Privacy policy.

heedly is made by HEEDLY LLC, a Florida limited liability company. This policy explains what information heedly handles, where it lives, who can see it, and what you can do about it. It covers the heedly iOS app (including TestFlight beta versions), the website heedlyapp.com, and the emails we send. It applies worldwide.

We have tried to write it so that it can be read on a bad day.

The short version

Your health data stays on your phone, encrypted, and is used only to run the app for you. heedly has no account system, does not sell data, shows no ads, does not use your data to train any artificial-intelligence or machine-learning model, and does not share your health data with anyone unless you yourself choose to (for example by exporting a doctor report). If you connect a wearable directly, its data travels to your phone through the delivery services described in section 5 and is not stored along the way. The few things that do reach us, such as the email you gave us to join the waitlist, are listed below.

1. Who we are and how to reach us

HEEDLY LLC
4770 Biscayne Blvd, Suite 730
Miami, FL 33137, United States
support@heedlyapp.com

For the purposes of data-protection law we are the "controller" of any personal data described in this policy that we actually hold. Most of your data we never hold at all, because it does not leave your device.

2. Who this policy is for

heedly is for adults. It is not directed at anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, email us and we will delete it.

3. What heedly handles, and where it lives

Most of what heedly works with is health data. Under the GDPR and UK GDPR that is "special category" data; under several US state laws it is "consumer health data." We treat all of it as sensitive, whatever the law calls it.

Information you enter in the app. Your daily check-in answers (energy, how your body feels), the tags you select (activities, symptoms, environment, cycle and body events such as "period," "medication change" or "infection"), the daily verdict on how a day landed, crash entries, the conditions you select during onboarding, hormonal context if you choose to give it, your notification and theme settings, and any personal note you add to a doctor report. Stored only on your device.

Apple Health data you allow heedly to read. With your permission, granted in the iOS Health app, heedly reads heart-rate variability, resting heart rate, respiratory rate, sleeping wrist temperature, sleep analysis, steps, active energy, exercise time and, where available, blood oxygen. This includes history already in Apple Health, which may have been written there by your Apple Watch or by other apps such as Oura, Garmin or Fitbit. heedly only reads; it never writes to Apple Health. Granting access is optional: heedly works without it, from your check-ins alone, and no feature, paid or free, requires you to share Apple Health data. Stored only on your device. You can revoke any permission at any time in the Health app.

Data from a wearable you connect directly. If a version of heedly lets you connect a wearable account directly (for example Oura, Garmin or Fitbit) rather than through Apple Health, section 5 explains how that works. Stored only on your device once delivered.

What the app works out for you. Your personal baselines, the tank state, the three-day outlook, trigger patterns, and a log of each day's outlook next to what you later reported. These are calculated from the data above, by statistics running on your phone. Computed and stored only on your device.

Consent and version records. Which privacy choices you have made and which version of this policy you accepted. Stored only on your device.

Subscription status. When the paid version is live, Apple processes your payment. We never see your card number. Apple gives us a receipt or transaction record so the app can tell whether your trial or subscription is active, and we keep a minimal record of that status so it survives reinstalling the app. That record contains no health data. Held by Apple and by us.

Waitlist and email contact data. The email address, and name if you gave one, that you provided to join the waitlist, the beta or our updates, plus our correspondence with you. Held by us, in our email account and in Mailchimp, our email provider.

Support and feedback. Anything you send us by email, through the website contact form, or through TestFlight feedback. If you choose to include screenshots or describe your symptoms, we will see that; please share only what you are comfortable with. Held by us.

Crash and diagnostic information. During a TestFlight beta, Apple collects crash logs and lets you send screenshots and comments, and passes them to us. Crash logs describe the state of the app and device at the moment of a crash; by design we do not write health data into logs. The App Store version does not include any third-party crash-reporting or analytics software. Held by Apple and by us.

Forecast results (beta only, optional). If you choose to, you can send us your forecast results from Settings during a beta. This opens an email from your own address with a file attached, so nothing is sent unless you press send. The file contains, for each day: what heedly forecast (the state, its score and main reason, and which day it was for), how confident it was, how many days it was based on, the app's engine version, and how you said the day turned out. It contains no wearable readings, tags, notes, conditions, name or device identifier. When it arrives we separate the file from your email and keep the results without your name or address.

What heedly does not collect. There is no account, login or password. The app does not collect your location, contacts, photos or advertising identifier, and contains no advertising or tracking software. Notifications are generated on your phone itself; no notification server receives your data.

A note on iCloud. heedly's database is excluded from iCloud Backup, so your health data is not uploaded to iCloud by heedly. This also means it is not restored automatically from a backup: if you change phones, use Export in Settings first and bring the file across yourself.

4. How we use information, and our legal basis

We use the information above only to:

• run the app for you: calculate your baselines, tank, outlook and patterns, and produce a doctor report when you ask for one, all on your phone;
• manage your trial or subscription;
• send you the beta invitation, updates you signed up for, and replies to your messages;
• find and fix problems, and understand from feedback and the optional forecast results whether the outlook is useful;
• comply with law and protect our rights, if that ever becomes necessary.

For people in the EU, UK, Switzerland and similar jurisdictions, our legal bases are: your explicit consent for health data (given when you accept this policy and grant Apple Health or wearable permissions; withdrawable at any time by deleting your data or the app), performance of our agreement with you for running the app, trial, subscription and beta, and our legitimate interest in keeping the app working and improving a pre-release product, which we rely on only for technical data, feedback and de-identified information. For email updates we rely on your consent when you sign up, and every email has an unsubscribe link.

5. Wearable connections, Apple Health and the companies behind them

Apple Health. Data heedly reads from Apple Health is used only to provide heedly's features to you. In line with Apple's rules for HealthKit, it is not used for advertising, marketing or data mining, is not sold, and is not shared with third parties except as you direct, for example when you export a doctor report yourself.

Direct wearable connections. Some versions of heedly let you connect a wearable account directly, because Apple Health does not pass on some signals (for example Oura's heart-rate variability and temperature). If you choose to connect, you log in with the wearable company, which asks your permission to share data with heedly. That data travels from the wearable company to heedly through Terra, a wearable-data service, and through heedly's own connection service, which exists only to deliver the data to your phone. Neither we nor Terra use it for anything else, and heedly's connection service does not keep a copy once it has been delivered to your device. Your history with that wearable is loaded once when you connect so your baselines are meaningful from the start. You can disconnect at any time in heedly's Settings or in the wearable company's own app or account page; disconnecting stops new data and the data already on your phone stays yours until you delete it.

What we commit to for every data source. We use wearable and Apple Health data only to provide heedly's features to the person it belongs to. We do not sell it, license it, pool it, or pass it to third parties. We do not use it, or any other user data, to train, fine-tune, develop or improve any artificial-intelligence or machine-learning model or system, ours or anyone else's, and we do not send your data to any third-party AI service. The patterns heedly shows you are per-person statistics (baselines, averages and deviations from your own normal) computed on your own phone from your own data; nothing is learned across users. heedly's subscription pays for heedly's own features. We do not charge for access to data from Oura, Apple Health or any other source, and we do not resell or redistribute that data.

Their rules too. Apple, Oura, Garmin, Fitbit, Terra and other companies have their own terms and privacy policies, which apply to your relationship with them. Some wearable companies require an active membership before any third-party app can receive your data.

6. Who we share information with

We do not sell personal data. We do not share it for advertising. We do not share health data with insurers, employers, researchers, pharmaceutical companies or wearable manufacturers. The only parties that receive information in connection with heedly are:

• Apple, which runs the App Store, TestFlight, HealthKit, payments and iOS, under Apple's own terms;
• Terra (Terra Enterprise Ltd, United Kingdom), only if you choose a direct wearable connection, as a processor acting on our instructions;
• Mailchimp (Intuit Inc., United States), which stores waitlist and email contact details on our behalf;
• the contractors who build and support heedly, who may see crash logs, feedback and support messages in order to fix problems, and who are bound by confidentiality;
• professional advisers and authorities, where required by law, to enforce our terms, or to protect someone's safety;
• a successor business, if HEEDLY LLC is ever sold, merged or reorganised. Any data we hold would transfer to the new owner under this policy or one at least as protective, and we would tell you before it happened. Data that lives only on your phone stays on your phone regardless of who owns the company.

Each of these providers and contractors is required, by contract or by law, to protect your information to at least the standard described in this policy and to use it only for the purpose we share it for.

If we ever offer a research-contribution option, it will be a separate, clearly explained choice inside the app, off by default, and only data from people who turn it on would be included. The forecast results described in section 3 are not that option.

7. How long we keep information

• Data on your phone: until you delete it in Settings, delete the app, or erase your device. We cannot access or delete it for you.
• Subscription status: for as long as you have a trial or subscription and for the period afterwards that we need to handle refunds, disputes and accounting, after which it is deleted or anonymised.
• Email contact details: until you unsubscribe or ask to be removed, or until the list is no longer used.
• Support messages and TestFlight feedback: for as long as needed to resolve the issue, and no longer than two years.
• Crash logs: no longer than one year.
• Forecast results: kept without your name or email address, separately from your email, for as long as they help us improve the forecast. The email you sent them in is deleted within 30 days.

8. Your rights and choices

Because almost all of your data is on your phone, you already control it directly: you can view it in the app, edit any past entry, export it, delete it in Settings, or delete the app. You can withdraw Apple Health permissions in the Health app and disconnect any wearable at any time.

For information we hold (subscription status, email contact details, support messages, crash logs, forecast results), you can ask us to tell you what we hold, correct it, delete it, give you a copy, restrict or object to our use of it, and withdraw any consent you have given. Email support@heedlyapp.com. We will respond within 30 days, or sooner where the law requires, and we may need to confirm that the request really comes from you. We will not treat you differently for exercising your rights.

If you are in the EU, UK or Switzerland, you also have the right to complain to your data-protection authority.

If you are in California, this section and sections 3, 4 and 6 are our notice at collection. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes other than providing heedly, so there is no "Do Not Sell or Share" or "Limit the Use of My Sensitive Personal Information" choice to make.

If you are in Washington, Nevada, Connecticut or another US state with a consumer-health-data law, this policy is our consumer health data privacy policy. The categories of consumer health data we collect, their sources, why we collect them, and the categories of recipients are listed in sections 3, 4 and 6. We do not sell consumer health data, and we do not share it with third parties except as described in section 6. You may exercise the rights above, including the right to withdraw consent and to have your consumer health data deleted, by emailing us.

9. International transfers

We are based in the United States. Information we hold is stored and processed in the United States, and Terra processes wearable data in the United Kingdom and the EU. Where you are in the EU, UK or Switzerland, we rely on your explicit consent for any health-related information you choose to send us, and on standard contractual clauses (with the UK addendum where relevant) with our service providers. Your on-device health data is not transferred anywhere by us.

10. Security

heedly stores your data on your phone in an encrypted database protected by iOS data protection. Health data is never written to plain-text logs or placed in web addresses. Health data does not pass through our servers except, if you choose a direct wearable connection, through the connection service described in section 5, which does not store it. Access to the information we do hold is limited to the people who need it to run heedly, under confidentiality obligations. No system is perfectly secure, and we do not promise that one is. If we learn of a breach affecting your personal data we will tell you, and any authority the law requires, without undue delay.

11. heedly is a wellness tool, not a medical device

heedly shows you patterns in your own data to support your own pacing decisions. It is not a medical device, is not intended to diagnose, treat, cure, mitigate or prevent any disease or condition, and is not a substitute for advice from a doctor or other qualified health professional. It has not been evaluated or cleared by the US Food and Drug Administration, the European or UK medical-device authorities, or any other regulator, and it is not intended to be used as one. Its outlooks can be wrong, especially in the first weeks while it is still working out your baseline. Always use your own judgement, and seek medical help when you need it. Our Terms of Service set this out in full.

12. Email and the website

The website heedlyapp.com collects what you type into its forms (your email address and anything you write to us) and standard technical information that any web server records when you visit, such as your IP address and browser type, used only to keep the site running and secure. We do not run advertising trackers on the site. Emails we send go through Mailchimp and may record whether an email was opened or a link clicked, which we use only to see whether our updates are working; every email includes an unsubscribe link. Our Facebook group, if you choose to join it, is run on Meta's platform under Meta's terms, and what you post there is visible to the group.

13. Changes to this policy

When we change this policy in a way that matters, the app will show you what changed and ask you to accept before continuing, and the version you accepted is recorded on your phone. Smaller changes, such as a new contact address, take effect when we publish them here. The current version is always at heedlyapp.com/privacy, with its effective date at the top.

14. Contact

HEEDLY LLC, 4770 Biscayne Blvd, Suite 730, Miami, FL 33137, United States. Email: support@heedlyapp.com.