Side Project: Building the Health Tracker I Actually Wanted

Introduction

If you don't know me that well, you may not know that I have c-PTSD. To be honest, on some days that means I couldn't tell you whether I'd taken my meds that morning. So I went looking for an app to help.

I tried a lot of them, and none of them felt made for me. They were clinical, or they pushed weight loss, or they showed me things I couldn't turn off (a big red arrow because my steps dipped is not nearly as motivating as some people think it is).

So I built the one I wanted. I've been working on it relentlessly for nearly 8 (!) years trying to get it just right. It's called Healthsome, and as of this week it's live on the App Store!

I'm the founder, the designer and (so far) the only engineer, so this post covers a bit of everything: what it does, what it's built with, and a few of the decisions I'm most proud of.

Disclaimer: I do not claim to be a cryptographer. The encryption section below describes what I built and why, using well-established libraries, but it is definitely not a guide to rolling your own crypto (please don't!).

What It Does

Healthsome is a health tracker for people juggling a lot at once: medications, symptoms, mood, sleep, cycles, workouts, water, food and habits. There are fourteen tracker types and twenty-one ready-made templates, or you can build your own exactly the way you like it.

It's built on one rule: your health data is yours. A few other things that make it different from the apps I tried:

• It doesn't grade you. There's no red for a missed dose and no traffic-light colors on completion rates. A missed dose or a slower week is information, not a failure, so it's shown plainly, like any other week.
• You decide what shows up. Any tracker or tag can be hidden from your timeline (or from everywhere) without being deleted.
• The journal lives on the same timeline as your numbers, so the story and the data stay together.
• Workouts are built in, both strength (sets, reps, RPE and an estimated 1RM) and GPS cardio with live distance and pace on your Lock Screen.

Tech Stack

It's a TypeScript monorepo managed with Nx.

The shared package was honestly one of the best early decisions I made. Anything both the app and the web need lives there, so the two can't quietly disagree about how a streak is counted or what an insight says.

Releases go through three channels: alpha, beta and production. JavaScript-only changes ship as EAS updates, and promoting an update to the next channel republishes the exact bundle that was already tested, rather than building a fresh one from whatever the branch looks like by then.

Encryption

This was the part I cared about most, and definitely the part I was most nervous about getting wrong.

The rule I set early on was to never invent my own crypto. Everything uses AES-256-GCM through expo-crypto, which works across iOS, Android and the web.

Here's how the keys fit together:

1. Each account gets one random 256-bit data key. It encrypts the values you log: entry values and details, journal text and tags, medication names and doses, and reminder text.
2. The data key is kept in the device's secure storage. It never goes to the server unwrapped.
3. During setup you get a 12-word recovery phrase. A key derived from that phrase (with PBKDF2) wraps the data key, and only the wrapped copy is stored on the server. If you get a new phone, you type in the phrase and you're back.
4. Adding a second device works by pairing. Each device has its own X25519 keypair, and the data key is sealed to it.

All of the app's reads and writes already went through one shared context, so encryption lives at that boundary. Charts, insights and the timeline keep working with plain values on your phone, and no individual screen had to learn anything about encryption. The end result is that I couldn't read what you log even if I wanted to (which I don't!).

Note: it would be really easy to put "the server only holds encrypted data" on a landing page, and it would not be quite true. To sort and filter, the server still needs things like timestamps, IDs, tracker types and Apple Health metric names. The weather feature also sends your location to Open-Meteo. So the copy says "the values you log" are encrypted rather than "all of your data," and the in-app privacy screen spells out exactly what isn't. Every privacy claim in the app was written against a code audit, with a comment next to it explaining what it's allowed to say. I would much rather undersell this than mislead anyone about their health data.

Insights: Statistics, Not AI

I get asked about this a lot! Insights looks for real relationships between the things you track, like whether you sleep better on days you walk more.

I did actually try an on-device AI model for this first. The catch is that it kept hallucinating, describing numbers and patterns that simply weren't in the data. Not great when the data is someone's health! Plain statistics can't make things up, and every result can show its work. So Insights runs on your phone, and no health data is ever sent off to an AI model, because there isn't one.

Under the hood it's a Pearson correlation over the days two trackers have in common, and it's deliberately strict about when it speaks up. A link is only mentioned when:

• the correlation is at least moderate (|r| of 0.4 or more),
• it's unlikely to be chance (p < 0.05),
• there are at least 8 shared days behind it,
• and it survives a correction for testing lots of pairs at once, so it doesn't cry wolf.

That said, nobody wants to read a correlation coefficient before coffee. So every insight leads with a sentence in plain language, shows both trackers on one chart (each line scaled to its own range), and tucks the numbers into a small footnote for anyone who wants them. Anything that doesn't clear the bar shows up as "no clear link." It's also never phrased as advice: Healthsome is a tracking and journaling tool, not a medical device, and it will never tell you to change a treatment.

And it works, too! It's found real things in my own data. My mood goes up with the amount of reading I log, and I walk more on weekends but take more flights of stairs on weekdays. That checks out, since I live in a loft and work from home (on a workday, the stairs are basically my commute).

Design and Accessibility

The whole app sits on a soft, blurry color field, with content floating above it on glass. That gave me two jobs: make the glass feel good, and make sure nothing on top of it gets hard to read.

Glass that works everywhere. Apple's Liquid Glass looks great on iOS 26, but below iOS 26 the native glass view doesn't fail loudly. It just quietly renders a flat, tinted rectangle with no blur at all, so every card turned into a muddy, low-contrast block for anyone on an older phone. I built a drop-in GlassSurface component that checks once whether Liquid Glass is available and falls back to a real blur when it isn't. Every screen uses it, so every screen got the fix at once.

Top: Liquid Glass on iOS 26. Bottom: the blur fallback on iOS 18, instead of a flat tinted block.

Chart colors that pass contrast. Each section of the app has a pale accent color, which is lovely as a tint and terrible as a chart line. The Insights purple drawn as a two-pixel line came out at 1.9:1 against its card, well under the 3:1 minimum for graphical objects. So charts get their own ink: the same hues, stepped darker or lighter for each mode until they clear that bar.

The small stuff. Contrast is checked in both light and dark mode, icon-only controls have screen reader labels (around 200 of them!), and I use Reduce Motion myself, so with it on, the breathing pulse becomes a gentle color cross-fade instead of disappearing completely. Grounding and journal prompts stay in the present, and there's a test that checks for it (my test automation roots are showing). None of this is glamorous, but it's the difference between an app that looks accessible and one that is.

Business Model

Healthsome is $6.99/month with a 7-day free trial. There are no ads, no advertising or analytics SDKs, and nothing is sold to anyone. It's paid for by the people who use it, and that's the whole business model.

The encryption means I can't read your data, and the subscription means I'm not trying to.

Takeaways

In the end, I'm so incredibly proud of how this turned out. It's the first side project I've ever shipped that felt finished (at least for now, since there's an Android app and a web app on the way).

Healthsome is out now on iPhone, and Android is coming soon.

• App Store: https://apps.apple.com/app/id6740287835
• Website: https://healthsome.io
• The longer case study, with screenshots: https://moriah.dev/projects/healthsome/

I'd love to hear what you think, especially if you live with a chronic illness or mental health stuff and have opinions about what tracking apps get wrong. Comments are open, or you can reach me at hello@healthsome.io.

And if you're building in health tech, I'd gently encourage you to ask who your app makes feel bad, and whether it has to. Now imagine how many more people would actually keep using these tools if more of them were built with that question in mind.