Privacy Policy

Overview

Harmoni Care Inc. (“Harmoni”, “we”, “us”) is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, and safeguard your personal information when you use the Harmoni platform, including our iOS app, Apple Watch companion app, and website.

Harmoni is a wellness observation tool — not a medical device. We observe and report. We never diagnose, treat, or provide medical advice.

We operate in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta's Personal Information Protection Act (PIPA), and the Alberta Health Information Act (HIA).

What We Collect

Account Information

When you create an account, we collect your name, email address, and role within your Care Circle (for example, Family Admin, Loved One, Family Member, or Caregiver).

Health & Wellness Data

With your explicit consent, we collect wellness data from Apple Watch via Apple HealthKit. This includes:

• Heart rate
• Blood oxygen (SpO2)
• Wrist temperature
• Respiratory rate (during sleep)
• Sleep duration and quality
• Walking steadiness and gait data
• Fall detection events

Blood pressure and confusion observations are entered manually by family members or caregivers — not collected automatically.

Contact Information for Alerts

We collect phone numbers for Care Circle members who opt in to voice call alerts. These numbers are used solely for wellness notifications and are never shared with third parties for marketing.

Location Data

We access location data only in the event of a fall detection, to help family members locate their Loved One. Location is never tracked continuously or stored beyond the specific fall event.

Usage Data

We collect anonymised usage data to improve the platform. This data cannot be linked back to individual users.

Why We Collect It

We use your information to:

• Generate wellness scores and gentle observations for your Care Circle
• Send alerts to family members when wellness patterns change
• Coordinate care within your circle — scheduling, medications, logbook entries
• Connect families with caregivers through Harmoni Visit
• Improve and maintain the platform

We do not:

• Sell your personal information to anyone — ever
• Use your health data for advertising
• Share your data with insurance companies
• Provide your data to employers
• Use your data to train AI models outside of your own care

How We Store It

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Production data is currently stored in the United States (Railway cloud platform). We plan to migrate to Canadian infrastructure (AWS ca-central-1, Montreal) as the service scales. Cross-border transfers comply with PIPEDA.
• Database access is restricted to authorised personnel only, with audit logging
• We conduct regular security assessments and vulnerability scans
• API endpoints are rate-limited to prevent abuse

Who Can See Your Data

Harmoni is built around Care Circles. Access is role-based and follows the principle of least privilege:

• Loved Ones can see their own wellness data and control their sharing preferences
• Family Admins have full access to wellness data, alert routing, and circle management
• Family Members see wellness summaries and receive alerts — not raw vitals data
• Caregivers have task-limited access during scheduled visits only
• Doctors and GPs have time-bounded, read-only access when explicitly granted by a Family Admin. Access expires automatically.
• Community Nurses have access scoped to their visit schedule and clinical assessments
• Pharmacists can view medication lists only — no vitals or wellness data

You can see exactly who has access to data within your Care Circle at any time, and revoke sharing instantly.

How You Control Your Data

You are always in control. You can:

• Revoke data sharing with any circle member at any time
• Disconnect Apple Watch to stop automatic data collection
• Export your health data before deleting your account
• Request deletion of all your data through Settings or by emailing us
• Withdraw consent at any time — this may limit some features

Third-Party Processors

We use a small number of trusted third-party services to operate Harmoni. None of these services use your data for advertising or sell it onward.

• Railway — Application and database hosting (US West region). Migration to AWS ca-central-1 (Montreal, Canada) planned.
• Twilio — Voice calls and SMS for wellness alerts only
• Stripe — Payment processing. We never store card details ourselves.
• Anthropic (Claude) — AI-powered wellness summaries. Health data is processed in-context only and is not used to train Anthropic's models.
• Apple HealthKit — Data flows from Apple Watch to Harmoni with your explicit consent

We do not use any advertising networks, analytics trackers, or data brokers.

Data Retention

We keep your data only as long as needed:

• Health and wellness data: Duration of your subscription plus 90 days, then deleted
• Account information: Retained while your account is active, deleted within 30 days of account closure
• Consent records: 7 years (legal requirement)
• Payment records: 7 years (CRA requirement)
• Anonymised aggregate data: May be retained indefinitely for service improvement

You can export your health data at any time before deleting your account.

Your Rights

Under PIPEDA, PIPA, and HIA, you have the right to:

• Access your personal information
• Request correction of inaccurate information
• Withdraw consent for data collection
• Request deletion of your data
• Be informed of any data breach that poses a real risk of significant harm
• File a complaint with the Office of the Privacy Commissioner of Canada

Children's Privacy

Harmoni is designed for adults. We do not knowingly collect personal information from anyone under the age of 18.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification. The “last updated” date at the top will always reflect the most recent version.

Contact Us

If you have questions about this Privacy Policy or your personal data:

Privacy Officer: Dr. Sundeep Varma, Founder

For complaints, you may also contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or the Office of the Information and Privacy Commissioner of Alberta at www.oipc.ab.ca.