Privacy Policy: HealthTrack Application

Comprehensive Privacy Policy Compliant with GDPR and CCPA

Effective Date: [DATE] Last Updated: [DATE] Version: 1.0

---

Plain Language Commitment: We will explain each section in plain language alongside the formal legal language. Look for the "What This Means" callouts throughout this document.

---

TABLE OF CONTENTS

1. Introduction and Scope
2. Legal Basis for Data Processing
3. What Data We Collect
4. Biometric Data: Special Provisions
5. How We Use Your Data
6. Data Storage and Security
7. Data Sharing and Disclosure
8. Your Rights Under GDPR
9. Your Rights Under CCPA
10. Data Retention and Deletion
11. Biometric Data: Storage, Sharing, and Deletion Protocol
12. Children's Privacy
13. Cross-Border Data Transfers
14. Cookies and Tracking Technologies
15. Changes to This Policy
16. Contact Information and Complaints

---

SECTION 1: INTRODUCTION AND SCOPE

1.1 Who We Are

[Company Name] ("Company," "we," "us," or "our") operates the HealthTrack application ("App"), a health and wellness tracking platform. We are:

• GDPR: The Data Controller responsible for your personal data
• CCPA: A Business that collects consumers' personal information

Registered Address: [Address] Data Protection Officer (DPO): [Name] — privacy@healthtrack.com EU Representative: [Name/Company] — [Address]

1.2 Scope of This Policy

This policy applies to:

Scope	Coverage
Geographic	EEA residents (GDPR), California residents (CCPA), all other users
Platforms	iOS app, Android app, web dashboard
Services	Health tracking, analytics, coaching features
Data Types	All personal and biometric data collected

What This Means: This policy covers everyone who uses HealthTrack. If you live in Europe or California, you have additional specific rights we explain in detail.

---

SECTION 2: LEGAL BASIS FOR DATA PROCESSING

2.1 GDPR Legal Bases

We process your data only when we have a valid legal basis. For each category:

Data Category	Legal Basis	Article
Account creation	Contract (Art. 6(1)(b))	Necessary to provide the service
Biometric/health data	Explicit Consent (Art. 9(2)(a))	Sensitive category — requires opt-in
Safety features	Vital Interests (Art. 6(1)(d))	Emergency situations only
Legal compliance	Legal Obligation (Art. 6(1)(c))	Required by law
App improvements	Legitimate Interests (Art. 6(1)(f))	After balancing test conducted
Marketing	Consent (Art. 6(1)(a))	Separate opt-in required

2.2 Explicit Consent for Biometric Data

Because biometric and health data constitutes Special Category Data under GDPR Article 9, we:

• Obtain separate, specific, informed, and unambiguous consent before collection
• Present consent requests in plain language, not buried in terms
• Allow consent to be withdrawn at any time without detriment
• Maintain records of all consent with timestamps and version tracking
• Never make service access conditional on biometric data consent

2.3 CCPA Framework

Under CCPA/CPRA, we acknowledge:

• Biometric data is a Sensitive Personal Information category
• We do not sell biometric or health data (and honor opt-outs for all other categories)
• We do not share biometric data for cross-context behavioral advertising
• Users may limit the use of sensitive personal information

What This Means: We will always ask for your specific permission before collecting health or body-related data. You can say no, and we cannot punish you for saying no.

---

SECTION 3: WHAT DATA WE COLLECT

3.1 Data Collection Categories

A. Account and Identity Data

• Name and username
• Email address
• Password (hashed — we never store plaintext passwords)
• Date of birth
• Gender (optional)
• Profile photo (optional)
• Account creation date and IP address

B. Health and Fitness Data (Requires Separate Consent)

• Heart rate and heart rate variability (HRV)
• Blood oxygen levels (SpO2)
• Sleep patterns and sleep stages
• Menstrual cycle data
• Caloric intake and nutritional information
• Exercise type, duration, and intensity
• Body weight, BMI, and body measurements
• Blood glucose readings (if manually entered)
• Medication tracking (if used)
• Mental wellness scores and mood logs
• Step count and activity levels

C. Biometric Data (Requires Explicit Separate Consent) ⚠️

• Fingerprint data (for app authentication only)
• Face ID / facial recognition data (for app authentication only)
• Continuous heart rate biometrics from wearables
• Unique physiological identifiers derived from health patterns

D. Device and Technical Data

• Device type, model, and operating system
• App version
• IP address (anonymized after 30 days)
• Crash reports and error logs
• Time zone and language settings

E. Usage Data

• Features accessed and frequency
• Session duration
• Navigation patterns within the app
• Goals set and progress

F. Data We Do NOT Collect

✗ Social Security Numbers
✗ Financial account numbers or credit card data
✗ Insurance information
✗ Precise location beyond what you explicitly share
✗ Contacts or communications from your device
✗ Any data from minors under 16 (GDPR) / 16 (CCPA)

3.2 How Data Is Collected

Method	Description
Direct input	You manually enter data
Wearable sync	Connected devices (Apple Watch, Fitbit, Garmin, etc.)
HealthKit/Google Fit	Platform health APIs (with your permission)
Automatic sensors	Phone sensors with your permission
Third-party sources	Only with your explicit authorization

What This Means: We collect health information you share with us or that comes from your fitness devices. We collect fingerprint or face data ONLY to let you log in securely — not for any other purpose.

---

SECTION 4: BIOMETRIC DATA — SPECIAL PROVISIONS

4.1 Definition of Biometric Data

For purposes of this policy, biometric data means:

Unique physical or behavioral characteristics used to identify or authenticate individuals, including but not limited to: fingerprint templates, facial geometry data, heart rate patterns that create unique physiological signatures, and any derived identifiers.

This definition is intentionally broad and consistent with:

• GDPR Article 4(14)
• Illinois BIPA (Biometric Information Privacy Act)
• CCPA/CPRA sensitive personal information category
• Washington My Health MY Data Act

4.2 Biometric Data Consent Requirements

Before collecting any biometric data, we will:

Step 1 — Disclosure: Present a clear notice stating:

• The specific biometric data to be collected
• The specific purpose(s) for collection
• How long data will be retained
• Whether data will be shared and with whom

Step 2 — Written Consent: Obtain your affirmative, written (digital) consent separately from our general terms.

Step 3 — Consent Record: Store your consent with:

• Date and time of consent
• Version of policy at time of consent
• Specific purposes consented to
• Method of consent given

Step 4 — Ongoing Consent Management: Provide easy access to withdraw consent at any time through Settings → Privacy → Biometric Data Consent.

4.3 Specific Biometric Use Limitations

Biometric Type	Permitted Use	Prohibited Use
Fingerprint data	App authentication only	Marketing, profiling, sharing
Face ID data	App authentication only	Identity verification for third parties
Heart rate patterns	Health insights for YOU	Advertising targeting, employer sharing
Sleep biometrics	Personal health dashboard	Insurance decisions, sales
Physiological signatures	Trend analysis for you	Law enforcement (absent court order)

---

SECTION 5: HOW WE USE YOUR DATA

5.1 Primary Purposes

Purpose	Data Used	Legal Basis
Providing health tracking service	All health data	Contract + Consent
Authentication and security	Biometric (authentication only)	Legitimate interest + Consent
Personalized health insights	Health and activity data	Consent
App functionality and bug fixing	Usage and device data	Legitimate interest
Customer support	Account data, relevant health context	Contract

5.2 Secondary Purposes (Opt-In Only)

Purpose	Opt-In Required	Data Used
Research contributions	✅ Yes — explicit	Anonymized/aggregated health data
Personalized coaching	✅ Yes	Health trends
Health notifications	✅ Yes	Relevant health metrics
Marketing communications	✅ Yes	Contact info only

5.3 What We Will Never Do

✗ Sell your personal or biometric data to third parties
✗ Share biometric data with employers, insurers, or government agencies
   (except under valid legal compulsion — see Section 7.4)
✗ Use health data for targeted advertising
✗ Share identifiable health data for research without explicit consent
✗ Use your data to make automated decisions with legal or similarly
   significant effects without human review
✗ Discriminate against you for exercising your privacy rights

What This Means: Your health data helps US give YOU better insights. We do not profit by selling your information or use it against you in any way.

---

SECTION 6: DATA STORAGE AND SECURITY

6.1 Storage Architecture

Infrastructure

Primary Storage:    AWS / Azure [specify] — Region: [US-East/EU-West]
Backup Storage:     [Provider] — Encrypted backups
Data Residency:     
  - EU users: Data stored in EU-based servers
  - US users: Data stored in US-based servers
  - Other regions: [Specify]

Encryption Standards

Data State	Standard	Key Management
At rest	AES-256 encryption	AWS KMS / Azure Key Vault
In transit	TLS 1.3 minimum	Certificate pinning
Biometric templates	AES-256 + additional tokenization	Hardware Security Module (HSM)
Database encryption	Transparent Data Encryption (TDE)	Separate key management
Backup encryption	AES-256	Separate backup keys

6.2 Biometric-Specific Storage Protections

Biometric data receives additional security layers beyond standard personal data:

Layer 1: Device-level storage where technically possible
         (Fingerprint/Face ID processed locally via Secure Enclave / TrustZone)

Layer 2: If server-side storage is necessary:
         - Stored as irreversible mathematical representations (templates)
         - Never stored as raw biometric images
         - Isolated in dedicated, air-gapped database segments
         - Accessible only by authenticated, authorized processes

Layer 3: Access controls
         - Strict role-based access (minimum 2 personnel with access)
         - All access logged with immutable audit trail
         - No human-readable access to biometric templates
         - Multi-factor authentication required for all access

Layer 4: Monitoring
         - Continuous anomaly detection
         - Automated alerts for unusual access patterns
         - Regular penetration testing (quarterly minimum)
         - Annual third-party security audits

6.3 Security Certifications and Standards

We maintain compliance with:

• SOC 2 Type II — Annual audit
• ISO 27001 — Information security management
• HIPAA Security Rule — Technical safeguards (where applicable)
• NIST Cybersecurity Framework — Ongoing implementation

6.4 Data Breach Response

In the event of a confirmed breach involving personal data:

GDPR Timeline:

• Notify supervisory authority: Within 72 hours
• Notify affected individuals: Without undue delay when high risk exists
• Document all breaches in our breach register regardless of notification requirement

CCPA/CPRA Timeline:

• Notify affected California residents: In the most expedient time possible
• Notify California Attorney General: If breach affects 500+ California residents

What This Means: Your data is locked with military-grade encryption. Biometric data is treated with an extra level of protection. If something goes wrong, we will tell you quickly.

---

SECTION 7: DATA SHARING AND DISCLOSURE

7.1 Sharing Categories Overview

Recipient	Data Shared	Legal Basis	Your Control
Cloud infrastructure providers	All (as processors)	Processing agreement	Cannot opt out (essential)
Analytics providers (anonymized)	Aggregated stats only	Legitimate interest	Opt-out available
Healthcare providers	Only if YOU share/export	Your action	Full control
Research partners	Anonymized only with consent	Consent	Opt-in required
Emergency services	Relevant health data	Vital interests	Cannot opt out
Law enforcement	Legally required only	Legal obligation	See Section 7.4

7.2 Service Provider (Processor) Requirements

All third parties who process your data must:

✅ Sign a Data Processing Agreement (DPA) meeting GDPR Article 28 requirements ✅ Demonstrate equivalent security standards ✅ Process data only on our documented instructions ✅ Assist with data subject rights requests ✅ Delete or return data upon contract termination ✅ Submit to audits upon request ✅ Notify us of breaches within 24 hours

Current Service Providers (Processors):

Provider	Purpose	Location	Safeguard
[Cloud Provider]	Infrastructure	US/EU	SCCs + DPA
[Analytics Provider]	App analytics	[Location]	DPA — anonymized only
[Support Platform]	Customer service	[Location]	DPA
[Email Provider]	Transactional emails	[Location]	DPA

Full list available at: [URL] or upon request

7.3 Data We Do NOT Share

❌ Biometric data — Never shared with third parties for any commercial purpose
❌ Identifiable health data — Never sold or shared for advertising
❌ Any data — Not sold to data brokers
❌ Health data — Not shared with employers, insurance companies,
                 financial institutions, or housing providers

7.4 Legal Compulsion Disclosure

We may be required to disclose data to law enforcement or government agencies. When this occurs:

Our Process:

1. We will review all requests for legal sufficiency
2. We will challenge overbroad or legally deficient requests
3. We will notify you before disclosure where legally permitted
4. We will provide minimum necessary data only
5. We will document all disclosures in our transparency report

We will not voluntarily provide biometric data to law enforcement absent:

• A valid court order or warrant
• Emergency circumstances involving imminent threat to life
• Your explicit consent

What This Means: We share data with companies that help us run the app — and they're all contractually bound to protect your information. We do not sell your data. Ever.

---

SECTION 8: YOUR RIGHTS UNDER GDPR

Applicable to residents of the European Economic Area (EEA), UK, and Switzerland

8.1 Your Rights Summary

Right	What It Means	How to Exercise	Response Time
Right of Access (Art. 15)	Get a copy of all your data	In-app or email	30 days
Right to Rectification (Art. 16)	Correct inaccurate data	In-app or email	30 days
Right to Erasure (Art. 17)	Delete your data ("right to be forgotten")	In-app or email	30 days
Right to Restrict Processing (Art. 18)	Limit how we use your data	Email request	30 days
Right to Data Portability (Art. 20)	Receive data in machine-readable format	In-app export	30 days
Right to Object (Art. 21)	Object to processing based on legitimate interests	Email request	Immediately upon receipt
Right to Withdraw Consent (Art. 7(3))	Withdraw any previously given consent	In-app settings	Immediately
Rights re: Automated Decisions (Art. 22)	Human review of automated decisions	Email request	30 days

8.2 How to Exercise GDPR Rights

Option 1 — In-App (Fastest): Settings → Privacy & Data → My Rights → Select Right

Option 2 — Email: privacy@healthtrack.com Subject line: "GDPR Rights Request — [Your Name] — [Right Requested]"

Option 3 — Written Request: [Physical Address]

Verification: We will verify your identity before processing rights requests. We will not request excessive information — typically email verification is sufficient.

No Fees: We do not charge for rights requests unless they are manifestly unfounded or excessive, in which case we will inform you before charging.

8.3 Right to Lodge a Complaint

You have the right to complain to your national data protection authority:

• EU residents: Your national DPA (list at edpb.europa.eu)
• UK residents: Information Commissioner's Office (ico.org.uk)
• Switzerland: Federal Data Protection and Information Commissioner

---

SECTION 9: YOUR RIGHTS UNDER CCPA/CPRA

Applicable to California residents

9.1 CCPA/CPRA Rights Summary

Right	Description	Response Time
Right to Know	What personal information we collect, use, share	45 days (extendable)
Right to Delete	Request deletion of your personal information	45 days
Right to Correct	Correct inaccurate personal information	45 days
Right to Opt-Out of Sale/Sharing	Stop sale or sharing of personal info	Honored immediately
Right to Limit Use of Sensitive PI	Restrict use of sensitive personal information	Honored immediately
Right to Non-Discrimination	Exercise rights without penalty	Always applies
Right to Know About Automated Decision-Making	Understand automated profiling	45 days

9.2 Sensitive Personal Information Under CCPA/CPRA

Your biometric and health data is classified as Sensitive Personal Information (SPI). You have the right to direct us to:

• Use SPI only to provide the service you requested
• Not use SPI for inferring characteristics about you
• Not share SPI for cross-context behavioral advertising

To exercise this right: [Do Not Share My Sensitive Personal Information] — [Link]

9.3 "Do Not Sell or Share My Personal Information"

We do not sell personal information as defined by CCPA.

However, you may still opt out of any data sharing: [Do Not Sell or Share My Personal Information] — [Link]

9.4 How to Submit CCPA Requests

Online: [Privacy Request Portal URL] Toll-Free Number: 1-800-XXX-XXXX (available Monday–Friday, 9 AM–5 PM PT) Email: ccpa@healthtrack.com

Verification Process:

• We will verify your identity using information we already hold
• We may ask you to confirm up to two pieces of personal information
• We will not require creation of a new account
• Authorized agents may submit requests with proper documentation

9.5 Authorized Agents

California residents may designate an authorized agent to exercise rights. We require:

• Written authorization signed by you, or
• Power of attorney pursuant to California Probate Code
• We may verify the request directly with you

---

SECTION 10: DATA RETENTION AND DELETION

10.1 Retention Schedule

Data Category	Retention Period	Basis
Account data	Duration of account + 2 years	Contract/Legal
Health and fitness data	Duration of account + 1 year (unless deletion requested)	Consent
Biometric data	Duration of consent or 3 years, whichever is shorter	Consent
Authentication biometrics	Session/device only (not retained server-side where possible)	Security
Financial transaction records	7 years	Legal (tax/accounting)
Security logs	2 years	Legitimate interest
Anonymized/aggregated data	Indefinitely (cannot be re-identified)	Legitimate interest
Backup data	Rolling 90-day backup window	Security

10.2 Automatic Deletion Triggers

Data will be automatically deleted when:

⏰ Biometric data consent expires — deleted within 30 days
⏰ Account inactive for 2 consecutive years — notification sent, then deletion
⏰ Subscription cancellation — health data retained 1 year, then deleted
⏰ Consent withdrawn — relevant data deleted within 30 days
⏰ Account deletion requested — see Section 11

---

SECTION 11: BIOMETRIC DATA — COMPLETE STORAGE, SHARING, AND DELETION PROTOCOL

This section provides the detailed technical and procedural framework for biometric data handling.

11.1 Biometric Data Storage Protocol

Collection Phase

Step 1: CONSENT GATE
        ↓
        User must complete separate biometric consent flow
        Consent is version-controlled and timestamped
        ↓
Step 2: MINIMIZATION CHECK
        ↓
        Only collect biometric data strictly necessary for stated purpose
        Default: Process biometrics on-device where possible
        ↓
Step 3: TRANSFORMATION
        ↓
        Raw biometric data (e.g., fingerprint scan) is IMMEDIATELY converted
        to a mathematical template/hash
        Original biometric image/recording is NEVER stored
        ↓
Step 4: TOKENIZATION
        ↓
        Template is assigned a random token ID
        Token is stored in main database
        Actual biometric template stored in isolated secure vault
        The two are never stored together
        ↓
Step 5: ENCRYPTION
        ↓
        Template encrypted with AES-256
        Key stored in Hardware Security Module (HSM)
        ↓
Step 6: ISOLATION
        ↓
        Stored in dedicated biometric data store
        Separated from all other personal data
        Separate access controls and audit logging

Storage Locations

Authentication Biometrics (Fingerprint/Face ID):
├── PRIMARY: Device Secure Enclave (iOS) / StrongBox (Android)
│   └── Never leaves the device
│   └── No server-side storage
│
└── FALLBACK (if device doesn't support secure storage):
    └── Server-side encrypted template vault
        ├── AES-256 encryption
        ├── HSM-managed keys
        └── Isolated network segment

Health Biometrics (Heart rate patterns, physiological signatures):
├── Encrypted at-rest (AES-256)
├── User-specific encryption keys
├── Stored separate from identity data
└── Accessible only through authenticated API with audit logging

Data Flow Diagram

User Device          App Server           Secure Vault         Your Dashboard
    │                    │                    │                    │
    │──Biometric Input──▶│                    │                    │
    │                    │──Transform to──────▶│                   │
    │                    │   Template         │                    │
    │                    │──Store Token──────▶│                    │
    │                    │                    │──Encrypted─────────▶│
    │                    │                    │  Template          │
    │◀─Confirmation──────│                    │                    │
    │                    │                    │                    │
[Raw biometric data deleted from all processing nodes immediately]

11.2 Biometric Data Sharing Protocol

Sharing Decision Tree

Request to share biometric data?
              │
              ▼
    Is this for authentication?
    ├── YES → Process locally, no sharing
    └── NO → Continue
              │
              ▼
    Is this a legal compulsion (court order/warrant)?
    ├── YES → Review validity → Challenge if deficient
    │         Notify user → Disclose minimum necessary
    └── NO → Continue
              │
              ▼
    Is this for research?
    ├── YES → Explicit separate consent obtained?
    │         ├── YES → Anonymize/aggregate → Share
    │         └── NO → Deny request
    └── NO → Continue
              │
              ▼
    Is this a service provider (processor)?
    ├── YES → DPA signed? Security verified? Minimum necessary?
    │         ├── YES → Permitted under specific conditions
    │         └── NO → Deny request
    └── NO → DENY — No legitimate basis exists

Absolute Sharing Prohibitions

BIOMETRIC DATA WILL NEVER BE SHARED WITH:

❌ Employers or prospective employers
❌ Insurance companies (health, life, disability)
❌ Financial institutions for credit decisions
❌ Advertisers or marketing platforms
❌ Data brokers
❌ Government agencies without valid legal compulsion
❌ Social media platforms
❌ Other apps or platforms without explicit, specific consent
❌ International recipients without adequate protections

11.3 Biometric Data Deletion Protocol

This is the most critical section for biometric data rights. We commit to the following:

Deletion Triggers

Trigger	Deletion Timeline	Process
User deletion request	30 days maximum (target: 48 hours for biometrics)	Automated + verified
Consent withdrawal	30 days maximum	Automated
Account deletion	30 days maximum	Comprehensive sweep
Retention period expiry	Automatic at expiry	Scheduled job
Specific consent expiry	Automatic at expiry	Scheduled job
Legal basis no longer applies	Immediate	Triggered process

Deletion Process — Step by Step

DELETION REQUEST RECEIVED
          │
          ▼
STEP 1: VERIFICATION (24-48 hours)
├── Verify identity of requestor
├── Log deletion request with timestamp
└── Send confirmation of receipt to user

          │
          ▼
STEP 2: SCOPE IDENTIFICATION (48-72 hours)
├── Identify all biometric data across ALL systems:
│   ├── Primary database
│   ├── Backup systems
│   ├── Archive storage
│   ├── Disaster recovery copies
│   ├── Third-party processors
│   └── Anonymized dataset contributions (if applicable)
└── Generate deletion manifest

          │
          ▼
STEP 3: PRIMARY DELETION (Within 7 days of verification)
├── Delete biometric templates from secure vault
├── Delete associated tokens from main database
├── Delete consent records (retain record THAT consent existed — not the data)
├── Delete any derived data unique to this user's biometrics
└── Overwrite deleted storage locations (DoD 5220.22-M standard or equivalent)

          │
          ▼
STEP 4: PROCESSOR DELETION (Within 14 days)
├── Issue deletion instructions to all data processors
├── Obtain written confirmation of deletion
└── Document in deletion log

          │
          ▼
STEP 5: BACKUP AND ARCHIVE DELETION (Within 30 days)
├── Flag backups containing this user's biometric data for purging
├── Purge from all backup rotations
└── Confirm backup deletion

          │
          ▼
STEP 6: VERIFICATION AND AUDIT (Within 30 days)
├── Technical verification that deletion is complete
├── Review deletion manifest against all known storage locations
├── Generate deletion certificate
└── Notify user of completion with deletion certificate

          │
          ▼
STEP 7: RETAIN PROOF OF DELETION
├── Maintain log that data existed and was deleted (no biometric data retained)
├── Retain consent record showing consent was given and withdrawn
└── Retain deletion request record for legal compliance

What "Deletion" Technically Means

We define deletion to mean:

CRYPTOGRAPHIC DELETION:
For encrypted data: We destroy the encryption keys, rendering
the data permanently inaccessible and cryptographically unrecoverable.
Timeline: Immediate for key destruction

PHYSICAL DELETION:
We overwrite the storage locations using secure deletion standards.
Data cannot be reconstructed through forensic means.
Timeline: Within 30 days

BACKUP DELETION:
Backups are purged on their next rotation cycle within 30 days.
No backup contains recoverable biometric data after this period.

Deletion Limitations and Exceptions

We will notify you if we cannot immediately delete data because of:

Exception	Basis	Duration
Active legal hold	Court order or litigation	Duration of hold
Regulatory investigation	Legal obligation	Duration of investigation
Fraud prevention	Up to 12 months	Legal basis documented

Even in these cases:

• Data is locked with restricted access
• Not used for any other purpose
• Deleted immediately when the exception no longer applies

Deletion Confirmation

Upon completed deletion, you will receive:

DELETION CERTIFICATE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
User ID: [Token — not real ID for security]
Request Date: [DATE]
Completion Date: [DATE]
Data Types Deleted: [List]
Systems Cleared: [List]
Processor Confirmations: [List]
Certificate ID: [Unique ID for verification]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
This certificate confirms deletion in accordance with
GDPR Article 17 and CCPA Section 1798.105

What This Means: When you ask us to delete your biometric data, we actually delete it — from everywhere, including backups. We'll send you written proof. Target: deleted within 48 hours; complete across all systems within 30 days.

---

SECTION 12: CHILDREN'S PRIVACY

We do not knowingly collect data from children:

• Under 16 in the EEA (GDPR Article 8)
• Under 16 in California (CCPA)
• Under 13 elsewhere (COPPA)

If we discover we have collected data from a child below the applicable age:

• We will delete it immediately without request
• We will notify the parent/guardian if contact information is available
• We will review how the collection occurred and prevent recurrence

Age Verification: We implement reasonable age verification at signup. We do not collect biometric data to verify age.

---

SECTION 13: CROSS-BORDER DATA TRANSFERS

13.1 GDPR Transfer Safeguards

When transferring EU/EEA personal data outside the EEA, we use:

Mechanism	Application
Standard Contractual Clauses (SCCs)	Primary transfer mechanism — all non-adequate countries
Adequacy Decisions	UK, Switzerland, Canada, and other adequate countries
Binding Corporate Rules	Intra-group transfers
Explicit Consent	Case-by-case, where appropriate

Transfer Impact Assessments (TIA): We conduct TIAs for all transfers to countries without adequacy decisions, assessing:

• Laws of the recipient country
• Risk of government access
• Supplementary technical measures in place

13.2 Biometric Data Transfer Restrictions

Biometric data transfers are subject to heightened restrictions:

✅ Transfer permitted:
   - Within the EU/EEA
   - To countries with adequacy decisions
   - Via SCCs with completed TIA showing adequate protection

❌ Transfer not permitted:
   - To countries with demonstrated government surveillance risks
     without supplementary measures
   - To processors that cannot demonstrate equivalent security
   - Without documented transfer mechanism on file

---

SECTION 14: COOKIES AND TRACKING TECHNOLOGIES

14.1 App Tracking

Tracker Type	Purpose	Basis	Control
Essential session tokens	App function	Contract	Cannot disable

VITALFLOW HEALTH, INC. PRIVACY POLICY

Last Updated: [Date] Effective Date: [Date]

---

1. INTRODUCTION AND SCOPE

VitalFlow Health, Inc. ("VitalFlow," "we," "us," or "our") respects your privacy and is committed to protecting your personal data, including biometric and health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, website, and related services (collectively, the "Services").

This Policy is designed to comply with:

• The General Data Protection Regulation (GDPR) (EU) 2016/679
• The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
• The Illinois Biometric Information Privacy Act (BIPA) and other applicable biometric privacy laws

IMPORTANT: Biometric data and health data constitute "Special Category Data" under GDPR and "Sensitive Personal Information" under CCPA. We process this data only with your explicit consent and under the strict security protocols described below.

---

2. DATA CONTROLLER AND CONTACT INFORMATION

Data Controller (GDPR): VitalFlow Health, Inc. [Address] Email: privacy@vitalflow.com

Designated Data Protection Officer (DPO): [Name] dpo@vitalflow.com

---

3. INFORMATION WE COLLECT

A. Categories of Personal Information (CCPA Categories)

• Identifiers: Name, email, device ID, IP address
• Commercial Information: Transaction history, subscription details
• Internet Activity: App usage, diagnostic data
• Geolocation Data: With your consent, for activity tracking
• Sensory Data: Photos/videos you upload
• Professional or Employment Information: If provided
• Inferences: Health insights and fitness predictions

B. Special Category Data (GDPR Article 9)

• Health Data: Heart rate, blood pressure, sleep patterns, medical history, symptoms logged
• Biometric Data:
  • Fingerprint authentication data (if enabled)
  • Facial recognition templates (if used for accessibility features)
  • Voice patterns (if using voice-logged symptom tracking)
  • Gait analysis/activity recognition patterns
  • Note: We collect only biometric templates (mathematical representations), not raw biometric images unless required for specific diagnostic features with separate consent.

---

4. LEGAL BASIS FOR PROCESSING

Under GDPR:

• Article 6(1)(a): Consent (for biometric and non-essential data)
• Article 6(1)(b): Contract performance (account creation, service provision)
• Article 9(2)(a): Explicit consent (for health and biometric data)
• Article 6(1)(f): Legitimate interests (fraud prevention, security) — does not apply to biometric/health data

Under CCPA:

• We collect Sensitive Personal Information only for specific business purposes compatible with your expectations and disclosed at collection.
• We do not sell biometric data to third parties.
• We do not share biometric data for cross-context behavioral advertising.

---

5. HOW WE USE YOUR INFORMATION

We use biometric and health data exclusively for:

• Authenticating your identity (biometric login)
• Providing personalized health insights and recommendations
• Generating anonymized research datasets (with explicit opt-in)
• Complying with legal obligations
• Protecting vital interests in emergency situations (only if explicitly authorized by you)

We do NOT use biometric data for:

• Marketing to third parties
• Building cross-platform user profiles
• Employment decisions or insurance underwriting
• Any purpose not disclosed at collection

---

6. DATA STORAGE AND SECURITY: BIOMETRIC DATA PROTOCOLS

A. Storage Architecture

Encryption Standards:

• At Rest: Biometric templates are encrypted using AES-256 encryption stored in isolated hardware security modules (HSMs) or secure enclaves (iOS Secure Enclave/Android Keystore)
• In Transit: TLS 1.3 with perfect forward secrecy for all biometric data transmission
• Key Management: Encryption keys are stored separately from data; biometric templates are irreversibly hashed using salted cryptographic one-way functions where technically feasible

Data Minimization:

• We store templates only, not raw biometric samples (e.g., we store fingerprint minutiae points, not fingerprint images)
• Templates are mathematically irreversible—reconstruction of original biometric characteristics is computationally infeasible
• Health data is pseudonymized with unique identifiers separate from account data

Geographic Storage:

• EU user data stored in EU-based servers (Frankfurt, Ireland)
• US user data stored in US-based servers with GDPR-compliant processing agreements
• Biometric data never stored in "high-risk" jurisdictions lacking adequate protection decisions

B. Retention Periods

• Active Accounts: Biometric templates retained only while you maintain active biometric authentication settings
• Inactive Accounts: Automatic deletion of biometric data after 2 years of inactivity
• Health Records: Retained per medical records retention laws (typically 7-10 years) or until account deletion, unless you request earlier deletion (see Section 8)
• Backup Systems: Biometric data purged from backups within 90 days of deletion request (see Section 9)

---

7. DATA SHARING AND DISCLOSURE: BIOMETRIC DATA LIMITATIONS

A. Strict Prohibition on Sale/Sharing

• We do NOT sell, rent, trade, or lease biometric data to any third party for monetary or other valuable consideration (CCPA § 1798.140(ad))
• We do NOT share biometric data with service providers for cross-context behavioral advertising

B. Limited Disclosure Categories

Service Providers (Processors): We share biometric data only with:

• Cloud infrastructure providers (AWS, Google Cloud) under Data Processing Agreements (DPAs) requiring:
  • Processing only on documented instructions
  • Confidentiality obligations
  • Security measures meeting ISO 27001 and SOC 2 Type II standards
  • Prohibition on sub-processing without consent
  • Return/deletion of data upon contract termination

Medical Professionals:

• Only with your explicit, case-by-case authorization via HIPAA-compliant secure messaging
• Requires separate Business Associate Agreement (BAA) if applicable

Legal Requirements:

• Only in response to valid subpoenas, court orders, or to comply with applicable laws
• We will attempt to notify you unless prohibited by law
• Exception: We will contest any overbroad requests seeking biometric or health data

Corporate Transactions:

• In merger/acquisition scenarios, biometric data remains subject to this Policy
• Acquirers must provide privacy commitments substantially similar to this Policy
• You will be notified 30 days prior to any transfer enabling opt-out/deletion

C. Research Partnerships

• Biometric/health data shared only in aggregated, anonymized form where re-identification is impossible (k-anonymity ≥ 5)
• Requires Institutional Review Board (IRB) approval for any identified research
• Explicit opt-in required for each research project

---

8. YOUR RIGHTS AND CHOICES

GDPR Rights (Articles 15-22):

• Right to Access: Receive copy of your data within 30 days
• Right to Rectification: Correct inaccurate biometric templates or health records
• Right to Erasure ("Right to be Forgotten"): Request deletion (see Section 9)
• Right to Restrict Processing: Limit use of health data while maintaining account
• Right to Data Portability: Receive data in structured, machine-readable format (JSON/CSV)
• Right to Object: Opt-out of any processing based on legitimate interests (not applicable to contract/essential functions)
• Rights Related to Automated Decision-Making: Right to human intervention for health-related algorithmic decisions

CCPA/CPRA Rights:

• Right to Know: Categories and specific pieces of personal information collected (last 12 months)
• Right to Delete: Deletion of personal information (with exceptions under § 1798.105)
• Right to Correct: Accuracy of personal information (CPRA addition)
• Right to Opt-Out: Of sale/sharing of personal information (though we do not engage in these activities)
• Right to Limit Use: Of Sensitive Personal Information (biometric/health) to only necessary business purposes
• Right to Non-Discrimination: No denial of services for exercising privacy rights (except where data is essential to service)

Exercising Rights:

• Submit requests via: privacy@vitalflow.com or in-app Settings > Privacy Center
• Verification required: Two-factor authentication plus government ID (last 4 digits only) for biometric data requests
• Authorized agents must provide written permission and identity verification
• Response within 45 days (extendable to 90 with notice)

---

9. BIOMETRIC DATA DELETION PROTOCOLS

A. User-Initiated Deletion

Process:

1. User submits deletion request via Privacy Center or email
2. Identity verification via multi-factor authentication + ownership confirmation of biometric template
3. Immediate deletion from production databases within 72 hours
4. Propagation to backup systems within 45 days (per GDPR Article 17(2) and CCPA requirements)

Technical Deletion Methods:

• Cryptographic Erasure: Encryption keys destroyed for encrypted biometric templates (rendering data inaccessible)
• Secure Overwriting: DOD 5220.22-M standard (3-pass overwrite) for magnetic storage
• Physical Destruction: For HSMs reaching end-of-life containing biometric data

Exceptions (Legal Retention): We may retain biometric/health data if necessary for:

• Compliance with legal obligations (e.g., FDA medical device regulations)
• Establishment of legal claims (law suit hold)
• Note: In such cases, data is archived offline with restricted access and encrypted, removed from active processing

B. Account Termination

• Upon account deletion, all biometric templates are permanently destroyed within 30 days
• Health data retained in anonymized form for epidemiological research only if you previously opted into research consent (irreversible anonymization)
• Aggregate statistical data (e.g., "average heart rate of users aged 30-35") retained but cannot be linked to individuals

C. Third-Party Notification

• Upon deletion, we notify all service providers processing your biometric data to delete their copies within 10 business days
• Confirmation email sent to user with audit trail of deletion completion

---

10. INTERNATIONAL DATA TRANSFERS

For EU/EEA/UK Users:

• Data transfers to the US utilize Standard Contractual Clauses (2021/914) with Transfer Impact Assessments
• Biometric data remains in EU servers unless you explicitly consent to US processing for specific features
• Supplementary measures: End-to-end encryption, pseudonymization before transfer

For Other Jurisdictions:

• Adequacy decisions relied upon where available (UK, Canada, Japan, etc.)
• SCCs used for non-adequate jurisdictions with additional technical safeguards for biometric data

---

11. CHILDREN'S PRIVACY

• Services not directed to children under 16 (or 13 with parental consent under COPPA)
• We do not knowingly collect biometric data from minors
• If discovered, data deleted within 24 hours and account terminated

---

12. CHANGES TO THIS POLICY

• Material changes notified via email and in-app notification 30 days in advance
• Changes to biometric processing require fresh explicit consent
• Previous versions available upon request

---

13. CONTACT AND COMPLAINTS

For privacy inquiries:

• Email: privacy@vitalflow.com
• Postal: [Address]

Right to Lodge Complaints:

• EU/EEA: Contact your local Data Protection Authority
• California: California Attorney General at oag.ca.gov/contact/consumer-complaint-against-business

---

CONSENT TO BIOMETRIC DATA PROCESSING

By enabling biometric features (fingerprint/face ID login), you explicitly consent to:

1. The collection and storage of biometric templates as described above
2. The retention periods specified in Section 6
3. The deletion procedures outlined in Section 9

You may withdraw consent at any time in app settings, switching to passcode authentication. Withdrawal does not affect prior lawful processing.

---

TECHNICAL APPENDIX: BIOMETRIC DATA MANAGEMENT EXPLAINED

Storage Best Practices

Template vs. Raw Data Storage:

• Raw Data: Original biometric input (fingerprint image, voice recording) should never be stored permanently. Process immediately into mathematical templates, then delete raw input.
• Templates: Irreversible mathematical algorithms (minutiae points for fingerprints, voiceprint spectrograms) that cannot reconstruct original biometric characteristics.
• Salting: Add unique random data to each template so compromise of one user's data doesn't compromise others using similar biometrics.

Hardware Security:

• Utilize device-native secure enclaves (Secure Enclave on iOS, Trusted Execution Environment on Android) so biometric template never touches app server or general OS memory.
• If server storage is necessary (for cross-device sync), use Hardware Security Modules (HSMs) with FIPS 140-2 Level 3 certification.

Sharing Limitations

Zero-Knowledge Architecture:

• Implement client-side encryption where user device encrypts biometric data before transmission
• Service providers hold encrypted blobs but not decryption keys
• Prevents cloud providers from accessing biometric content even if compelled by legal order

Purpose Specification:

• Any sharing must be tied to specific, enumerated purposes (e.g., "authentication" not "improving services")
• Data use agreements must explicitly prohibit:
  • Training third-party AI models on biometric data
  • Combining with other datasets to create identity profiles
  • Retention beyond contract termination

Deletion Technical Requirements

The Right to Erasure Complexity: Biometric data presents unique deletion challenges because:

1. Backup Systems: GDPR requires deletion from backup systems when "technically possible." For biometric data:

   • Implement "right to be forgotten" flags in backup metadata
   • Upon restoration from backup, automated scanning identifies and purges flagged biometric records
   • Maximum 90-day retention in backups (industry standard for backup rotation)

2. Distributed Systems:

   • Biometric data may exist in CDN caches, edge computing nodes, or dev/staging environments
   • Deletion request must trigger API calls to all microservices holding fragments
   • Audit trail required confirming deletion from all nodes

3. Irreversibility Verification:

   • Post-deletion cryptographic attestation proving keys destroyed (for encrypted data)
   • Random sampling verification that storage sectors overwritten
   • Certificate of destruction for physical media

Retention in Aggregate Form: If user consented to research use, biometric data must be transformed via:

• K-anonymity: Ensure at least k-1 other users share identical biometric characteristics (impossible with unique biometrics, thus requiring aggregation)
• Differential Privacy: Add statistical noise to datasets so individual contributions are mathematically obscured
• Summary Statistics Only: Store "average heart rate during exercise" rather than "User X's heart rate at Time Y"

This policy should be reviewed by legal counsel and updated whenever biometric processing technologies or legal requirements change.