Privacy & Data
The most sensitive datathere is. Handled like it.
Human state isn’t analytics data. It’s a live read on someone’s well-being. Synheart’s infrastructure ensures raw signals stay on the device. This page explains what is processed, what your app sees, and who controls it.
The model in one sentence
On-device by default. Cloud only by consent.
Signals are processed into structured human state on the device itself. What crosses to the cloud — if anything — is the structured output, and only when the person has explicitly consented and your app has explicitly enabled it.
Raw biosignals (heart rate streams, HRV, motion)
Never leave the device. Processed locally by the on-device engine.
Behavioral signals: typing rhythm, scrolling, switching.
Timing, rhythm, and pattern only — never content. Never keystrokes, never text, never screenshots. Processed locally.
HSI output: focus, stress, recovery, confidence.
Delivered to your app on the device. Crosses to the cloud only if consent is granted and your app enables upload.
Identity
No persistent user identifier is generated or stored by the SDKs; your app supplies its own.
Research data
Deployments do not feed research datasets. Research data comes from consented studies under ethics oversight.
The documents
The fine print, findable.
The policies and agreements that govern how Synheart collects, processes, and protects signals and human-state data — and your rights over it.
Privacy Policy
What Synheart itself collects and why (site, Platform accounts, support).
Terms Of Service
The agreement for using Platform and cloud services.
Data Usage & Consent
Description of how signal data is used, retained, and deleted.
Don’t take our word for it.
Don’t take our word for it.
The HSI specification the format all of this produces is openly published under Apache 2.0, with schema, RFCs, and test vectors. Every payload carries a contains_pii flag and a confidence value. How signals become output is documented, versioned, and inspectable.
View the spec on GitHub
Consent is enforced at the SDK level.
- Data is collected only with granted permissions. Consent gating is in Core SDK, not in app code.
- The consent gate runs on-device before serialization — an unconsented field is never created, not merely not displayed.
- Revoking consent stops collection immediately.
- Local data can be encrypted at rest.
Aggregates only. Enforced in code.
- Individuals view their state privately; the organization sees team aggregates with a minimum of 10 consented participants in the service.
- Opt-out is invisible to managers. Participation status is never exposed; absence is indistinguishable from cohort suppression.
- No individual scores for the employer, under any configuration. No emotion inference in workplace products.
FAQ
Frequently Asked Questions
Build on infrastructure that treats state as sensitive.
Read the policies in full, or reach out with any question about how your data is handled.