Privacy Policy - Huginn Health

1. Introduction

Welcome to Huginn Health ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our health tracking application and services.

By using Huginn Health, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

When you create an account, we collect:

Name (first and last)
Email address
Date of birth
Country of residence
Sex/gender (for health calculations)

2.2 Health and Fitness Data

To provide our services, we collect and process the following health data:

Body Metrics: Weight, height, body mass index (BMI), body fat percentage, muscle mass, water percentage
Activity Data: Steps, active minutes, exercise sessions, calories burned, heart rate zones
Sleep Data: Sleep duration, sleep stages (deep, light, REM, awake), sleep quality
Vital Signs: Blood pressure, resting heart rate
Nutrition Data: Food intake, calories, macronutrients (protein, carbohydrates, fat, fiber)
Wellness Data: Mood tracking, hydration levels

2.3 Device Integration Data

When you connect third-party fitness devices and services, we receive data from:

Google Health: Activity, sleep, heart rate, and exercise data (including from Fitbit devices)
Withings: Weight, body composition, and blood pressure data
Garmin: Activity, sleep, heart rate, stress, and workout data

We only access data that you explicitly authorize through each platform's OAuth consent process.

2.4 Technical Data

IP address (for country detection and security)
Browser type and version
Device information
Session data and cookies

3. How We Use Your Information

We use your information to:

Provide and maintain our health tracking services
Calculate health metrics (BMI, calorie targets, progress tracking)
Display trends and insights about your health data
Sync data between your connected devices and our platform
Personalize your experience based on your health goals
Send important service notifications
Improve our services and develop new features
Ensure the security of your account

                Important: We do NOT sell your personal health data to third parties. Your health information is used solely to provide you with our services.
            

4. Data Storage and Security

4.1 Where We Store Your Data

Your data is stored in the United Kingdom, on a privately operated server. The service is not reachable from the public internet: it is accessible only over an encrypted private network to devices that have been explicitly authorised.

Data notifications from Garmin are received by a relay operated on Cloudflare's network, which holds each notification for no more than 7 days until our server collects it.

Your data is subject to UK data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

4.2 Security Measures

We implement the following security measures:

All data transmission is encrypted using TLS/SSL (HTTPS)
Database encryption at rest
Secure authentication via Google OAuth 2.0
Regular security audits and updates
Access controls and authentication for all API endpoints
Secure session management
No public internet access to the service; access only over an encrypted private network

4.3 Data Retention

We retain your health data for as long as your account is active. Historical health data is preserved to enable long-term trend analysis and health insights. You may request deletion of your data at any time (see Section 7).

5. Third-Party Services

5.1 Authentication

We use Google OAuth for secure authentication. When you sign in, Google shares your basic profile information (name, email, profile picture) with us.

5.2 Fitness Device Integrations

When you connect fitness devices, we access data through official APIs provided by:

Google Health: Subject to Google's Privacy Policy
Withings: Subject to Withings' Privacy Policy
Garmin: Subject to Garmin's Privacy Policy

You can revoke access to any connected service at any time through our Settings page or directly through the third-party platform.

5.3 Nutrition Data

We use the Open Food Facts database to provide nutritional information for food products. This is an open, collaborative database and does not involve sharing your personal data.

6. Data Sharing and Disclosure

We do not sell, trade, or rent your personal health information. We may share your information only in the following circumstances:

With Your Consent: When you explicitly authorize sharing
Service Providers: With trusted service providers who assist in operating our platform (e.g., Cloudflare, for the Garmin relay), bound by confidentiality agreements
Legal Requirements: When required by law, regulation, or legal process
Safety: To protect the rights, property, or safety of our users or others

7. Your Rights and Choices

You have the following rights regarding your data:

7.1 Access and Portability

You can access your health data at any time through our dashboard. You may request an export of your data in a portable format.

7.2 Correction

You can update your personal information through the Settings page.

7.3 Deletion

You may request deletion of your account and all associated data by contacting us. Upon request, we will delete your data within 30 days, except where we are legally required to retain it.

7.4 Disconnect Devices

You can disconnect any linked fitness device at any time through our Settings page. This will stop future data syncing but will not delete previously synced data unless you specifically request it.

7.5 Opt-Out

You may opt out of non-essential communications at any time.

8. Children's Privacy

Huginn Health is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete that information.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Significant changes will be communicated via email or through the application.

10. Contact Us

Questions or Concerns?

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: privacy@huginn.health

Website: https://huginn.health

12. UK GDPR Compliance

We are fully committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This section outlines your rights under UK data protection law.

12.1 Legal Basis for Processing

We process your personal data on the following legal bases:

Consent: You have given clear consent for us to process your personal health data for the specific purposes described in this policy
Contract: Processing is necessary to provide you with the services you have requested
Legitimate Interests: Processing is necessary for our legitimate interests (service improvement, security) where these do not override your rights

12.2 Your Rights Under UK GDPR

Under UK data protection law, you have the following rights:

Right of Access: You can request a copy of all personal data we hold about you
Right to Rectification: You can request correction of inaccurate or incomplete data
Right to Erasure: You can request deletion of your personal data ("right to be forgotten")
Right to Restrict Processing: You can request that we limit how we use your data
Right to Data Portability: You can request your data in a machine-readable format
Right to Object: You can object to processing based on legitimate interests
Right to Withdraw Consent: You can withdraw your consent at any time

To exercise any of these rights, please contact us at privacy@huginn.health. We will respond to your request within one month.

12.3 Data Protection Officer

For any questions or concerns about how we handle your personal data, or to exercise your data protection rights, please contact:

Email: dpo@huginn.health

12.4 Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Helpline: 0303 123 1113

12.5 Service Availability

Huginn Health is currently only available to residents of the United Kingdom. By registering for our service, you confirm that you are a UK resident.