Store your sleep data on our servers
To protect your health data (i.e. sleep data) from loss you can choose to use our backup service. Then, we ensure that your health data are saved even if something would happen to the app on your device. We will store all the data available in the app on our secure servers, hosted by Google Cloud. Learn more about Google Cloud under “How we share your personal data and who we share it with”.
We will keep your health data in the backup until you withdraw your consent, or until you end your subscription. If you withdraw your consent we will immediately delete or anonymise your health data. If you unsubscribe to the service, we will keep your data for up to one (1) year, in case you change your mind within this period of time and want to start a new subscription. We will thereafter delete or anonymise your data as soon as possible.
Help us improve the Sleep Cycle app
We appreciate if you would like to help us improve the Sleep Cycle app by contributing with your health data. If we know how you are using the app, know about your sleep patterns and surrounding circumstances, etc. we can improve the app – this will make our, and ultimately your, insights better and more to the point and this will also improve your user experience. For this purpose, we will only use pseudonymised data, meaning that your health data will be awarded a hashed ID.
Your data will be stored in our product development environment (separate from the backup environment), hosted by Amplitude Inc. and their service provider Amazon Web Services. Learn more under “How we share your personal data and who we share it with”.
We will keep your data until you withdraw your consent or up to three (3) years from collection, whichever is longer. If you withdraw your consent we will immediately delete or anonymise your health data.
Help us improve the world
Provide aggregated and anonymous insights/statistics
If you consent, we may use your data (including health data) to share publicly and to third parties, for example, in public reports about sleep and activity, to partners under agreement with us, or as part of the community benchmarking information we provide to users of our subscription services. We will only share non-personal information that is aggregated or de-identified so that it cannot reasonably be used to identify you as an individual.
Your data will be stored on our secure servers, hosted by Google Cloud. Learn more about Google Cloud under “How we share your personal data and who we share it with”.
If you withdraw your consent, we will stop using your data in the community benchmarking information. However, we may continue to store data that we have already collected based on your consent for statistical and scientific purposes (GDPR, art 9.2(j)). If so, your data will be stored only in pseudonymised form.
We want to make the world a better place and contribute in the best way we can. We have a large user base who uses the app on a daily basis. Many research projects are interested in gaining access to our users’ personal data and consequently, we may ask you to participate in a research study from time to time. If you want to participate, we will share your personal data (as identified in each individual case) with the investigator in question. Once the investigator has received your data, the investigator will be the data controller for any sub-sequent processing of the data.
Your personal data may be shared with the investigator “one-off” or on an ongoing and continuous basis, depending on the set up of the research project. If you withdraw your consent during a research study, we will immediately stop sharing your personal data. Your withdrawal does not affect previous transfers of data.
Depending on the research project, and the investigator, your data may be transferred to a country outside the EEA. We will make sure that your data enjoys the same level of protection as if it had remained within the EEA. For this purpose we will enter into EU Model Clauses with the investigator. Your data will be encrypted during transfer.
You will receive separate, and more specific, information about the research study in question in connection with signing-up to participate.
How we share your personal data and who we share it with
The data we store and otherwise process about you will be stored on secure servers hosted by Google Cloud. In addition, data that we process for product development purposes will be transferred to our product development environment (separate from the backup environment) hosted by Amplitude Inc. and their service provider Amazon Web Services.
We also use other service providers that may process your data on our behalf. When we communicate with you, for example via e-mail, your e-mail address may be transferred to Mailgun Technologies Inc. and Leanplum Inc. who provide e-mail and communication services. In order to provide the best possible customer support, we use the services of Zendesk Inc. We use Fivetran Inc. to facilitate transfers of data between the service providers mentioned above. Fivetran Inc. will only store data for twenty-four (24) hours.
As you may understand, this means that your data may be processed both within the EU/EEA, as well as in other locations outside the EU/EEA, including in the U.S. In order to ensure that your data enjoys the same level of protection as if it had remained within the EU/EEA, we have entered into EU Model Clauses with all our service providers who process personal data outside of the EU/EEA. In addition, your data will generally be encrypted during transit and rest, and the data stored Amplitude Inc. and Amazon Web Services will be pseudonymised.
You can exercise many of your rights directly in the Sleep Cycle app or on your device. You are always welcome to contact us directly and we will help you with your request.
Right to information and access
You have the right to know if we process personal data about you. If we do, you also have the right to receive information about the personal data we process and why we do it. You also have the right to receive a copy of all personal data we have about you.
If you are interested in specific information, please indicate it in your request. For example, you can specify if you are interested in a certain type of information (e.g. what contact and identification information we have about you) or if you want information from a certain time period.
Right to have erroneous data corrected
If the data we hold about you are incorrect, you have the right to have it corrected. You also have the right to supplement incomplete information with additional information that may be needed for the information to be correct.
Once we have corrected your data, or it has been supplemented, we will inform those we have shared your data with about the update, provided that it is not impossible or too cumbersome. If you ask us, we will also tell you who we have shared your data with.
If you request to have data corrected, you also have the right to request that we limit our processing during the time we investigate the matter.
Right to have data deleted
In some cases, you have the right to have your data deleted. You have the right to have your data deleted if:
- The data is no longer needed for the purposes for which we collected it,
- You withdraw your consent, if applicable,
- The data is used for direct marketing and you unsubscribe from it,
- You oppose use that is based on our legitimate interest and we cannot show compelling grounds that outweigh your interests,
- The personal data has been used illegally, or
- Deletion is required to fulfill a legal obligation.
You can delete specific data points, for example sleep sessions or comments posted by yourself, directly in the app. If you are not using the online backup services you can simply just uninstall the Sleep Cycle app in order to remove any stored data. If you choose to delete your account (or if you withdraw your consent), please note that while most of your information will be deleted within a few days, it may take up to thirty (30) days to delete all of your information, like the data stored in our backup systems. We may preserve data for legal reasons or to prevent harm.
If we delete data following your request, we will also inform those we have shared your data with, provided that it is not impossible or too cumbersome. If you ask us, we will also tell you who we have shared your data with.
You may export your personal data to a CSV file from inside the app.
Objecting to data use
You have the right to object to processing that is based on our legitimate interest. If you object to the use, we will, based on your particular situation, evaluate if our interests in using the data outweigh your interests in the data not being used for that purpose. If we are unable to provide compelling legitimate grounds that outweigh yours, we will stop using the data you object to – provided we do not have to use the data to establish, exercise or defend legal claims. If you object to the use, you also have the right to request that we restrict our use during the time we investigate the matter.
You always have the right to object to, and thus unsubscribe from, direct marketing.
Right to withdraw consent
You have the right to withdraw your consent for a specific processing at any time. You can withdraw your consent in the privacy settings in the app or by contacting us [link to contact information].
Your withdrawal will not affect processing that has already been carried out.
Right to request restriction
Restriction means that the data is marked so that it may only be used for certain limited purposes. The right to restriction applies:
- When you believe the data are incorrect and you have requested correction. If so, you can also request that we limit our use while we investigate if the data are correct or not.
- If the use is illegal but you do not want the data to be deleted.
- When we no longer need the data for the purposes for which we collected it, but you need it to be able to establish, assert or defend legal claims.
- If you object to the use. If so, you can request that we limit our use while we investigate if our interest in processing your data outweighs your interests.
Even if you have requested that we restrict our use of your data, we have the right to use it for storage, if we have obtained your consent to use it, to assert or defend legal claims or to protect someone’s rights. We may also use the information for reasons relating to an important public interest.
We will let you know when the restriction expires.
If we limit our use of your data, we will also inform those we have shared your data with, provided that it is not impossible or too cumbersome. If you ask us, we will also tell you who we have shared your data with.
Our policies for children
We appreciate the importance of taking additional measures to protect children’s privacy.
We do not knowingly collect personal data from children under the age of 16. If you have reason to believe that a child under the age of 16 uses the Sleep Cycle app please contact us and we will endeavor to delete that information from our databases [link to contact information].
Changes to privacy notice
We reserve the right to change this Privacy Notice from time to time. We will inform you of any changes by posting the updated notice in the app and on our website. If we make any material changes to our notice, we will push a notification through the Sleep Cycle app and/or by e-mail (if we have your e-mail address and you have not opted-out from such use). We encourage you to contact us if you have any questions about the notice or about how we process your personal data.
You may also submit complaints to a supervisory authority, in particular in the Member State of your habitual residence, place of work or where the alleged infringement of the GDPR took place. In Sweden, the supervisory authority is the Swedish Supervisory Authority for Privacy Protection.