MetricBridge For platforms

Platform licence terms

Version 0.1 · 19 October 2026 · These are the standard terms for the Pilot, Certified Partner and Partner Plus packages on /platforms/. Any change is dated and versioned here.

1. What this is

1. The architecture, as a fact of the agreement. MetricBridge reads Apple Health on the user's own iPhone. The user, and only the user, switches on an export to an endpoint the platform gave them, and can switch it off. The phone POSTs directly to that endpoint under the public contract at /docs/webhook/. MetricBridge operates no server in that path, receives no copy of any payload, and cannot see that a transfer happened.
2. What is licensed. The right to describe your product as integrating with MetricBridge, to use the "Works with MetricBridge" mark under section 6 when you hold a Certified Partner or Partner Plus package, to be listed on our platform page, and to receive the support, notice and review services of your package. The contract, schemas, examples, reference receiver and platform kit are separately open and free under the licence on each file, with or without this agreement.
3. What is not licensed. No data. No access to users. No exclusivity. No right to resell or sublicense. No endorsement of your product by MetricBridge beyond the literal statement that it passed the conformance suite on the date of the report.

2. Fees

1. Fees are the flat amounts on /platforms/, in US dollars, exclusive of VAT or other taxes that apply, payable in advance. The Pilot fee is credited in full against the first year of a Certified Partner or Partner Plus package taken within 30 days of the pilot ending.
2. Fees are never for data. No fee, credit, discount or other consideration under this agreement is calculated from, or conditional on, the volume of data, the categories of data, the number of users who send data, or the content of any payload. MetricBridge receives no payload and no per-record consideration. This clause exists so that nothing here is, or could be read as, a sale or sharing of consumer health data by MetricBridge.
3. App Store offer codes included in a package are co-marketing. They are issued by MetricBridge through Apple, in the quantity stated for the package, for your users to redeem on the App Store. They are not sold per code and may not be resold.

3. Who is responsible for the data

1. You are. For any data a user sends your endpoint through MetricBridge, you are the sole controller under the UK and EU GDPR, the regulated entity under the Washington My Health My Data Act and similar state laws, and the vendor of personal health records under the US FTC Health Breach Notification Rule where those apply. MetricBridge is none of: processor, sub-processor, joint controller, service provider, business associate, data source, or seller.
2. You represent that your product is a health, fitness or wellness service to the user (Apple's condition for a user sharing HealthKit-derived data with a third party), and that you are not a HIPAA covered entity or business associate in respect of this data.
3. Your consents and notices. You obtain the user's explicit consent where the law requires it (UK and EU GDPR Article 9(2)(a); Washington's separate collection and sharing consents), you name "Apple Health data you choose to send us through MetricBridge" in your privacy notice, you give users a way to withdraw and to have their data deleted, and you never condition your service on a user sending data.
4. Purpose limitation. General wellness use within your service only. No advertising or marketing use, no data mining for those purposes, no profiling for advertising, no sale, no onward disclosure beyond what your service needs, no training of models on the data without a separate explicit consent, and no transfer to data brokers, advertising platforms or information resellers. These mirror Apple's HealthKit conditions and bind you whether or not Apple reviews your product.
5. Security. TLS 1.2 or later; verification of the MetricBridge signature and token on every request; encryption at rest; access control; a retention limit you publish; deletion on request and on termination; the same obligations flowed down to anyone who processes the data for you.
6. Incidents. You notify MetricBridge within 72 hours of becoming aware of a breach involving data received through the integration, you make every regulatory and user notice yourself, and you make no public statement naming MetricBridge without giving us a chance to review it. MetricBridge may suspend your listing and mark use while an incident is open.
7. No change puts us in the path. Any proposed change that would route data through, or give MetricBridge access to, user data needs a written reassessment of roles first and is otherwise outside this agreement.

4. Excluded uses

The integration may not be used, offered or described for:

• diagnosis, treatment, disease management, triage, clinical monitoring, clinical decision support, or anything else a medical device does;
• any use where someone other than the user is the real customer for the user's data: employers, insurers, lenders, schools, teams or coaches by default, family members, investigators, or decisions about a person's employment, insurance, credit, legal status or discipline;
• users under 18;
• research without each participant's own consent and the study's own ethics approval;
• advertising, marketing, data mining, profiling for advertising, sale, brokerage, or onward transfer to any recipient that is not part of delivering your service to the user;
• any recipient that is not a health, fitness or wellness service to the user.

5. Claims and positioning

1. MetricBridge is a general wellness tool and not a medical device. You will not describe MetricBridge, the integration or the data as "medical", "clinical-grade", "validated", "HIPAA-compliant", "certified" or "approved" by anyone, and your onboarding, marketing and in-product copy for the integration will match the wellness positioning on /platforms/.
2. You may say, truthfully, that your product receives Apple Health data its users choose to send through MetricBridge, and that it passed the MetricBridge conformance suite on the date of its report.

6. The marks

1. "MetricBridge" and "Works with MetricBridge" are used only with a Certified Partner or Partner Plus package in force, in the form we supply, with the "paid partner" disclosure we specify on any directory or listing, and never in a way that implies endorsement, agency, exclusivity or that MetricBridge made or operates your product.
2. Use is conditional on passing the conformance suite and re-passing it after any change on your side that touches the integration.
3. Either side may end mark use on 30 days' written notice. MetricBridge may end it immediately for misuse, an open incident, or a breach of sections 3 to 5, in which case you remove the mark within 14 days.
4. Each side keeps its own marks, names, code and know-how. You own your data and your product. Feedback you give about MetricBridge may be used without obligation.

7. Support, and what you must never send us

1. Support is given with synthetic data only, by email from the person who writes the code, at the response times of your package, on UK business days. You will never send real payloads, logs, screenshots or files containing a user's health values to MetricBridge; anything that arrives is deleted unread and the support request is answered against the published examples instead.
2. Contract changes are additive. A breaking change ships only under a new schema version, with at least 90 days' notice to Certified Partners and Partner Plus partners, and migration help within the package.

8. Liability, warranty, term

1. The integration, the kit and the documentation are provided as they are. MetricBridge gives no warranty about your regulatory status, your compliance, or the fitness of the integration for any particular product.
2. You indemnify MetricBridge against claims arising from your receipt, use, security or notices relating to data received through the integration. MetricBridge's total liability under this agreement is capped at the fees you paid in the 12 months before the claim, and neither side is liable for indirect or consequential loss.
3. Packages run for the stated term (60 days for the Pilot, one year otherwise) and do not renew automatically. Either side may end a pilot for convenience on 14 days' notice; a package ends immediately on a breach of sections 3 to 5 that is not cured within 14 days of notice, or on insolvency.
4. Governing law and courts: England and Wales.
5. Records: you keep records of consents and deletions for data received through the integration; MetricBridge keeps the signed agreement, your conformance report and your listing text.

9. Contact

Questions about these terms, before or after signing: [email protected]. Our own working notes on the law behind sections 3 and 4, written for the founder and not as advice to you, are open in the product's privacy and security pages.