Privacy Policy

Effective April 20, 2026 · Last updated October 22, 2026 · Applies to the Yakuru Ring app (iOS, Android, Wear OS), the Yakuru app for Garmin watches, the Ultra Ring, and yakuruhealth.com

Your privacy is fundamental to Yakuru. This policy explains what data we collect, how we use it, who we share it with, and the rights you have over your personal information. We do not sell your data.

Who We Are

Yakuru Inc. (“Yakuru”, “we”, “us”, “our”) is a Delaware C-Corporation headquartered in Salt Lake City, Utah. We are the data controller for personal data collected through the Yakuru app, Ultra Ring, and related services.

• Yakuru Inc. · Delaware, USA
• Yakuru Inc. · Salt Lake City, Utah (supplement operations)
• Yakuru Labs · Colorado (hardware R&D)

Data We Collect

To deliver personalized health insights, we collect the following categories of data:

• Account data — name, email, date of birth, password hash, profile photo
• Biometric data — HRV, resting heart rate, temperature, SpO₂, activity, sleep stages, workout sessions
• Self-reported data — mood, wellness scores, journal entries, nutrition logs
• Photos and files you choose to have read — a photo of a meal, a menu or a supplement label, or a photo or PDF of a workout plan. Each is sent to our AI provider to be read and is not kept by Yakuru afterwards; only what you confirm on the next screen is saved.
• Device data — Ultra Ring ID, firmware version, battery level, sync timestamps
• Usage data — app interactions, feature usage, crash reports, performance metrics
• Transaction data — subscription status, order history, payment method (last 4 digits only)
• Location data — used to map outdoor workout routes, find nearby clinics, and set your timezone for jet lag features

We never collect financial information directly. All payments are processed securely through Stripe and Shopify, which hold PCI-DSS Level 1 certification.

Device Permissions and Why We Ask

Every permission is optional and can be revoked at any time in your device settings. Declining a permission disables only the feature that needs it.

Yakuru for Garmin Watches

The Yakuru app for Garmin watches is installed from the Garmin Connect IQ Store and works together with the Yakuru phone app. It talks only to your own Yakuru phone app and has no internet connection of its own. On Android, the two talk through the Garmin Connect app on the same phone. On iPhone, the Garmin Connect app is used to choose your watch; after that, the Yakuru phone app talks to the watch directly over Bluetooth.

• What the watch sends to your Yakuru phone app — workouts you save (sport, start and end time, active time, splits, sets, heart rate, time in heart-rate zones, and energy and distance where the watch measured them), the effort you rate afterwards, check-ins, cycle entries, supplement routine actions, travel check-ins and feedback on coach advice. The phone app then handles this data as described in the rest of this policy.
• What your phone sends to the watch — the Recovery, sleep and training information and the coach advice you already see in the Yakuru phone app, so the watch can show them.
• What stays on the watch — a short summary for the glance, a workout while you are recording it, and anything waiting to reach your phone. Items waiting to send are removed once your Yakuru account has received them. Unlinking the watch from its Settings screen removes your account and your phone’s information from it, and deleting the app from the watch removes everything it stored.
• Location — used only while you record an outdoor workout. The route is recorded into the activity file your Garmin watch saves to your Garmin Connect account; the Yakuru watch app does not send it to Yakuru.
• Garmin — activities recorded on the watch are saved to your Garmin Connect account and handled by Garmin under Garmin’s own privacy policy, not this one.

Connected AI

Connected AI lets you have an AI assistant you already use — Claude, ChatGPT, or an agent of your own — read your own Yakuru data, so you can ask it about your health in your own words. It is off until you set it up, and every part of it needs your AI consent first.

• What you choose — you pick the topics the assistant may read (for example sleep, recovery, activity or cycle) and how far back. Only your own stored daily values are included.
• How it is shared — by connecting the assistant to Yakuru’s connector (MCP) with your Yakuru sign-in, by creating an access token for your own agent, by downloading a data file, or by sending a single question with your numbers to the assistant. Each is something you start yourself; nothing is shared with an assistant you have not set up.
• Who receives it — the company behind the assistant you connect (for example Anthropic for Claude or OpenAI for ChatGPT) receives the data under your own account with them and handles it under their privacy policy, not this one.
• Your control — access tokens expire after 90 days; you can disconnect an assistant or revoke a token at any time, and the app lists what you have shared. Withdrawing your AI consent stops every assistant and token from reading at once.

How We Use Your Data

We use your data exclusively to deliver and improve the Yakuru services you have subscribed to.

• Generate personalized biometric insights and protocols
• Power Yakuru Brain AI coaching and pattern recognition
• Process subscription orders and deliver supplements
• Provide coach/athlete data sharing (with explicit consent)
• Respond to support requests and technical issues
• Send service announcements and important updates
• Comply with legal obligations (tax, audit, regulatory reporting)

What We Do NOT Do

We believe these commitments differentiate Yakuru from most health apps:

• We do not sell your personal data to any third party
• We do not share biometric data with advertisers
• We do not share your data with insurance companies or employers
• We do not use your data to train AI models outside of your personal Brain profile
• We do not retain data longer than necessary for stated purposes
• We do not use dark patterns to obscure privacy choices

Data Sharing

We share your data only in these specific situations:

• With service providers who process data on our behalf, under strict data processing agreements — Sahha (biometric and health data aggregation), Supabase (account data, application database and file storage), RevenueCat (subscription entitlements), Firebase (push notifications and crash diagnostics), OpenAI (COACH AI coaching replies, and reading the meal, menu, supplement-label and workout photos and PDFs you choose), Perplexity (finding sources for figures in COACH replies), Anthropic (checking and finalising COACH replies before you see them), Stripe (payments) and Shopify (commerce)
• With coaches or teammates you explicitly authorize via granular sharing controls
• With an AI assistant you connect yourself through Connected AI — only the topics you choose, and only while it stays connected
• With law enforcement when required by valid legal process
• In connection with a merger, acquisition, or sale of assets — with advance notice to affected users
• In aggregated, anonymized form for research partnerships (opt-in only)

All service providers are bound by contracts that prohibit them from using your data for their own purposes.

Your Rights (GDPR, CCPA, Australian Privacy Principles)

You have comprehensive rights over your personal data regardless of where you live:

• Access — download a copy of all data we hold about you (JSON or CSV)
• Rectification — correct inaccurate information
• Erasure — request complete deletion of your account and data
• Portability — export your data to another service
• Restriction — limit how we process your data
• Objection — opt out of specific uses (e.g. research, analytics)
• Withdraw consent — turn off any data sharing you previously enabled
• Non-discrimination — exercising these rights never affects your service

Exercise any of these rights anytime from You → Data & privacy in the app, or by emailing privacy@yakuruhealth.com. We respond within 30 days.

Data Security

We invest heavily in protecting your data:

• Encryption of biometric data in transit (TLS 1.3) and at rest (AES-256)
• Multi-factor authentication available for all accounts
• SOC 2 Type II — audit in progress, not yet attested
• Regular penetration testing by independent security firms
• Bug bounty program with HackerOne
• Zero-trust architecture with role-based access control
• Encrypted backups in multiple geographic regions

No system is 100% secure. In the unlikely event of a data breach affecting your account, we will notify you within 72 hours as required by GDPR, and provide detailed remediation steps.

Data Retention

We retain your data only as long as necessary:

• Active account data — retained while your account is active
• Biometric trends — kept for up to 10 years for longevity science
• Support conversations — 3 years
• Financial records — 7 years (legal requirement)
• Deleted accounts — erased from primary systems as soon as you confirm deletion in the app (requests by email within 30 days), and from backups within 90 days
• Photos and files you have read (meals, menus, supplement labels, workout plans) — not kept by Yakuru once they have been read
• Anonymized research data — retained indefinitely with no personal identifiers

Account Deletion

You can delete your Yakuru account and its data at any time, from inside the app or by contacting us. Deletion is free and does not require you to speak to anyone.

How to delete your account →

International Data Transfers

Yakuru operates globally. Your data may be transferred to and stored in countries outside your home country, including:

• Australia (primary operations)
• United States (OpenAI, Perplexity and Anthropic AI services, Delaware incorporation)
• European Union (backup redundancy)

All international transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring GDPR-equivalent protection regardless of destination.

Children’s Privacy

Yakuru is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact privacy@yakuruhealth.com and we will delete it immediately.

For users aged 16–18, certain features (community, social sharing) require parental consent.

Cookies & Tracking

The Yakuru mobile app does not use third-party advertising cookies. Our website uses essential cookies for authentication and strictly necessary analytics. You can manage cookie preferences via our cookie banner.

We do not use cross-site tracking, fingerprinting, or any tracking technology that follows you across the web.

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by us
• Right to opt out of the sale of personal information (we do not sell)
• Right to non-discrimination for exercising CCPA rights
• Right to correct inaccurate personal information
• Right to limit use and disclosure of sensitive personal information

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or service offerings. Material changes will be notified via email and in-app notification at least 30 days before the effective date.

The date at the top of this policy indicates when it was last updated. Continued use of Yakuru after changes take effect constitutes acceptance.

Contact Us

For any privacy concerns, data requests, or to exercise your rights, contact our Data Protection Officer.

You also have the right to lodge a complaint with your local supervisory authority:

• Australian Privacy Commissioner — oaic.gov.au
• EU Data Protection Supervisor — edps.europa.eu
• US Federal Trade Commission — ftc.gov