Privacy Policy

Account information. Your name and email address, and a session with our sign-in provider. If you sign in with Google, Google shares your name, email address and profile picture with us. We also store your language and time zone.

Health and wellness data from devices you connect. Only when you choose to connect a device or app, we receive the data it records, which can include:

• Sleep: duration, stages (deep, REM), efficiency, time to fall asleep and time awake.
• Heart and recovery: heart rate variability, resting heart rate, recovery and readiness scores, stress.
• Breathing: blood oxygen (SpO₂), respiratory rate and breathing disturbances.
• Activity and fitness: steps, active minutes, active calories, strain, workouts and VO₂max.
• Body: weight, body fat and muscle mass, and skin temperature deviation.
• Menstrual cycle day, if a connected source provides it.

We keep a copy of each record exactly as the device provider sent it, so we can recompute your results if our methods improve.

Data you create in Umbral. Supplement experiments you plan or run, the dates you mark as purchased, started or stopped, your daily taken/skipped log, and which suggestions you accept or dismiss.

Information we derive. Your personal baselines and normal ranges, the suggestions and clinician prompts our rules produce, and the results of your experiments. Because these can reveal information about your health, we treat them as health data too.

Connection information. The access tokens that let us fetch data from your devices (stored encrypted), your user ID at each device provider, and sync status and error messages.

Technical information. When you visit, our hosting provider receives your IP address, browser and device type and the pages requested, and keeps them in short-lived server logs. See Cookies and similar technologies.

Payment information. When paid plans can be purchased, payments are handled by our payment processor. We receive your plan and payment status, not your full card number.

We do not collect lab results, medications, diagnoses, precise location, contacts, photos, or biometric identifiers such as face or fingerprint data.

• You, when you create an account and use Umbral.
• Device providers you authorize: WHOOP and Oura directly; the providers available through our connection partner Junction (for example Garmin, Fitbit, Polar, Withings, Dexcom and others shown when you connect); and Apple Health, through the Health Auto Export app on your iPhone or through Junction.
• Your sign-in provider, such as Google, if you use it to sign in.
• Your browser and device, automatically, as described under technical information.

• To provide Umbral: sync your devices, calculate your baselines and ranges, and show your metrics.
• To generate supplement suggestions and "talk to a clinician" prompts. These come from fixed, published rules applied to your own data. We do not use artificial-intelligence models to analyze your health data, and we do not send it to any AI provider.
• To run the experiments you start and report how your metrics changed.
• To keep Umbral secure, prevent abuse, and fix problems.
• To communicate with you about your account, security and changes to our terms or this policy.
• To comply with the law and enforce our terms.

Our suggestions are educational, not medical advice, and they are not used to make any decision that produces legal or similarly significant effects about you.

What we do not do. We do not sell your personal information. We do not use your health data for advertising or marketing, to decide what ads you see, or to segment you for promotions. We do not share it with supplement brands, retailers, advertisers, data brokers or insurers, and we do not let third parties use it to train their models.

We share personal information only as described here.

Service providers that process data on our behalf, under contracts that limit their use of it to providing their service to us:

• Vercel hosts the website and app and processes requests, including health data in transit.
• Supabase hosts our database in the United States, where your account and health data are stored.
• Clerk manages sign-in and sessions. It holds your name, email and plan, not your health data.
• Junction connects the devices it supports. It receives an internal Umbral ID and your time zone, retrieves data from those devices, and passes it to us. For some devices (such as Peloton, Zwift, Eight Sleep or Dexcom) Junction asks for your login for that service directly; Umbral never sees those passwords.
• Our payment processor, when you buy a plan.

Device providers. When you connect WHOOP or Oura, we exchange authorization requests with them to fetch your data. We do not send them any data about you from Umbral.

Third-party content. Our pages load fonts from Google Fonts, and supplement pages show product images from Amazon, so Google and Amazon receive your IP address and the file requested. Product links to Amazon carry our affiliate tag, and we may earn a commission; if you follow one, Amazon learns which product you clicked, and its own privacy policy applies. We never send Amazon or Google an identifier for you or any of your health data.

Legal and safety. If required by law, subpoena or court order, or when necessary to protect the rights, property or safety of Umbral, our users or others. Where the law allows, we will tell you first.

Business transfers. If Umbral is involved in a merger, acquisition or sale of assets, your information may be transferred as part of it. We will notify you before that happens, and your health data will remain subject to the promises in this policy and our Consumer Health Data Privacy Policy.

With your consent. For any other sharing, we will ask you first.

We use only what Umbral needs to work, plus our own measurement of how the site is used. There are no advertising cookies, third-party analytics tools or tracking pixels on Umbral, and we never load another company's script to watch what you do.

• Sign-in cookies set by Clerk (such as __session and __client_uat) keep you signed in.
• NEXT_LOCALE remembers your language.
• umbral_oauth_* protects a device connection against forgery and expires after 10 minutes.
• umbral_vid is a random visitor id, kept for one year, that lets us count visits and see which pages lead people to create an account. It is our own cookie, it is stored only on our servers, and it is never shared with or sold to anyone. The usage events it ties together are the page you are on, the link you tapped, how far you scrolled and how long you stayed; never the content of a form, the address bar's query string, or your IP address.
• umbral_tz remembers your time zone, so a night of sleep lands on the right day.
• umbral_vocab remembers whether you prefer plain or technical wording.
• umbral_age_gate keeps the age screen's answer for one day.
• umbral-theme, stored in your browser, remembers light or dark mode.

We do not track you across other websites, so a Do Not Track signal changes nothing: there is nothing to turn off. If your browser sends a Global Privacy Control signal, we honor it: we do not set umbral_vid or record usage events for that browser, and we treat the signal as an opt-out of any sale or targeted advertising, which we do not do.

We keep your account and health data for as long as your account is open, because Umbral compares new data with your history to calculate your baselines.

When you ask us to delete your account or your data, we delete it from our active systems within 30 days of confirming your request, and we ask our service providers to do the same. Copies in encrypted backups are overwritten as backups rotate, and no later than 90 days after your request.

Short-lived server logs are kept by our hosting provider for a limited period and then deleted automatically. We may keep a record of privacy requests, and information we are legally required to keep, for as long as the law requires.

All traffic to Umbral is encrypted in transit with TLS. The tokens that give us access to your devices are encrypted with AES-256-GCM before they are stored, and our database provider encrypts data at rest. Data sent to us by device providers is verified with cryptographic signatures, and access to production systems is limited to the people who need it to run Umbral.

No system is perfectly secure. If a breach affects your information, we will notify you, and regulators such as the Federal Trade Commission under its Health Breach Notification Rule, as the law requires.

Wherever you live in the United States, you can ask us to:

• Access the personal information we hold about you, and learn who we have shared it with.
• Correct information that is inaccurate.
• Delete your account and the information we hold about you.
• Receive a copy of your data in a portable, machine-readable format.
• Withdraw your consent to our collecting or processing your health data. We will stop, and you can also ask us to delete what we already have.

You can also stop new data from reaching us at any time by revoking Umbral's access in your device's app or account settings (for example, in the WHOOP or Oura app).

We do not sell personal information or use it for targeted advertising or for profiling that produces legal or similarly significant effects, so there is nothing to opt out of; you may still send us an opt-out request and we will record it. We will not discriminate against you for exercising any of these rights.

How to make a request. Email info@umbral.health from the email address on your Umbral account, and tell us what you would like us to do. We may ask you to confirm the request from that address, or for other information, to verify it is you. You can use an authorized agent; we will ask for proof of the agent's authority and may ask you to confirm your identity directly.

We respond within 45 days. If we need more time, we will tell you why within that period and may extend it once by another 45 days.

Appeals. If we decline your request, you can appeal by replying with "Appeal" in the subject line within 60 days. We will answer your appeal within 45 days and explain our decision. If you are not satisfied, you can contact your state attorney general.

California. We do not sell or share personal information for cross-context behavioral advertising, and we use sensitive personal information only to provide the service you asked for. We do not disclose personal information to third parties for their own direct marketing.

Umbral is for adults. You must be at least 18 years old to use it. We do not knowingly collect information from anyone under 18, and if we learn that we have, we will delete it. If you believe a minor has given us information, contact us at info@umbral.health.

Umbral is offered in the United States. Your information is stored and processed in the United States by us and our service providers.

We will post any change on this page and update the effective date above. If we make a material change, we will tell you by email or in Umbral before it takes effect. We will not use or share health data we already hold in a materially different way without asking for your consent again.

RP Opportunity Ventures, LLC

16192 Coastal Highway, Lewes, Delaware 19958, United States

info@umbral.health