保健櫃 HEALTHSHELF

保健櫃（HealthShelf）隱私政策

最後更新：2026 年 9 月 17 日

保健櫃不收集你的任何資料。這個 App（iOS 與 Android 都一樣）沒有伺服器、沒有帳號、沒有雲端。你輸入的所有東西都只存在你自己的手機上，不會被上傳到任何地方。

保健櫃唯一的網路連線是下載公開資料：食藥署的藥品許可證資料集、衛福部中醫藥司的中藥基準方與中藥許可證、衛福部的中西藥交互作用資料庫，以及 App 自己的對照表（營養素上限、藥物類別、搭配規則）更新。這些檔放在一個固定的公開網址，App 整份拿回手機再比對；請求不帶任何參數、沒有 cookie、沒有帳號，對方只看得到「有一支手機來拿過這些檔」。不會把你的藥名、成分、紀錄或照片送出去，連當作查詢條件都不會。設定裡可以把這個連線關掉，關掉後 App 完全不連網，用內建的那一份資料照常運作。這條承諾改變時，這份政策會先更新。

資料存在哪裡

保健品與藥品資料、服用紀錄、身體反應、照片、花費、健檢報告的數值，全部存在你手機上 App 自己的儲存空間裡（iOS 的沙箱或 Android 的 App 專屬儲存）。健檢報告只存你確認過的項目、數值與參考區間，不存照片或原文。開發者看不到，也沒有任何管道可以看到。

App 用到的權限

iOS 與 Android 版都遵守同一條原則：辨識與運算都在你的手機上進行，圖片與文字不會被送出去。以下依平台列出各自用到的權限。

iOS

  • 相機：掃描藥袋、包裝或健檢報告上的文字。辨識用 iPhone 內建的 Vision 框架，完全在裝置上進行，照片與文字都不會離開手機。
  • 照片：讓你從相簿選一張藥單或產品照片。同樣只在本機處理。
  • 健康 App：如果你打開這個功能，保健櫃會把你打勾吃下的維生素與礦物質寫進「健康 → 營養」。只寫出，從不讀取你的健康資料。可以隨時在「設定 → 健康」關掉。
  • 通知：服藥提醒是 iPhone 的本機通知，不經過任何伺服器。

Android

  • 相機：掃描藥袋、包裝或健檢報告上的文字。辨識用 Google ML Kit 文字辨識，模型包在 App 裡、在裝置上執行，照片與文字都不會離開手機。
  • 相簿：透過系統相簿選擇器選一張照片，不需要另外要相簿權限，同樣只在本機處理。
  • 照片去背：新增產品照片時，App 用 Google Play 服務的 ML Kit 主體分割功能幫照片去背。這個模型不包在 App 裡，第一次使用時由你手機上的 Google Play 服務下載；去背運算仍在你的手機上進行，照片本身不會離開手機。
  • 通知、精確鬧鐘、開機完成：服藥提醒用 Android 系統的鬧鐘在本機排程。這三個權限只用來讓提醒能準時響、手機重開機後重新排好，不涉及任何資料傳輸。

Health Connect（Android 版對應 iOS 健康 App 的整合）目前還沒做；之後加入時一樣只會寫出、不讀取，且會先更新這份政策。

備份

你可以自己匯出一份備份檔。備份是你主動按下去才產生的，會用你設定的密碼加密（PBKDF2-SHA256 + AES-256-GCM）。iOS 用 Apple 系統框架、Android 用 Java 標準函式庫（javax.crypto）實作，演算法與參數相同，兩邊的備份檔可以互相還原。密碼不會存在任何地方，開發者也無法解開。檔案要放哪裡（iCloud 雲碟、下載資料夾、其他）由你決定，保健櫃不會自動上傳到任何地方。

App 沒有的東西

  • 沒有分析、統計或使用行為追蹤
  • 沒有廣告，沒有廣告識別碼
  • 沒有第三方 SDK（Android 版用到的 Google ML Kit／Play 服務屬於作業系統層級的官方元件，不是第三方 SDK；ML Kit 內建想回報使用統計給 Google 的功能已在 App 裡拿掉）
  • 不會把資料賣給、或分享給任何人

這個網站（healthshelf.app）

上面那些講的是 App。你現在看的這個網站是另一件事，所以分開講清楚。

這個網站會記錄看了哪一頁，以及有沒有人點下載按鈕。用的是 Aptabase：不寫 cookie、不寫 localStorage，請求不帶身分。送出去的是頁面路徑（例如 /privacy/）與來源網站，不含完整網址。

網站沒有表單、沒有帳號、不收 email，也不會把你在這裡看了什麼跟 App 裡的任何東西連在一起——技術上也做不到，因為 App 什麼都不送出來。

兒童

保健櫃不收集資料，因此也不會收集兒童的資料。

政策變更

如果未來有變更，會更新這一頁的日期。若哪天真的加入了會傳送資料的功能，會在 App 內明白告知並徵求同意。

聯絡

有任何疑問請寄信到 [email protected]，或到 Threads 找官方小編：@healthshelf.tw。

HealthShelf — Privacy Policy

Last updated: 17 September 2026

HealthShelf collects no data. The app (iOS and Android alike) has no server, no account, and no cloud component. Everything you enter stays on your own phone and is never uploaded.

HealthShelf's only network activity is downloading public data: the Taiwan FDA drug licence dataset, the Ministry of Health and Welfare's Traditional Chinese Medicine formularies and licences, its herb–drug interaction database, and updates to the app's own reference tables (nutrient limits, drug classes, pairing rules). These files live at a fixed public URL; the app fetches them whole and matches on your phone. Requests carry no parameters, no cookies and no account, so the host only sees that a phone fetched the files. Your medication names, ingredients, logs and photos are never sent out, not even as a search query. You can switch this connection off in Settings; the app then works entirely offline from its bundled copy. This policy will be updated before that promise ever changes.

Where your data lives

Your supplements and medications, intake logs, body reactions, photos, spending records and lab-report values are stored only in the app's own storage on your phone (the iOS sandbox, or Android's app-private storage). For lab reports the app keeps only the items, values and reference ranges you confirmed — never the photo or the raw text. The developer cannot see any of it, and has no mechanism to.

Permissions

Both the iOS and Android apps follow the same rule: recognition and processing all happen on your phone; images and text are never sent anywhere. Permissions differ by platform:

iOS

  • Camera — to scan text on medication bags, product packaging and lab reports. Recognition uses Apple's on-device Vision framework; neither the images nor the text ever leave your phone.
  • Photos — to let you pick an existing photo to scan or use as a product image. Processed entirely on device.
  • Health — if you enable it, HealthShelf writes the vitamins and minerals you check off into Health → Nutrition. It only writes and never reads your health data. You can turn this off at any time in Settings → Health.
  • Notifications — medication reminders are local iOS notifications. No server is involved.

Android

  • Camera — to scan text on medication bags, packaging and lab reports. Recognition uses Google ML Kit Text Recognition; the model is bundled with the app and runs on device, so images and text never leave your phone.
  • Photos — picked through the system photo picker, which needs no separate photo-library permission. Processed entirely on device.
  • Background removal — when you add a product photo, the app uses ML Kit Subject Segmentation via Google Play services to remove the background. This model is not bundled with the app and is downloaded by Google Play services on first use; the processing still happens on your phone, and the photo itself is never sent anywhere.
  • Notifications, exact alarms, boot completed — medication reminders are scheduled locally using Android's alarm system. These three permissions only make reminders fire on time and get rescheduled after a restart; none of them involve sending data anywhere.

Health Connect (the Android counterpart to iOS Health integration) is not implemented yet. When it is added, it will only ever write data, never read it, and this policy will be updated first.

Backups

You can export a backup file yourself. Backups are created only when you choose to, and are encrypted with a password you set (PBKDF2-SHA256 + AES-256-GCM). iOS uses Apple's system frameworks and Android uses Java's standard crypto library (javax.crypto) with the same algorithm and parameters, so backup files are interchangeable between the two apps. The password is never stored anywhere and the developer cannot decrypt your backup. Where the file goes (iCloud Drive, Downloads, elsewhere) is entirely your choice; HealthShelf never uploads it anywhere.

What the app does not do

  • No analytics or usage tracking
  • No advertising and no advertising identifiers
  • No third-party SDKs (on Android, Google ML Kit / Play services are OS-level official components, not a third-party SDK; ML Kit's built-in usage-reporting component has been removed from the app)
  • Your data is never sold or shared with anyone

This website (healthshelf.app)

Everything above describes the app. This website is a separate matter, so it is stated separately.

This site records which page was viewed and whether the download button was clicked, using Aptabase: no cookies, no localStorage, no identifying request data. What is sent is the page path (for example /privacy/) and the referring site — never the full URL.

The site has no forms, no accounts and collects no email addresses, and cannot link what you read here to anything in the app — technically it could not, because the app sends nothing out.

Children

HealthShelf collects no data, and therefore collects no data from children.

Changes

Any changes will be reflected in the date at the top of this page. If a feature that transmits data is ever added, it will be disclosed in the app and require your consent.

Contact

Questions: [email protected], or message us on Threads: @healthshelf.tw.