Olevity

Olevity Limited · Hong Kong

Privacy Policy

Effective 20 October 2026

Who we are and what this policy covers

Olevity is a breathing-training app made by Olevity Limited, a company incorporated in Hong Kong (Business Registration No. 80366672; registered office: Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong) (“Olevity”, “we”, “us”). This policy covers the Olevity mobile app, the olevity.co website, private breathing lessons booked through it, and support correspondence with us. It explains what information we handle, why, and the choices you have. If anything here is unclear, write to us at [email protected] — a person reads it.

The short version

Data you give us

• Account — your email address and authentication credentials (currently a password), managed through AWS Cognito. Your password is not visible to us. An email address is required to create and secure a cloud account; without it, cloud-based features are unavailable.
• Onboarding answers — your chosen course track, schedule preferences, and the answers to our health-safety screening. The screening is required before starting the course, because we use it to route you safely. We do not offer a free-text health-note field. Optional information can simply be left blank — the related feature will do without it.
• Check-ins and questionnaires — your daily morning check-in answers (sleep and breathing scores) and any assessments you complete, including the individual answers.

Data collected while you use the app

• Practice log — for each practice, the technique, date, duration, whether you finished it, and details such as rounds and breath holds. This is a record of what you did, kept as part of your course history like lesson progress, so it does not depend on an optional choice. When cloud sync is on, it is stored in our US-hosted backend.
• Session readings and ratings — only when you allow the related feature: heart-rate and beat-interval data from a connected sensor, with derived metrics such as HRV (RMSSD/SDNN); breathing-rhythm results; and your ratings of how you feel before or after a practice (optional health and sleep tracking). Without that choice the practice is still logged, without the readings or ratings. When cloud sync is on, allowed readings are stored in our US-hosted backend.
• Camera pulse readings — if you take a fingertip camera reading, the camera frames are processed live on your device to detect your pulse. We do not save or upload photos or video; the frames are processed in memory and discarded. Accepted numeric readings (heart rate, HRV and signal quality) can be saved and synced. Numeric diagnostic traces, including failed captures, are saved locally; images are not. A trace can include signal samples, timing, quality results and device details. Sharing or emailing one requires a separate deliberate action.
• Phone-motion readings — if you use a phone-on-abdomen breathing reading, motion-sensor data is processed to estimate your breathing rhythm; accepted results can be saved and synced. Local diagnostic traces can contain motion samples and device details; sharing or emailing a trace is a separate deliberate action.
• Course progress — which lessons and practices you’ve completed.
• Install identifier — a randomly generated per-install identifier, which may be associated with your account and is used to sync and distinguish app installations.
• Purchase status — whether your account has access to the purchased course (see RevenueCat below).

Operational and technical data

Like almost any online service, our backend and service providers process a limited amount of technical information when the app talks to our servers: IP addresses, request timestamps, device model, operating system and app version, authentication and security events, and service and error logs. We use this information to keep accounts secure, diagnose faults, and operate the service — not to profile you or for advertising. The olevity.co website similarly generates standard web-server request logs, and uses Cloudflare Web Analytics, a cookie-free page-view count that does not identify or track you.

Device permissions we ask for, and why

• Camera — fingertip pulse readings only. Never for photos or video.
• Bluetooth — to connect heart-rate monitors (such as chest straps). On some Android versions, the operating system may require location permission to scan for nearby Bluetooth devices; Olevity does not use that permission to collect or store your geographical location.
• Motion sensors — breathing-rhythm readings while the phone rests on your abdomen.
• Notifications — practice reminders you schedule. These are created locally on your device; we do not send remote push notifications and no push token is collected.

Apple Health

With your permission, the app reads heart rate, heart-rate variability, beat-to-beat heart data, sleep, respiratory rate, blood oxygen, VO₂ Max, resting heart rate, heart-rate recovery, mindfulness sessions, workouts, and date of birth (used to personalise heart-rate calculations), and writes mindfulness sessions after in-app practice.

Apple Health data is used on your device to show your trends and readiness. Readings imported from Apple Health are not uploaded to our servers. You can change or revoke Health access at any time in iOS Settings. Information the app writes to Apple Health remains under your control in Apple Health.

Private lessons and coaching clients

If you book a private breathing lesson through olevity.co/lessons, we handle a small amount of information that is separate from app data. It is not linked to an Olevity app account unless you buy a course and ask us to activate the app-course gift on your account.

• Booking and payment — your name, email address, the session you booked and the answers to the booking questions (your goal, how you heard about us, anything you want us to know). Bookings are handled by Cal.com and payments by Stripe; we never see card details. Both act under their own privacy policies and are used only to run the booking and the payment.
• Coaching records — your goals, the answers to our suitability screening (asked on the consult or in a short form we send you), session notes, and coaching measures such as your BOLT score. Paul records these himself. They are kept in Olevity’s Google Workspace, accessible only to him, and are never entered into a scheduling or payment service.
• Why — to teach you safely and track your progress (performance of our contract with you), and, for screening answers about your health, with your explicit consent, which you can withdraw at any time by email.
• How long — coaching records are kept while you are a client and for 24 months after your last session, then deleted. Booking and payment records are kept for the period Hong Kong tax and accounting rules require. You can ask for your coaching records to be deleted sooner at any time.
• Your rights are the same as for app data (see Your rights below). Write to [email protected] or [email protected].

Why we use your data, and our legal bases

Where the EU or UK GDPR applies to you, our legal bases are as follows:

• Account creation and authentication — to create and secure your account. Basis: performance of our contract with you.
• Course delivery, progress, your practice log, and purchased features — to provide the service you asked for. Basis: performance of our contract with you.
• Health screening and physiological readings — to route you safely, show your readings, and personalise the course. Basis: performance of our contract, together with your explicit consent to the processing of health-related data.
• Optional Oura, Apple Health, and sensor features — to provide the specific connected feature you choose. Basis: your explicit, feature-specific consent.
• Security, fraud prevention, and essential operational logs — to protect accounts, users, and our systems. Basis: our legitimate interests in running a secure service.
• Legal obligations and legal claims — to meet legal requirements and establish or defend legal rights. Basis: legal obligation or legitimate interests, as applicable.

Health data and your consent

Before safety questions, we ask for an unticked, explicit agreement to store and use your safety answers for precautions and practice restrictions. This is separate from Terms acceptance and OS permissions. Declining leaves practice paused; privacy and account deletion remain available. Existing users must make the new choice and complete fresh screening; historical answers do not establish consent.

Optional health and sleep tracking, health-store reads and writes, Oura, Bluetooth, camera and motion features have separate choices. Review or withdraw them under Menu → Health-data consent, also accessible before onboarding is complete. Withdrawing a feature stops its affected processing and erases its health data, which cannot be undone. Your practice log stays, without the readings or ratings that feature collected. Withdrawing safety consent pauses practice and erases your health records, screening and practice log; a later agreement requires screening again. Purchases and your account remain.

A new agreement requires a connection and successful server confirmation. A withdrawal stops the affected feature on this device immediately; if offline or deletion fails, it remains pending and retries when connected. Another offline device can continue using its last confirmed choice until reconnection. Old queued uploads cannot restore erased data. The app shows when server deletion has not completed.

We record the notice version, scope, affirmative or withdrawal action, server timestamp and revision, without copying health answers into the consent record.

Services we rely on

• Sentry — crash and error diagnostics for release builds using the real backend, including technical device/app information and error context. Diagnostics are processed and stored in Sentry’s European Union region (Germany) and kept for 90 days. We do not store IP addresses in Sentry and apply server-side scrubbing of sensitive fields; even so, do not assume diagnostics can never contain personal information. It is not used for advertising.
• Amazon Web Services (AWS) — we use AWS for account authentication, APIs, databases, and other backend services. Our primary serverless backend and synced user data are hosted in the AWS US East (Northern Virginia) Region in the United States. Data is encrypted in transit and at rest. AWS may use subprocessors or provide support from other locations in accordance with its data-processing terms.
• Oura — optional. If you connect an Oura Ring, you authorise Oura to share data with us; our server stores the connection tokens and retrieves your sleep, readiness, and heart-rate data on your behalf to show it in the app. If you disconnect Oura, revoke your authorisation, or request deletion while Oura is connected, we stop retrieving and processing Oura data and delete the relevant Oura connection tokens and Oura-derived user data within the period required by our agreement with Oura, currently no more than 72 hours.
• RevenueCat — manages in-app purchases. RevenueCat receives a pseudonymous user identifier, purchase information from the app store, and standard technical information needed to process purchases — never your health data.
• Apple and Google — payment processing through the App Store / Google Play, under their terms.
• Expo — the app periodically checks a content-update service for app updates. This is a standard version check, not analytics.

When we share data

We do not sell or rent your data, and we do not share your health information for advertising or marketing. We share personal data only:

• with the service providers named above (and their necessary subprocessors), strictly to run the app;
• where we are required to by law, a court order, or a valid regulatory request;
• where necessary to protect our users, enforce our legal rights, or keep the service secure; or
• as part of a merger, acquisition, or business transfer — in which case your data remains protected by this policy and we will notify you where required.

What we don’t do

No third-party analytics in the app, and only cookie-free page counts on the website. No advertising or tracking SDKs. No selling or renting data. We do not sell health information or use it for advertising, third-party marketing, or purposes unrelated to providing and securing the Olevity service, except where disclosure or processing is required by law.

Retention and deletion

We keep permitted account data, course history, check-ins, and readings while your account is active, until deletion or withdrawal as described above, so your history and baselines keep working. Accounts that remain inactive for 24 months may be deleted after we notify you at least 30 days beforehand. When your account is deleted, production data is removed as soon as reasonably practicable and within 30 days, except where a shorter rule applies (Oura data — see above) or a longer period is required, as follows: application and API logs are kept for 30 days; encrypted backups of our database are kept for up to 35 days and then expire; crash diagnostics in Sentry are kept for 90 days (see above); diagnostic traces you choose to email us are kept only while we investigate your report and are then deleted; records we must keep for tax, accounting, or legal purposes are retained for the applicable statutory period; and minimal records of privacy requests may be retained where needed to handle the request or legal claims. Account deletion leaves a minimal account-identifier blocking record, with no health answers, to prevent stale credentials recreating health data. The current consent record is retained while the account exists. We may retain data that has been irreversibly anonymised, because it can no longer identify you.

You can delete your account and synced data in three ways:

• In the app — Menu → Delete Account. We will ask you to confirm before deletion, because it is irreversible.
• On the web — via olevity.co/delete-account.
• By email — write to [email protected] from your account address.

Deleting your account removes your synced data from our systems, including at our processors, within 30 days (Oura data sooner, as described above). Deleting your account does not automatically refund a purchase; refund requests go through the App Store or Google Play, and your statutory rights are unaffected.

Deleting the app removes information stored in the app’s ordinary local storage, subject to the behaviour of your device and backups. Information written to Apple Health remains under your control in Apple Health and may need to be deleted there separately.

Your rights

Under Hong Kong’s Personal Data (Privacy) Ordinance you have the right to request access to, and correction of, your personal data. Depending on where you live, you may also have rights to delete or export your data, to object to or restrict processing, and to withdraw consent at any time. The app can also export your readings (CSV) directly from your device.

To exercise any right, email [email protected]. We may ask you to verify your identity (normally by responding from your account email address) before acting on a request. For a valid data access or correction request under Hong Kong’s Personal Data (Privacy) Ordinance, we will respond within the applicable statutory period, normally 40 days. Where the EU or UK GDPR applies, we will normally respond within one month, subject to any permitted extension. Other requests will be handled within the period required by applicable law.

If you are unhappy with how we handle your data, you can complain to the Hong Kong Privacy Commissioner for Personal Data (pcpd.org.hk). Where the UK or EU GDPR applies to you, you can also complain to the UK Information Commissioner’s Office or your local EU supervisory authority.

Children

Olevity is for adults. It is not directed at anyone under 18, and we do not knowingly collect their data.

International transfers

Olevity Limited is based in Hong Kong, while our primary backend is hosted in the United States. When you create an account or enable cloud-based features, your account information, course progress, check-ins, health-safety answers, and synced readings may therefore be transferred to and stored in the United States.

Some of our other service providers may also process personal data in the United States or other countries. We use contractual and organisational safeguards intended to protect personal data wherever it is processed. Where the EU GDPR or UK GDPR applies, these safeguards include the European Commission’s Standard Contractual Clauses and the applicable UK international-data-transfer provisions. You may contact us for further information about these safeguards.

Changes to this policy

We’ll post any changes on this page and update the effective date. Meaningful changes will be flagged in the app before they take effect.

Contact

[email protected] — Olevity Limited, Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong