Overview
Grio is an AI coach, which means some of your data reaches model providers. The question worth answering precisely is which data, when, and what stops it.
Two design choices do most of the work: raw sensor samples never leave your device, and the permission check for third-party AI sharing lives at the network boundary rather than in each feature that happens to remember it.
How it’s calculated
The egress gate
Grio requires a current Third-Party AI Data Sharing Permission before any account-owned personal data reaches an external AI provider. That permission is rechecked at the provider transport boundary (the moment before the network request), where a missing scope, missing state, an outdated disclosure, or a verification error all stop the request.
Putting the gate there rather than on individual screens is what makes it cover everything: foreground and background work, embeddings, images, and transcription alike, instead of relying on each use case to remember a consent check.
There is one narrow exception. The pre-account coach greeting, before you have an account, may be authorized by the current disclosure for that single request. Creating an account records a separate account-level permission for everything after.
Revocation writes a server-owned tombstone that wins over stale grants and blocks provider requests authorized after the revoke commits. It cannot recall an already-sent request, and it is not itself a deletion. Deletion is a separate action with its own policy.
What leaves your device
| Data | Leaves the device? |
|---|---|
| Raw HealthKit samples | Never |
| Daily health projections | Yes, privacy-reduced |
| Five-minute physiological buckets | Yes (aggregates only, with a bounded retention window) |
| Detail slices for a chart | Never persisted, never uploaded, cleared on account exit |
| Workout heart-rate zone breakdown | Computed on-device; a duration summary only |
| Your messages, meals, and records | Yes, as part of the coaching service |
The five-minute buckets are the narrowest exception to the daily-only rule, and their contents are enumerated rather than open-ended: aggregate heart rate, aggregate HRV, sample counts, steps, exercise minutes, workout overlap, time bounds, timezone, source, and observation time. Nothing else. They exist to evaluate recent physiological load and stress, and they expire.
Deletion and disconnection
Account deletion and provider disconnection are related but distinct operations. Successful provider disconnection is checkpointed before photo and database deletion, so a retry does not repeat a revocation that already succeeded. If Apple or Google disconnection cannot complete, the first deletion request returns a typed confirmation requirement without deleting anything; a second, explicit manual-cleanup confirmation then deletes the Grio account and records that follow-up is required.
This keeps an outage at an identity provider from permanently blocking your right to delete, without silently pretending the cleanup succeeded.
Edge cases and fallbacks
- Verification error at the boundary: the request stops. Failing closed is the intended behaviour.
- An outdated disclosure: treated as missing permission until you see the current one.
- Cancelling Apple reauthentication: no deletion request is sent at all.
How to read your score
There is no score here, but there is a claim worth reading carefully. Grio does not say your data never leaves your device; it says which data does, and what gate stands in front of it. Any health app with a language model behind it that claims otherwise is either not using one or not describing it accurately.
What to do with it
- Read the disclosure once, properly: it is the thing the gate actually checks, and an outdated one stops requests.
- Revoke sharing if you want the coach off your data: understand that it blocks future requests rather than retracting past ones.
- Delete rather than abandon, if you are leaving. Deletion is a real, separate action with a defined path even when a sign-in provider is unreachable.
- Check the origin on any record you did not expect: Grio shows whether a fact came from Apple Health, from a device, or from you.
Troubleshooting & FAQs
- If I revoke AI sharing, does that delete data providers already have?
- No, and Grio says so plainly. Revocation writes a server-owned tombstone that wins over stale grants and blocks any provider request authorized after it commits. It cannot recall a request that was already sent, and it does not by itself delete Grio records or provider-held copies. Deletion is a separate action.
- Do my raw Apple Watch samples go to a server?
- No. Raw HealthKit samples never leave your device. What is uploaded are privacy-reduced projections: daily aggregates and, for the stress and physiological-load features, five-minute buckets carrying only aggregate heart rate and HRV, sample counts, steps, exercise minutes, workout overlap, time bounds, timezone, source, and observation time.
- Can I delete my account if Apple or Google sign-in is unavailable?
- Yes. If provider disconnection cannot complete, the first request returns a confirmation requirement rather than deleting anything. A second, explicit manual-cleanup confirmation deletes the Grio account and records that follow-up is still required. Provider availability never permanently blocks your deletion right.