Data Protection Policy

1. Introduction

This Data Protection Policy explains EverRhythm's internal approach to data-protection governance. Applicable duties depend on the service, jurisdiction, parties and processing purpose. Publication of this policy does not itself establish compliance with UK GDPR, EU GDPR, HIPAA, PIPEDA or another privacy framework. Our Privacy Notice provides user-facing information about current processing.

2. UK and European Data Protection

Where UK or European data-protection law applies, EverRhythm assesses the requirements for the relevant service and processing purpose. This policy does not treat publication as evidence of regulatory approval.

• Lawful Basis for Processing: Each purpose must have a documented lawful basis before processing. Special-category health processing requires a separate applicable Article 9 condition where UK/EU rules apply; explicit consent is not a universal health-data basis.
• Data Subject Rights: EverRhythm must maintain procedures for applicable rights including access, rectification, erasure, restriction, objection and portability where the legal conditions for those rights are met.
• Data Protection by Design and by Default: We integrate data protection into our development processes and ensure that, by default, only necessary data is processed.
• Data Protection Impact Assessments (DPIAs): High-risk processing is screened for DPIA requirements. Internal working DPIAs exist for identified high-risk areas, but deployment-specific approval and competent review remain separate evidence states.

3. US Health-Data Context

US health-data obligations depend on the service, parties and legal relationship involved. Health-related information is not automatically HIPAA Protected Health Information merely because it concerns health. Where HIPAA applies to a deployment, the applicable safeguards and contractual requirements must be established for that deployment.

• Technical and organisational safeguards: Relevant controls are assessed against the actual deployment and retained assurance evidence; internal security-readiness evidence is not a HIPAA attestation.
• Administrative safeguards: Required policies, training, accountable roles and risk-management processes must be evidenced for any HIPAA-regulated deployment before they are represented as established.
• Physical safeguards: Provider facility and infrastructure safeguards depend on the actual hosting arrangement and supplier evidence.
• Business Associate Agreements (BAAs): Where EverRhythm or a provider is a Business Associate for a particular deployment, required BAA arrangements must be evidenced; no universal BAA claim is made here.

4. Other Jurisdictions

Other privacy laws may apply depending on where and how a service is offered. EverRhythm assesses those obligations separately rather than treating this policy as a universal compliance declaration.

5. Data Retention and Deletion

Retention is set by processing purpose, applicable obligations and demonstrated need. EverRhythm is reconciling its existing retention schedules before publishing purpose-specific periods. Requests for erasure are assessed under the rights that apply to the relevant processing; backup and recovery copies follow their applicable lifecycle rather than being described as immediately deleted without evidence.

6. International Data Transfers

EverRhythm is reconciling the actual locations and legal roles of its providers. Where a transfer is restricted under applicable data-protection law, the relevant adequacy position, appropriate safeguard or other lawful route must be identified and evidenced before the transfer is represented as approved.

7. Data Breach Notification

Breach notification is assessed under the law applicable to the incident. Under UK GDPR, supervisory-authority notification and communication to affected individuals use different statutory risk thresholds and timing requirements. EverRhythm therefore records the facts, risk assessment, decision and notification actions for each incident rather than applying one universal threshold or timetable across jurisdictions.

8. Policy Management and Versioning

EverRhythm is consolidating its policy governance so that public statements, internal controls, approvals and retained evidence can be traced to the relevant version. Publication is not treated as proof of legal or regulatory approval.

Our policies are systematically managed through:

• Version Control: Material governed versions and change summaries must be retained rather than silently overwritten.
• Review: Review timing is recorded through scheduled and change-triggered governance.
• Approval: Internal approval and any required external legal or privacy review are separate evidence states.
• Transparency: Material notification or renewed-consent requirements are assessed when processing or policy wording changes.

9. Contact and DPO

If you have questions about this Data Protection Policy, please contact privacy@everrhythm.health. EverRhythm's formal DPO applicability determination is recorded separately and is not inferred from a public contact label.