Privacy Policy

Version: 1.3
Effective Date: June 1, 2026
Last Updated: October 14, 2026

Table of Contents

1. About This Policy
2. Who We Are
3. Information We Collect
4. How We Use Your Information
5. Legal Bases for Processing
6. Data Storage and Security
7. Data Sharing and Third Parties
8. Data Retention
9. Your Rights
10. Account and Data Deletion
11. Children's Privacy
12. International Data Transfers
13. Cookies and Website Tracking
14. Changes to This Policy
15. Contact Us

Regional Addenda:

• A. European Economic Area, UK & Switzerland
• B. United States and Canada
• C. Brazil
• D. Argentina and Mexico
• E. Kazakhstan
• F. Other Jurisdictions

1. About This Policy

This Privacy Policy explains how HelAI ("we", "us", "our") collects, uses, stores, and protects personal information when you use the HelAI mobile application (available on iOS and Android) and the website helai.app (collectively, the "Service").

We are committed to handling your personal information transparently and in accordance with applicable data protection laws across all markets in which we operate. We build privacy protections into our product by design: the AI pose-tracking feature runs entirely on your device, and health data from Apple Health or Google Health Connect is never transmitted to our servers.

Please read this policy carefully. By creating an account or using the Service, you acknowledge that you have read and understood this policy.

2. Who We Are

Data Controller / Operator:
Konstantin Yeftifeyev, a natural person operating as HelAI
Taugul-1, house 57
Almaty 050001
Republic of Kazakhstan

HelAI is built and operated by one individual. There is no company and no employees. This means there is no Data Protection Officer: privacy requests are handled by the operator personally at the address below.

Phone:
+7 778 767 7555

Privacy Contact:
[email protected]

General Contact:
[email protected]

Website:
https://helai.app

3. Information We Collect

We collect the minimum information necessary to provide the Service. Below is a complete description of every category of data we collect.

3.1 Account and Identity Data

When you create an account, we collect:

• Email address — used for authentication and communication
• Display name (first and last name) — used to personalize your experience
• Authentication provider — whether you signed in via Google, Apple, or email/password
• User identifier (UID) — a unique identifier assigned by our authentication service (Firebase Authentication)

This data is stored both locally on your device and in our cloud authentication system.

Your UID is a pseudonymous identifier: it does not contain your name or email. Besides our own backend, it is used as your customer identifier at RevenueCat (Section 3.11), as your user identifier in Google Analytics if you give Analytics consent (Section 3.6), and as your customer identifier at AppsFlyer if you give Marketing consent (Section 3.7).

3.2 Fitness and Workout Data

When you use the app to track workouts, we collect:

• Workout sessions — date, duration, name, and optional notes
• Exercise history — exercises performed within each session, including type and order
• Set data — number of sets, repetitions, and weight used per exercise
• Personal records (PRs) — automatically calculated from your set history
• Goals — fitness goals you create and their progress
• Exercise preferences — custom rest timers, execution notes, and settings per exercise

Free tier — on-device by default: All fitness and workout data is stored locally on your device in an encrypted database. We do not upload the workout history of free-tier users.

HelAI Pro — cloud sync: If you subscribe to HelAI Pro, your workout history (sessions, exercises, sets), goals, personal records, workout templates, programs, achievements, custom exercises, and per-exercise settings are synchronised to our backend (Firebase Data Connect, Section 7.1) under your user identifier, so that they are backed up and available on every device you sign in to. Cloud sync is part of the Pro service you purchase (Section 5, contract). When your subscription ends, cloud sync stops: nothing new is uploaded or downloaded. The existing cloud copy is kept, unused, until you delete your account or ask us to erase it (Section 10). We keep it on the basis of our legitimate interest in not making a returning subscriber lose their training history (Section 5); you can object at any time (Section 9). If you subscribe again, sync resumes with that copy. The copy on your device is not affected.

3.3 Health and Biometric Data

If you grant permission, the app reads the following health data from your device's health platform (Apple Health on iOS, Google Health Connect on Android):

• Sleep duration
• Resting heart rate and heart rate variability (HRV)
• Daily step count
• Weight, height, and body fat percentage

This data stays on your device. It is displayed on the Home screen and in the Profile body-metrics section, stored locally in an encrypted database, and is never transmitted to our servers. Granting these permissions is optional; refusing them does not prevent you from using the core features of the app.

We also write two things back, if you allow it. When you finish a workout, HelAI can add that workout session and an active-calorie figure to Apple Health or Health Connect so the session appears in your activity totals. The calorie figure is an estimate calculated from the exercise type, the duration and your body weight — it is not a measurement. You can turn this off in the app, and deleting a workout in HelAI also removes the record HelAI wrote. Nothing else is written, and none of it is sent to us.

3.4 Camera and AI Pose Detection Data

The AI coaching feature uses your device's camera to analyze your exercise form in real time:

• Video frames are processed entirely on your device by a local machine learning model (MediaPipe Pose Landmarker) and are discarded frame by frame. No video or image is written to storage, and nothing from the camera is transmitted to us or to any third party.
• Technique reports stay on your device. After a set, the AI coach saves a short structured summary — rep count, detected form errors, joint-angle statistics and tempo — to the encrypted database on your device so you can review it later. It contains no video and no images, it is never uploaded, and it is removed when you delete the set or uninstall the app.
• Camera access is used only while you are actively using the AI coaching screen
• If you choose to analyse a video from your photo library, the app copies that file into its own storage for the duration of the analysis and deletes it afterwards. The video is processed on the device and is never uploaded.
• The ML model itself is downloaded once to your device as part of the app installation or an on-demand asset pack — model inference always happens locally

3.5 Device and Technical Data

To detect and fix crashes and technical issues, we automatically collect:

• Device model and manufacturer
• Operating system and version
• App version
• Crash stack traces and error logs
• App usage breadcrumbs (sequence of actions leading to an error)

This data is collected by Firebase Crashlytics. It is used solely for debugging and improving app stability. It does not include your personal information such as name or email, and we do not attach a user identifier to crash reports.

This is part of our Diagnostics consent category. It is off by default and is collected only if you opt in through the in-app consent screen. Crashlytics collection is disabled at app startup until you grant consent, and you can withdraw it at any time (see Section 5 and Section 9).

If the app crashes while Diagnostics is off, the crash report that Crashlytics keeps on the device is deleted there. It is not sent later, even if you turn Diagnostics on afterwards. Withdrawing Diagnostics also deletes any report that has not been sent yet.

3.6 Usage Analytics

To understand how the app is used and improve the product, we collect:

• Screen view events — which screens you visit within the app (for example: "Home", "Profile", "ActiveWorkout", "PoseCamera")
• A small set of product events — signing in and the method used, completing onboarding, finishing a workout (with its duration, number of exercises and number of sets), opening the paywall (and from where), opening a HelAI link (the link and its campaign tags), tapping the streak on the Home screen, opening an exercise's technique video, requesting AI coaching for an exercise (Section 3.10), and your consent and tracking choices
• Your account identifier — while Analytics consent is on and you are signed in, your Firebase UID is set as the Google Analytics user ID, so the events above are linked to your account. This identifier is pseudonymous: it is not your name or your email address.
• One account attribute — whether the account has an active HelAI Pro subscription
• The app instance ID — an identifier that Google Analytics assigns to this installation of the app. With Analytics consent, we also store it in your RevenueCat customer record (as the attribute $firebaseAppInstanceId, Section 7.7), so that RevenueCat can report your purchases and renewals to Google Analytics from its servers.
• Device information and approximate location — device model, operating system, app version, language, and an approximate location (such as country and region) that Google derives from your IP address. We do not collect precise location.

We do not collect your notes or your health metrics through analytics. The names of the exercises you perform are not sent; when you open an exercise's technique video or request AI coaching for it, the event carries that exercise's catalog identifier.

No advertising identifier in Analytics. Google Analytics in HelAI does not collect the device advertising identifier on either platform: on Android its collection of the advertising ID is switched off, and the iOS app includes Google Analytics without the component that reads the IDFA, with collection of the identifier for vendor (IDFV) also switched off. Google's advertising signals (ad_storage, ad_user_data, ad_personalization) are set to denied by default, so analytics data is not used for advertising or ad personalisation. The app shows no ads.

If you have given Marketing consent (and, on iOS, allowed tracking), the names of these events are also sent to AppsFlyer so a campaign can be credited with a sign-up or a purchase (Section 3.7). Their contents are not: AppsFlyer receives that a workout was completed, never how long it lasted or what it contained.

This data is collected by Firebase Analytics. It is part of our Analytics consent category, is off by default, and is collected only if you opt in through the in-app consent screen. Analytics collection is disabled at app startup until you grant consent, and you can withdraw it at any time. On iOS, your answer to Apple's App Tracking Transparency prompt does not affect Analytics: it follows only your Analytics choice.

When you turn Analytics off in Profile → Privacy consent, collection stops, the analytics identifiers on your device are reset (if you turn Analytics on again later, the app gets a new app instance ID and its history is not joined to the old one), and the app deletes $firebaseAppInstanceId from your RevenueCat record. Events already collected stay in Google Analytics for the retention period in Section 8, unless you ask us to delete them (Section 10).

3.7 Marketing and Attribution Data

To understand which marketing campaign or referral brought you to HelAI (so we can measure and improve our marketing), we use AppsFlyer, a mobile attribution service:

• Install and attribution data — install source, referring campaign identifier, and re-engagement events
• An attribution identifier — an identifier that AppsFlyer creates for this installation and stores on your device (the AppsFlyer ID). It is a pseudonymous identifier, not an anonymous one.
• The device advertising identifier, where permitted — on Android the advertising ID (unless you have deleted or limited it in your device settings); on iOS the IDFA, only if you allow tracking at the App Tracking Transparency prompt
• Your account identifier — your Firebase UID, set as the AppsFlyer customer user ID
• The names of in-app events — for example that you signed in, finished onboarding or completed a workout (Section 3.6). Only the event name is sent, never its details or parameters.
• An Apple Search Ads attribution token (iOS only) — a token that Apple's AdServices framework provides. The app asks RevenueCat's SDK to collect it and send it to RevenueCat, which uses it to attribute your install or purchase to an Apple Search Ads campaign. It is collected only if you have given Marketing consent and allowed tracking at the App Tracking Transparency prompt. The Android app does not collect it.

This is part of our Marketing consent category. It is off by default and is used only if you opt in through the in-app consent screen. AppsFlyer is initialized but does not start collecting or sending any data until you grant Marketing consent. With Marketing consent, the AppsFlyer ID and device identifiers are also stored in your RevenueCat record so that a Pro purchase can be attributed to a campaign (Section 7.4). On iOS, with Marketing consent and ATT permission, RevenueCat also receives the Apple Search Ads attribution token described above (Section 7.4). If you turn Marketing off, the app stops collecting the token; a token already sent to RevenueCat cannot be recalled by the app, and we delete it on request (Section 9).

We do not display advertising inside the app, and we do not use this data for profiling or to build advertising audiences. It is used solely to attribute installs and purchases to campaigns.

iOS App Tracking Transparency: On iOS, Marketing additionally requires your permission through Apple's App Tracking Transparency (ATT) prompt. The prompt asks only to let us see which ad campaign brought you to HelAI; the app shows no ads and personalises nothing. If you deny tracking at the ATT prompt, AppsFlyer will not start and the app will not collect the Apple Search Ads attribution token, even if you enabled the Marketing category — your system-level choice always takes precedence. The ATT answer affects only Marketing: Analytics and Diagnostics follow only their own consent choices, because only Marketing processing (AppsFlyer, and the copy RevenueCat keeps for attribution, Section 7.4) can read the IDFA or collect the Apple Search Ads attribution token.

3.8 Wearable Device Data

If you pair a Garmin smartwatch with the app, workout events and AI coaching feedback are exchanged between the app and your watch via Bluetooth Low Energy (BLE). This communication is device-to-device only — no data from this exchange is transmitted to our servers or to Garmin's servers.

3.9 Website and Contact Form Data

When you visit helai.app or submit a message through our contact form, we collect:

• Language preference — taken from the page address (for example /en/) or, on a first visit, from your browser's language setting. Nothing is stored on your device for this.
• Contact form submissions — your name, email address, subject, and message content, used solely to respond to your inquiry
• IP address — when you submit the contact form, your IP address is used to rate-limit submissions (at most 3 per 15 minutes, held in server memory only for that window), passed to Cloudflare Turnstile for anti-bot verification, and included in the support email we receive so that we can trace abuse

3.10 Feedback You Send Us

If you rate the app from the in-app prompt, we receive your star rating and, if you write one, your comment, together with your app version, platform and language. This is stored on our backend under your account identifier so we can follow up on what you wrote. It applies to free and Pro accounts alike. If you would rather not be identified, write to [email protected] instead.

Requesting AI coaching for an exercise. When an exercise is not yet supported by the AI coach, the app offers a "Request AI for this exercise" button. If you tap it, we store which exercise you asked for (its catalog identifier and code), together with your account identifier, your app version, platform and language, whether the request came from a test build of the app, and the time of the first request. One record is kept per account and exercise. We use these records to count demand, so we can decide which exercises the AI coach should support next; the app also remembers on your device that you have already asked. The records are stored in Firebase Data Connect in the EU (Section 6.2), apply to free and Pro accounts alike, and are kept until you delete your account or ask us to erase your data (Section 8). If you have given Analytics consent, the request is also counted as an analytics event (Section 3.6).

3.11 Subscription and Purchase Data

If you purchase HelAI Pro, our subscription processor RevenueCat receives from Apple or Google the product identifier you bought, the purchase and expiry dates, the store transaction identifier, and your subscription status. RevenueCat identifies you by the same user identifier as our authentication service (your Firebase UID). With Analytics consent, your RevenueCat record also holds the Google Analytics app instance ID (Section 3.6); with Marketing consent, the AppsFlyer ID and the device identifiers listed in Section 7.4, and, on iOS once you also allow tracking at the ATT prompt, an Apple Search Ads attribution token (Section 3.7). We never see or store your payment card details — the app stores handle payment.

3.12 Push Notification Tokens

If you allow notifications, Firebase Cloud Messaging assigns your app installation a push token that we use to deliver workout reminders and updates. The token is not linked to advertising and is not shared with any other party. Like Remote Config, Cloud Messaging relies on the Firebase Installation ID, a pseudonymous identifier of your app installation (Section 7.1).

4. How We Use Your Information

We use the information we collect for the following specific purposes:

We do not use your data for advertising, profiling for non-fitness purposes, or sale to third parties.

5. Legal Bases for Processing

For users in jurisdictions that require a legal basis for data processing (including the EU, UK, Brazil, and others), we process your data on the following bases:

You have the right to object to processing based on legitimate interests, and to withdraw any consent you have given. See Section 9 for how to exercise your rights.

Managing Your Consent

When you first launch the app, we show you a consent screen that lets you accept all optional data collection, reject all optional data collection, or customize each category individually. The three optional categories — Analytics, Diagnostics, and Marketing — are off by default; the Necessary category (authentication, purchases, push delivery, and cloud sync) is always required for the app to function.

You can change your choices at any time in the app under Profile → Privacy consent. Until you make a choice, all optional data collection stays off. On iOS, the Marketing category additionally depends on your answer to Apple's App Tracking Transparency prompt: if you deny tracking, marketing attribution stays off regardless of the in-app toggle. The ATT answer affects only Marketing; Analytics and Diagnostics follow only your choices on the consent screen.

When we change what an optional category covers, the app asks you again. A choice you made under an earlier version of the consent screen is then treated as "all optional categories off" until you answer again. With version 1.3 of this policy, the app asks every user again (consent version 2), because the consent screen now states that Analytics is linked to your account identifier and lists everything Marketing shares; from the moment the app applies your choices at startup, before the consent screen appears, until you answer, Analytics, Diagnostics and Marketing all stay off.

6. Data Storage and Security

6.1 Local Storage (On-Device)

Most of your personal data — including all workout history, health data, personal records, and goals — is stored locally on your device using:

• SQLite database encrypted with SQLCipher (AES-256 encryption at rest)
• Data is accessible only to the HelAI application

6.2 Cloud Storage

Account data (email, display name, UID) is stored in Firebase Authentication, operated by Google LLC. Firebase services are hosted on Google Cloud Platform infrastructure.

Firebase Data Connect (our exercise catalog database) is hosted in the europe-southwest1 region (Spain, EU).

For HelAI Pro subscribers, synced training data is stored in the same region (europe-southwest1). So are the feedback and "Request AI for this exercise" requests you send (Section 3.10).

6.3 Security

HelAI is built and run by one person. There is no security team, and neither the app nor this service has been audited or certified by anyone. These are the measures actually in place:

• In transit: TLS between the app and Google's Firebase endpoints.
• On your device: the local database is encrypted with SQLCipher (AES-256).
• On our backend: data is held in Google Cloud (Spain) under Google's own encryption at rest. Every request carries your authentication token, and server-side rules restrict each account to its own records.
• Who can reach it: only the operator, through the Google Cloud, Firebase and RevenueCat consoles, with two-factor authentication enabled.
• Data minimisation: health-platform data, camera frames and free-tier training data never reach our servers at all.

No method of transmission or storage is completely secure. If a breach occurs that is likely to put your rights at risk, we will notify you and the competent authority as the law requires.

7. Data Sharing and Third Parties

We do not sell, rent, or trade your personal information to any third party. The following third-party service providers process some of your data on our behalf as data processors:

7.1 Google LLC — Firebase Platform

Services used: Firebase Authentication, Firebase Data Connect, Firebase Analytics, Firebase Crashlytics, Firebase Cloud Messaging, Firebase Remote Config, Firebase Installations
Data processed: Account credentials, exercise catalog queries, synced training data for HelAI Pro subscribers (Section 3.2), feedback and "Request AI for this exercise" requests (Section 3.10), push notification tokens, usage events linked to your account identifier together with the app instance ID and approximate location (Analytics — with your consent, Section 3.6), crash logs (Crashlytics — with your consent). Remote Config, Cloud Messaging and Firebase Installations identify your app installation by the Firebase Installation ID, a pseudonymous installation identifier; Remote Config uses it to deliver feature flags to the app.
From RevenueCat: with your Analytics consent, RevenueCat sends your purchase and subscription events to Google Analytics, matched by the app instance ID (Section 7.7).
Location: Google Cloud Platform — primarily europe-southwest1 (Spain, EU)
Legal framework: Google Cloud Data Processing Addendum (Standard Contractual Clauses included)
Link: Google Cloud Privacy

7.2 Cloudflare, Inc.

Service used: Cloudflare Turnstile (anti-spam verification on our website contact form)
Data processed: A challenge verification token — no user tracking, no cookies set for advertising
Location: Cloudflare global network
Link: Cloudflare Privacy Policy

7.3 Resend, Inc.

Service used: Email delivery (for contact form responses)
Data processed: your name, email address, message content and the IP address the message was sent from, which we include in the email so we can trace abuse
Link: Resend Privacy Policy

7.4 AppsFlyer Ltd. — Mobile Attribution

Service used: Install and re-engagement attribution (Marketing category)
Data processed: Install source, campaign identifier, the AppsFlyer ID (an attribution identifier stored on your device), the device advertising identifier where permitted (Android advertising ID; on iOS the IDFA only after you allow tracking at the ATT prompt), your account identifier (Firebase UID, as the AppsFlyer customer user ID), and the names of in-app events without their details (Section 3.7)
Processed only with your consent: AppsFlyer does not start or send any data unless you opt in to the Marketing category (and, on iOS, allow tracking at the ATT prompt)
Identifier linkage: When Marketing consent is granted, the AppsFlyer ID is also stored as the $appsflyerId attribute of your RevenueCat subscriber record (Section 7.7), so that a Pro purchase can be attributed to the campaign that brought you here. Together with it, the RevenueCat SDK collects the device advertising identifier (the Android advertising ID; on iOS the IDFA, only after you allow tracking at the ATT prompt) and, on iOS, the identifier for vendor (IDFV), and RevenueCat records the IP address of the request. Your Firebase UID is used as the RevenueCat app_user_id.
Apple Search Ads attribution token (iOS only): When you have given Marketing consent and allowed tracking at the ATT prompt, the app also asks the RevenueCat SDK to collect the attribution token that Apple's AdServices framework provides and to send it to RevenueCat, which uses it to attribute your install or purchase to an Apple Search Ads campaign. The Android app does not collect it.
Without Marketing consent none of these identifiers, and no Apple Search Ads attribution token, are sent to RevenueCat. When you withdraw Marketing consent, AppsFlyer stops, collection of the Apple Search Ads attribution token stops, and the app asks RevenueCat to delete $appsflyerId, the advertising identifier and the IDFV from your record. The app cannot recall an Apple Search Ads attribution token that has already been sent, and it does not delete RevenueCat's record of the IP address; we delete these, and any of the identifiers that remain there, on request (Section 9).
Link: AppsFlyer Services Privacy Policy

7.5 Other Google Cloud services

One further Google service sits behind the ones above: Cloud Firestore, which receives subscription events from RevenueCat. It processes the same subscription data as Section 7.7 and no additional categories.

7.6 DigitalOcean, LLC

Service used: hosting for the helai.app website
Data processed: the IP address and request metadata of every visit, in server logs
Location: European Union
Link: DigitalOcean Privacy Policy

7.7 RevenueCat, Inc. — Subscription Management

Service used: In-app subscription and entitlement management for HelAI Pro
Data processed: User identifier (Firebase UID), product identifier, purchase and expiry dates, store transaction identifier, subscription status; with Analytics consent, the Google Analytics app instance ID ($firebaseAppInstanceId); with Marketing consent, the AppsFlyer ID ($appsflyerId), the device advertising identifier (Android advertising ID; on iOS the IDFA only after you allow tracking), the iOS identifier for vendor (IDFV), the IP address and, on iOS once you also allow tracking, an Apple Search Ads attribution token (Section 7.4)
Forwarding: With your Analytics consent, RevenueCat uses the app instance ID to send your purchase and subscription events (such as purchases and renewals) to Google Analytics from its servers. With your Marketing consent, it uses the AppsFlyer ID to report purchases to AppsFlyer for campaign attribution; on iOS, if you also allow tracking, it uses the Apple Search Ads attribution token to attribute your install or purchase to an Apple Search Ads campaign. When you withdraw Analytics consent, the app deletes $firebaseAppInstanceId from your record.
Location: United States
Legal framework: RevenueCat Data Processing Addendum (Standard Contractual Clauses included)
Link: RevenueCat Privacy Policy

7.8 What We Do NOT Do

• We do not sell your personal information to data brokers, advertisers, or any other party
• We do not share health data with any third party (it never leaves your device)
• We do not display advertising inside the app and do not use ad networks; our marketing-related processors are AppsFlyer and, for the Apple Search Ads attribution token on iOS, RevenueCat, used solely for install and purchase attribution and only with your consent
• We do not use analytics data for advertising: Google Analytics in HelAI collects no advertising identifier, and Google's advertising signals are denied by default (Section 3.6)
• We do not share workout history or personal records with any third party for their own purposes; for HelAI Pro subscribers this data is stored on our own backend (Google Cloud, Section 7.1) as a processor acting on our instructions
• Garmin ConnectIQ integration operates exclusively over BLE — no data reaches Garmin's servers from HelAI

7.9 Legal Disclosures

We may disclose your information if required to do so by law, court order, or governmental authority. Where possible, we will notify you before complying with such requests unless prohibited by law.

8. Data Retention

After your account is deleted, we retain no personal data except where required by applicable law (for example, fraud prevention or tax compliance).

9. Your Rights

Regardless of where you live, you have the following rights with respect to your personal data:

• Right of Access: You may request a copy of the personal data we hold about you
• Right to Rectification: You may request correction of inaccurate or incomplete data
• Right to Erasure: You may request deletion of your personal data ("right to be forgotten")
• Right to Data Portability: You may request your data in a structured, machine-readable format
• Right to Object: You may object to processing based on our legitimate interests (such as customer support)
• Right to Restriction: You may request that we limit how we use your data in certain circumstances
• Right to Withdraw Consent: Where processing is based on consent (Analytics, Diagnostics, Marketing, and health data), you may withdraw consent at any time without affecting the lawfulness of prior processing

How to Exercise Your Rights

In-app: Go to Profile → Privacy consent to turn the Analytics, Diagnostics, and Marketing categories on or off at any time, or to reject all optional data collection. Health data permissions and notifications are also managed under Profile.

By email: Send your request to [email protected] with the subject line "Data Rights Request" and include:

• The right you wish to exercise
• Your account email address
• A brief description of your request

Response time: We will respond to all verified requests within 30 calendar days. In complex cases, we may extend this by an additional 30 days with prior notice.

We will not discriminate against you for exercising your rights.

10. Account and Data Deletion

You have the right to delete your account and all associated data at any time. Account deletion is irreversible.

How it actually works. The app does not delete the account by itself: it opens a request form, and the operator carries the deletion out by hand. That is why it takes up to 30 days rather than being instant. You will get a confirmation when it is done.

Method 1: In-App Deletion (Recommended)

1. Open the HelAI app
2. Navigate to Profile
3. Tap Delete account and confirm
4. The app opens our deletion request page at helai.app/support#deletion
5. Submit the form using the email address of your account

Deletion is carried out within 30 days (Section 9).

Method 2: Email Request

Send an email to [email protected] with the subject line "Account Deletion Request". Include the email address associated with your account. We will process your request within 30 days.

What Gets Deleted

Upon account deletion or an erasure request, within 30 days:

• Firebase account (authentication credentials, email, name) — deleted from Firebase Authentication
• Cloud-synced data — for HelAI Pro subscribers, all synced training data and preferences are permanently deleted from our servers
• Our copy of your subscription events in Cloud Firestore (Section 7.5) — deleted
• Feedback you sent and your "Request AI for this exercise" requests (Section 3.10) — deleted
• Analytics and attribution data — we ask Google Analytics to delete the data linked to your user ID and app instance ID, and AppsFlyer to delete the data linked to your AppsFlyer ID
• Crash reports are not linked to your account, so they cannot be found by it; they expire after 90 days (Section 8)
• Subscription record — your RevenueCat subscriber record is deleted. Deleting your account does not cancel billing: an active subscription must be cancelled separately in the App Store or Google Play, otherwise it continues to renew. Apple and Google keep their own record of the purchase under their own policies, and we cannot delete that.
• Local data — everything on your device is removed when you sign out or uninstall the app. You do not need to wait for us for this part.

Health Data

Health data from Apple Health or Google Health Connect is stored only on your device. It is automatically removed when you uninstall the app. Revoking health permissions from your device settings stops any future data reading.

Exceptions

We may retain minimal records for a limited period where required by law (such as for fraud prevention or tax records). Such retained data will be kept strictly confidential and deleted as soon as legally permitted.

10a. Consumer Health Data (Washington, Nevada, Connecticut)

If you live in Washington State, Nevada or Connecticut, your health-related data is covered by a separate document as those laws require: Consumer Health Data Privacy Notice. It describes exactly what health data HelAI holds, where it goes, and the rights you have over it, including the right to have it deleted. We do not share health data with third parties (Section 7.8). The only party that handles any of it is Google, as our processor storing the Pro cloud copy of training data, and a deletion request removes that copy (Section 10).

11. Children's Privacy

The Service is for adults only — you must be 18 or older to use it. It is not directed to children, and we do not knowingly collect personal information from anyone under 18.

We do not verify age. If we learn that an account belongs to someone under 18, we delete the account and its data.

Parents or guardians who believe a person under 18 is using the Service may contact us at [email protected] and we will remove the account and its data.

12. International Data Transfers

We are based in the Republic of Kazakhstan. Your data may be processed in countries other than your own, including:

• Spain (EU) — Firebase Data Connect and Firebase Authentication are hosted in the europe-southwest1 region
• United States — Google LLC's global infrastructure and Cloudflare's network span the US
• United States — RevenueCat, Inc. (subscription records) and Resend, Inc. (support email delivery)

We take the following measures to protect your data in international transfers:

• Standard Contractual Clauses (SCCs): Our agreement with Google LLC (Firebase) includes the EU Standard Contractual Clauses approved by the European Commission
• Data Processing Terms: The data-processing terms of each processor apply — the Google Cloud DPA, AppsFlyer DPA, RevenueCat DPA, Resend DPA, and Cloudflare DPA — including Standard Contractual Clauses where data leaves the EEA
• Minimal transfer principle: health-platform data and camera data never leave your device. Free-tier training data also stays on the device. For HelAI Pro subscribers, training data is stored on Google Cloud in Spain (EU).
• Consent: Where required by your local law (Japan, Turkey, certain other jurisdictions), your use of the Service and acceptance of this policy constitutes your consent to the cross-border transfer of your account data as described

13. Cookies and Website Tracking

We use only essential, strictly necessary data on our website (helai.app):

• Language preference — carried in the page address (for example /en/ or /de/) and otherwise derived from your browser's language setting. We do not store it on your device, and it is not shared with anyone.
• Cloudflare Turnstile — our contact form uses Cloudflare Turnstile for anti-spam verification. Cloudflare receives your IP address as part of this check. Turnstile does not set tracking cookies and does not build a user profile. It is strictly necessary for form security.

We do not use:

• Advertising or tracking cookies
• Third-party analytics cookies
• Social media tracking pixels
• Session recording tools

A cookie consent banner is not displayed because no non-essential cookies are used.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes — particularly changes that expand the types of data we collect or share — we will notify you:

• In-app notification displayed on your next app launch
• Updated "Last Updated" date at the top of this page

Minor changes (such as clarifications or corrections) may be made without advance notice. We encourage you to review this policy periodically.

When a change affects what an optional consent category (Analytics, Diagnostics or Marketing) covers, the app also asks for your consent again, and from the moment the app applies your choices at startup until you answer, all optional processing stays off (Section 5, "Managing Your Consent"). Version 1.3 is such a change: it states that Analytics is linked to your account identifier and lists everything shared under Marketing, so the app asks every user for consent again (consent version 2).

Your continued use of the Service after notification of changes constitutes acceptance of the updated policy. If you disagree with any changes, you should discontinue use and request account deletion.

15. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us:

Privacy inquiries:
[email protected]

General support:
[email protected]

Website:
https://helai.app/support

HelAI is a one-person operation, so replies are not instant. We answer as soon as we can, usually within a few days, and requests concerning your personal data are answered within 30 days as the law requires.

Regional Addenda

The following sections supplement the general policy above for users in specific jurisdictions. Where there is a conflict between this regional addendum and the general policy, the regional addendum applies to users in that jurisdiction.

A. European Economic Area, United Kingdom, and Switzerland

This section applies to users in EU/EEA member states, the United Kingdom, and Switzerland.

Legal Bases (GDPR Article 6 and Article 9)

Health data is classified as special category personal data under Article 9 GDPR and may only be processed with your explicit consent, which you grant when you authorize access to Apple Health or Google Health Connect. You may withdraw this consent at any time through your device's system settings.

Analytics, Diagnostics, and Marketing are processed on the basis of your consent (Article 6(1)(a) GDPR). These categories are off by default; no analytics, crash-reporting, or attribution data is collected until you opt in through the in-app consent screen, and you may withdraw each consent at any time under Profile → Privacy consent. On iOS, marketing attribution is additionally gated by Apple's App Tracking Transparency prompt; that prompt does not affect Analytics or Diagnostics.

All other processing is conducted on the bases described in Section 5.

Your GDPR Rights

In addition to the rights listed in Section 9, you have the right to:

• Lodge a complaint with your national supervisory authority (for example, the BfDI in Germany, the CNIL in France, the AEPD in Spain, or the ICO in the United Kingdom)
• Request information about any automated decision-making that significantly affects you (there is currently none)
• Receive information about the source of your data (all data is provided directly by you)

Privacy Risk Assessment

We assess the privacy risks of our health-data and pose-detection processing and apply data minimisation and on-device processing: health metrics and camera frames never leave your device.

Cross-Border Transfers

HelAI is operated from the Republic of Kazakhstan, which the European Commission has not recognised as providing an adequate level of protection. The GDPR still applies to this processing under Article 3(2), and we are directly bound by it. Your data is stored on Google Cloud in Spain; the operator's access to it from Kazakhstan is covered by the commitments in this policy. Transfers to Google LLC are covered by the EU Standard Contractual Clauses incorporated in the Google Cloud Data Processing Addendum.

B. United States and Canada

California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights.

Categories of personal information we collect (CCPA categories):

We do not sell or share your personal information. We have not sold or shared personal information in the preceding 12 months. Analytics and marketing-attribution data is collected only with your opt-in consent and is not sold or shared. California residents may submit a "Do Not Sell or Share My Personal Information" request to [email protected], though such a request is unnecessary as we do not sell or share PI.

Your California rights:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing (not applicable — we do not sell/share)
• Right to limit use of sensitive personal information (health data used only for app functionality)
• Right to non-discrimination for exercising rights

Sensitive personal information: Health data from your device's health platform is classified as sensitive personal information under CPRA. We use it only to provide the core features of the Service (Readiness Card, Body Metrics). It is not used for inference, advertising, or profiling.

Authorized agents: You may designate an authorized agent to submit CCPA requests on your behalf by providing written authorization to [email protected].

Other US States

Residents of Virginia, Colorado, Connecticut, Texas, Utah, and other states with comprehensive privacy laws have rights similar to those described in Section 9. We respond to all verifiable consumer requests in accordance with applicable state law.

Canada (PIPEDA and Quebec Law 25)

We process personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, Act Respecting the Protection of Personal Information in the Private Sector (Law 25).

• Purpose limitation: We collect personal information only for the purposes described in this policy
• Consent: Meaningful consent is obtained for all processing
• Health information: Treated as sensitive; requires explicit consent
• Breach notification: Material breaches will be reported to the Office of the Privacy Commissioner of Canada (OPC)
• Quebec residents: This policy is available in French at helai.app/fr/privacy

Questions or complaints: You may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

C. Brazil

This section applies to users in Brazil. Processing of your personal data complies with the Lei Geral de Proteção de Dados (LGPD — Law No. 13,709/2018).

Lawful Bases (LGPD Article 7 and Article 11)

Personal data is processed on the basis of contract performance (for account data) and consent (for health data, analytics, diagnostics, and marketing attribution). Analytics, Diagnostics, and Marketing are off by default and processed only with your opt-in consent. Health data is classified as sensitive personal data under LGPD Article 11 and is processed on the basis of your explicit consent.

Your LGPD Rights

In addition to Section 9, you have the following rights under LGPD:

• Confirmation of the existence of processing
• Access to your data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or unlawful data
• Portability of your data to another service provider
• Information about which parties your data has been shared with
• Information about the consequences of refusing consent
• Withdrawal of consent at any time

Data Protection Officer (Encarregado)

Name: Konstantin Yeftifeyev
Contact: [email protected]

International Data Transfer

Your personal data (account data) is transferred to the European Union (Spain) for storage on Google Cloud Platform. This transfer is conducted on the basis of consent and contractual clauses providing equivalent protection to the LGPD, in accordance with LGPD Article 33.

Complaints

If you believe your rights have been violated, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

This Privacy Policy in Portuguese serves as the required LGPD privacy notice for Brazilian users.

D. Argentina and Mexico

Mexico (LFPDPPP)

Processing of your personal data in Mexico complies with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).

This Privacy Policy constitutes the Aviso de Privacidad required by Mexican law.

Sensitive personal data: Health data is classified as sensitive personal data under Mexican law and is processed only with your explicit, written consent (granted digitally in-app).

ARCO Rights: You have rights of Access, Rectification, Cancellation, and Opposition (derechos ARCO). To exercise your ARCO rights, contact [email protected].

Responsable: Konstantin Yeftifeyev (HelAI), [email protected]

Age: The Service is for adults only — you must be 18 or older to use it, in Mexico as everywhere else (Section 11).

Argentina (Ley 25.326)

Processing of personal data in Argentina complies with the Ley de Protección de los Datos Personales No. 25,326 and regulations of the Agencia de Acceso a la Información Pública (AAIP).

Health data is classified as sensitive data and processed only with explicit consent.

Your rights: You have rights of access, rectification, deletion, and opposition. Requests may be submitted to [email protected]. If your request is not addressed satisfactorily, you may direct complaints to the AAIP at argentina.gob.ar/aaip.

E. Kazakhstan

This is our home jurisdiction. Processing complies with the Law of the Republic of Kazakhstan No. 94-V "On Personal Data and Their Protection" (2013, as amended).

Health data is classified as restricted-access personal data (персональные данные ограниченного доступа) and is processed only with your explicit consent.

Your rights: access, correction, deletion, and revocation of consent. Contact [email protected].

F. Other Jurisdictions

HelAI is available in many countries beyond those listed above. Wherever you live, the commitments in the main body of this policy apply to you: we collect only what is described in Section 3, we use it only for the purposes in Section 4, we share it only with the processors named in Section 7, and you can exercise the rights in Section 9 by writing to [email protected].

Where your national law grants you rights beyond those described here, those rights apply and we will honour them. We have not published a separate section for every country, because we would rather state what we actually do than list laws we cannot individually administer as a one-person operation.

This Privacy Policy was prepared for the HelAI mobile application and website. It is provided for informational purposes and does not constitute legal advice. We recommend consulting a qualified attorney in your jurisdiction for specific legal guidance.