Privacy policy.

1. About this policy

This policy applies to your use of Hupps, including hupps.app and dashboard.hupps.app.

We are the data controller for the personal data we use to provide Hupps. This includes website and account information, health and fitness data, and records of your permissions and privacy choices.

Other services you choose to use have their own responsibilities for the personal data they collect and use. Their privacy notices explain those uses.

2. The data we use

Account and sign-in details

Your email address, account identifier, verification and sign-in records, and session information. These come from you and from your use of Hupps.

Connection and permission records

The sources you connect, provider and app identifiers, connection status, permissions requested and approved, and records of when you give, change, or withdraw permission. A participating app may provide a reference that links your Hupps connection to your account in that app. A source may also supply an access or refresh token used to maintain an authorised connection.

Technical and security information

IP addresses, browser and device information, request times, sign-in attempts, errors, and service logs generated when you use our website and account services. The public website also uses Cloudflare Web Analytics for page-view and loading-performance information.

Messages you send us

Your contact details and the information you include in support, business, or privacy enquiries. Please avoid sending health records, passwords, or sign-in codes by email.

You can browse the public website without creating an account. We need an email address to provide an account and verify sign-in. Connecting a source and allowing an app access are optional; declining access means the relevant connection or sharing feature cannot work.

3. Health and fitness data

Depending on your sources and permissions, connections can involve activity and workouts, sleep, daily summaries, body measurements, nutrition, health observations, hormone and menstrual data, and profile information. This information comes from the sources you connect. Available data varies by source and may include historical records. Health data is sensitive personal data under the GDPR. Connection and permission records can also reveal health information. Insights and analysis results derived from these records are also personal data where they relate to an identifiable person.

We use health data to provide the connections and sharing you authorise, based on your explicit consent. Your personal-insights consent covers health and fitness data from all the sources you connect, within the permissions you give those sources. Sharing remains authorised separately for each app. Research participationis a separate, optional choice. Creating an account or accepting our terms does not enable any of these uses without your affirmative consent.

4. Your data rights and our purposes

Helping you exercise your data rights

Access to your own data supports Hupps’ aim of helping you understand your health. We help you put your data-access and sharing choices into practice through supported connections, using your instructions and permission records to facilitate the access and sharing you request. Our Terms of Use explain the service and your instructions. Neither those terms nor this notice authorises us to make a request on your behalf without the relevant instruction.

Where the EU Data Act (Regulation (EU) 2023/2854) applies, Articles 4 and 5 give users rights to access readily available data from connected products and related services, and to ask the data holder to make it available to a third party they choose. This can include data from connected health and fitness devices. If you authorise Hupps to make a request on your behalf, that request is limited to the access and sharing you authorise.

These rights are subject to the Act’s scope and conditions. They do not cover every proprietary score or inferred insight, and the connections available through Hupps depend on the sources we support. You can also exercise applicable access and portability rights directly with the organisation holding your data.

The Data Act complements your GDPR rights. Our processing of personal data still requires an appropriate GDPR legal basis and, for health data, an applicable special-category condition. The explicit consent described below remains necessary for our health-data connection and sharing activities.

Where we receive data as a third party under the Data Act, we use it only for the purposes and under the conditions agreed with you, and erase it when it is no longer needed for those purposes, as required by that Act.

Our legal bases for processing

Our purposes and legal bases under the GDPR are:

• Providing your account and connection controls. We use account, session, and connection information to deliver the service you request and answer service-related questions. The legal basis is performing our contract with you, or taking steps at your request before a contract (Article 6(1)(b)).
• Connecting and sharing health data. We rely on your consent (Article 6(1)(a)) and, for data concerning health, your explicit consent (Article 9(2)(a)). Permission must be specific to the processing explained when you connect or share. Reading this policy or creating an account does not itself give consent to process or share health data.
• Personal health insights. With your explicit consent, we use health and fitness data from all sources you connect to calculate and show you personal activity, sleep and wellbeing trends when those features become available. This consent covers ongoing processing for that purpose; you do not need to approve each individual trend. It does not authorise research or sharing with another app. We rely on consent (Article 6(1)(a)) and explicit consent for health data (Article 9(2)(a)).
• Research, statistics and product development. With your separate, optional consent, we analyse health and fitness data for research, statistics and future product development. This includes pseudonymised analysis and processing personal data to prepare anonymous, aggregated research findings for publication. Pseudonymised records remain personal data. We rely on consent (Article 6(1)(a)) and explicit consent for health data (Article 9(2)(a)).
• Operating and protecting Hupps. We use technical information and necessary account records to deliver the website, understand its usage and loading performance, investigate errors, prevent misuse, and respond to general enquiries. We rely on our legitimate interests in running a reliable, secure service (Article 6(1)(f)), taking your rights and reasonable expectations into account. This basis alone does not authorise the use of health data.
• Meeting legal duties. We use necessary records to respond to privacy requests, demonstrate compliance, and meet applicable legal obligations (Article 6(1)(c)). Where necessary to establish, exercise, or defend legal claims, we rely on legitimate interests and, if health data is involved, Article 9(2)(f).

Your personal-insight and research choices

Personal insights are a core part of Hupps. During signup, we explain the health-data processing used to provide them and ask for your explicit consent through “Consent and create account”. There is no separate personal-insights preference or switch. Research participation is optional and initially off. You can decline or withdraw it without losing personal insights, connections or app sharing. App sharing is authorised separately. The consent information explains the data, purpose, who processes it and how to withdraw. Accepting our terms alone does not give health-data consent.

Personal health insights for users are not currently available. Research and development can take place before those features launch. We will explain a new feature’s processing and any external providers, and obtain any additional consent needed, before you use it.

Anonymous research publications

We may publish research findings, statistics and reports based on aggregated, anonymous data. We publish these outputs only when people cannot reasonably be identified from them, including by combining them with other available information. Removing names or replacing identifiers does not by itself make data anonymous. Any underlying records or outputs that remain identifiable continue to be covered by this policy and your consent choices.

5. Your connections and choices

A permission should identify the app, data types, and purpose of sharing. Where the permission flow explains this, it may cover eligible matching data from multiple sources, including sources connected later. Check the scope before allowing access. Contact us if the recipient or purpose is unclear.

• Withdraw personal-insight or research consent:change your research participation choice in your account where available, or contact [email protected] and tell us which purposes you want to stop. We will stop using your personal data for those purposes. Hupps cannot provide personal insights without personal-insight processing. Your other permissions remain separate.
• Withdraw an app’s permission: contact [email protected] with the name of the app whose access you want to stop. This concerns future processing based on that permission. Other app permissions and source connections are separate.
• Disconnect a source: use the source-disconnection control where available, or contact us for help. You can also check the source’s own account settings for connected-app access. Disconnecting is separate from closing your account with the source or withdrawing permissions for other sources.
• Delete your Hupps account: contact [email protected] to request account closure and deletion of the personal data we hold, subject to the limited retention grounds explained below.

Contact us to change or withdraw consent, or if a control in your Hupps account does not confirm the requested change. Withdrawal does not affect processing that was lawful before you withdrew consent. Clearing browser storage or signing out does not withdraw an app’s permission or delete your account.

Stopping sharing does not erase data an app has already received. Contact that app about its copy and its own processing. We will also notify recipients of an applicable correction, deletion, or restriction where the law requires us to do so.

Once findings are anonymous and can no longer be linked to you, we cannot remove your individual contribution. Withdrawal does not require retracting anonymous publications. This does not exempt identifiable research records or outputs from your privacy rights.

6. Who receives your data

Data is shared with recipients relevant to the service you use:

• Apps you authorise: the data types you approve and the identifiers and connection information needed to provide that access, where that sharing is supported and permitted. Each app is responsible for explaining its subsequent use. Your instruction does not mean every source permits every onward transfer.
• Sources you connect: the information needed to authorise, maintain, and disconnect the connection. Their services remain subject to their own privacy notices.
• Website and account service providers: Cloudflare hosts and protects our website and provides Web Analytics; Google Cloud hosts account services; and Twilio SendGrid sends sign-in emails.
• Health-data connection providers: specialist health-data integration services connect your health accounts and collect, store, and share health data with apps you authorise. The provider and its end-user privacy notice are presented when you connect. That notice also describes the provider’s own service improvement, product development and research purposes, including publication of aggregated or de-identified findings. Where the provider determines why and how personal data is used for its own purposes, it acts as a controller for that processing. Contact us if you need a copy of the provider’s notice.
• Readers of our research: we may make the anonymous, aggregated findingsdescribed above publicly available.
• Professional advisers and public authorities: where necessary for legal advice, compliance with a binding legal requirement, or the establishment, exercise, or defence of legal claims. Disclosure is limited to what the relevant purpose requires.

7. Cookies and browser storage

The public website uses Cloudflare Web Analytics to measure page views and loading performance. Its browser script is added by our hosting provider. The measurements can include the page and referring site, browser and device type, country, and page-load timings. See Cloudflare’s description of its analytics measurements. Hosting and security services also process technical information when your browser requests a page.

The account dashboard uses cookies to keep you signed in and maintain a connection flow. It also uses browser storage to remember flow and interface state. Session cookies expire at the end of their configured lifetime or are cleared when the relevant session ends. Session storage lasts for the browser session; local storage can remain until the app or you clear it.

You can block or clear cookies and browser storage in your browser settings. Doing so may prevent sign-in or interrupt a connection flow. These settings do not replace the sharing controls in your account.

8. How long we keep data

Retention depends on the purpose of the record. We keep personal data only for as long as needed for that purpose and any applicable legal requirements. The criteria we use are:

• Account and active connection records: whether your account or connection remains active and whether the record is needed to provide, disconnect, or close it.
• Health data and identifiable analysis results: how long they are needed for the connection, sharing, insight, research or product development purpose you consented to. For research work, we consider the project’s scope and duration, whether identifiable records remain necessary, and your withdrawal or deletion requests. We also account for resolving sharing errors and carrying out deletion. Withdrawing access stops future authorised sharing; it is not a statement that every stored copy is immediately erased.
• Permission and security records: what is necessary to demonstrate your choices, investigate an incident, comply with legal duties, or address a specific legal claim. Expiry of a sign-in code or session ends its validity; it does not necessarily delete the associated record.
• Website analytics: the period needed to understand website usage and performance, taking account of the provider’s reporting and retention settings. This is separate from health data processed for a connection.
• Support messages: the time needed to resolve your enquiry and any necessary follow-up or related legal obligation.

We may retain anonymous statistics and research findings for longer, including in published reports, because they no longer identify you. Research datasets are not treated as anonymous merely because names have been removed.

When handling a deletion request, we consider active systems, service providers, and backup copies. If an exception requires us to retain particular information, we explain the reason and applicable period or criteria in our response. For data a health-data connection provider independently controls, its end-user privacy notice, presented when you connect, explains its retention and deletion practices. The sources and apps you use set their own retention periods for data they independently control.

9. International transfers

Our providers and the sources and apps you connect may process data in countries outside the European Economic Area. For transfers we arrange, we require an applicable European Commission adequacy decision or appropriate safeguards, with additional protections where necessary.

Our health-data connection provider’s processing arrangements include primary processing in the United Kingdom and the Netherlands, with possible transfers to the United States. Our agreement with that provider incorporates the applicable transfer safeguards, including Standard Contractual Clauses where required.

Contact [email protected] for information about the destinations and safeguards that apply to your data, including how to obtain a copy of the relevant safeguards. A source’s or app’s own international transfers are described in its privacy notice.

10. Keeping data secure

Hupps uses HTTPS, sign-in verification, and access controls to protect account information and connections. No online service can guarantee absolute security. Keep access to your email account secure, do not share verification codes, and contact us if you suspect unauthorised access to Hupps.

11. Your privacy rights

Subject to the conditions in applicable law, you can ask to access your personal data, correct it, delete it, restrict its use, or receive a portable copy. You can object to processing based on legitimate interests and withdraw consent at any time. You also have rights concerning decisions based solely on automated processing that have legal or similarly significant effects on you.

Send requests to [email protected]. We may need proportionate information to confirm your identity. We respond without undue delay and normally within one month. If a request is complex or we receive several requests, the GDPR allows up to two additional months; we will explain any extension within the first month. Requests are normally free of charge.

You can complain to the Cyprus Commissioner for Personal Data Protection or to the supervisory authority where you live, work, or believe an infringement occurred. You do not have to contact us before exercising that right.

12. Children’s information

Hupps is for adults aged 18 and over.

If you believe someone under 18 has provided personal data to Hupps, contact [email protected] so we can investigate and take the steps required by applicable law.

13. Who we are

Hupps is operated by AI HELENUS LIMITED, a company registered in Cyprus with registration number HE 471127. In this policy, “Hupps”, “we”, and “us” mean AI HELENUS LIMITED.

14. Changes to this policy

We will update this page when our practices change. For material changes, we will provide an appropriate notice before the change takes effect. Where a new use requires consent, we will ask for it separately.