Privacy Policy
Effective: 25 August 2026
Jibawi Health AI is a private, self-hosted application that retrieves and analyzes health and wellness information authorized by its user through Oura.
Data processed
Depending on the permissions granted, the application may process Oura profile, sleep, readiness, activity, heart-rate, workout, blood-oxygen, stress, resilience, session, tag, ring-configuration, battery and heart-health data. Jibawi Identity also provides the minimum account claims required to authenticate and authorize the approved user.
Purpose and storage
Data is used only to provide the private dashboard, synchronization status, trends, optional AI-generated wellness insights and authorized ChatGPT MCP tools. Health records are stored in the application database. Oura OAuth credentials and retained identity-provider tokens are encrypted at rest. Connector audit metadata records the client, authorized subject, tool name, outcome and bounded non-health error category; it is retained for up to 180 days for security review. Data is not sold or used for advertising.
External services
Data is obtained from Oura. Authentication is provided by the configured Keycloak identity service. When optional AI analysis is enabled, the minimum necessary wellness records are sent to the configured OpenAI service to answer the request or produce an insight. Those optional AI requests also include a stable one-way pseudonymous safety identifier for abuse monitoring and request linkage; the raw Keycloak subject is not sent to OpenAI. When the private ChatGPT connector is authorized, only data permitted by the granted MCP scopes is returned to ChatGPT. Hosting providers process operational data as required to run the service.
Retention and control
Stored health records remain in the active database until deleted by the authorized user or system administrator. The dashboard deletion control first disconnects Oura, then removes health records, sync history, AI insights and chat history from the active database. Future synchronization remains disabled until Oura is explicitly connected again. It does not erase the separate security audit log, which expires automatically after 180 days. Encrypted recovery backups are separate: deletion does not rewrite existing backups, which expire under the administrator’s documented backup-retention policy. A durable deletion marker must accompany any restore so pre-deletion records are not silently restored.
When reconnecting or disconnecting, the application attempts to revoke the current Oura grant and always removes its local token. If Oura cannot confirm revocation, access must also be removed through the Oura account’s connected-app settings. ChatGPT connector access can be withdrawn by disconnecting the app or revoking its OAuth grant.
Security and limitations
The application uses HTTPS, Keycloak-backed access control, resource- and scope-restricted MCP tokens, encrypted OAuth tokens, restricted cookies and request validation. Passwords are entered only at the identity provider and are not handled by Jibawi Health. No system is risk-free.
This application is a wellness tool and not a medical device. It does not provide diagnosis, treatment or emergency monitoring.
Contact
For privacy requests, use the private administrator support channel configured for this deployment.