Meridian · Security
How Meridian protects your data
Meridian has no account, and we run no servers for it. Your reports are read on your iPhone and your records are never sent to us. This page explains what protects them, and where the limits are.
Reports are read on your iPhone
Meridian reads photos and PDFs with Apple’s on-device text recognition and, on iPhones that support it, Apple’s on-device Foundation Model. The model is used only to find each test’s name, value, unit and range; it does not interpret results. Nothing is sent to a server to read a report.
What is encrypted, and by whom
Report files you add (photos and PDFs)
Protected by Meridian
AES-256-GCM. The key is created on your iPhone and kept in its Keychain, usable only while the iPhone is unlocked.
Your readings, notes, family members and profile
Protected by iOS Data Protection
Encrypted by iOS with your passcode. They can’t be read while your iPhone is locked.
A backup file you export
Protected by Meridian
AES-256-GCM with a key made from the password you choose (PBKDF2-HMAC-SHA256, 600,000 rounds; at least 8 characters). We can’t recover this password.
A spreadsheet export
Not encrypted once shared
A zip of CSV files with your original scans. Treat it like any document that holds health information.
App Lock
You can turn on App Lock in Meridian’s Settings. It uses your iPhone’s passcode and Face ID, and a privacy cover hides Meridian’s screen in the app switcher and when you return to the app. Face ID is handled by iOS; Meridian never receives your face data.
Backups
Your iPhone backup
Meridian’s data is part of your iPhone’s iCloud or computer backup, so a restored or new iPhone has your records, unless you turn off Settings › Your Data › Include in iPhone Backup in Meridian.
iCloud encryption
iCloud backups are end-to-end encrypted only if you turn on Advanced Data Protection. Without it, Apple keeps the keys to your iCloud backup. Apple explains the difference.
A different iPhone
If you restore a computer backup to a different iPhone, your report files open only if that backup was encrypted.
A backup file you keep
You can also export a password-protected backup file and keep it wherever you like, then restore it on any iPhone with Meridian.
What connects to the internet
Meridian connects only to the App Store and RevenueCat, to check your subscription under an anonymous ID. Neither receives your health data. The app has no analytics, advertising or tracking code.
The limits
An unlocked iPhone
Anyone who can unlock your iPhone can open Meridian unless App Lock is on.
Files you share
A PDF summary or spreadsheet you share leaves Meridian’s protection; it is as safe as the place you send it.
A forgotten password
If you forget a backup file’s password, nobody can open that file, including us.
Reading mistakes
Automatic reading can misread or miss a value. Check each result against your original report before you save it.
Report a security problem
If you find a security problem in Meridian or this website, email support@bypurpledaisy.com with “Security” in the subject. We’ll reply as soon as we can and credit you if you’d like.