Privacy Policy

← Back to Helios

Helios ("we," "our," or "us") operates the Helios mobile application and related backend services (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, the legal bases on which we rely, and the rights available to you. By creating an account or using the Service, you acknowledge that you have read and understood this Policy.

1. Who We Are & Where We Operate

Helios is the data controller (and, where applicable, data fiduciary) responsible for your personal information. The Service is offered to users located in the United States, Canada, the United Kingdom, and India. We do not target users outside these countries.

Depending on where you live, your data is protected by laws including the UK General Data Protection Regulation and Data Protection Act 2018 (UK), the Personal Information Protection and Electronic Documents Act and Quebec Law 25 (Canada), the Digital Personal Data Protection Act 2023 (India), and applicable U.S. federal and state privacy laws.

Contact: support@my-helios.app

2. Information We Collect

2.1 Account Information

• Email address
• Authentication credentials (via Apple Sign-In or Google Sign-In; we do not store your password)
• Account creation date

2.2 Profile and Health Data (Collected During Onboarding)

• Demographics: Gender, date of birth, height, weight
• Current mood state
• Health conditions: Diabetes, heart disease, hypertension, asthma, arthritis, anxiety/depression, thyroid disorders, GERD, and custom conditions you provide
• Current medications: Names of medications and supplements
• Family medical history: Heart disease, cancer, diabetes, hypertension, stroke, Alzheimer's/dementia, mental health conditions
• Health concerns: Sleep quality, energy levels, weight management, stress/anxiety, chronic pain, and custom concerns
• Lifestyle information: Activity level, average sleep hours, lifestyle type, barriers to health goals
• Health goals: Short-term goals, long-term goals, goal timelines, goal-specific details
• Wearable device types: Apple Watch, Fitbit, Garmin, Oura Ring, Whoop, etc.

2.3 Chat and Conversation Data

• Messages: All messages you send to and receive from Helios AI, including text content and any attachments
• AI-Extracted Memories: Facts and health data points extracted from your conversations, stored with semantic vector embeddings for retrieval
• Healthspaces: Isolated health contexts you create, along with associated chats and memories

2.4 Apple HealthKit Data

If you grant permission, we access Apple HealthKit data including: step count, heart rate, heart rate variability, blood pressure, respiratory rate, oxygen saturation, sleep data, workout data, body measurements, activity metrics, and other available health samples.

2.5 Agent Mode Data (Browser Automation)

• Screenshots of web pages (analyzed by AI for navigation)
• URLs visited and navigation activity logs
• Form data entered on your behalf
• Login credentials you provide (encrypted with AES-256-GCM, held in memory only during the active session, never persisted to disk or database)

2.6 Payment and Subscription Data

• Subscription tier and status (managed via RevenueCat)
• Payment transaction records (processed by Stripe / Apple; we do not store card numbers)
• Purchase tracking information (order numbers, tracking numbers, delivery status)

2.7 Device and Usage Data

• Device type, operating system version
• App interactions and feature usage patterns
• Error logs and crash reports (if Sentry error tracking is enabled)

3. How We Use Your Information

• Provide personalized health insights using AI
• Power AI conversations by processing your messages and health context through AI models
• Extract and store health memories for future reference and continuity
• Facilitate agent tasks (appointment booking, shopping) on your behalf
• Process payments and manage subscriptions
• Track deliveries for purchases made through Agent Mode
• Maintain, secure, and improve the Service
• Communicate service notices and respond to support requests
• Comply with legal obligations

4. Legal Bases for Processing

Where the UK GDPR or similar laws apply, we rely on the following legal bases:

• Explicit consent (UK GDPR Art. 9(2)(a); India DPDPA s.6; PIPEDA express consent) — for processing your health and other sensitive data, and for transferring it internationally. You may withdraw consent at any time by deleting your account.
• Performance of a contract (UK GDPR Art. 6(1)(b)) — to provide the Service you sign up for.
• Legitimate interests (UK GDPR Art. 6(1)(f)) — to secure, debug, and improve the Service, using de-identified data where possible.
• Legal obligation (UK GDPR Art. 6(1)(c)) — to comply with applicable law.

5. Third-Party Service Providers

Your data is shared with the following providers, which act as our processors. All are located in the United States. Where a provider offers a data processing agreement, we enter into it; we require providers not to use your data for their own purposes or to train their models on it.

Provider	Purpose	Data Shared	Location
xAI (Grok)	AI chat processing, reasoning, and memory extraction	Message content, health context	USA
VoyageAI	Semantic vector embeddings for memory retrieval	Text content for embedding	USA
OpenRouter	Vision AI for Agent Mode screenshot analysis	Screenshots taken during agent sessions	USA
Supabase	Database hosting and authentication	Your account and app data	USA
Railway	Application server hosting	All data in transit through the backend	USA
Stripe	Payment processing	Payment amounts, transaction metadata (no card numbers)	USA
RevenueCat	Subscription management	Subscription status, app user ID	USA
AfterShip	Purchase and shipment tracking	Tracking numbers, carrier information	USA
Sentry (optional)	Error tracking and monitoring	Error logs, stack traces	USA

We do not sell, rent, or trade your personal information or health data. Aggregated, de-identified data that cannot identify you may be used to improve the Service.

6. International Data Transfers

We process and store your data in the United States. If you are located in the United Kingdom, Canada, or India, providing your information and using the Service necessarily involves transferring your data — including health data — to the United States and to the processors listed above.

• This transfer is necessary to provide the Service you request, and you give your explicit, informed consent to it during onboarding (UK GDPR Art. 49(1)(a); India DPDPA cross-border provisions; PIPEDA).
• The United States may not provide the same level of data protection as your home country, and your data may be subject to access by U.S. authorities under U.S. law.
• Where a provider makes them available, we put in place contractual safeguards (such as data processing agreements and standard contractual clauses) for these transfers.
• If you do not consent to this transfer, do not use the Service.

7. Data Security

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Agent mode credentials encrypted with AES-256-GCM, held in memory only, cleared on session end
• Row Level Security (RLS) enforcing user data isolation at the database level
• OAuth 2.0 authentication and JWT-based sessions; audit logging of security-sensitive events

No system is completely secure. We implement industry-standard protections but cannot guarantee absolute security.

8. Data Retention

• Active accounts: Retained while your account is active.
• Messages and memories: Persist until you delete the chat, healthspace, or account (memories expire after 2 years).
• Agent mode credentials: In memory only; cleared after 30 minutes of inactivity or session end.
• Account deletion: Personal data permanently deleted within 30 days; backups purged within 90 days.
• Legal holds: Data may be retained longer where required by law.

9. Your Rights

Subject to your location and applicable law, you have the right to access, correct, delete, and export your data; to withdraw consent; to object to or restrict certain processing; and to lodge a complaint with your data protection authority. We do not sell personal data and will not discriminate against you for exercising your rights.

• UK: Rights under the UK GDPR (access, rectification, erasure, restriction, portability, objection, withdraw consent). Complaints: the Information Commissioner's Office (ico.org.uk).
• Canada: Rights under PIPEDA and Quebec Law 25 (access, correction, withdraw consent). Complaints: the Office of the Privacy Commissioner of Canada (priv.gc.ca), or the Commission d'accès à l'information du Québec.
• India: Rights under the DPDPA 2023 (access, correction, erasure, grievance redressal, nominate). Complaints: the Data Protection Board of India.
• United States: Rights under applicable state laws (e.g., California CCPA/CPRA, Washington My Health My Data Act): know, delete, correct, opt out of sale (we do not sell), and limit use of sensitive data.

Exercise your rights in Settings or by emailing support@my-helios.app. We respond within the timeframe required by your applicable law (generally 30 days).

10. Age Requirements

You must be at least 18 years old to use Helios. The Service is not directed to, and we do not knowingly collect data from, anyone under 18. If we learn that we have collected data from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal information, contact support@my-helios.app.

11. Cookies and Tracking

The Helios mobile app does not use browser cookies. We may collect device identifiers and usage analytics as described in Section 2.7. We do not use third-party advertising trackers or sell data for advertising.

12. HIPAA Disclaimer (U.S.)

Helios is a consumer wellness and health education application. We are NOT a healthcare provider, health plan, or healthcare clearinghouse, and therefore are NOT a HIPAA-covered entity or business associate. HIPAA does not apply to the Service. Security practices we implement do not constitute HIPAA compliance. If you require HIPAA-protected health services, consult your healthcare provider.

13. Data Breach Notification

If a breach of your personal data is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where the risk is high, affected users without undue delay, in accordance with applicable law (including the UK GDPR, PIPEDA, India's DPDPA, and U.S. state breach-notification laws).

14. Automated Processing

Helios uses AI to analyze your data and generate insights. No health, medical, or other significant decisions are made automatically on your behalf; all AI outputs are informational suggestions only, and you remain responsible for your decisions.

15. Changes to This Policy

We may update this Policy from time to time. We will update the "Last Updated" date and notify you of material changes via in-app notice or email, and request renewed consent where required.

16. Contact Us

Email: support@my-helios.app

Helios provides health information and wellness insights for educational purposes only. It is not a substitute for professional medical advice, diagnosis, or treatment. Always consult a qualified healthcare provider for medical decisions. Helios is not a HIPAA-covered entity.