay accurate. They can be corrected instead. Copies outside the App, such as an original photo, a backup file, a shared tax summary, or an Apple device backup, remain until you delete them separately.

There is no Provider account and no server-side copy of your records for the Provider to access, return, correct, or erase.

Security

Records and documents are encrypted on the iPhone, and backups are encrypted before they leave the App. No storage method can eliminate all risk. Security also depends on your passcode, keeping iOS updated, physical control of the iPhone, and keeping your backup recovery code safe.

Children's Privacy

The App is intended for adults managing a health savings account. It is not directed to children, and it has no account system. Records may include the names of family members who received care. The Provider does not receive this information through the App.

United States Use

The App is designed around United States health savings account rules. If it is used elsewhere, the same on-device data handling applies, but the App's tax information may not apply.

Changes to This Policy

This Privacy Policy will be updated before any material change to how the App handles information, for example adding syncing between devices, an account, or a third-party service. The effective date will be updated, and a material change will be presented through an App update or another reasonable notice before the changed practice is introduced.

Contact

Questions about this Privacy Policy, or a request to delete a support communication: hsa-support@synodospath.com

Website Privacy

This section applies to the HSA Assistant website, hsaassistant.synodospath.com. It is separate from the App’s practices described above.

The website has no account registration, contact form, payment function, or upload feature. Synodos Path does not use visitor analytics, advertising trackers, tracking cookies, session recording, fingerprinting, or behavioral profiling on this site.

Hosting and network providers may process limited technical request data—such as an IP address, browser or device information, requested page, request time, and security or error logs—to deliver, protect, and troubleshoot the website. Synodos Path does not use that operational data for advertising or behavioral profiling.

Visiting this website does not give the Provider access to records stored in the App. If you choose to email us, your message and address are handled separately from App records and are used to respond to you. Please don’t email receipts or other medical documents unless they’re needed to answer your question.