Application Privacy Policy

This Application Privacy Policy covers all personal information collected through the Happy Hearts app. For information specifically about how we handle Protected Health Information (PHI) under HIPAA, please also review our HIPAA Notice of Privacy Practices

1. Information We Collect

We collect information in the following categories:

Health and Wellness Information

This includes information such as:

• Blood pressure readings
• Medications
• Heart health data
• Health insights and recommendations
• Information you input related to your health
• Photos and files you upload

B. Personal Information

• Name
• Email address
• Date of Birth
• Account credentials
• Customer support communications

C. Device and Usage Information

• Device type, operating system
• App usage and interactions
• Log data and diagnostics (e.g., crash reports)
• IP address and approximate location (if applicable)

D. Information from Connected Devices

If you connect a compatible device (e.g., blood pressure monitor, wearable fitness tracker, or smartwatch such as Fitbit or Apple Watch), we collect data transmitted from that device to provide our Services. This may include heart rate, step count, activity data, sleep data, and other health-related metrics supported by your device.

E. Information from Third Parties

We may receive information from:

• Employers, health plans, or program sponsors
• Service providers supporting our platform
• Your healthcare providers, health plans, or other covered entities (e.g., health records, clinical information, or treatment history), with your authorization

F. Data Linkage

The personal information we collect is generally linked to your account or device to provide the Services. We do not collect anonymized data for independent resale or unrelated purposes.

2. How We Use Information

A. PHI

We use and disclose PHI in accordance with our HIPAA Notice of Privacy Practices, including for treatment, payment, and healthcare operations.

B. Non-PHI Personal Information

We use other personal information to:

• Create and manage your account
• Provide app functionality
• Communicate with you
• Provide customer support
• Maintain security and prevent fraud
• Analyze and improve app performance

3. How We Share Information

A. PHI

PHI may be shared only as described in our HIPAA Notice of Privacy Practices.

Non-PHI Personal Information

We may share non-PHI information with service providers and partners solely to support the operation of our Services, including hosting, analytics, customer support, security, and infrastructure.

These service providers may collect and process information on our behalf in accordance with our instructions.

All such parties are required to protect your information.

Legal and Safety Disclosures

We may disclose information when required by law or to:

• Protect rights and safety
• Prevent fraud or abuse
• Comply with legal obligations

4. Tracking and Advertising

We do not track users across third-party apps or websites for advertising purposes.

We do not use third-party advertising SDKs.

We do not use personal information for cross-app behavioral advertising.

Any analytics we use are not used for advertising purposes.

5. Permissions and Device Access

We request device permissions only as necessary to provide core app functionality. For example:

• Bluetooth: to connect to health devices
• Camera: for device setup or support, nutritional analysis, and for scanning documents
• Photo Library: to upload existing photos for nutritional analysis
• Storage: to save and access app data on your device
• Notifications – to provide reminders and updates
• Activity Recognition & Health Sensors: to collect health and fitness data from connected wearables, which may include steps, heart rate, blood pressure, sleep, exercise activity, stress levels, and other health metrics supported by your device

You can manage permissions in your device settings.

6. Data Retention & Deletion

A. Retention

We retain your information for the following periods:

• Account and profile information: Retained for the duration of your account and for up to 2 years following account closure or deletion, unless a longer period is required by law.
• Health information (PHI): We retain health records for a minimum of 10 years from the date of your last service with us, or longer if required by applicable law or to comply with legal, regulatory, contractual, audit, or litigation hold requirements, including applicable Medicare and CMS program requirements.
• Device and usage data: Retained for up to 12 months for analytics and service improvement purposes, then deleted or de-identified.
• Customer support communications: Retained as reasonably necessary to resolve support issues and comply with applicable legal, regulatory, audit, litigation hold, and business record retention requirements.

When information is no longer needed and no legal obligation requires its retention, we securely delete or de-identify it.

B. Deletion

You may request deletion of your account and associated personal information at any time by:

• Using the account deletion option within the app which can be found through your Profile → Settings → Delete Account (near the Log Out button) or
• Submitting a request at support@happyheartcareservices.com; or
• Contacting us at privacy@happyheartcareservices.com.

Upon receiving a verified deletion request, we will delete your account and associated personal information within thirty (30) days, except where retention is required by law. Where we are required to retain certain information (for example, health records under HIPAA or state medical record retention laws), we will inform you of the specific data retained and the legal basis for retention.

Deleting the Happy Hearts app from your device does not delete your account or data. You must submit a deletion request through one of the methods above.

7. Your Privacy Rights

A. PHI Rights

Your rights regarding your health information (PHI), including access, correction, and restrictions, are described in our HIPAA Notice of Privacy Practices.

B. Other Privacy Rights

Depending on your location, you may have rights to:

• Access your personal information
• Request correction
• Request deletion
• Opt out of certain data uses

To exercise these rights, contact us at: privacy@happyheartcareservices.com

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale or sharing of personal information. We do not sell your personal information. To exercise your rights, contact us at privacy@happyheartcareservices.com.

8. Security

We implement administrative, technical, and physical safeguards designed to protect your information.

In the event of a breach involving PHI, we will notify you as required by law.

9. Children’s Privacy

Our Services are not intended for children under 18, and we do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Application Privacy Policy from time to time. Updates will be posted within the app and on our website.

11. Contact Us

12. Policy History

Version Number	Date	Description of Change/Periodic Review
1	6/25/2026	Policy Creation