Privacy Policy

Effective April 20, 2026 · Applies to the Yakuru Ring app (iOS, Android, Wear OS), the Ultra Ring, and yakuruhealth.com

Your privacy is fundamental to Yakuru. This policy explains what data we collect, how we use it, who we share it with, and the rights you have over your personal information. We do not sell your data.

Who We Are

Yakuru Inc. (“Yakuru”, “we”, “us”, “our”) is a Delaware C-Corporation headquartered in Salt Lake City, Utah. We are the data controller for personal data collected through the Yakuru app, Ultra Ring, and related services.

• Yakuru Inc. · Delaware, USA
• Yakuru Inc. · Salt Lake City, Utah (supplement operations)
• Yakuru Labs · Colorado (hardware R&D)

Data We Collect

To deliver personalized health insights, we collect the following categories of data:

• Account data — name, email, date of birth, password hash, profile photo
• Biometric data — HRV, resting heart rate, temperature, SpO₂, activity, sleep stages, workout sessions
• Self-reported data — mood, wellness scores, journal entries, nutrition logs
• Device data — Ultra Ring ID, firmware version, battery level, sync timestamps
• Usage data — app interactions, feature usage, crash reports, performance metrics
• Transaction data — subscription status, order history, payment method (last 4 digits only)
• Location data — used to map outdoor workout routes, find nearby clinics, and set your timezone for jet lag features

We never collect financial information directly. All payments are processed securely through Stripe and Shopify, which hold PCI-DSS Level 1 certification.

Device Permissions and Why We Ask

Every permission is optional and can be revoked at any time in your device settings. Declining a permission disables only the feature that needs it.

How We Use Your Data

We use your data exclusively to deliver and improve the Yakuru services you have subscribed to.

• Generate personalized biometric insights and protocols
• Power Yakuru Brain AI coaching and pattern recognition
• Process subscription orders and deliver supplements
• Provide coach/athlete data sharing (with explicit consent)
• Respond to support requests and technical issues
• Send service announcements and important updates
• Comply with legal obligations (tax, audit, regulatory reporting)

What We Do NOT Do

We believe these commitments differentiate Yakuru from most health apps:

• We do not sell your personal data to any third party
• We do not share biometric data with advertisers
• We do not share your data with insurance companies or employers
• We do not use your data to train AI models outside of your personal Brain profile
• We do not retain data longer than necessary for stated purposes
• We do not use dark patterns to obscure privacy choices

Data Sharing

We share your data only in these specific situations:

• With service providers who help us operate Yakuru — health data partners for biometric aggregation, Shopify for commerce, Anthropic for Brain AI, Stripe for payments — all under strict data processing agreements
• With coaches or teammates you explicitly authorize via granular sharing controls
• With law enforcement when required by valid legal process
• In connection with a merger, acquisition, or sale of assets — with advance notice to affected users
• In aggregated, anonymized form for research partnerships (opt-in only)

All service providers are bound by contracts that prohibit them from using your data for their own purposes.

Your Rights (GDPR, CCPA, Australian Privacy Principles)

You have comprehensive rights over your personal data regardless of where you live:

• Access — download a copy of all data we hold about you (JSON or CSV)
• Rectification — correct inaccurate information
• Erasure — request complete deletion of your account and data
• Portability — export your data to another service
• Restriction — limit how we process your data
• Objection — opt out of specific uses (e.g. research, analytics)
• Withdraw consent — turn off any data sharing you previously enabled
• Non-discrimination — exercising these rights never affects your service

Exercise any of these rights anytime from Settings → Data & Privacy in the app, or by emailing privacy@yakuruhealth.com. We respond within 30 days.

Data Security

We invest heavily in protecting your data:

• Encryption of biometric data in transit (TLS 1.3) and at rest (AES-256)
• Multi-factor authentication available for all accounts
• SOC 2 Type II — audit in progress, not yet attested
• Regular penetration testing by independent security firms
• Bug bounty program with HackerOne
• Zero-trust architecture with role-based access control
• Encrypted backups in multiple geographic regions

No system is 100% secure. In the unlikely event of a data breach affecting your account, we will notify you within 72 hours as required by GDPR, and provide detailed remediation steps.

Data Retention

We retain your data only as long as necessary:

• Active account data — retained while your account is active
• Biometric trends — kept for up to 10 years for longevity science
• Support conversations — 3 years
• Financial records — 7 years (legal requirement)
• Deleted accounts — purged from primary systems within 30 days, from backups within 90 days
• Anonymized research data — retained indefinitely with no personal identifiers

Account Deletion

You can delete your Yakuru account and its data at any time, from inside the app or by contacting us. Deletion is free and does not require you to speak to anyone.

How to delete your account →

International Data Transfers

Yakuru operates globally. Your data may be transferred to and stored in countries outside your home country, including:

• Australia (primary operations)
• United States (Anthropic Claude API, Delaware incorporation)
• European Union (backup redundancy)

All international transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring GDPR-equivalent protection regardless of destination.

Children’s Privacy

Yakuru is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact privacy@yakuruhealth.com and we will delete it immediately.

For users aged 16–18, certain features (community, social sharing) require parental consent.

Cookies & Tracking

The Yakuru mobile app does not use third-party advertising cookies. Our website uses essential cookies for authentication and strictly necessary analytics. You can manage cookie preferences via our cookie banner.

We do not use cross-site tracking, fingerprinting, or any tracking technology that follows you across the web.

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by us
• Right to opt out of the sale of personal information (we do not sell)
• Right to non-discrimination for exercising CCPA rights
• Right to correct inaccurate personal information
• Right to limit use and disclosure of sensitive personal information

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or service offerings. Material changes will be notified via email and in-app notification at least 30 days before the effective date.

The date at the top of this policy indicates when it was last updated. Continued use of Yakuru after changes take effect constitutes acceptance.

Contact Us

For any privacy concerns, data requests, or to exercise your rights, contact our Data Protection Officer.

You also have the right to lodge a complaint with your local supervisory authority:

• Australian Privacy Commissioner — oaic.gov.au
• EU Data Protection Supervisor — edps.europa.eu
• US Federal Trade Commission — ftc.gov