Privacy Policy

HRU Health (“HRU”, “we”, “us”) operates the HRU iOS application and the website hru-health.com. We are based at 57-63 Knightsbridge, London SW1X 7BF, United Kingdom, and we are the data controller for the personal data described in this policy.

Questions, requests, or concerns about your data: contact us at privacy@hru-health.com.

This policy covers the HRU app for iPhone and the hru-health.com website. The app is offered to clients whose account has been set up by their HRU clinician — there is no self-signup. Your relationship with your clinician, and any care they provide, is governed separately by their own terms.

Account data. Your name and email address, provided to us by your clinician when your account is created, and the identifier Apple assigns when you use Sign in with Apple (together with the name and email Apple shares at your direction).

Health and assessment data. This is the core of the service, and we treat it as special category data under UK and EU data protection law:

• Physiological assessment results your clinician uploads on your behalf (body composition, heart-rate variability, and related measurements), and the scores and insights we derive from them.
• Answers you give to in-app questionnaires (sleep, physical activity, body signals, nutrition and meal timing).
• Your in-app activity: tasks you mark complete, breathing sessions, and cognitive-exercise results.
• Heart readings taken with your iPhone camera. The camera signal is processed entirely on your device — no video or images ever leave your phone. Only the derived numbers (heart rate, heart-rate variability, coherence metrics) are stored with your account.
• Messages you exchange with the in-app coach, which may reference your health data.

What we do not collect. We do not collect your location. We do not use advertising or tracking identifiers, and we do not sell personal data — to anyone, ever. Voice dictation in the app is transcribed on your device; audio is not sent to our servers.

We use your data to:

• provide the service: compute your scores, personalise your plan, and answer your questions through the in-app coach;
• send you service emails (such as your welcome email with your activation code);
• respond to support requests; and
• keep the service secure and working correctly.

Parts of the service — personalised insights, plans, and the coach — are generated using artificial-intelligence models run by specialist infrastructure providers processing data on our behalf and on our instructions. We do not permit your data to be used to serve advertising.

We process your health data on the basis of your explicit consent, which you may withdraw at any time by closing your account. We process account data as necessary to provide the service you have signed up for, and technical data on the basis of our legitimate interest in keeping the service secure and reliable.

Your clinician. The clinician who onboarded you can see your assessment data and progress — that is how the service is designed to work.

Service providers. We use a small number of providers who process data on our behalf under contract: Apple (Sign in with Apple), our hosting provider OVHcloud, our transactional email provider Brevo, and AI infrastructure providers used to generate insights and coach responses. We share only what each provider needs to perform its function.

We do not share your data with advertisers, data brokers, or any other third party for their own purposes. We may disclose data if required by law.

Your data is stored on servers in Europe. Some of our providers (for example, AI infrastructure providers) may process data in other countries, including the United States. Where that happens, we rely on recognised safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an adequacy decision.

We keep your data while your account is active so your history and trends keep working. If your account is closed — at your request or your clinician’s — we delete your personal data from our systems, except where we are legally required to retain it. You can request deletion at any time via your clinician or by emailing privacy@hru-health.com.

Under UK and EU data protection law you have the right to access your data, correct it, delete it, restrict or object to its processing, receive a copy in a portable format, and withdraw consent at any time. To exercise any of these rights, contact privacy@hru-health.com. We respond within one month.

You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk).

All data travels between your device and our servers over encrypted connections (TLS). Sign-in credentials are held in your device’s secure Keychain. Access to production data is restricted to the small team that operates the service.

HRU provides wellness insights and lifestyle guidance. It is not a medical device, and nothing in the app is a diagnosis or a substitute for professional medical advice. Always consult a qualified clinician about medical concerns.

The service is intended for adults and is not directed at anyone under 18. We do not knowingly collect data from children.

hru-health.com may use cookies and similar technologies for analytics to understand how the site is used. If you take the free self-test on the site, your answers and results are stored so we can show you your outcome; they are not linked to an app account. Contact details you submit through the site are used only to respond to you.

If we make material changes to this policy we will update this page and, where appropriate, notify you in the app or by email. The effective date below always reflects the current version.