Privacy Policy

HRU Health (“HRU”, “we”, “us”) operates the HRU iOS application and the website hru-health.com. We are based at 57-63 Knightsbridge, London SW1X 7BF, United Kingdom, and we are the data controller for the personal data described in this policy.

Questions, requests, or concerns about your data: contact us at privacy@hru-health.com.

This policy covers the HRU app for iPhone and the hru-health.com website. Anyone aged 18 or over can create an account in the app. If you have had, or have booked, an in-clinic HRU Assessment, your clinic can link your account to your clinical record, for example with an activation code. Your relationship with your clinician, and any care they provide, is governed separately by their own terms. Your use of the app is also governed by our Terms & Conditions.

Account data. Your name and email address, which you give us when you sign up (or your clinic gives us when it registers you), and the identifier Apple assigns when you use Sign in with Apple, together with the name and email Apple shares at your direction. We also keep a record of the consents you give in the app, and when you gave them.

Subscription data. If you subscribe, Apple tells us your subscription’s status: which plan, when it started, renews or ends, whether a free trial or billing issue applies, and the transaction identifiers Apple uses for it. We also record any complimentary access we give you. Apple handles the payment itself: we never receive your card or other payment details.

Health and assessment data. This is the core of the service, and we treat it as special category data under UK and EU data protection law:

• Physiological assessment results your clinician uploads on your behalf (body composition, heart-rate variability, and related measurements), and the scores and insights we derive from them.
• Answers you give to in-app questionnaires (sleep, physical activity, body signals, nutrition and meal timing, and factors that can affect your heart readings, such as nicotine, alcohol and medication).
• Your in-app activity: tasks you mark complete, breathing sessions, and cognitive-exercise results.
• Heart readings taken with your iPhone camera or, if you choose to connect one, a Bluetooth heart-rate monitor (such as a chest strap). Either way the signal is processed entirely on your device — no video, images, or raw sensor streams ever leave your phone. Only the derived numbers (heart rate, heart-rate variability, coherence metrics) are stored with your account, along with which instrument took the reading. We do not store your monitor’s identity.
• Messages you exchange with the in-app coach, which may reference your health data.

What we do not collect. We do not collect your location. We do not use advertising or tracking identifiers, and we do not sell personal data — to anyone, ever. Voice dictation in the app is transcribed on your device where possible; when on-device transcription is unavailable, audio is processed by Apple’s speech service to produce the transcript and is never stored by HRU.

We use your data to:

• provide the service: compute your scores, personalise your plan, and answer your questions through the in-app coach;
• manage your subscription and access, including free trials and complimentary periods;
• send you service emails (such as your welcome email with your activation code);
• respond to support requests; and
• keep the service secure and working correctly.

Parts of the service — personalised insights, plans, and the coach — are generated using artificial-intelligence models run by specialist infrastructure providers processing data on our behalf and on our instructions. We do not permit your data to be used to serve advertising.

We process your health data on the basis of your explicit consent, which you may withdraw at any time by closing your account. We process account and subscription data as necessary to provide the service you have signed up for under our Terms & Conditions, and technical data on the basis of our legitimate interest in keeping the service secure and reliable.

Your clinician. If your account is linked to an HRU clinic, your HRU clinician can see your assessment data, your questionnaire answers and your progress — that is how the service is designed to work. If you have not had an assessment and have not linked your account to a clinic, no clinician sees your data.

Service providers. We use a small number of providers who process data on our behalf under contract: Apple (Sign in with Apple, and App Store payments and subscription status), our hosting provider OVHcloud, our transactional email provider Brevo, and AI infrastructure providers used to generate insights and coach responses. We share only what each provider needs to perform its function.

We do not share your data with advertisers, data brokers, or any other third party for their own purposes. We may disclose data if required by law.

Your data is stored on servers in Europe. Some of our providers (for example, AI infrastructure providers) may process data in other countries, including the United States. Where that happens, we rely on recognised safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an adequacy decision.

We keep your data while your account is active so your history and trends keep working. If your account is closed — at your request or your clinician’s — we delete your personal data from our systems, except where we are legally required to retain it. You can request deletion at any time in the app (Profile → Delete Account), via your clinician, or by emailing privacy@hru-health.com.

Deleting your account does not cancel an App Store subscription; cancel it in your Apple ID settings as well. Apple keeps its own records of your purchases under Apple’s privacy policy.

If you start signing up but do not complete the consent step, we automatically delete the partial record within 30 days. You can also erase it immediately with “Delete my details” on the sign-up screen.

Under UK and EU data protection law you have the right to access your data, correct it, delete it, restrict or object to its processing, receive a copy in a portable format, and withdraw consent at any time. To exercise any of these rights, contact privacy@hru-health.com. We respond within one month.

You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk).

All data travels between your device and our servers over encrypted connections (TLS). Sign-in credentials are held in your device’s secure Keychain. Access to production data is restricted to the small team that operates the service.

HRU provides wellness insights and lifestyle guidance. It is not a medical device, and nothing in the app is a diagnosis or a substitute for professional medical advice. Always consult a qualified clinician about medical concerns.

The service is intended for adults and is not directed at anyone under 18. We do not knowingly collect data from children.

hru-health.com may use cookies and similar technologies for analytics to understand how the site is used. If you take the free self-test on the site, your answers and results are stored so we can show you your outcome; they are not linked to an app account. Contact details you submit through the site are used only to respond to you.

If we make material changes to this policy we will update this page and, where appropriate, notify you in the app or by email. The effective date below always reflects the current version.