Politique de confidentialité

We collect three categories of data:

1.1Biosignal Data (Physiological Data)

When you use Synheart Wear, participate in Syni Life sessions, or enable integrations with supported wearables (e.g., WHOOP, Garmin), we may collect:

• Heart rate (HR)
• Heart rate variability (HRV)
• Respiratory rate
• Sleep stages & duration
• Movement & accelerometer data
• Skin temp (if supported by device)
• Stress markers
• Focus-related metrics

1.2Behavioral Signals (Device Interaction Data)

If you enable the Synheart Behavioral SDK, we may collect:

• Keystroke cadence (timing, not content)
• Scroll velocity and interaction patterns
• App interaction bursts and idle gaps
• Focus patterns and task switching frequency
• Motion and device orientation

We never collect message content, keystroke content, or personal text. Only timing-based signals.

1.3App, Account & System Data

• Name, email, phone (if provided)
• Device information (OS, version, model)
• IP address (for security)
• Crash logs and analytics
• Subscription or billing info (if applicable)
• Usage analytics in the Life app (optional, off by default)

If you turn on usage analytics in the Life app (Settings → Privacy & Consent → App Improvement, or during onboarding), we use Google Analytics for Firebase to learn which screens you open and how often you use the app. This includes screen views, session information, an app-instance identifier, device and app version, and approximate location (country or city) derived from your IP address. It never includes your typing, health data, or human-state readings.

We use data to deliver and improve Synheart features:

2.1To Generate Cognitive & Emotional Insights

• Focus estimation
• Emotion & stress modeling
• Flow state detection
• HRV-based cognitive readiness

2.2To Operate Our Platform

• Account creation & authentication
• Cloud synchronization (if consented)
• Developer integrations
• Wearable device linking

2.3To Improve Our Models (Only With Consent)

• Model training and enhancement
• Anonymous benchmarking
• Quality improvement

2.4To Communicate With You

• Product updates
• Support requests
• Security notifications

We do not sell personal data.

We do not use data for advertising.

Depending on the Service:

• On-device: Core behavioral signals, some biosignal processing, HSI fusion.
• Cloud (with consent): Synheart Cloud, Syni, and model inference by third-party AI providers (see Section 5.4).
• Regions: AWS (US/EU/Canada regions depending on your country).

Raw data never leaves the device unless you opt in.

Raw data includes:

• High-resolution HRV windows
• PPG/accelerometer streams
• Behavioral sequences
• Keyboard timing samples

If you grant permission:

• Data is encrypted before leaving your device.
• Only necessary segments are transmitted for the selected feature.
• You can disable cloud upload at any time.

We may share data only in these cases:

5.1With Your Consent

For example:

• Linking your wearable
• Connecting third-party apps
• Using Syni with cloud inference

5.2With Service Providers

To operate Synheart Cloud:

• AWS (hosting)
• DeepInfra (text embeddings for Synapse search)
• Google Analytics for Firebase (Life app usage analytics, only when turned on)
• Sentry (crash reporting)

All are bound by contractual privacy requirements.

5.3For Legal Compliance

If required by law, with proper documentation.

We never share biosignal or behavioral data with advertisers, data brokers, or unrelated third parties.

5.4AI Inference Providers (Cloud Syni)

When you turn on cloud Syni, the question you ask, the derived behavioral metrics it references (such as focus, rhythm, stability, and variability), and your account and device identifiers are sent to third-party AI providers solely to generate your response. We never send your raw text, raw keystrokes, or raw biosignals. Depending on the question, inference may be processed by one or more of:

• OpenAI
• Microsoft Azure OpenAI
• Groq
• Meta
• Together AI

These providers process your data only to generate your response, are contractually bound to protect it to a standard equivalent to this Privacy Policy, and are prohibited from using it to train their own models. You can turn cloud Syni off at any time to keep all processing on your device.

We retain data only as long as necessary:

• Account data: while account is active
• Biosignals: configurable in app
• Behavioral data: typically 30–90 days (for rolling window models)
• Logs & telemetry: 30 days
• Usage analytics (Life app, if turned on): event-level data is kept for 2 months and user-level data for 12 months, then deleted automatically by Google Analytics.
• Backups: encrypted, limited access

You can request complete deletion at any time (see Section 9).

Depending on your region (GDPR, CCPA, PIPEDA), you have the right to:

• Access your data
• Correct your data
• Delete your data
• Export your data (portable export)
• Withdraw consent
• Restrict processing
• Object to profiling
• Submit a complaint

We will respond within the legally required time frame.

We use strong security methods including:

• End-to-end encryption for sensitive data
• On-device processing wherever possible
• Strict access controls
• Secure key management
• Encrypted backups
• Regular penetration testing

Despite best efforts, no system is 100% secure.

You can control:

• Whether raw data leaves your device
• Whether behavioral signals are collected
• Whether cloud inference is used
• Whether wearable data syncs
• Whether usage analytics is enabled (Life app: Settings → Privacy & Consent → App Improvement)

You may also delete your account at any time, which removes all personal data from our systems.

Turning usage analytics off stops collection immediately and resets the analytics identifier on your device. We do not collect the advertising identifier (IDFA/AAID), and analytics data is not used for advertising.

Synheart is not intended for children under 16.

We do not knowingly collect data from children.

Synapse (synapse.synheart.ai) can connect to a member's own Google account. This section describes exactly what it reads and why.

11.1What We Access

Only what each feature needs:

• Account email and Google account ID (openid, email): to verify which Google account is yours, so activity and meetings can be attributed to you.
• Google Calendar (calendar.readonly), only if you connect your calendar: the start and end times of your own events, used to compute your meeting load. We never read event titles, descriptions, attendees or locations.
• Google Drive (drive.readonly), only if you link your Drive and only for shared drives your organization's administrator has added to Synapse: the names, links and text of Google Docs, Google Slides, plain-text and Markdown files. We never index My Drive, and we never modify, create, share or delete anything in your Google account.

11.2How We Use It

Drive text is split into passages and indexed so that you can search it in Synapse and through AI tools you connect to Synapse. A file is returned only to members of your organization who can open it in Google Drive and have linked their own Drive. Calendar times feed your own meeting-load metrics.

11.3How We Store, Share and Delete It

How your Google data is kept:

• OAuth tokens are stored encrypted. Indexed text is stored in our database, separate for each organization.
• To index text for search, passages are sent to our embedding provider (DeepInfra), which processes them solely to return search vectors.
• Unlinking Google Drive removes your access to every Drive file immediately. When your administrator removes a shared drive, its indexed text is deleted. A file you can no longer open is removed at the next sync. Erasing your account deletes your Google tokens.

11.4Limited Use

Synapse's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data to serve advertisements, we do not sell it, we do not use it to train generalized AI or machine-learning models, and people at Synheart do not read it except with your permission, for security purposes, to comply with law, or where it has been aggregated and anonymized for operations.

We may update this Privacy Policy to reflect improvements, legal changes, or new features.

If changes are significant, we will notify users.