Privacy Policy

Effective October 3, 2026 · Last updated October 3, 2026 · Creative Labs LLC

Apnealytics ingests data from your CPAP/BiLevel machine, stores the raw files, and presents your therapy — nightly AHI, adherence, event composition, leak, pressure, and per-night detail. Apnealytics is a tracking and coaching tool, not a medical device, and does not provide a diagnosis. Machine-estimated metrics are not a clinical diagnosis; always consult a licensed clinician about your therapy.

1. The data we process

Account data. Your email address (for passwordless magic-link and password sign-in) and basic account/session records.

Therapy / health data (sensitive): raw data-card files from your machine; parsed per-night summaries and session detail (AHI and sub-indices, usage/adherence, leak, pressure incl. P95, EPR, event timing); equipment and replacement logs; optional journal entries.

Apple Health / Health Connect (only if you connect it): a small set of daily aggregates you choose — resting heart rate, HRV, SpO₂, sleep hours, weight. The large health export never leaves your device; only these aggregates are sent, used solely to display alongside your therapy data — never for advertising, never shared.

Payment data (where applicable): subscriptions are processed by Apple (in-app purchases on iOS) and by our web payment providers (RevenueCat, which runs checkout on Stripe). We never receive or store your full card number — only subscription/customer references and plan status.

AI assistant (optional, “Ask your data”). If you choose to use the in-app AI assistant, you supply your own OpenAI or Anthropic developer API key, and your questions plus the therapy figures needed to answer them are sent to that provider you selected, under their terms — never to an AI service of ours, and not used to train anyone’s models beyond that provider’s own policies. You control whether to use this feature at all.

Technical data. Minimal operational logs and error reports needed to run and secure the service. We do not put health data in logs, our error monitoring strips request bodies, cookies, headers, query strings, and user identity, and we run no third-party advertising/analytics trackers on authenticated pages.

2. How we use your data

To provide the service (parse uploads, compute metrics, render your dashboard); to authenticate you and keep your account secure; to operate billing (where applicable); to maintain, debug, and secure the service; and to send you transactional email. We do not sell your personal information, and we do not use your health data for advertising.

3. Legal bases (where GDPR/UK-GDPR applies)

Contract (to provide the service), consent (Apple Health connection and optional features; withdrawable anytime), and legitimate interests (securing the service). Health data is special-category data; where required we rely on your explicit consent and process it only to provide the service to you.

4. How your data is stored and protected

Per-account isolation — database-level Row-Level Security on every user-owned table, so your rows are only readable within your own account. Private file storage — raw files live in private storage, reachable only via short-lived signed URLs. Encryption in transit (TLS/HTTPS). Authentication — passwordless magic links and optional password, with server-side, revocable sessions and a rate-limited sign-in. Minimized diagnostics — error monitoring excludes health data and identifiers. No method is 100% secure, but we design to these practices.

5. Who we share data with (subprocessors)

Only vendors that host or power the service, under their terms, as needed: Vercel (hosting), Neon (database), Cloudflare R2 (private file storage), Resend (transactional email), Apple & RevenueCat and Stripe (subscription billing), Expo (push-notification delivery), Sentry (error monitoring, health data stripped). Separately, if you use the optional AI assistant, your questions and the therapy figures needed to answer them go to the AI provider you choose (OpenAI or Anthropic) using your own API key. We may disclose data if required by law or to protect our rights, users, or the public. We do not sell personal information.

6. Sharing features you control

If you create a clinician/share link, it shows aggregate summaries and, by default, excludes raw health identifiers; share pages are set not to be indexed. You control whether to create or revoke a link.

7. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete your data, and to object to or restrict certain processing. In-app you can export your data and request deletion of your account, and you can disconnect Apple Health in iOS Settings anytime. For anything else, contact us. We don’t discriminate against you for exercising privacy rights.

8. Data retention and deletion

We keep your data while your account is active. When you delete your account, we remove it and associated therapy data — including raw files — within 30 days, except where we must retain limited records to meet legal, accounting, or security obligations. Backups are purged on their normal rotation.

9. Children

Apnealytics is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

10. Data breach notification

If a breach affecting your personal data occurs, we will act under our internal breach-response plan and notify affected users and any regulators as required by applicable law, without undue delay.

11. International transfers

Our infrastructure is operated in the United States. If you access Apnealytics from another country, your data may be processed there; where required we use appropriate safeguards for cross-border transfers.

12. Changes to this policy

We may update this policy; we’ll post a new effective date and, for material changes, notify you. Continued use after an update means you accept it.

13. Contact

Questions or requests: info@apnealytics.com · Creative Labs LLC.