Privacy Policy
Last updated 2 August 2026
BioEquity is the data controller for the information described here. This policy explains what we collect, why, and what we do not do.
The short version. We collect your email, the health data needed to verify the habit you chose, and a payment method held by Stripe. We do not sell anything, we run no advertising, and we do no tracking. If your employer pays for your subscription, they see nothing about your health, your habits or your money — only that a seat is in use.
What we collect
DataWhyLegal basisEmail addressYour account, and to contact you about a bondContractWorkouts and step counts from Apple Health / Health ConnectTo verify the habit you chose, on the day you claim itExplicit consent (Art. 9(2)(a))Photos you capture for a check-inEvidence for habits a sensor cannot measureExplicit consentBonds, check-ins and settlementsTo run the product and calculate what you are chargedContractPayment methodTo charge a shortfall. Held by Stripe — we never see or store card numbersContractSubscription statusTo know whether Pro features are activeContract
Health data is special category data. We only read it because you explicitly allow it, only the categories needed for the habit you picked, and only for the day being verified. You can withdraw permission at any time in your device settings — habits that rely on it will stop verifying, so tell us if that happens mid-bond.
What we do not do
We do not sell or share your data with anyone for their own purposes.
We run no advertising and no third-party analytics or tracking SDKs.
We do not build profiles about you or make automated decisions with legal effects — the settlement calculation is a published formula, shown to you before you commit.
We never access your photo library. The camera is capture-only.
If your employer pays for your subscription
A company can buy BioEquity Pro seats for its staff. An administrator can see who occupies a seat, and that is all.
They cannot see your habits, your health data, your bonds, your stakes, or whether you kept or forfeited money — individually or in aggregate. This is enforced by our database permissions, not by policy. Your employer paying for your account gives them no view into your health.
Who processes your data
Supabase — database, authentication and file storage, hosted in Ireland (eu-west-1).
Stripe — payment processing. Stripe holds card details; we hold only a reference.
RevenueCat — subscription status for the App Store and Google Play.
Apple / Google — subscription billing, and the health frameworks on your device.
Some of these transfer data outside the EEA under Standard Contractual Clauses.
How long we keep it
Health data and check-in photos — kept while your account exists, and deleted when you delete your account.
Settlement records — retained for six years, as Irish accounting law requires. When you delete your account these records are detached from you: your name, email and health data are gone, and what remains cannot be linked back to you.
Everything else — deleted with your account.
This is GDPR Article 17(3)(b): the right to erasure gives way where retention is required by law. We erase everything we are permitted to erase.
Deleting your account
Go to Profile → Delete account. It erases your check-ins, your health data and every photo you captured, and it cannot be undone. If a charity payment is outstanding it must clear first — the money is owed to a charity, and we will tell you the exact amount.
Your rights
You can ask us for a copy of your data, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Email cian@bioequity.ie and we will respond within one month.
If you think we have handled your data badly, you can complain to the Irish Data Protection Commission at dataprotection.ie.
Security
Data is encrypted in transit and at rest. Access is enforced at the database level, so one person's records are unreadable to anyone else even if the app were compromised. Check-in photos are held in private storage with no public access.
Children
BioEquity is for adults. We do not knowingly collect data from anyone under 18.
