Privacy policy

1. Who we are

Health Dash ("we", "us") is a product of Nebula Wellness. It is a health dashboard service that aggregates data you choose to connect from your Oura Ring and your Garmin devices (via intervals.icu). For the purposes of applicable data-protection law, Nebula Wellness is the data controller for your account data and for the health data you instruct us to collect on your behalf. You can contact us about anything in this policy at the email address given on your account page.

2. What we collect

Account data. Your email address, display name, a salted hash of your password (never the password itself), your plan and trial status, and sign-in timestamps.

Connection credentials. The API credentials you supply — your Oura personal access token (or the OAuth tokens issued if you connect Oura by sign-in) and your intervals.icu athlete ID and API key. We also issue you a private Apple Health push URL if you use that route. These are stored server-side, are never displayed back to you after saving, and are used solely to move your data between those services and your dashboard.

Health and fitness data. The data those services return when we sync on your behalf: sleep (including stages, efficiency, and overnight heart metrics), heart rate and heart-rate variability, readiness and recovery scores, SpO₂, respiration, body temperature deviation, daytime stress and resilience, cardiovascular age estimates, steps and calories, recorded workouts (including GPS routes, laps, heart-rate zones and device telemetry), VO₂ max, training load, and weight and body composition. We also store values you enter manually (for example weight, blood panel results, notes, planned workouts and targets).

Technical data. Server logs, and client-side error reports (the error message, stack trace, page URL and browser user-agent) used solely to find and fix defects.

What we deliberately do not collect: we do not use analytics trackers, advertising pixels, or fingerprinting. The only cookie we set is the session cookie that keeps you signed in.

3. How we use your data

• To provide the product: computing your rings, charts, baselines, comparisons and written insights from your own numbers.
• To operate your account: authentication, password resets, plan management and support.
• To power the AI features, where you use them (see section 5).
• To fix defects, using error reports and server logs.

We do not sell your data. We do not share it with advertisers. We do not use your health data to train machine-learning models. We do not build profiles of you for any purpose other than showing you your own dashboard.

4. Where your data lives

Your data is stored in a managed PostgreSQL database (currently Neon) and processed on our application server. Both are configured for encrypted connections (TLS) in transit, and the database provider encrypts data at rest. Access to production systems is limited to the operator of the service.

5. Third-party services

Health Dash works by talking to services you connect, using credentials you supply:

• Oura — we read your data from the Oura API v2 using your personal access token. Oura's own privacy policy governs their side.
• intervals.icu — we read your Garmin data through the intervals.icu API using your athlete ID and API key. See the intervals.icu privacy policy.
• Apple Health — if you use the Apple Health route, an app on your phone (currently Health Auto Export) pushes the metrics you choose to a private URL we issue you. This is a one-way push from your device: we hold no Apple credentials, cannot read your phone, and cannot request anything you have not configured it to send. Rotating the URL in Setup stops it immediately.
• Anthropic — where you use the AI insight and coach features, a summary of your recent metrics and your chat messages are sent to Anthropic's Claude API to generate the response. Anthropic's privacy policy applies to that processing. API inputs are not used by Anthropic to train models under their standard API terms. If you do not use the AI features, nothing is sent.

Disconnecting a source in Setup stops all future collection from it immediately.

6. How long we keep it

Your data is kept for as long as your account exists — the whole point of the product is your long-term history. Client error reports are kept for at most 90 days. Password-reset tokens expire after 24 hours and are single-use.

7. Your rights

Depending on where you live, data-protection law (including the UK and EU GDPR) gives you rights over your data. We honour these for everyone, regardless of jurisdiction:

• Access and portability — ask and we will export everything we hold about you in a machine-readable format.
• Rectification — incorrect values can be corrected or overridden in the app; anything else, ask.
• Erasure — ask for deletion and your account and all associated health data are permanently removed from the production database. Backups age out on the provider's rolling schedule.
• Objection and restriction — you can stop any processing by disconnecting a source or closing your account.
• Complaint — you may lodge a complaint with your local supervisory authority (in the UK, the ICO).

8. Security

Passwords are hashed with scrypt. Sessions are signed, HTTP-only cookies. Sign-in and sign-up endpoints are rate-limited. API credentials are write-only once saved. All traffic is served over HTTPS in production. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you without undue delay.

9. Children

Health Dash is not directed at children and may not be used by anyone under 16. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

If we make material changes we will notify you by email or an in-app notice before they take effect. The "last updated" date at the top always reflects the current version.