Privacy Policy

1. What We Collect

• ECG recordings you upload.
• Pattern Summaries and related derived processing records.
• Account information such as your email address.
• Basic device, session, security, and operational metadata needed to run and protect the service.
• App diagnostics and error reports linked to your account when diagnostics sharing is enabled in the mobile app.
• Optional website product analytics events when you consent to analytics in the browser.

2. How We Use Data

• Compare uploaded ECG recordings with reference signal patterns and generate Pattern Summaries.
• Authenticate users, secure accounts, and provide Sinoa features.
• Operate, monitor, troubleshoot, and improve system performance.
• Maintain security, respond to abuse, and meet legal obligations.
• Review app diagnostics and error reports to investigate support issues and service reliability problems.
• Understand whether public website, onboarding, account, and billing flows are working without sending ECG files or Pattern Summary content to product analytics.

3. Recording Completeness and Result Scope

Sinoa classifies uploaded recordings based on the amount of usable contiguous signal available.

A recording that meets expected duration and quality for the device used may produce a full Pattern Summary. Shorter recordings may still show waveform previews or limited segment-based evidence. These non-full recordings are excluded from standard trend summaries and full-summary comparisons.

Only recordings that meet expected duration and quality requirements for the device used are included in standard trend summaries and comparison features.

4. Data Protection

We use encryption in transit and encryption at rest for production systems that store account data, uploaded ECG recordings, generated Pattern Summaries, and related processing records.

Backups are encrypted and managed under separate backup, retention, and restore processes.

5. Data Retention

We retain active data as needed for service functionality, account access, security, legal obligations, and plan-based retention behavior.

Uploaded source ECG files are intended for short processing retention. Generated Pattern Summaries and derived result records follow plan-based retention windows shown in the product where available.

Mobile app diagnostics and synced error reports used for troubleshooting are retained for up to 30 days unless a shorter deletion path applies.

When you request account cleanup or delete supported content, we remove that data from live systems in accordance with the product's deletion controls.

When you delete your account in the app, Sinoa deletes your account record and supported retained live data such as uploads, generated Pattern Summaries, pattern history, support access requests, saved sessions, and synced diagnostics from live systems.

Encrypted backup or snapshot deletion may not occur immediately and is not guaranteed on the same timeline as live-system deletion.

6. Notifications

Sinoa does not currently send push notifications as part of the product.

7. Data Sharing

We do not sell your personal data.

Data is shared only when you initiate sharing, when needed to operate the service with infrastructure or billing providers, or when required by law.

Authorized support or admin personnel may review synced app diagnostics and error reports solely for troubleshooting, security, and service reliability work.

If you consent to website product analytics, limited product event metadata is sent to PostHog under SINOA's analytics configuration.

8. Your Rights and Choices

• Delete your account from the app.
• Request account deletion without the app at https://rhythmiqi.com/account-deletion.
• Delete supported retained live account data by category or date range.
• Request access to your account data.
• Update supported account settings such as display name and timezone.

9. Health Data Notice

Even when HIPAA does not apply to this service model, health-related information remains sensitive.

Sinoa is an educational product and not a clinical diagnosis workflow. Non-HIPAA health app operators may still be subject to FTC health-data obligations, including the Health Breach Notification Rule where applicable.