Your information existing in EverRhythm does not give everyone permission to use it.

Connected should never mean uncontrolled

Your personal EverRhythm should not automatically become visible to an employer because you receive workplace support. A university should not automatically gain access to wider Personal information because you use EverRhythm as a student. Research participation should not silently unlock unrelated information. Professional access should remain appropriate to the relationship rather than unrestricted.

Where sharing is available, EverRhythm should make it understandable what is being shared, with whom, for what purpose and under what permission. More information may make a system or AI more capable, but that alone does not justify collecting or accessing it.

1. Introduction

Welcome to EverRhythm. We are committed to protecting your privacy and handling sensitive personal and health information carefully. This notice describes our current data practices and your rights. Regulatory obligations depend on the service, jurisdiction and relationship involved; this notice does not itself claim certification or universal compliance with every privacy or health-data framework.

2. Information We Collect

We collect information to provide and improve our services. This includes:

• Account Information: Name, email address, password, date of birth, and other profile details.
• Health Data: Information you log about medical conditions, symptoms, medications, treatments, mood and other health-related activities. Health information is special-category personal data where UK GDPR applies; whether information is PHI under HIPAA depends on the relevant US legal context and relationship.
• Technical Data: IP address, device type, operating system, browser type, and usage data collected through cookies and similar technologies.
• Third-Party Data: We may receive data from third-party services if you choose to integrate them with your EverRhythm account.

3. How We Use Your Information

Your data is used to:

• Provide, maintain, and personalize our services.
• Generate insights and reports about your health trends.
• Communicate with you about your account and our services.
• Support research only under the governance, participant information, lawful basis, special-category condition and permissions applicable to the specific study or programme.
• Ensure the security of our services and for troubleshooting.

4. Legal Basis for Processing

Where UK GDPR or equivalent data-protection law applies, the lawful basis depends on the specific processing purpose and relationship. Our current governance review maps each purpose separately rather than applying one basis to the whole service.

• Consent: May apply where processing is genuinely optional and the required consent standard can be met, including some direct-to-consumer health features.
• Contract: May apply where processing is necessary to provide a service you requested under our Terms and Conditions.
• Legitimate interests or other lawful bases: May apply to defined purposes such as security or service operation where the legal requirements for that basis are satisfied.

5. US Health-Data Context

US privacy and health-data obligations depend on the service and relationship involved. EverRhythm does not treat every item of consumer health information as HIPAA PHI merely because it concerns health. Where HIPAA or another US health/privacy law applies to a particular deployment, the applicable obligations must be assessed for that context.

6. Other Jurisdictions

Additional privacy laws may apply depending on where a service is offered and how EverRhythm is used. Jurisdiction-specific obligations are assessed separately; this notice should not be read as an automatic claim that every framework applies to every deployment.

7. Data Sharing and Third Parties

EverRhythm does not use this notice to authorise undisclosed sale or sharing of personal data. Any material recipient or disclosure route must be identified and governed for the applicable purpose. We may share information with:

• Service Providers and technical integrations: EverRhythm's currently evidenced technical estate includes Floot-managed infrastructure/database/auth runtime, Sentry (error and performance monitoring), Axiom (structured logging and monitoring), Stripe (payments/subscriptions), Google Gemini (AI-enabled features), OpenWeather (weather correlation where used), Fitbit (user-authorised wearable import) and Google Analytics (optional analytics, default-denied). The presence of a configured integration does not mean every provider receives your data on every journey; data sent depends on the feature you use and the deployed configuration. Contractual roles, locations and any restricted-transfer safeguards remain subject to the applicable provider and deployment review.
• Ticaga: EverRhythm has chosen Ticaga for support-desk technology, but the current EverRhythm application repository does not yet evidence a live Ticaga integration or data flow. We therefore do not currently represent Ticaga as receiving or processing your EverRhythm personal data. This notice will be updated before or when a verified Ticaga data flow becomes active.
• Research: Research use or disclosure is governed separately for the relevant study or programme. Participant information must explain the applicable purpose, legal basis, special-category condition and choices before research processing is activated.
• Legal Requirements: We may disclose your information if required by law, such as in response to a subpoena or court order.

8. Data Storage and Retention

We retain personal data only for as long as there is a justified purpose or applicable obligation. EverRhythm is reconciling purpose-specific retention periods and disposal evidence; where a fixed period is not yet approved, the criteria used to determine retention must be documented before the notice is treated as final. Information that has been irreversibly anonymised so that it is no longer personal data may be retained separately from identifiable or pseudonymised information.

9. Your Rights

Depending on the processing and applicable lawful basis, you may have rights including:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure ("Right to be Forgotten"): Request the deletion of your personal data.
• Data Portability: Receive your data in a machine-readable format.
• Restrict Processing: Limit how we use your data.
• Object to Processing: Object to our processing of your data for legitimate interests.

Some rights are conditional rather than absolute. To exercise an applicable right, please contact us using the details below.

Where UK data-protection law applies, you also have the right to complain to the Information Commissioner's Office. You may also raise the concern with EverRhythm first using the privacy contact below.

10. Policy Management and Versioning

EverRhythm is consolidating its policy governance so that public statements, internal controls and retained evidence remain traceable and versioned.

Our privacy policy management includes:

• Version Control: Material policy changes are intended to retain identifiable version and change history.
• Review: Policy review is being moved to recorded scheduled and change-triggered governance.
• Approval: Internal approval and any required external legal/privacy review are treated as distinct states.
• Transparency: Material notification or renewed-consent requirements are assessed when a policy or processing purpose changes.

11. Contact Us

If you have any questions about this Privacy Notice or our data practices, please contact our privacy team at:

Email: privacy@everrhythm.health