Hiyd · Legal

Privacy Policy

Effective: August 26, 2026Last updated: August 26, 2026

This Privacy Policy explains how Hiyd Incorporated ("Hiyd," "we," "us," or "our"), a United States company headquartered in San Jose, California, collects, uses, shares, and protects personal information. It applies to all users worldwide and covers everything we operate:

• the Hiyd mobile app for iOS and Android;
• the Hiyd wearable device and the services that support it;
• our website and online store at hiyd.ai, including browsing, checkout, orders, and support.

We refer to all of these together as the "Service." This is the single, complete privacy policy for Hiyd: it is the policy linked from our Apple App Store and Google Play listings, from the Hiyd app, and from our online store, and it replaces any earlier separate policies we published for the app and the store.

The disclosures in this Policy are intended to correspond to the Privacy Nutrition Label shown on our Apple App Store listing and the Data safety section shown on our Google Play listing. If you believe any of them disagree, please tell us at support@hiyd.ai and we will correct it.

If you do not agree with this Policy, please do not use the Service.

1. Information We Collect

We collect or process the following categories of personal information, depending on how you use the Service and as permitted or required by applicable law.

Account and profile information

• Name, email address, date of birth, biological sex, height, weight, and fitness goals.
• Account credentials and settings, including your Sign in with Apple identifier if you use it.

Health and wellness data from the Hiyd wearable

The Hiyd wearable collects raw analog-to-digital converter (ADC) signals from its on-device sensors. These signals are processed, on the device or on our servers, to derive:

• Sleep stages and duration
• Heart rate (HR)
• Heart rate variability (HRV)
• Step counts and related activity metrics

The raw ADC data and the derived metrics are linked to your account. We treat this as sensitive personal information, and as special category health data under the GDPR and UK GDPR.

Health data read from Apple Health (HealthKit) and Health Connect

If you turn on the health platform connection, we request permission to read health and fitness data from Apple HealthKit on iOS, or from Android Health Connect on Android. On both platforms the connection is optional, permission is requested through the operating system's own prompt, you grant or deny it per data type, and you can withdraw it at any time. Hiyd works without it. Section 4 describes exactly what we request, what we do and do not do with it, and how to turn it off.

Nutrition data

• Food, beverage, and supplement intake that you choose to log in the app.

Store, order, and payment information

• Contact, billing, and shipping details you provide at checkout.
• Transaction information, including items you view, add to your cart, purchase, return, exchange, or cancel, and your order history.
• Payment information, including form of payment, payment confirmation, and transaction details. Card details are collected and processed by Shopify and its payment processors; we do not store full payment card numbers on our systems.

Communications with us

• Messages you send to support@hiyd.ai or through our contact forms, including their contents and any attachments, and your marketing preferences.

Information collected automatically

• Usage and product analytics: screens viewed, features used, session duration, in-app events, crash and error events, and similar diagnostics, collected through PostHog.
• Device information: device model, operating system version, app version, browser, language, time zone, and the device push token used to deliver notifications through Firebase Cloud Messaging.
• Network information: your IP address at the time of API requests and website visits, used for security and abuse prevention.
• Cookies and similar technologies on our website, as described in Section 7.

We do not collect your precise or approximate location, your contacts, your photos, your messages, your call or SMS logs, your calendar, or the list of other apps installed on your device.

2. How We Collect It

• Directly from you when you register, log nutrition, place an order, or contact support.
• From your Hiyd wearable over a Bluetooth connection to the Hiyd app, which then transmits data to our servers.
• From Apple Health on iOS, with your explicit permission, granted through the iOS HealthKit prompt and changeable at any time in iOS Settings > Privacy & Security > Health > Hiyd.
• From Health Connect on Android, with your explicit permission, granted through the Android Health Connect permission prompt and changeable at any time in Settings > Security & privacy > More privacy settings > Health Connect > App permissions > Hiyd, or in the Health Connect app.
• Automatically while you use the app or website, through the SDKs and cookies described in Sections 6 and 7.
• From our service providers, such as Shopify and payment processors, when they handle a transaction on our behalf.

3. How We Use Your Information

• Provide the Service. Create and maintain your account, sync your wearable, compute sleep, HR, HRV, step, and nutrition metrics, and display them in the app.
• Fulfil orders. Process payments, ship your order, handle returns, exchanges, and warranty claims, and send you order and delivery notifications.
• Personalise your experience. Use your profile (age, sex, height, weight, goals) to calibrate metrics and recommendations.
• Communicate with you. Send push notifications you have enabled, respond to support requests, and tell you about important Service or policy changes. With your consent where required, we also send marketing emails, which you can unsubscribe from at any time.
• Improve the Service. Understand how features are used, diagnose bugs, and improve product quality.
• Train and fine-tune models. We use anonymised data, with direct identifiers removed, to fine-tune the models that power Service features. We never use data read from Apple HealthKit or Health Connect for this purpose (see Section 4).
• Security and fraud prevention. Detect, investigate, and prevent abuse, fraud, and unauthorised access, and keep your account secure.
• Legal compliance. Comply with applicable laws, regulations, and lawful requests, and establish or defend legal claims.

Data read from Apple HealthKit or Health Connect is used only to provide health and fitness features to you inside the app, as described in Section 4. It is never used for advertising, marketing, model training, or any other purpose.

Legal bases (EEA, UK, and Switzerland). We process your personal data on the basis of (i) performance of our contract with you, (ii) your explicit consent, which you can withdraw at any time, for health data and the health platform integrations, (iii) our legitimate interests in operating, securing, and improving the Service, and (iv) compliance with our legal obligations.

4. Apple Health, HealthKit, and Health Connect

What we request, and why

When you turn on the health platform connection in the Hiyd app, your operating system shows you a permission screen listing each data type we ask for. We request permission to read the categories that correspond to the metrics Hiyd shows you, which typically include steps and activity, heart rate, heart rate variability, sleep, workouts and exercise sessions, and basic body measurements such as height and weight. The operating system lists the exact types at the moment you are asked, and you can allow or deny each one individually.

We use this data for one purpose: to show your Hiyd metrics alongside data from your other devices and apps, and to calibrate the metrics we compute for you. Nothing is read from Apple Health or Health Connect until you allow it, and denying access does not limit any other part of the app.

Writing data back

We only write data to Apple Health or Health Connect for the specific data types you have authorised us to write, so that metrics measured by your Hiyd wearable can appear alongside your other sources. We do not write false or inaccurate data into either platform.

Our commitments for Apple HealthKit and Health Connect data

These commitments apply to all data we read from Apple HealthKit and from Android Health Connect:

• We do not use it for advertising, marketing, remarketing, or other use-based data mining purposes other than improving health, managing health, or health research.
• We do not sell it to any third party, including advertising platforms, data brokers, and information resellers.
• We do not disclose it to third parties except (a) with your explicit permission, (b) to service providers acting on our behalf and bound by confidentiality and security obligations, or (c) where required by law.
• We do not use it to train or fine-tune any model, anonymised or otherwise.
• We do not use it to make or support decisions about your eligibility for insurance, employment, or credit.
• We do not transfer it to any party for the purpose of serving or measuring advertisements.
• We request the minimum set of data types needed for the features you use, and we access them only while you have granted permission.
• It is stored encrypted in transit and at rest, and it is deleted when you delete your account, as described in Section 8.

Turning the integration off

You can revoke access at any time, and revoking stops any further reading immediately:

• iOS: Settings > Privacy & Security > Health > Hiyd, or from the Hiyd app's settings.
• Android: the Health Connect app, or Settings > Security & privacy > More privacy settings > Health Connect > App permissions > Hiyd, or from the Hiyd app's settings.

To remove copies of health platform data we have already stored, delete your account as described in Section 8, or email support@hiyd.ai. Data held inside Apple Health or Health Connect itself is controlled by you in those apps and is not deleted by us.

5. How We Share Information

We do not sell your personal information, and we never sell or share your health, wearable, Apple Health, or Health Connect data. We share information only as follows:

• Service providers listed in Section 6, acting on our behalf under contractual confidentiality and security obligations.
• Shopify. Our website and online store are hosted by Shopify, which collects and processes information about your access to and use of the store in order to provide and improve it. Information you submit to the store is transmitted to and shared with Shopify and, where relevant, with third parties that may be located in countries other than where you live. To learn more, see the Shopify Consumer Privacy Policy, and exercise any rights you may have over data Shopify holds through the Shopify Privacy Portal.
• Shipping and fulfilment partners, who receive the name, address, and contact details needed to deliver your order.
• Legal and safety. When required by law, subpoena, court order, or other lawful request, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Hiyd, our users, or others.
• Corporate transactions. In connection with a merger, acquisition, financing, reorganisation, or sale of assets. In that case we will require the recipient to honour this Policy, or give you notice and a choice before your data becomes subject to a different policy.
• With your consent, for any other purpose disclosed to you at the time we collect the information.

None of the service providers listed in Section 6 receives data read from Apple HealthKit or Health Connect, other than our hosting provider storing it in encrypted form on our behalf.

6. Service Providers

We use the following third parties to operate the Service. Each is contractually required to provide protections at least equivalent to those described in this Policy, to use your data only for the purposes we direct, and to maintain appropriate security measures.

We do not currently use any third-party advertising network or analytics provider beyond those listed above. If we add a service provider that materially changes how your data is handled, we will update this Policy and, where required by law, obtain your consent.

7. Cookies, Tracking, and Advertising Choices

Our website uses cookies and similar technologies to keep the store working, remember your cart and preferences, measure how the site is used, and, where enabled, support marketing. Depending on where you live, sharing information with marketing partners for interest-based advertising may be treated as a "sale," "sharing," or "targeted advertising" under U.S. state privacy laws, even though no money changes hands and no health data is involved.

• You can opt out of that activity at any time on our Your Privacy Choices page.
• If you visit our website with the Global Privacy Control signal enabled, and depending on where you are, we will treat it as an opt-out request for the browser and device you are using, and for the associated account where we can identify one. We do not respond to other "Do Not Track" signals.
• You can unsubscribe from marketing emails using the link in any marketing message. We may still send non-promotional messages about your account or orders.
• Your device and browser settings also let you block or delete cookies, though parts of the site may not work correctly if you do.

Tracking and advertising identifiers in the app

• The Hiyd mobile app does not track you across apps and websites owned by other companies.
• We do not use the Apple Advertising Identifier (IDFA) or the Google Advertising ID, and the app does not ask for App Tracking Transparency permission.
• We do not embed advertising SDKs, and we do not share app data with data brokers or advertising networks.
• The analytics we do collect, through PostHog, are used only to operate and improve the Service, and never to build advertising profiles.

The cookie and advertising activity described above relates to website and store data only. Health, wearable, Apple Health, and Health Connect data is never used for advertising and is never shared with advertising partners.

8. Data Retention and Deletion

We retain your personal information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Order and transaction records are kept for the period required by tax and accounting law.

Deleting your account

You can delete your account, and all data associated with it, from inside the Hiyd app:

1. Open the app and go to Settings.
2. Select Account.
3. Tap Delete Account and confirm.

You can also request deletion on our account deletion page, without installing or opening the app, or by emailing support@hiyd.ai from the address associated with your account.

What happens after deletion

• Your account and personal data, including any data read from Apple Health or Health Connect, are removed from our production systems immediately on confirmation.
• Residual copies may remain in encrypted backups for up to 30 days, after which they are permanently purged.
• Anonymised data that no longer identifies you may be retained for analytics and model improvement. This never includes data read from Apple HealthKit or Health Connect.
• We may retain limited information where the law requires it, for example transaction records for tax purposes, or to resolve a dispute.

Withdrawing consent

You can withdraw consent at any time by deleting your account, disabling specific permissions in your device settings (Apple Health, Health Connect, notifications), unsubscribing from marketing, or contacting support@hiyd.ai. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

9. Your Rights and Choices

Depending on where you live, you may have some or all of the rights below. To exercise any of them, contact support@hiyd.ai. We will verify your identity where the law permits or requires it, and respond within the timeframe applicable law sets. We will not discriminate against you for exercising these rights.

All users

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and data, as described in Section 8.
• Export your data in a portable format.

European Economic Area, United Kingdom, and Switzerland

You also have the right to restrict or object to processing, to withdraw consent at any time without affecting the lawfulness of prior processing, and to lodge a complaint with your local data protection authority. A list of EU authorities is available at edpb.europa.eu; UK users can contact the ICO at ico.org.uk. For the purposes of applicable data protection law, Hiyd Incorporated is the data controller of your personal information.

United States

Residents of California and other states with comprehensive privacy laws have the right to know what personal information we collect, to delete it, to correct it, to obtain a portable copy, to opt out of the "sale" or "sharing" of personal information and of targeted advertising (see Section 7), and to limit the use of sensitive personal information. We do not sell personal information for money, and we do not use or disclose sensitive personal information, including health data, for purposes other than those permitted by law and described in this Policy. You may also appeal a decision we make about your request by replying to our response or writing to support@hiyd.ai.

Canada

Canadian users may access and correct personal information held by Hiyd, and may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Authorised agents

Where applicable law allows, you may use an authorised agent to submit a request on your behalf. We will require proof of the agent's authority, and may need to verify your identity directly with you, before we act on the request.

10. Security

We use industry-standard administrative, technical, and physical safeguards to protect your information, including encryption in transit (TLS) and at rest, access controls, logging, and routine security reviews. Health data, including data read from Apple HealthKit and Health Connect, is encrypted in transit and at rest and is accessible only to the small number of personnel who need it to operate the Service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, so we recommend you do not use unsecured channels to send us sensitive information. If we become aware of a breach affecting your personal information, we will notify you and the applicable regulators as required by law.

11. Children's Privacy

Hiyd is intended for users 13 years of age and older, and the Service is not directed to children. We do not knowingly collect personal information from children under 13, and we do not have actual knowledge that we sell or share the personal information of anyone under 16. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, contact support@hiyd.ai.

Users between 13 and the age of digital consent in their jurisdiction, which may be up to 16 in parts of the EEA, should use the Service only with the involvement of a parent or legal guardian.

12. International Data Transfers

Hiyd is based in the United States, and we and our service providers, including DigitalOcean, Shopify, PostHog, Apple, Google, and Klaviyo, process your information in the United States and in other countries. If you are located in the European Economic Area, the United Kingdom, Switzerland, Canada, or anywhere else outside the United States, using the Service means your personal information is transferred to a country whose data protection laws may differ from those of your own. Where required, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the equivalent United Kingdom transfer contracts, and on your consent, to transfer personal information internationally.

13. Third-Party Links

The Service may link to websites and platforms operated by third parties. We do not control those sites and are not responsible for their content, privacy practices, or security. Review their privacy policies and terms before providing them with information. Our inclusion of a link does not imply endorsement.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or for operational, legal, or regulatory reasons. If we make material changes, we will notify you in the app, by email, or by another reasonable means before the changes take effect. The "Last updated" date at the top of this Policy shows when it was most recently revised. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

15. Contact Us

If you have questions, concerns, or requests about this Policy or your personal information, contact us:

Hiyd Incorporated
Email: support@hiyd.ai
Mailing address: 430 Navaro Pl, San Jose, CA