Politique d’utilisation des données et de consentement

Synheart collects three data categories:

1.1Biosignal Data (Physiological Data)

Depending on your device and app settings, this may include:

• Heart rate (HR)
• Heart rate variability (HRV)
• PPG-derived features
• Respiratory rate
• Sleep stages and duration
• Activity and movement
• Accelerometer and motion signals
• Skin temperature (if supported by device)
• Cognitive and emotional state features derived from the above

1.2Behavioral & Interaction Signals

Collected only if you enable the Synheart Behavioral SDK.

We may collect:

• Keystroke timing (cadence only, NOT content)
• Scrolling speed and gesture dynamics
• Typing bursts and idle gaps
• App interaction sequences
• Device orientation and motion
• Focus patterns and task-switching frequency

We never collect:

• Message content
• Typed text
• Screen captures
• Personal content

Behavioral signals are anonymized or pseudonymized whenever possible.

1.3Metadata & System Data

This includes:

• Device type and OS
• IP address (security only)
• SDK version
• Error logs
• App performance data

This data helps maintain and improve service functionality.

We use collected data for the following purposes:

2.1Generating Human State Metrics

Data is processed to create insights such as:

• Emotional state indicators
• Focus estimation
• Cognitive load inference
• Flow state detection
• Stress and calmness levels
• Readiness and recovery signals

These outputs are informational and not medical.

2.2Operating Synheart Services

Including:

• Account creation
• Wearable syncing
• HSI (Human State Interface) fusion
• Model inference
• Data visualization in your dashboard
• Developer app integrations

2.3Improving Models and Accuracy (Only With Consent)

If you opt in:

• Data may be used to improve Synheart algorithms
• Data may be included in anonymized datasets
• Data may be used to tune predictive models

If you opt out: Your data is used only for your real-time experience and not for training.

We follow a multi-layered consent model to ensure clarity and control.

3.1Explicit Consent (Required for Certain Features)

Explicit consent is required for:

• Uploading raw biosignals to Synheart Cloud
• Enabling Behavioral SDK data collection
• Enabling Syni Cloud LLM inference
• Connecting third-party wearables
• Allowing data for model improvement
• Syncing data across devices

You can always withdraw consent in settings.

3.2Implied Consent (Necessary for Basic Functionality)

Implied consent covers:

• Basic app functionality
• Device metadata
• Crash logs
• Authentication events

Without this, the app cannot operate.

3.3Developer App Consent Requirements

If you use Synheart SDKs in your own app, YOU MUST:

• Obtain end-user consent before collecting data
• Disclose what data your app sends to Synheart
• Allow users to revoke consent
• Delete user data upon request
• Not store sensitive signals beyond what is necessary

We reserve the right to suspend API keys for misuse.

• Raw biosignal data stays on-device by default.
• Only derived metrics (focus, HRV score, emotion, embeddings) leave the device unless you consent.
• When cloud upload is allowed, data is encrypted in transit and at rest.
• You can opt out at any time.

Raw data includes:

• High-resolution HRV windows
• PPG samples
• Accelerometer streams
• Behavioral timing sequences

We do not share raw data with third parties unless required by law and with user consent.

Retention varies by type:

• Data Type

  Default Retention

• Raw biosignal data

  On-device only

• Behavioral data

  30–90 days for rolling models

• Derived insights

  Until account deletion

• Account info

  While account is active

• Cloud backups

  Limited, encrypted

You may request deletion at any time.

We only share data in the following cases:

6.1With Your Consent

Examples:

• Syncing wearables
• Connecting third-party apps
• Allowing Syni to perform cloud inference

6.2With Service Providers

Synheart uses providers strictly for:

• Secure cloud hosting (e.g., AWS)
• Error monitoring
• Payment processing

All providers are bound by strict data protection agreements.

6.3Legal Requirements

We may disclose data if legally required, with proper documentation.

We do not sell user data. We do not share biosignals or behavioral signals for advertising.

Depending on your region (GDPR, CCPA, PIPEDA), you have the right to:

• Access your data
• Request deletion
• Withdraw consent
• Correct inaccuracies
• Export your data
• Object to certain processing

Requests can be made anytime at legal@synheart.ai.

We use industry-standard security including:

• On-device processing for sensitive signals
• End-to-end encryption for biosignals
• Pseudonymization and minimization
• Strict access controls
• Regular audits
• Zero-trust infrastructure practices

Synheart is not intended for children under 16.

We do not knowingly process children's physiological or behavioral data.

If you have questions about this Policy or want to exercise your rights: