Privacy Policy Generator

Privacy Policy: DailyRhythm

Northbridge Wellness Technologies, Inc. Effective Date: November 1, 2026 Last Updated: [TODO: date of publication]

1. Introduction and Scope

1.1 Who we are

Northbridge Wellness Technologies, Inc. ("Northbridge," "we," "us," or "our") makes DailyRhythm. DailyRhythm is a subscription mobile app that helps you track habits and wellness goals. Our registered address is [TODO: full legal address, including state of incorporation].

For people in the European Union (EU) and the United Kingdom (UK), Northbridge is the controller of your personal data. A controller is the company that decides why and how your information is used.

1.2 What this policy covers

This Privacy Policy explains how we collect, use, share, and protect personal information when you:

• download, sign up for, or use the DailyRhythm app;
• buy or manage a subscription;
• contact our support team or receive emails from us; or
• visit [TODO: website URL, if any] (together, the "Services").

"Personal information" (also called "personal data") means any information that identifies you or could reasonably be linked to you.

This policy does not cover third-party services that we don't control, such as the Apple App Store or Google Play. Those companies have their own privacy policies.

1.3 DailyRhythm is not a medical service

DailyRhythm is a wellness tool. It is not a medical device, and it does not diagnose or treat any condition. We are not a healthcare provider, so the U.S. health privacy law HIPAA generally does not apply to us. We still treat the wellness information you enter with extra care, as explained below.

1.4 Region-specific information

Most of this policy applies to everyone. Extra rights and details for certain places are in:

• Section 7.3: EU and UK residents
• Section 7.4: California residents
• Section 7.5: Colorado and other U.S. state residents
• Section 7.6: Canadian residents (including Québec)
• Section 7.7: Washington and Nevada residents (Consumer Health Data)

2. Quick Summary

3. Information We Collect

3.1 Information you give us

About wellness information: Mood, sleep, weight, and similar entries can reveal things about your health. Many laws treat this as sensitive or health data, including the EU/UK GDPR, the California Consumer Privacy Act (CCPA), the Colorado Privacy Act, and Washington's My Health My Data Act. We ask for your explicit consent before we collect it (see Section 4.2). Please don't enter information you aren't comfortable storing with us.

3.2 Information collected automatically

When you use the app, we and our service providers automatically collect:

About ad identifiers: On Apple devices, we can only access your IDFA if you allow it in Apple's App Tracking Transparency prompt. On Android devices, you can reset or delete your AAID in your device settings. We use these identifiers only for limited in-app analytics. [TODO: Confirm whether IDFA/AAID collection is necessary at all. If it's used only for analytics, consider turning it off; see the checklist.]

3.3 Information from third parties

• Apple App Store and Google Play: If you subscribe through Apple or Google, they process your payment. They send us limited information, such as a transaction ID, subscription status, product purchased, country, and renewal or cancellation events. We do not receive your payment card details or your Apple/Google account password.
• Stripe: If you pay through Stripe, it gives us payment metadata (last 4 digits, card type, billing ZIP/postal code, payment status). Full card numbers never reach our servers.
• Service providers: Tools such as Firebase, Sentry, and OneSignal send us reports about app performance and message delivery.

[TODO: Confirm there are no other sources, such as "Sign in with Apple/Google," wearable or Apple Health/Google Health Connect integrations, referral programs, or data purchased from partners. If any exist, add them here.]

4. How We Use Information

4.1 Purposes and legal bases

Some privacy laws, including the GDPR in the EU and UK, require a "legal basis" for each use of personal data. The table below lists our purposes and the legal basis we rely on for each.

"Legitimate interests" means we have a real business reason to use your data, and that reason is not outweighed by your privacy rights. You can object to uses based on legitimate interests (see Section 7).

4.2 Extra protections for wellness information

• Consent first. Before you enter wellness information for the first time, we ask for your explicit, separate consent. [TODO: Build a dedicated in-app consent screen for this. It should not be bundled with acceptance of the Terms.]
• Limited use. We use wellness information only to provide DailyRhythm's features to you, and to keep it secure.
• No ads, no sale. We do not sell wellness information. We don't use it for advertising or share it with advertisers, and we don't use it to draw conclusions about you for marketing.
• Kept out of analytics. [TODO: Confirm engineering practice. Recommended: wellness entry values (such as actual weights or mood scores) are never sent to Firebase, Sentry, OneSignal, or SendGrid. Only non-sensitive event names like "check-in completed" are sent.]
• You can withdraw consent at any time in [TODO: settings path] or by emailing us. If you withdraw, we will stop collecting new wellness entries and will delete existing ones as described in Section 6. Some features won't work without this information.

4.3 Automated decisions

We do not use automated decision-making that has legal or similarly significant effects on you, such as decisions about credit, employment, or insurance. [TODO: Confirm. If the app gives personalized recommendations or "insights" based on wellness data, describe them here.]

5. How We Share Information

5.1 Service providers (processors)

We share personal information with companies that help us run DailyRhythm. They may use it only to provide services to us and must protect it under written contracts.

[TODO: Add any other vendors, such as customer support desk software, cloud email (Google Workspace/Microsoft 365), or internal tools used to read support messages.]

5.2 App stores

If you subscribe through the Apple App Store or Google Play, Apple or Google processes your payment as an independent controller. That means they decide how to use that data under their own privacy policies. We share only what's needed to confirm and manage your subscription.

Stripe may also act as an independent controller for some activities, such as fraud prevention and meeting its own legal obligations, under Stripe's Privacy Policy.

5.3 Other disclosures

We may also share personal information:

• For legal reasons: To comply with a law, court order, subpoena, or other valid legal process, or to protect the rights, property, or safety of Northbridge, our users, or others. When the law allows, we will try to tell you before disclosing your data. We will challenge requests that are overly broad or unlawful.
• In business transfers: If we're involved in a merger, acquisition, financing, bankruptcy, or sale of assets, personal information may transfer to the new owner. The new owner must honor this policy, or give you notice and any choices the law requires. [TODO: Washington MHMDA and some state laws may require new consent to transfer consumer health data. Check with counsel.]
• With your direction or consent: For example, if you ask us to share data with another app or person. [TODO: Delete this line if there are no such features.]
• In aggregated or de-identified form: We may share information that has been combined or stripped of identifiers so it can't reasonably identify you. We will not try to re-identify it.

5.4 We do not sell your personal information

We do not sell personal information, and we have not sold it in the past 12 months. We do not sell or share wellness or health information for any purpose.

Targeted advertising / "sharing": Under California law, "sharing" means giving data to third parties for cross-context behavioral advertising, which is ads based on your activity across different apps and websites.

[TODO, choose ONE after a technical review:] Option A (recommended): "We do not 'share' personal information for cross-context behavioral advertising or use it for 'targeted advertising.' We do not link Firebase to Google Ads or other advertising networks, and we do not use ad identifiers for advertising." Option B: If Firebase is linked to Google Ads, or IDFA/AAID is used for ad attribution or retargeting, you must disclose this as "sharing"/"targeted advertising," add a "Do Not Sell or Share My Personal Information" link and an in-app opt-out, and honor opt-out preference signals. Rewrite this section accordingly.

We do not knowingly sell or share the personal information of consumers under 16.

6. Data Retention and Security

6.1 How long we keep data

We keep personal information only as long as we need it for the purposes in this policy. Then we delete it or de-identify it.

We may keep data longer if the law requires it, or to resolve disputes, stop fraud, or enforce our agreements.

6.2 How we protect data

We use reasonable administrative, technical, and physical safeguards, including:

• encryption in transit (TLS/HTTPS) and at rest [TODO: confirm AES-256 or equivalent on AWS];
• password hashing [TODO: confirm algorithm, such as bcrypt or Argon2];
• access controls that limit employee access to people who need it, with multi-factor authentication [TODO: confirm];
• vendor security reviews and data processing agreements;
• logging and monitoring; and
• an incident response plan, with breach notifications to you and regulators as the law requires.

No system is 100% secure. Please use a strong, unique password, and tell us right away at privacy@northbridgewellness.com if you think your account has been compromised.

7. Your Rights and Choices

7.1 Rights for everyone

Wherever you live, you can:

• Access and download a copy of your data: [TODO: in-app export path, such as Settings › Privacy › Export My Data]
• Correct your profile and entries in the app
• Delete individual entries or your whole account: [TODO: in-app path, such as Settings › Account › Delete Account]. Apple and Google require apps to offer in-app account deletion.
• Unsubscribe from marketing emails using the link in any email
• Turn off push notifications in your device settings
• Limit ad tracking by declining Apple's tracking prompt, or by resetting or deleting your ad ID on Android
• Withdraw consent to wellness data processing (Section 4.2)

Cancelling a subscription does not delete your account, and deleting your account does not cancel an App Store or Google Play subscription. Manage those subscriptions in your Apple or Google account settings.

7.2 How to make a request

• Email: privacy@northbridgewellness.com
• In-app: [TODO: path]
• Toll-free number: [TODO: The CCPA generally requires a toll-free number, unless you operate exclusively online and have a direct relationship with the consumer, in which case email alone is enough. Confirm which applies.]

Verification: To protect your data, we'll confirm your identity, usually by asking you to make the request while logged in or from your account email. We won't ask for more information than we need.

Authorized agents: You can have someone else make a request for you where the law allows. We may ask for signed permission and confirm your identity directly.

Response times: We respond within 1 month in the EU/UK, 30 days in Canada, and 45 days in the U.S. We may extend these deadlines where the law allows, and we will tell you if we do.

No discrimination: We won't deny you service, charge you a different price, or give you a worse experience because you used your privacy rights.

Cost: Requests are free, unless they are clearly unfounded or excessive.

7.3 EU and UK residents (GDPR / UK GDPR)

You have the right to:

• Access your personal data;
• Rectification, meaning to correct inaccurate data;
• Erasure ("the right to be forgotten");
• Restrict our processing;
• Data portability, meaning to receive your data in a machine-readable format or have it sent to another company;
• Object to processing based on legitimate interests, and to object at any time to direct marketing;
• Withdraw consent at any time, without affecting processing that happened before you withdrew; and
• Lodge a complaint with your local data protection authority. In the UK, that is the Information Commissioner's Office (ICO). In the EU, you can complain to the authority in your country.

EU representative: [TODO: Name and address of EU Art. 27 representative] UK representative: [TODO: Name and address of UK Art. 27 representative] Data Protection Officer: [TODO: Confirm whether a DPO is required. Large-scale processing of health data as a core activity may trigger GDPR Art. 37. If you appoint one, list the contact here.]

7.4 California residents (CCPA/CPRA)

Categories collected in the last 12 months (using CCPA category names):

Sources, purposes, and retention: See Sections 3, 4, and 6.

Your California rights: You can know/access, delete, and correct your data. You can opt out of sale/sharing (we don't sell or share; see Section 5.4). You can limit the use of sensitive personal information. We use sensitive personal information only for purposes allowed by the CCPA regulations, such as providing the service you asked for, so we don't currently offer a separate "Limit" link. [TODO: Confirm.] You also have the right to be free from retaliation.

Opt-out preference signals: We honor Global Privacy Control (GPC) and similar legally recognized signals where they apply. [TODO: Confirm technical implementation for the website.]

Shine the Light (Cal. Civ. Code § 1798.83): We do not share personal information with third parties for their own direct marketing.

[TODO: If Northbridge meets the CCPA threshold of 10+ million Californian consumers, publish annual request metrics.]

7.5 Colorado and other U.S. states

Residents of Colorado, Connecticut, Virginia, Oregon, Texas, and other states with comprehensive privacy laws have rights to confirm whether we process their data, and to access, correct, delete, and port it. They also have the right to opt out of targeted advertising, sale, and profiling for significant decisions. We don't engage in these activities; see Sections 4.3 and 5.4.

• Sensitive data consent: Under Colorado and similar laws, health-related information is "sensitive data." We collect it only with your opt-in consent (Section 4.2).
• Minors: Colorado law adds protections for users we know are under 18. We don't process minors' data for targeted advertising, sale, or profiling. [TODO: Review engagement features like streaks and reminders under Colorado's minors' rules if users under 18 are allowed.]
• Universal opt-out: We honor recognized universal opt-out mechanisms, such as GPC.
• Appeals: If we deny your request, you can appeal by emailing privacy@northbridgewellness.com with the subject "Privacy Appeal." We will respond within the time the law requires, usually 45–60 days. If you disagree with our decision, you can contact your state Attorney General.

7.6 Canadian residents (PIPEDA, Québec Law 25, and provincial laws)

• You can access your personal information, challenge its accuracy and have it corrected, and withdraw consent, subject to legal or contractual limits.
• Québec residents also have the right to data portability, the right to have information de-indexed or dissemination stopped where applicable, and the right to be told about automated decisions (we don't make any; see Section 4.3).
• Person responsible for personal information / Privacy Officer: [TODO: Name/title]. Contact: privacy@northbridgewellness.com. (Québec requires publishing this person's title and contact details.)
• Marketing emails: We send commercial emails to Canadians only with consent, as required by Canada's Anti-Spam Legislation (CASL).
• Complaints: You can complain to the Office of the Privacy Commissioner of Canada, or in Québec, to the Commission d'accès à l'information.

7.7 Washington, Nevada, and Consumer Health Data

Washington's My Health My Data Act and similar laws in Nevada (and elsewhere) protect "consumer health data," and wellness entries in apps like DailyRhythm may count. We collect this data only with your consent, and we share it with other parties only with separate consent or as needed to provide the service. You can access it, delete it, and withdraw consent. Read our separate Consumer Health Data Privacy Policy for full details.

[TODO: Washington law requires a stand-alone Consumer Health Data Privacy Policy with a prominent link on the homepage and in the app. Draft it separately.]

8. International Data Transfers

Northbridge is based in the United States, and our service providers operate in several countries. Your personal information may be transferred to, stored in, and processed in the United States and other countries whose data protection laws may differ from yours.

• EU/UK data: When we transfer personal data out of the EU or UK to a country without an "adequacy decision" (an official finding that the country protects data well enough), we use approved safeguards. These include the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, along with additional safeguards where needed. [TODO: If Northbridge self-certifies to the EU-U.S. Data Privacy Framework (and its UK Extension), add a DPF statement, independent recourse mechanism, and FTC jurisdiction language. Otherwise, rely on SCCs. Note that a challenge to the DPF is on appeal at the EU's top court.]
• Data hosted in the EU: [TODO: State whether EU/UK users' data is stored in AWS EU regions, and whether any of it is accessed from the U.S., for example by support staff or U.S.-based vendors like Firebase, Sentry, SendGrid, and OneSignal.]
• Canadian data: Your information may be processed outside Canada, including in the U.S. There, it may be accessible to courts, law enforcement, and national security authorities under local law. We use contracts to protect it. [TODO: Québec Law 25 requires a privacy impact assessment before transferring data outside Québec.]

For a copy of the safeguards we use, contact privacy@northbridgewellness.com.

9. Children's Privacy

DailyRhythm is not intended for children. You must be at least [TODO: minimum age, recommended 16, or 18] to use the Services. We check your date of birth at sign-up and don't let underage users create an account.

We don't knowingly collect personal information from children under 13 in the U.S. or under 16 in the EU/UK, or from anyone under the minimum age where they live. If we learn we have collected information from a child without proper consent, we'll delete it promptly. If you think a child has given us information, contact privacy@northbridgewellness.com.

[TODO: If users aged 13–17 are allowed, add a section on teen protections, including CCPA opt-in for ages 13–15, Colorado minors' rules, GDPR Art. 8 parental consent ages by country, and UK Age Appropriate Design Code duties.]

10. Cookies, SDKs, and Similar Technologies

Cookies are small files a website stores in your browser. Mobile apps use similar tools called SDKs (software development kits). These are pieces of code from other companies built into our app, plus device identifiers such as the IDFA/AAID.

Website: [TODO: If there is a marketing site with cookies, add a cookie banner and list of cookies, or link a separate Cookie Notice.]

To manage in-app analytics, go to [TODO: Settings › Privacy › Analytics].

11. Changes to This Policy

We may update this policy from time to time. The "Last Updated" date at the top shows when we last changed it. If we make material changes, such as using your data in a new way, we'll let you know in the app or by email before the change takes effect. Where the law requires it, we'll ask for your consent again, and we will not apply material changes to data we already collected without that consent.

Previous versions are available on request [TODO: or link to an archive].

12. Contact Us

Northbridge Wellness Technologies, Inc. Attn: Privacy Team [TODO: Street address, City, State ZIP, USA] Email: privacy@northbridgewellness.com Phone: [TODO, if required]

EU Representative: [TODO] UK Representative: [TODO] Canadian Privacy Officer: [TODO] Data Protection Officer (if appointed): [TODO]

If you're not satisfied with our response, you can contact your local data protection authority (see Section 7).

✅ Checklist: Items to Verify Before Publishing

1. Advertising and "sharing" decision (Section 5.4): Confirm Firebase isn't linked to Google Ads or other ad networks, and decide whether IDFA/AAID is needed at all. If you drop them, remove the IDFA/AAID references. If you keep them for ads, add "Do Not Sell or Share" links and an opt-out.
2. Wellness-data consent flow: Build a separate, explicit, opt-in consent screen (GDPR Art. 9, Colorado and other states' sensitive data rules, Washington MHMDA), with an easy way to withdraw.
3. Stand-alone Consumer Health Data Privacy Policy: Draft and link one for Washington, and review Nevada's and Connecticut's consumer health data rules too.
4. Keep health data out of vendors: Check that no mood, sleep, or weight values reach Firebase, Sentry, OneSignal, or SendGrid (event names, crash payloads, push tags, email templates).
5. Minimum age: Pick 16 or 18 and enforce it with the date-of-birth check. If teens are allowed, add teen-specific protections.
6. EU/UK Article 27 representatives and a DPO assessment: Appoint representatives and document the DPO decision.
7. Transfer mechanism: Sign SCCs and UK Addenda with all vendors, complete transfer impact assessments, and decide on DPF certification. Confirm AWS region mapping for EU users.
8. Canada: Name the Privacy Officer, get CASL-compliant marketing consent, and complete Québec's privacy impact assessment for transfers outside Québec.
9. Retention periods: Fill in every TODO in Section 6 and set Firebase and Sentry retention settings to match.
10. Security claims: Confirm encryption at rest, the hashing algorithm, and MFA before publishing.
11. EU/UK consent for analytics SDKs: Add a consent prompt before non-essential SDKs run (ePrivacy/PECR).
12. Request channels: Confirm the in-app export and deletion paths, whether a toll-free number is needed, GPC handling, and the appeals process.
13. Data Processing Agreements (DPAs): Make sure signed DPAs are in place with AWS, Google/Firebase, Stripe, SendGrid, OneSignal, and Sentry.
14. Consistency: Make sure your App Store "Privacy Nutrition Label" and Google Play "Data safety" form match this policy exactly.
15. Data protection impact assessment (DPIA) and state risk assessments: Do these for health data processing (GDPR Art. 35, Colorado, and the new CCPA risk-assessment rules).

Disclaimer: This is a template draft, not legal advice. It must be reviewed and adapted by qualified legal counsel in each relevant jurisdiction before publication.

Drafting notes: I checked several current legal developments to set up the transfer, health-data, and minors sections:

• EU–U.S. Data Privacy Framework: It's still valid. The EU General Court upheld it in September 2025, but an appeal is pending at the EU's top court (Case C-703/25 P). That's why the policy uses Standard Contractual Clauses as the main safeguard and treats the Framework as optional.
• Washington's My Health My Data Act: Wellness app data is covered. The law requires opt-in consent to collect it, separate consent to share it, and a stand-alone policy.
• Colorado: Protections for known minors now extend to users under 18.

Sources:

• IAPP – General Court dismisses Latombe challenge
• WilmerHale – CJEU to review DPF challenge
• EuropeanMartech – DPF status 2026
• IAPP – Washington My Health My Data Act overview
• Cooley – MHMDA FAQ: Requirements
• Washington AG – Protecting Personal Health Data
• Moore & Van Allen – Colorado Privacy Act minors changes
• McDermott – CPA rule amendments on minors