Privacy Policy

Heartwise ("we," "us," or "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights as a participant.

1. Who we are

Heartwise is a women's cardiovascular research platform operated by Grace LaManna. Our mission is to collect longitudinal health data from women to advance cardiovascular research. Contact: grace@heartwiseapp.com

2. What data we collect

We collect the following categories of data when you use the Heartwise app:

• Account data: First name, email address, password (hashed)
• Health logs: Sleep quality and duration, stress level and type, caffeine intake and timing, water intake, movement type and intensity, alcohol consumption, breathwork practice, menstrual cycle phase and day, and heart symptoms you choose to record (such as palpitations, chest tightness, or shortness of breath), with an optional severity level
• Biometric data (optional): Heart rate variability (HRV), resting heart rate — entered manually from wearable devices
• Demographic data (optional): Age range, race/ethnicity, contraceptive use — collected for equity-focused research analysis
• Technical data: Device type, browser type, IP address, usage patterns

3. How we use your data

• To provide personalized health insights within the app
• To conduct anonymized cardiovascular research
• To send you account-related emails (welcome, notifications)
• To improve the platform and research methodology
• We will never sell your personal information (your name, email, or any data that identifies you)
• We will never share your data with advertisers
• We will never show you ads inside Heartwise
• We may license de-identified, aggregated research data to research partners — including commercial ones. This funds Heartwise and keeps it free for you. See Section 5.

4. How we protect your data

• All data is encrypted in transit using TLS 1.3
• All data is encrypted at rest using AES-256
• Your account is linked to an anonymous cohort ID — researchers never see your name or email
• Researcher access is governed by a formal data use agreement
• We use Supabase (enterprise-grade infrastructure) for data storage. Data is stored on servers located in the United States (US East region).
• Access to identifiable data is restricted to authorized personnel and protected by server-side credentials that are never exposed to your browser

4a. Data breach notification

In the event of a data breach affecting your personal information, we will notify affected users by email without undue delay and, where required, within 72 hours of becoming aware of the breach, in accordance with applicable law (including GDPR Article 33 where relevant). The notification will describe the nature of the breach, the data involved, and the steps we are taking in response.

5. Data sharing and how Heartwise is funded

How we make money — plainly. Heartwise is free to you and never sells your personal information. We are funded by licensing de-identified, aggregated research data to research partners under formal data use agreements, and we may enter other partnerships or sponsorships in the future. Those research partners may include academic institutions, health systems, and commercial organizations such as pharmaceutical, biotech, and medical device companies. They receive statistical and aggregated findings — never your name, email, or any information that identifies you. If we introduce advertising, sponsorships, or affiliate relationships, we will disclose them clearly. We believe you have a right to know who benefits from the data you contribute, which is why we say so here rather than burying it.

Clinical trial opportunities (optional). If you separately opt in, we may let you know about clinical trials or research studies you may be eligible for. This is off by default, entirely optional, and you can turn it off at any time. We never share your contact information with a study sponsor unless you specifically agree to be connected to that study.

If Heartwise is acquired. If Heartwise is acquired by, merges with, or sells substantially all of its assets to another company, your data may be transferred as part of that transaction. Any acquirer would be required to honor the commitments in this policy. We will notify you before any such transfer, and you can export or delete your data at any time.

We use the following third-party services:

• Supabase — database and authentication (supabase.com/privacy)
• Resend — transactional email (resend.com/privacy)
• Netlify — website hosting (netlify.com/privacy)

6. Your rights

• Export your data at any time from within the app
• Request deletion of all your data — processed within 30 days
• Withdraw from the research study at any time with no consequence
• Correct inaccurate data
• GDPR rights honored for EU participants
• CCPA rights honored for California residents

7. Data retention

We retain your data for as long as your account is active. If you delete your account, your personal data is removed within 30 days. Anonymized research data may be retained indefinitely as part of the research dataset.

8. Children

Heartwise is intended for users aged 18 and older. We do not knowingly collect data from anyone under 18. If we become aware of a minor's account, we will delete it immediately.

9. Changes to this policy

We will notify you by email of any material changes to this policy. Continued use of the app after changes constitutes acceptance.

10. Contact

Privacy questions, data requests, or deletion requests: grace@heartwiseapp.com

Terms of Service

By creating an account and using Heartwise, you agree to these terms. Please read them carefully.

1. Eligibility

You must be at least 18 years old to use Heartwise. By using the app you confirm you are 18 or older. Heartwise is designed for individuals who identify as women or who have female physiology relevant to cardiovascular health research.

2. Not medical advice

3. Research participation

By using Heartwise you agree to participate in anonymized cardiovascular research. Your data will be:

• Anonymized before any researcher accesses it
• Used solely for women's cardiovascular research
• Never sold or shared with advertisers
• Accessible to researchers only under formal data use agreements

Participation is voluntary. You may withdraw at any time with no consequence by deleting your account.

4. Account responsibilities

• You are responsible for maintaining the security of your account
• You must provide accurate information when creating your account
• You may not share your account with others
• You may not use the app for any illegal purpose

5. Intellectual property

All content, design, and code in the Heartwise platform is owned by Grace LaManna / Heartwise. You retain ownership of the health data you submit. You grant Heartwise a license to use your anonymized data for research purposes.

6. Disclaimer of warranties

Heartwise is provided "as is" without warranties of any kind. We do not guarantee uninterrupted access, accuracy of insights, or fitness for any particular purpose.

7. Limitation of liability

To the maximum extent permitted by law, Heartwise and Grace LaManna shall not be liable for any indirect, incidental, or consequential damages arising from your use of the platform.

8. Termination

We reserve the right to suspend or terminate accounts that violate these terms. You may delete your account at any time.

9. Governing law

These terms are governed by the laws of the State of Delaware, United States.

10. Contact

Questions about these terms: grace@heartwiseapp.com

Research Consent

Before participating in Heartwise research, please read and understand how your data will be used.

What you are consenting to

By creating a Heartwise account you consent to the collection and use of your anonymized health log data for women's cardiovascular research. Specifically:

• Your daily health logs (sleep, stress, caffeine, movement, etc.) will be stored securely
• Your data will be anonymized and linked to a random cohort ID — never your name or email
• Anonymized data may be used in academic research publications
• Anonymized data may be shared with vetted academic researchers under data use agreements

What you are not consenting to

• Sale of your data to any third party
• Use of your data for commercial advertising
• Sharing of your personally identifiable information with any researcher

Voluntary participation

Your participation is entirely voluntary. You may withdraw at any time by deleting your account. Withdrawal will not affect you in any way. Upon withdrawal, your personal data will be deleted within 30 days.

IRB status

IRB submission is currently in progress. Once approved, this consent form will be updated to reflect IRB protocol number and approval date. The formal IRB consent process will be implemented at that time.

Questions

Questions about this research: grace@heartwiseapp.com

HIPAA Notice

Is Heartwise a HIPAA covered entity?

Heartwise is a consumer wellness and research application. It is not a healthcare provider, health plan, or healthcare clearinghouse as defined under HIPAA. As a result, Heartwise is not currently a HIPAA "covered entity."

However, Heartwise collects sensitive health information and is committed to protecting it with standards that meet or exceed HIPAA requirements, including:

• Encryption of all data in transit and at rest
• Access controls limiting who can view your data
• Anonymization before any research use
• Formal data use agreements with any research partners

What this means for you

While HIPAA's legal protections may not directly apply to Heartwise, we treat your health data with the same seriousness. Your data will never be sold, shared with insurers, or used against your interests in any way.

Questions

HIPAA questions: grace@heartwiseapp.com

Cookie Policy

What are cookies?

Cookies are small text files stored on your device when you visit a website. We use minimal cookies necessary to operate the platform.

What cookies we use

• Essential cookies: Required for login and session management. Cannot be disabled.
• Analytics cookies: Help us understand how the app is used (anonymous). You may opt out.

We do not use advertising cookies. We do not share cookie data with advertisers.

Your choices

You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in. You can opt out of analytics cookies using the cookie banner on our website.

Contact

Cookie questions: grace@heartwiseapp.com