1. Overview & scope

This Privacy Notice (the "Notice") explains how VALT Wearables Inc. and its affiliates ("VALT," "we," "us," or "our") collect, use, store, disclose, and protect personal information when you use our websites, mobile applications, devices, APIs, and related services (collectively, the "Services"). It should be read together with our Terms & Conditions.

By accessing or using the Services, you acknowledge that you have read and understood this Notice. If you do not agree with it, please do not use the Services. This Notice may not address every product, integration, or jurisdiction, and supplemental notices may apply to specific features.

2. Information you provide directly

We collect information you choose to give us, including your name, email address, account credentials, date of birth, profile details, payment and billing information, manually logged health and wellness data (such as nutrition, mood, symptoms, activity, and goals), photographs you upload, and the content of any communications, feedback, survey responses, or support requests you send to us.

3. Health & biometric information

Depending on the features you use and the devices or integrations you connect, the Services may collect or derive health-related and biometric information, including heart rate and heart-rate variability, respiration, blood oxygen, blood pressure, temperature, sleep stages and timing, movement, steps, posture, workouts and training load, menstrual and reproductive data, glucose readings, body composition, lab and biomarker results, and health records you import.

Some of this information may be considered "sensitive," "special category," or "protected" data under applicable laws. Where required, we process it only with your consent or another lawful basis, and you may withdraw consent or disconnect a data source at any time.

4. Information from devices & integrations

When you connect a wearable, scale, glucose monitor, health platform (such as Apple Health or Google Fit), or other third-party application, you authorize VALT to receive data from that source through its provider. We may also collect device identifiers, firmware versions, sync timestamps, and connection logs. The data we receive, and its accuracy and completeness, are controlled by the third party and may change without notice.

5. Information collected automatically

When you use the Services, we automatically collect technical and usage information such as IP address, device and browser type, operating system, app version, language settings, referring pages, in-app actions, session duration, diagnostic and crash logs, and approximate or precise location (where you have enabled it). This information is collected using cookies, SDKs, log files, and similar technologies.

6. Cookies & tracking technologies

We and our service providers use cookies, local storage, pixels, and software development kits (SDKs) to enable core functionality, remember preferences, measure performance, and understand usage. You can control cookies through your browser or device settings; disabling them may limit certain features. Where required by law, we request consent before setting non-essential cookies, and we honor recognized opt-out signals (such as Global Privacy Control) where applicable.

7. How we use information

We use personal information to operate, maintain, secure, and improve the Services; to authenticate users and process transactions; to generate analytics, scores, trends, and personalized insights; to provide AI-assisted features; to communicate with you about updates, security, and support; to conduct research and product development; to prevent fraud and abuse; and to comply with legal obligations.

Scores, insights, predictions, and AI outputs are generated by automated systems and models that are continuously evolving. They are informational only, may be inaccurate or incomplete, and may change as our methods change.

8. Artificial intelligence & automated processing

Certain features use machine learning and large language models to analyze your data and produce summaries, answers, or suggestions. These outputs are probabilistic and may be wrong; they are not medical advice. We may use de-identified or aggregated data to develop and improve our models. We do not use your identifiable health data to train models without an appropriate legal basis or your consent where required.

9. Legal bases for processing

Where the GDPR, UK GDPR, or similar laws apply, we process personal information on one or more of the following bases: your consent; performance of a contract with you; compliance with a legal obligation; protection of vital interests; and our legitimate interests in operating and improving the Services, provided those interests are not overridden by your rights. For sensitive health data, we rely on your explicit consent or another permitted condition.

10. How we share information

We do not sell your personal information, and we will never sell your health data. We share information only as described here: with service providers and processors who operate the Services under confidentiality and data-protection obligations; with integration partners you direct us to connect; in connection with a merger, acquisition, financing, or sale of assets; to comply with law, legal process, or lawful requests; and to protect the rights, safety, and property of VALT, our users, and the public.

We may share de-identified or aggregated information that cannot reasonably be used to identify you for research, analytics, and product development.

11. Data retention

We retain personal information for as long as your account is active or as needed to provide the Services, and thereafter as required to meet legal, accounting, tax, security, or dispute-resolution obligations. Retention periods vary by data type and context. De-identified and aggregated data may be retained indefinitely. When information is no longer needed, we take reasonable steps to delete or anonymize it.

12. Data security

We implement reasonable technical and organizational measures designed to protect personal information, including encryption in transit and at rest, access controls, and monitoring. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential. If we become aware of a breach affecting your information, we will notify you and regulators as required by law.

13. International data transfers

We may process and store information in countries other than where you live, including the United States, which may have different data-protection laws. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers. By using the Services, you understand that your information may be transferred to and processed in such countries.

14. Your rights & choices

Depending on your location, you may have rights to access, correct, update, port, restrict, or delete your personal information; to object to certain processing; to withdraw consent; and to lodge a complaint with a supervisory authority. You can manage many of these directly in the app, including disconnecting integrations, exporting data, and deleting your account.

We will not discriminate against you for exercising your rights. To make a request, contact us using the details below; we may need to verify your identity before responding.

15. Region-specific disclosures (EEA/UK, California & others)

If you are in the EEA or UK, the rights and legal bases described above apply, and our EU/UK representative or contact can be reached via the details below. If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete, correct, and limit the use of sensitive personal information, and the right to opt out of "sharing" for cross-context behavioral advertising; we do not sell personal information. Residents of other jurisdictions may have similar rights under local law.

16. Children's privacy

The Services are not directed to children under the age required in their jurisdiction (and in no case under 16 unless permitted with verifiable parental consent). We do not knowingly collect personal information from children below the applicable age. If you believe a child has provided us information without proper consent, contact us and we will take appropriate steps to delete it.

17. Third-party services & links

The Services may integrate with, link to, or display content from third parties. Their handling of your information is governed by their own privacy policies, not this Notice. We are not responsible for the privacy practices of third parties, and we encourage you to review their terms before connecting or using them.

18. Accuracy & limitations of data

Information derived from devices, integrations, and our own algorithms may be incomplete, delayed, or inaccurate, and is provided for general wellness and informational purposes only. We make no representation that any metric is medically accurate or suitable for any particular purpose.

19. Changes to this Notice

We may update this Notice from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice through the Services or by other means. Your continued use of the Services after an update constitutes acceptance of the revised Notice.

20. Contact us

Questions, requests, or complaints regarding this Notice or your personal information can be directed to VALT Wearables Inc. at privacy@valt.health. We will respond within the timeframes required by applicable law.