Depending on how you use Attune, the App may process information that you provide directly, information generated through your use of the App, technical information, and health and fitness information.

Attune may process information you choose to enter into the App, including information related to your health, wellness, lifestyle, and use of the App’s features.

Depending on the features you use, this may include information such as:

Some of this information may constitute health data or other special categories of personal data under applicable data protection laws.

We process such information only as necessary to provide the features you choose to use and, where required by law, on the basis of your explicit consent.

Attune provides features that can use health and fitness information from Apple Health (HealthKit) on iOS and Health Connect on Android.

Access to Apple Health and Health Connect is optional. Attune requests access only after you choose to use a feature that requires such data and subject to the permissions you grant through your device.

Depending on your device, platform, and the features you use, Attune may access:

• Weight — for weight tracking and to prefill a weight value when appropriate;
• Height — to complete missing profile information and calculate metrics such as BMI;
• Step count — to display your daily steps and recent activity;
• Exercise information — such as exercise session duration, to display daily physical activity and support activity and motivational features;
• Sleep data — such as sleep duration and sleep sessions, to analyze your sleep patterns, display sleep-related metrics and insights, and help you monitor your sleep over time.

Attune only requests health and fitness data that is necessary for the corresponding user-facing functionality.


How We Use Health Data

Health and fitness data accessed through Apple Health or Health Connect is used only to provide Attune’s health, activity, progress, sleep, and wellness features.

For example, Attune may use this data to:

• display daily steps and physical activity;
• display weight and weight progress;
• calculate and display health-related metrics such as BMI;
• analyze sleep duration and patterns and display sleep-related metrics and insights;
• provide progress and motivational features.

Attune does not use health data obtained through Apple Health or Health Connect for advertising, marketing, behavioral profiling, or tracking.


Storage and Sharing of Apple Health and Health Connect Data

Health and fitness data read from Apple Health or Health Connect is accessed and processed locally on your device for the features described above.

We do not upload, transmit, or store health and fitness data obtained from Apple Health or Health Connect on our servers or in external databases.

We do not sell this data or share it with advertisers, analytics providers, data brokers, or other third parties.

In particular, health data obtained from Apple Health or Health Connect is not sent to our analytics or attribution providers.

Information that you separately choose to enter or save in Attune is handled according to the other applicable sections of this Privacy Policy.


Your Control Over Health Data

You control Attune’s access to Apple Health and Health Connect.

You can grant or deny access to individual health and fitness data types and can review or revoke these permissions at any time through Apple Health or your iOS settings, or through Health Connect or your Android settings.

If you revoke a permission, Attune will no longer be able to access the corresponding data through Apple Health or Health Connect.

Because Attune does not retain health data obtained from Apple Health or Health Connect on our servers, there is no server-side copy of this data for us to delete. You can manage or delete the underlying data through Apple Health or Health Connect.

Technical and Usage Data

When you use Attune, we and our service providers may process limited technical and usage information necessary to operate, maintain, understand, and improve the App.

This information may include, depending on your device and settings:

• device and operating system information;
• App version;
• language and general device settings;
• technical identifiers;
• App interactions and feature usage;
• session and diagnostic information;
• crash and performance information;
• subscription and purchase status;
• attribution information relating to installation or acquisition of the App.

We do not intentionally include health information obtained from Apple Health or Health Connect in analytics or attribution events.


Analytics and Product Improvement

We use PostHog to help us understand how users interact with Attune, evaluate feature usage, identify technical or usability issues, and improve the App.

The information sent to PostHog may include technical information and events describing interactions with App features.

We do not send health data obtained from Apple Health or Health Connect to PostHog.

Where appropriate, analytics data is pseudonymized or otherwise limited to what is necessary for analytics and product improvement purposes.


Attribution

We use Adjust to measure App installations and understand the effectiveness of our acquisition and promotional activities.

Adjust may process device, technical, attribution, and interaction information in accordance with applicable platform permissions and privacy requirements.

We do not send health data obtained from Apple Health or Health Connect to Adjust.


Subscriptions and Purchases

Attune may offer subscriptions or other in-app purchases.

Purchases are processed through Apple’s App Store or Google Play. We do not receive or store your full payment card details.

We use RevenueCat to manage subscription entitlements and purchase status across the App. RevenueCat may process information related to purchases, subscriptions, App user identifiers, and technical information necessary to provide these services.

We do not send health data obtained from Apple Health or Health Connect to RevenueCat.


Purposes and Legal Bases for Processing

Where the GDPR applies, we process personal data only when we have an appropriate legal basis.

Depending on the type of data and processing, these bases may include:

• Consent or explicit consent — including where required for the processing of health information or other special categories of personal data;
• Performance of a contract — where processing is necessary to provide the App and features you request;
• Legitimate interests — for purposes such as maintaining, securing, analyzing, and improving Attune, where those interests are not overridden by your rights and freedoms;
• Compliance with legal obligations — where processing is necessary to comply with applicable law.

Access to Apple Health and Health Connect is additionally controlled by the permissions you grant through your device.


Third-Party Service Providers

We use third-party service providers to operate and support Attune. These may include:

• PostHog — product analytics;
• Adjust — attribution and measurement;
• RevenueCat — subscription and purchase management;
• Apple — App Store, in-app purchases, and Apple Health/HealthKit functionality on iOS;
• Google — Google Play, in-app purchases, and Health Connect functionality on Android.

These providers may process limited information as necessary to provide their respective services and according to their own privacy practices and our agreements with them.

Health and fitness data obtained from Apple Health or Health Connect is not provided to PostHog, Adjust, or RevenueCat.


Advertising

We do not use health data obtained from Apple Health or Health Connect for advertising.

We do not sell health data or provide it to data brokers.


Data Retention

We retain personal data only for as long as necessary for the purposes for which it was processed, subject to applicable legal requirements.

Retention periods may vary depending on the type of information and the purpose of processing.

Information that is no longer necessary is deleted or anonymized where appropriate.

Health and fitness data accessed directly from Apple Health or Health Connect is not retained on our servers.

Third-party service providers may retain technical, analytics, attribution, or subscription information according to their applicable retention policies and our agreements with them.


Data Security

We use appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

Access to personal data is limited where appropriate, and data transmitted between the App, our systems, and service providers is protected using appropriate secure communication methods.

WACHANGA LIMITED maintains information security processes based on recognized security practices, including ISO/IEC 27001:2022.

No method of electronic transmission or storage can, however, be guaranteed to be completely secure.


International Data Transfers

Some of our service providers may process personal data outside the European Economic Area.

Where required, we use appropriate safeguards for international transfers of personal data in accordance with applicable data protection law, such as adequacy decisions or appropriate contractual safeguards.


Your Rights

Where applicable under data protection law, you may have the right to:

• obtain information about the processing of your personal data;
• access your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data;
• request restriction of processing;
• object to certain processing;
• receive certain personal data in a portable format;
• withdraw your consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Permissions for Apple Health and Health Connect can be managed separately through your device.

To exercise your data protection rights regarding data controlled by WACHANGA LIMITED, contact us at dpo@wachanga.com.

You also have the right to lodge a complaint with the competent data protection supervisory authority.


Children’s Privacy

Attune is intended for adults and is not directed to children.

We do not knowingly collect personal data from children through Attune. If we become aware that personal data from a child has been collected contrary to applicable law, we will take appropriate steps to delete it.


Automated Decision-Making

Attune does not use personal data to make decisions that produce legal or similarly significant effects based solely on automated processing.


Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Attune, our data practices, applicable law, or platform requirements.

When we make changes, we will update the “Last updated” date at the top of this Privacy Policy. Where required by law, we will provide additional notice or request consent before materially changing how personal data is processed.


Contact Us

If you have questions about this Privacy Policy or the processing of your personal data, you can contact:

WACHANGA LIMITED
27, 25th Martiou Street
2408 Nicosia, Cyprus
Email: dpo@wachanga.com