Privacy Policy

1. Who we are

Hubo One is owned and run by Elohimed Care Private Limited, a company registered in India under the Companies Act, 2013, with its registered office at SY No 132, Location No 8, WeWork Cinnabar Hills, Embassy Golflinks Business Park, Domlur, Bengaluru 560071, India. In this policy, "we", "us" and "our" mean Elohimed Care Private Limited, and "you" means anyone who uses the Hubo One app or the website www.hubo.one (together, "Hubo One").

Under India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for your personal data. This policy explains what we collect, why, who we share it with, and the choices you have.

2. What we collect and why

Some of what Hubo One handles is information about your body and wellbeing, which the law treats as sensitive. We treat it that way too.

We do not collect a password (Hubo One has none), your contacts, or your phone's advertising ID.

3. Your permission

Hubo One asks for your permission before it first uses each kind of data, and before connecting Apple Health, Health Connect, a wearable or ABDM. Your phone also asks you separately before Hubo One can use your location, camera, photos or microphone.

You can withdraw your permission at any time:

• Phone permissions and connections: switch them off in your phone's settings, in Apple Health or in Health Connect. We stop receiving that data straight away.
• Anything else: email privacy@hubo.one and tell us what you want us to stop using. We will stop, and delete that data if you ask.
• Everything: delete your account from the menu in the app (see section 8).

Withdrawing does not undo anything we did lawfully before, and some features may stop working without the data they need. Using the app or website does not by itself count as permission. Where we rely on your consent, we ask for it clearly.

4. Apple Health, Health Connect and wearables

When you connect Apple Health, Health Connect or a wearable, we read only the types of data you approve on your phone's permission screen. For data from these sources:

• we use it only to provide and improve the Hubo One features you use;
• we never use it for advertising or marketing, and never sell it;
• we never share it with data brokers, or use it to decide anyone's eligibility for credit, insurance or employment;
• we share it with service providers only to the extent needed to run Hubo One for you (see section 6);
• no person at Hubo One reads it unless you ask us to (for example, for support), it is needed for security, or the law requires it.

Our use of data received from Health Connect follows the Health Connect permissions policy, including its Limited Use requirements. You can remove access at any time in Apple Health, Health Connect or your phone's settings.

5. How your insights are made

Hubo One compares your data with your own recent normal, not with other people, and turns it into insights and suggestions. Most insights come from rules we design and test. Some are written with the help of an artificial intelligence (AI) service.

We work with three AI providers: Anthropic (our main provider), OpenAI and Google (Gemini), and choose between them depending on the task. When we use one, we send only the data that task needs, together with your name so the message can speak to you personally. This can include food photos you add and voice messages you choose to send, so they can be recognised or turned into text. We never send your phone number or email address.

Under our agreements with them, these providers process your data only to return the result to us, may keep it briefly for security and abuse checks, and do not use it to train their models.

Insights are general wellness information. They are not medical advice and do not diagnose or treat any condition. Unified Records are never used to create insights.

6. Who we share data with

We do not sell, rent or trade your personal data, and we do not show ads. We share data only in these situations.

Service providers who run Hubo One for us

These companies process data only on our instructions, under contracts that require them to protect it:

When you ask us to

For example, when you share or export your Unified Records or other data with someone you choose.

When the law requires it

We disclose data to a government authority, court or regulator only where Indian law requires it, and only what is required. We may also share what is necessary to prevent fraud, protect the security of Hubo One, or protect someone's safety.

If our company changes hands

If Elohimed Care Private Limited merges with or is acquired by another company, your data may move to that company. It will remain bound by this policy, and we will tell you before any change to how it is used.

Anonymous statistics

We may use and share combined statistics, such as average sleep across all members, that cannot be used to identify you.

7. Where your data is stored

Your data is stored on Amazon Web Services servers in Mumbai, India. Some of our service providers, such as Google Firebase and our AI providers, may process data outside India. When that happens, we use providers with strong security commitments, and we never transfer data to any country that the Government of India has restricted.

8. How long we keep it

• While your account is open, we keep your data so Hubo One can show your history and learn your patterns.
• If you delete your account (from the menu in the app), we hold your data for 7 days in case you change your mind. To cancel the deletion, email privacy@hubo.one within 6 days. By the end of the 7th day, all your data is permanently deleted, including from our backups, and cannot be recovered. See how account deletion works.
• If you ask us to delete particular data, we delete it within 30 days.
• What we must keep: payment and invoice records, and logs of how data was processed, for as long as Indian tax, accounting and data protection laws require. These are kept securely and used for nothing else.

9. Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

• access a summary of the personal data we hold about you and how we use it, and the names of those we have shared it with;
• correct, complete or update your data;
• delete particular data, or your whole account from the menu in the app;
• withdraw your permission for any module or connection, at any time;
• nominate someone to exercise these rights for you if you die or become unable to;
• raise a grievance with us, and if you are not satisfied with our answer, complain to the Data Protection Board of India.

You can update your details and delete your account in the app. For anything else, email privacy@hubo.one from the email address on your account, or tell us your registered mobile number. We may ask you to confirm a one-time code so we know the request is really from you. We reply within 30 days.

10. Notifications and messages

With your permission, Hubo One sends notifications about your insights, reminders and progress. We never send them during your sleep hours. You can choose which kinds you get in the app, or switch them off in your phone's settings.

We send one-time codes by SMS and email, and emails about your account. If we send you news about Hubo One, every such email has a link to stop them.

11. Our website and cookies

Our website uses essential cookies to keep you signed in and to process payments securely. We do not use analytics, advertising or tracking cookies. You can block or delete cookies in your browser, though signing in may then stop working.

12. Keeping your data safe

We protect your data with encryption (TLS) while it travels between your device and our servers, access limited to the people who need it for their work, and regular reviews of our systems. Everyone at Hubo One and every service provider who handles personal data is bound to keep it confidential.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India, as the law requires, and explain what we are doing about it.

We will never ask for your one-time code by phone, message or email. If you receive a message that claims to be from Hubo One and asks for it, do not reply, and let us know at privacy@hubo.one.

13. Age

Hubo One is only for people aged 18 or older. We ask for your date of birth at sign up and do not knowingly collect data from anyone younger. If we learn that someone under 18 has created an account, we will delete it and its data.

14. Changes to this policy

We may update this policy as Hubo One and the law change. The date at the top shows when it last changed. If a change affects how we use your data in a meaningful way, we will tell you in the app or by email before it takes effect, and ask for your permission again where the law requires it.

15. Contact and grievances

For any question, request or complaint about your personal data, contact our Grievance Officer:

We acknowledge grievances within 48 hours and resolve them within 30 days. This policy is governed by the laws of India, and the courts of Bengaluru have jurisdiction.