Sanjivani AI Privacy Policy

1. Introduction

Welcome to Sanjivani AI, developed by HYUMN Labs ("HYUMN Labs," "we," "us," or "our"). We build intelligent healthcare technology platforms designed to integrate health data and provide AI-powered physiological insights. We recognize that health data is highly sensitive. This Privacy Policy details how we collect, use, protect, and process your personal and health information across our mobile applications, web interfaces, and cloud services.

We prioritize privacy in our system design by ensuring you maintain control of your health data, utilizing deterministic models designed to limit unnecessary data exposure, and architecting our technical infrastructure to align with industry-standard security practices.

2. Scope

This Privacy Policy applies to the Sanjivani AI mobile applications (iOS and Android), web applications, cloud synchronization infrastructure, API services, and any future enterprise deployments (collectively, the "Services"). It governs the data practices associated with user accounts, connected wearable integrations, and the AI models utilized to generate physiological insights.

3. Definitions

• Health Data: Information concerning your physical or mental health, physiological states, activities, and biometric measurements collected through our Services or connected devices.
• Personal Data: Any information relating to an identified or identifiable natural person (e.g., name, email address, account identifiers).
• Connected Platforms: Third-party wearable devices, health aggregators, and APIs (such as Apple Health or Oura) that you authorize to share data with Sanjivani AI.
• AI Insights: The automated, software-generated informational analyses produced by our algorithms based on your synchronized Health Data.

4. Information We Collect

To provide you with Sanjivani AI's services, we collect information in three primary ways: information you provide to us directly (such as account credentials), information collected automatically via device sensors or system telemetry, and information imported securely from Connected Platforms upon your authorization.

5. Health Information

Sanjivani AI acts as an aggregator and analyzer. Depending on the Connected Platforms you authorize and the capabilities of your devices, we may process the following categories of Health Data:

• Heart Rate (Resting, Active, and Trends)
• Heart Rate Variability (HRV)
• Sleep Metrics (Duration, Stages, Efficiency)
• Blood Oxygen Saturation (SpO2)
• Respiratory Rate
• Body Temperature (Basal and Trends)
• Activity and Movement Data (Steps, Energy Expenditure)
• Workout and Training Data (Intensity, Duration, Type)
• Recovery and Readiness Scores
• Physiological Stress Markers
• Self-Reported Symptoms and Context
• Medication Information (if manually logged or imported)

We strictly process the data points supported and supplied by your hardware and authorized integrations.

6. Device Information

To ensure secure communication, deliver push notifications, and maintain application stability, we collect non-health device telemetry. This includes your operating system version, app version, unique device identifiers (for secure token storage and session management), and IP addresses (used for secure routing, rate-limiting, and fraud prevention).

7. Connected Health Platforms

Sanjivani AI integrates with industry-leading health ecosystems to provide a unified view of your physiology. You may choose to connect Sanjivani AI to:

• Apple Health
• Health Connect (Android)
• Google Health
• Samsung Health
• Fitbit
• Garmin
• Oura
• WHOOP
• Sleep as Android
• Polar
• Rebble

Data is retrieved from these platforms only after you provide consent within the respective native environments or via OAuth authorization flows.

8. Apple Health & Google Health Connect Specific Protections

Because we integrate closely with mobile operating systems, we strictly adhere to the developer guidelines established by Apple and Google regarding health data:

• Data obtained from Apple Health and Google Health Connect is used exclusively for providing and improving health-related functionality requested by you.
• Data obtained from Apple Health and Google Health Connect is never used for advertising, marketing profiling, or sold to data brokers.
• You remain in total control of your permissions and may revoke Sanjivani AI's access at any time directly through your device's operating system settings or within our application.

Sanjivani AI utilizes background processing to periodically synchronize your authorized health data even when the application is closed. You can disable background synchronization at any time within your device's operating system settings.

9. OAuth Integrations

For cloud-based platforms (such as Fitbit, Oura, WHOOP, and Garmin), we utilize the OAuth 2.0 protocol. Under this framework:

• We do not ask for, see, or store your third-party account passwords.
• You authenticate directly on the provider's secure website or application.
• We request the specific permission scopes necessary to provide our Services (e.g., read-only access to heart rate or sleep data).
• Providers issue Sanjivani AI a revocable cryptographic token that we use to sync your data.

10. AI Processing

Sanjivani AI relies on algorithmic models to synthesize raw physiological data into readable insights. Our AI processing evaluates your historical baselines against recent inputs to provide context based on established physiological research (such as circadian rhythms and cardiovascular strain). These outputs are strictly informational and do not constitute medical diagnoses.

11. AI Training & Transparency

We use AI exclusively to generate personalized physiological insights for your individual account. We do not use your personal Health Data to train, retrain, or improve global, platform-wide AI models shared across other users. Your health data is processed solely to calculate your individual baselines and contextualize your own metrics. We do not sell or license your data to third parties for their AI training purposes.

12. Local Device Processing

Where technically feasible, Sanjivani AI leverages on-device processing. Initial data normalization and local caching are executed on your smartphone to support offline capabilities and reduce the volume of raw data transmitted over the network.

13. Cloud Processing

For longitudinal analysis, cross-platform synchronization, and compute-intensive model generation, your data is transmitted to our cloud infrastructure. Data processing in the cloud is access-controlled and utilized solely for returning insights to your authenticated application instance and improving our service.

14. How We Use Information

We use your Personal and Health Data to:

• Provide, operate, and maintain the Sanjivani AI platform.
• Generate personalized, AI-assisted physiological insights, trends, and summaries.
• Synchronize your data across your devices and selected integrations.
• Analyze technical performance to resolve crashes, bugs, and sync failures.

15. Legal Basis for Processing

Where required by applicable data protection laws, we process specific categories of your data based on the following legal grounds:

• Explicit Consent: The collection, processing, and synchronization of sensitive Health Data (e.g., Heart Rate, Sleep Metrics) and the activation of OAuth integrations.
• Contractual Necessity: The processing of Account Credentials (e.g., email address) and Device Information required to provide the core Services outlined in our Terms of Service.
• Legitimate Interests: The collection of anonymized Crash Logs, technical telemetry, and IP addresses for technical security, fraud prevention, and system stability monitoring.

16. User Consent

We operate on an opt-in model. Connection to Apple Health, Health Connect, or any cloud API requires a manual user action and direct authorization via native OS prompts or secure web portals. We do not independently extract health data outside of these authorized channels.

17. Data Sharing

We do not sell your personal or health data. Data is shared only in the following scenarios: with essential service providers necessary to operate the platform, to comply with valid legal processes (e.g., a binding court order), or if you explicitly direct us to export or share your data.

18. Third-Party Service Providers

We partner with enterprise-grade third-party infrastructure providers to host our backend and manage secure databases. Specifically, we utilize Google Cloud, Firebase, and Firestore for our cloud hosting, database management, and authentication services. These providers act as data processors under binding agreements and are restricted from independently accessing or repurposing your raw health data beyond providing the infrastructure required for Sanjivani AI.

19. Analytics

To understand platform usage and improve the user experience, we may collect technical telemetry data (e.g., screen load times, feature adoption rates). This telemetry is decoupled from your physiological Health Data.

20. Crash Reporting

If the Sanjivani AI app encounters an error, it may generate a crash report to help our engineering team resolve the issue. These reports contain stack traces, device models, and OS versions, but are designed to omit personal identifiers and health metrics.

21. Cookies (Web)

When accessing Sanjivani AI via a web browser or during web-based OAuth flows, we utilize strictly necessary cookies to maintain secure sessions. We do not deploy tracking cookies or fingerprinting scripts designed to monitor your broader web activity.

22. Advertising

We do not use your Health Data, Personal Data, or AI Insights for advertising purposes. Sanjivani AI does not display third-party advertisements, nor do we supply your profile to ad networks for retargeting.

23. International Data Transfers

Sanjivani AI operates globally, and your data may be transferred to, and processed in, data centers located outside your country of residence (such as the United States) by our cloud infrastructure providers (e.g., Google Cloud). These infrastructure providers implement strict security measures to protect data during transit and at rest. However, please be aware that data protection laws in these jurisdictions may differ from those in your home country. By using our Services, you acknowledge the transfer of your data to these facilities. We do not independently conduct formal Transfer Impact Assessments (TIAs).

24. Data Retention

We retain your Personal Data and Health Data for as long as you maintain an active account with Sanjivani AI. If you choose to delete your account, your health data and associated cryptographic tokens are scheduled for deletion from our active production databases within a commercially reasonable timeframe, in accordance with our data destruction policies and applicable legal requirements.

25. Data Security

We implement a defense-in-depth security framework designed to align with industry standards. This includes access controls, regular security assessments, and continuous monitoring for network activity. While we strive to protect your data, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

26. Encryption

We utilize industry-standard encryption protocols to protect your data:

• In Transit: Communications between your device, Connected Platforms, and our backend APIs are secured using standard protocols such as Transport Layer Security (TLS).
• At Rest: Data stored in our cloud infrastructure (via Firestore/Google Cloud) is encrypted at rest using standards established by our infrastructure providers (typically AES-256).

27. Authentication

We enforce secure authentication mechanisms for backend requests. OAuth integration tokens obtained from platforms like Fitbit or WHOOP are managed by our backend or securely stored on your device using operating system-level storage capabilities (such as the iOS Keychain and Android Keystore).

28. Account Security

Account security is a shared responsibility. We encourage you to use robust, unique passwords and secure your devices. Our systems employ session expiration protocols to mitigate unauthorized access attempts.

29. User Rights

Depending on your jurisdiction, you may have the right to access the data we hold about you, request corrections to inaccurate information, and withdraw your consent for future data processing.

30. Data Portability

You may request to export your health metrics. Upon a verifiable request via our support channels, we will provide a reasonable export of your processed data in a commonly used format.

31. Right to Delete Data

You have the right to request the deletion of your account and associated Health Data through the Sanjivani AI application settings or by contacting our support team. Upon processing the request, we will take steps to render the data inaccessible and delete it in accordance with our retention schedules.

32. Disconnecting Third-Party Integrations

You can disconnect any Connected Platform (e.g., Oura, Apple Health) at any time through the Sanjivani AI Data Sources screen. Disconnecting a source revokes our ongoing access and halts future synchronization from that provider.

33. Children's Privacy

Sanjivani AI is intended exclusively for use by adults. While we do not currently implement a strict biometric or ID-based age verification mechanism during onboarding, our Terms of Service strictly prohibit minors under the age of 13 (or 16 in certain European jurisdictions) from creating an account. We do not knowingly solicit or collect personal or health data from children. If we discover or are notified that an account belongs to a minor, we will immediately take steps to permanently delete the account and all associated data from our active production systems.

35. AI Limitations

Our AI models utilize probabilistic analyses of the data provided by your hardware. Wearable sensors are subject to artifacts, miscalibrations, and environmental interference. Consequently, AI insights may occasionally be incomplete or inaccurate. You should never alter medication, diet, or treatment plans based solely on Sanjivani AI insights without consulting a certified medical professional.

36. Changes to This Policy

We may update this Privacy Policy periodically. If we make material changes, we will notify you via a notice within the application or via email. Your continued use of the Services after the effective date of the revised policy constitutes acceptance of those changes.

37. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your Health Data, please contact our Data Protection Officer (DPO) at:

Sanjivani AI Privacy Team
Email: support@sanjivaniai.in