Privacy Policy

1. Introduction

Welcome to Helsa Health ("we," "us," or "our"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you:

• Use the Helsa Health mobile application (the "App") for iOS or Android devices.
• Visit or interact with our website, https://helsa.health (the "Website").

By accessing or using our App or Website, you agree to this Privacy Policy. If you do not agree, please discontinue use of our services.

2. Who We Are & Applicable Law

Helsa Health is operated by Rimfrost LLC, a limited liability company incorporated in the State of Delaware, United States, while headquartered in both Zurich, Switzerland and San Fransisco, CA.

As a Delaware entity, the governing law for this policy and related terms shall be that of the State of Delaware, United States. However, because we operate globally, we also comply with:

• The Swiss Federal Act on Data Protection (FADP) for users in Switzerland, and
• The EU General Data Protection Regulation (GDPR) for users located in the European Economic Area (EEA).

3. Information We Collect

Account Registration Information

• Sign-In Methods: When you register or log in via Google Sign-In, Apple Sign-In, or email/password, we may collect your name, email address, and any other details you voluntarily provide (such as gender, birthday, or profile picture).
• User Profile: Additional health-related or lifestyle information you choose to include in your profile, such as height, goal weight, activity level, health conditions, etc.

Health and Wellness Data

We use Firebase (Firestore, Cloud Functions, Storage, etc.) to store various metrics, including:

• Weight and body composition metrics (e.g., muscle mass, body fat, waist circumference).
• Sleep metrics (sleep rating, sleep hours).
• Cardiovascular metrics (blood pressure, heart rate, HRV, VO2Max).
• Blood metrics (blood glucose, cholesterol, A1C, triglycerides).
• Activity & Nutrition metrics (activity score, calories burned, meal scans).
• Calm/Mental Wellness metrics (calm score, calm rating).
• Historical logs for the metrics above, including dates and timestamps.

Photos

The App allows you to take photos of your food. These images may be stored temporarily on Firebase Storage to analyze and display them back to you. The analysis is performed by AI tools and is used solely for providing personalized feedback or insights.

Voice Input with OpenAI Whisper

If you use voice input, your audio data will be processed by OpenAI Whisper to generate text transcriptions. We do not permanently store your voice recordings; however, OpenAI may temporarily store or log these recordings for service improvement or debugging. For details, please see OpenAI's Privacy Policy.

Analytics & Automatic Data Collection

• App analytics (PostHog): The App uses PostHog, hosted in the European Union, to understand how the App is used. It records which screens you open and actions such as starting onboarding, signing up, viewing the subscription screen, and starting or cancelling a purchase, together with a random identifier for your installation of the App, your account ID once you sign in, and technical information such as device model, operating system, App version, language, and time zone. PostHog does not receive your health answers, meals, medication or dose details, side effects, or other health data. It does not record your screen, is not used for advertising, and is not used to work out your location from your IP address. The Website does not use analytics.
• Crash reports (Firebase Crashlytics): If the App crashes, a crash report with technical details (such as device model, OS version, App version, and the error) is sent to Google Firebase so we can fix the problem.
• Subscriptions (RevenueCat): Purchases are made through Apple or Google. RevenueCat receives your purchase and subscription status together with your account ID, so the App can unlock Premium features.
• Meta (Facebook) SDK: The App includes Meta's software development kit, which may send Meta basic App events, such as when the App is installed or opened, along with device information. It does not receive your health data.
• Push Notifications: If you enable push notifications, we store your device token to send reminders or updates.
• Cloudflare: Our Website is hosted on Cloudflare Pages, which may collect IP addresses or other network data for security and performance purposes.

4. How We Use Your Information

Provision of Services

To personalize user experience, generate guidance, track metrics, and provide health insights or analytics.

AI/LLM Data Processing

• We use public large language models (LLMs) to analyze certain user health data and offer guidance.
• We make efforts to exclude personal identifiers (such as name, email, birthday, profile picture) from the data shared with the LLM. Only relevant health metrics or textual inputs are analyzed.
• This helps improve our recommendation accuracy and user experience.

Communications

• To send important notifications related to your account, including subscription reminders, security updates, and push notifications about daily health checks or meal scans.
• To respond to your inquiries and provide customer support.

Analytics & Service Improvement

To track usage trends, enhance our features, and develop new services.

Legal Compliance & Protection

• To comply with applicable Swiss law, EEA regulations, or any court orders.
• To protect our rights, privacy, safety, or property and that of our users.

5. Legal Bases for Processing (If Applicable Under GDPR)

If you are in the EEA, we process your personal data based on one or more of the following legal bases:

• Your Consent: Where you have given consent (e.g., for push notifications or marketing).
• Contractual Necessity: Where processing is necessary for the performance of a contract (e.g., our Terms of Service).
• Legitimate Interests: For our legitimate interests, such as understanding how the App is used through analytics and improving our services, provided these are not overridden by your interests or fundamental rights.
• Legal Obligation: Where we have a legal duty to retain or disclose information.

6. Disclosure of Your Information

Service Providers

We share information with third-party vendors (e.g., Google Firebase, PostHog, RevenueCat, Cloudflare) who assist us with data hosting, analytics, subscriptions, and support. They are bound by confidentiality obligations and may only use your data as instructed.

OpenAI Whisper & LLM Providers

We share anonymized/pseudonymized data with OpenAI for voice-to-text processing or text-based guidance. According to OpenAI's policy, audio may be stored temporarily for service improvement. See OpenAI's Privacy Policy for more information.

Business Transfers

Your information may be transferred if we undergo a merger, acquisition, or asset sale. We will notify users before personal data becomes subject to a new privacy policy.

Legal Requirements

We may disclose personal data if required by law or to respond to valid legal processes.

7. International Data Transfers

As Rimfrost, LLC is a U.S.-registered company and uses cloud-based infrastructure, your data may be transferred to, and processed in, countries outside your place of residence, including the United States, Switzerland, and EU countries.

When we transfer data internationally, we ensure appropriate safeguards are in place under applicable laws (e.g., Standard Contractual Clauses under GDPR or adequacy decisions under Swiss FADP).

8. Data Retention

We retain your data as long as your account is active or as necessary for the purposes outlined in this Policy. You can request deletion of your account and data by contacting us at hi@helsa.health. We will make reasonable efforts to honor your request unless we are legally required to keep certain data.

9. Your Rights

Depending on your jurisdiction (e.g., Switzerland, EEA), you may have the right to:

• Access, rectify, or erase your personal data.
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent (where processing is based on consent).
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, please contact hi@helsa.health.

10. Security

We employ appropriate technical and organizational measures to protect your personal data, including encrypted connections (HTTPS) and secure Firebase cloud storage. However, no transmission method over the internet or electronic storage is completely secure.

11. Children's Privacy & Minimum Age

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal data from children under 16 without parental or guardian consent. If you believe a child under 16 has provided us with personal data, please contact hi@helsa.health so we can remove the data and delete the account if necessary.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. The "Effective Date" at the top indicates when this Privacy Policy was last revised. If we make significant changes, we will notify you via email or by prominently posting a notice on our App or Website.

13. Contact Us

If you have questions, concerns, or requests about this Privacy Policy, please contact: