Privacy Policy

1. Who we are

Habbeat / Habbeat Health (“Habbeat”, “we”, “us”, “our”) provides the Habbeat mobile application, websites (including habbeat.com and store.habbeat.com), employer offerings, and related services (collectively, the “Services”). This Privacy Policy explains how we collect, use, share, and protect personal data when you use the Services.

Contact: privacy@habbeat.com · support@habbeat.com

2. Data we collect

Depending on how you use Habbeat, we may collect:

• Account & profile: name, email, phone (if provided), country/region, language, date of birth or age, gender, height, weight, goals, preferences, authentication identifiers from Apple, Google, or similar sign-in providers, and subscription status.
• Health & wellness data you choose to log: workouts, exercises, sets/reps, cardio, meals, nutrition estimates, water, sleep, steps, habits, fasting windows, body measurements, progress photos, notes, and similar wellness information.
• Health platform data (with permission): data you authorise from Apple Health, Google Health Connect, or similar services (e.g. steps, active calories, distance, and workouts).
• AI & coaching: messages and prompts you send to Habi or other in-app assistants, associated context (such as recent logs or goals), and generated responses. These may be processed by third-party AI providers on our behalf.
• Payments & subscriptions: plan type, trial status, transaction references, billing metadata, and limited payment details. Mobile store purchases are processed by Apple or Google; web purchases may be processed by Razorpay or other gateways. We do not receive your full card number from app stores.
• Device & technical data: device type, operating system, app version, push notification tokens, IP address, timezone, crash logs, diagnostics, and coarse location where permitted.
• Usage data: feature interactions, screens viewed, referral sources, and aggregated analytics to improve the Services.
• Communications: support requests, contact form messages, employer inquiries, and marketing preferences.

3. How we use data

We use personal data to:

• Provide, personalise, and maintain the Services you request.
• Generate workout, nutrition, and coaching recommendations (including AI).
• Process subscriptions, trials, coins/rewards, and support requests.
• Send service, security, and promotional communications (where permitted).
• Detect fraud, abuse, chargebacks, and security incidents.
• Analyse aggregated usage to improve features and reliability.
• Comply with law, enforce our terms, and protect rights and safety.

4. Legal bases (GDPR & similar)

Where GDPR or similar laws apply, we rely on:

• Contract: to deliver the Services you sign up for.
• Legitimate interests: to secure, improve, and market the Services in a balanced way.
• Consent: where required for optional marketing, certain health integrations, or sensitive processing — withdrawable where applicable.
• Legal obligation: to meet regulatory and tax requirements.

5. AI processing

AI features may send prompts, logs, and related context to cloud and AI service providers to generate responses. Do not submit information you do not want processed for this purpose. AI outputs are not guaranteed to be accurate or private in all contexts; see our Terms regarding limitations.

6. Sharing & subprocessors

We may share data with:

• Cloud hosting, database, email, and infrastructure providers (e.g. AWS and similar).
• Apple, Google, and payment processors for billing and subscription status.
• AI and analytics providers that process data under contract.
• Professional advisers, law enforcement, or regulators when required by law or to protect rights, safety, and integrity of the Services.
• Successors in a merger, acquisition, or asset sale, subject to this policy.

We do not sell your personal information. We do not share health data with third parties for their independent marketing without your consent where required by law.

7. International transfers

We may process data in India, the United States, the European Economic Area, and other countries where we or our providers operate. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

8. Retention

We retain data while your account is active and as needed to provide the Services, resolve disputes, enforce agreements, and meet legal obligations. When you delete your account, we delete or anonymise personal data within a reasonable period (typically within 30 days), except where retention is required by law or for legitimate security, fraud-prevention, or accounting purposes. Aggregated anonymised data may be kept longer.

9. Security

We use technical and organisational measures designed to protect data, including encryption in transit, access controls, and secure authentication. No method of transmission or storage is 100% secure; use the Services with that understanding and keep your credentials confidential.

10. Your rights

Depending on your location, you may have rights to:

• Access, correct, update, or delete your personal data.
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent where processing is consent-based.
• Opt out of marketing communications.
• Lodge a complaint with a supervisory authority.

To exercise rights, email privacy@habbeat.com. We may verify your identity before fulfilling requests and respond within legally required timeframes.

11. India (Digital Personal Data Protection Act)

If you are in India, you may have rights under applicable data protection law, including access, correction, erasure, and grievance redressal. Our grievance contact for data protection matters is privacy@habbeat.com. We aim to acknowledge grievances within 72 hours and resolve them within one month, or as required by law.

12. California (CCPA/CPRA)

California residents may have rights to know, delete, and correct personal information, and to opt out of “sale” or “sharing” (we do not sell personal information). Contact privacy@habbeat.com.

13. Children

The Services are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe we have collected a child’s data, contact us and we will take appropriate steps to delete it.

14. Cookies & similar technologies

Our websites may use cookies, local storage, and similar technologies for sessions, preferences, analytics, and security. The mobile app uses device identifiers and tokens rather than browser cookies. You can manage browser cookies in your browser settings.

15. Changes

We may update this policy from time to time. We will post the revised version with a new “Last updated” date and, where appropriate, notify you in-app or by email. Continued use after changes constitutes acceptance where permitted by law.