Privacy policy
Last Updated: July 21, 2026
Notice at Collection
This Privacy Policy describes how Aktiia SA d/b/a Hilo (“Hilo”, “we”, “us”, or “our”) collects, uses and shares your personal information when you access and use our websites, the Hilo mobile application, our devices, and any of our other products and services (together, the “Services”). It also describes the choices you have and how you can contact us if you have questions or concerns. We may provide additional privacy notices that apply to specific products, services, or programs.
This Privacy Policy applies to individuals in the United States. If you access the Services from outside the United States, a different privacy notice may apply to you.
Personal Information We Collect
Information you provide to us may include:
Contact details, such as your first and last name, email address, postal address and telephone number.
Account and profile data, such as your user ID, login credentials, date of birth, gender, height, weight, country, and any additional information you provide about yourself.
Health and wellness information you enter in the Services, such as manually entered information relating to health, lifestyle, habits, routines, medication adherence, wellbeing, and similar personal circumstances, as well as activities, notes, comments, tags, feedback, and other content you provide within the Services.
Order and payment information, such as billing and delivery address, order and subscription details, and transaction history. Payment card details and other financial information are processed directly by our payment service providers in accordance with their respective privacy policies.
Communications that we exchange with you, including when you contact us with inquiries, feedback, or support requests by email, telephone, WhatsApp, chat (including our chatbot), or contact form, and any appointment- or company-related details you provide. Our chatbot uses AI-assisted technology to help generate responses to your inquiries. Please do not submit health-related or other sensitive information through the chatbot unless it is necessary to process your request and has been expressly requested. If you communicate with us through third party messaging services such as WhatsApp, those providers also process your communications under their own privacy policies.
Survey responses, if you choose to participate in our surveys or questionnaires.
Social and sharing data, such as information you choose to share with other users through social or community features within the Services. You can manage your sharing preferences, or opt out of sharing entirely, through the relevant settings within the Services.
Marketing information, such as your preferences for receiving communications about the Services, and details about how you engage with our communications.
Information we collect through our devices and app. When you use the Hilo app and connected devices, we may collect:
Measurement data, such as blood pressure readings, wrist-signal data, pulse, heart rate, movement, temperature, respiration, sleep-related data and other physiological metrics collected through the Services or connected devices.
Derived and analytical data, such as calculated insights, including sleep stages (e.g., deep, light, REM, awake), activity levels, readiness or recovery indicators, stress or other wellbeing indicators, body mass index (BMI), and other health insights derived from your information.
Device pairing and calibration data, such as device identifiers, pairing information, calibration data and related technical information.
Location data, such as approximate or precise location derived from GPS, Wi-Fi, or network-based information, where you have granted the necessary permissions. We do not collect precise location data without your consent. You may withdraw your consent or disable location access at any time through your device settings, although this may affect the availability of certain features.
Automatic data collection. We and our service providers may automatically log information about you, your device, and your interaction over time with the Services, such as:
Device and technical data, such as your device’s operating system, manufacturer and model, browser type, IP address, unique device identifiers, app version, language settings, and network information; and
Usage data, such as pages or screens you viewed, the website you came from, access times, interactions with the Services, and diagnostic, telemetry and performance information.
Cookies, pixels, SDKs. We may also collect this information using cookies, pixels, SDKs and similar technologies. Cookies are text files that websites store on a visitor’s device or in the browser to help you navigate between pages efficiently, remember your preferences, enable functionality, and help us understand user activity and patterns. For the choices available to you, see the Your Privacy Rights and Choices section below.
Information we collect from third parties:
Sign-in services. If you register or log in using Google sign-in or Apple sign-in, we receive authentication information from those providers.
Platform operators. If you download our app or purchase a subscription through the Apple App Store or Google Play Store, we may receive account- and subscription-related information from the platform. Purchases and subscriptions made through the app stores are also subject to the platforms’ own terms and privacy policies.
Social media platforms. We maintain pages on platforms such as Facebook, Instagram, LinkedIn, TikTok, X and YouTube. If you interact with us via these pages, we may receive your communications and other information about your interactions with us. Any information collected by the platforms that maintain our pages is governed by their own privacy policies and is not within our control. If you wish to exercise privacy rights with respect to information a platform holds, we recommend contacting the platform directly; you may also contact us, and we will forward your request to the platform where appropriate.
How We Use Personal Information
We use your personal information for the following purposes:
To provide and operate the Services. This includes creating and managing your account; processing orders, payments, subscriptions, deliveries, returns, and cancellations; generating, displaying, and storing your measurements and insights; pairing and calibrating your devices; using your approximate location to display the appropriate regional storefront, language, currency, and shipping options; and personalizing and improving the Services.
To communicate with you. This includes responding to your inquiries, providing customer support, and sending you service communications such as order confirmations, shipping notifications and account notices.
Marketing. With your consent or as otherwise permitted by law, we may send you newsletters and other communications about the Services and measure how you engage with them. We do not use your health data for marketing or advertising.
Research, validation, and product improvement. We may use information collected through the Services, including health-related information and physiological measurements, to analyze, improve, validate, and develop our products and services, including to improve measurement accuracy, enhance product performance and safety, train and improve our algorithms and models, conduct scientific, clinical, technical, or product-development research, support quality management and regulatory documentation and prepare scientific, medical, or technical publications. Where appropriate, we apply safeguards such as aggregation, de-identification, pseudonymization, or anonymization. Pseudonymized or de-identified data may still constitute personal information where individuals remain identifiable, and in such cases we process it in accordance with this Privacy Policy. We do not publish information that directly identifies you without your consent where required by law. Where we ask for your consent for these activities, you may decline or withdraw it without affecting your ability to use the core features of the Services.
For compliance and protection, including to enforce any applicable terms and conditions, comply with legal obligations, defend against legal claims or disputes, protect the security and integrity of the Services and to detect, prevent, and investigate fraudulent, harmful, unauthorized, or illegal activity.
Health data. We process health data solely for the purposes described in this Privacy Policy, with your consent where required by applicable law, and subject to strict access controls and security measures. We do not use health data for marketing or advertising, and we do not sell it.
How We Share Personal Information
We may share your personal information with:
Affiliates. Affiliated companies for purposes consistent with this Privacy Policy.
Service providers. Companies that provide services on our behalf or help us operate the Services or our business, including cloud hosting and health-data processing (such as Amazon Web Services), e-commerce and website hosting, information technology and security, shipping and delivery, customer support and communications (including chatbot services), customer relationship management, email and messaging, consent management, analytics and product improvement, marketing and attribution, authentication, subscription management, surveys, reviews and referral programs, business administration (such as finance and order management), and recruiting. Where possible, certain analytics, attribution, engagement, and subscription providers receive pseudonymized identifiers (for example, hashed user identifiers) instead of directly identifiable account information. These providers are contractually required to protect your personal information, to use it only to provide services to us, and not to sell it.
Payment providers. Payment service providers, such as PayPal, Stripe, Klarna and the card networks, process your payment information on their own behalf for payment execution, authentication, identity verification, fraud prevention and, for certain providers (such as Klarna), creditworthiness assessment, in accordance with their own privacy policies.
Distributors and other business partners. Distributors, resellers, and other business partners involved in delivering our products and services, and, where applicable, laboratories or healthcare partners.
Third parties at your direction. Third parties, such as healthcare providers or insurers, where you direct us to share your information or provide your consent. These third parties are responsible for their own use of your personal information, and we recommend that you review their privacy policies.
Third-party facilities. If you receive access to the Services through, or in connection with, a hospital, clinic, healthcare provider, research institution, or other third-party facility, that facility may be responsible for your personal information to the extent it determines the purposes and means of processing, and you should refer to its privacy policy. Where we process personal information solely on behalf of such a facility, we do so only under its instructions and under a contract with that facility.
Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.
Authorities and others. Law enforcement, government authorities, courts, and private parties, as we believe in good faith to be necessary or appropriate to comply with legal obligations or to establish, exercise, or defend legal claims. Where legally permissible, we will inform you of such disclosures.
Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, us or our affiliates.
We do not sell your personal information or health data, and we do not share health data with third parties for their own purposes, including advertising.
Your Privacy Rights and Choices
Unsubscribe from marketing communications. You may opt out of marketing communications by following the unsubscribe instructions in the communication we send you or by contacting us. We may continue to send you administrative communications that are necessary for our relationship with you.
App permissions and consent. Where we rely on your consent for optional features, such as location-based features or notifications, you may withdraw your consent at any time through your device or app settings.
Cookie preferences. You may grant, refuse, or withdraw your consent to non-essential cookies at any time via the consent banner on our website. Most browsers also let you remove or reject cookies through your browser settings. Where required by law, we honor opt-out preference signals such as the Global Privacy Control (GPC).
Your state privacy rights. Depending on where you live, U.S. state privacy laws may give you the following rights with respect to your personal information:
Know and access. Request the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collecting it, and the categories of third parties to whom we disclose it.
Delete. Request that we delete personal information we collected from you, subject to certain exceptions.
Correct. Request that we correct inaccurate personal information we maintain about you.
Data portability. Obtain a copy of certain personal information in a portable and, where feasible, readily usable format.
Opt out of “sale,” “sharing,” and targeted advertising. Direct us not to sell or share your personal information or use it for targeted advertising. As explained above, we do not sell or share your personal information.
Limit use of sensitive personal information. Direct us to limit the use and disclosure of your sensitive personal information to certain purposes. We use sensitive information only for the purposes described in this Privacy Policy.
Opt out of profiling. Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, where applicable. We do not engage in this type of profiling.
Appeal. Appeal a decision we make about your request, where your state’s law provides an appeal right.
Non-discrimination. Not receive discriminatory treatment for exercising your privacy rights.
How to exercise your rights. You (or an authorized agent acting on your behalf) may submit a request by emailing us at, by submitting our online request form at us.hilo.com/pages/contact-us, or by calling +1 555 971 3663. We will confirm receipt of your request and respond within the time required by applicable law (generally within 45 days, with an extension where permitted). To protect your information, we will take steps to verify your identity before responding, generally by matching information you provide with information in our records; we may decline requests that we are unable to verify. We may require an authorized agent to provide proof of authorization and may require you to verify your identity directly with us. If we decline to act on your request, you may appeal by contacting us at legal@aktiia.com if your appeal is denied, you may contact your state attorney general.
U.S. State-Specific Disclosures
California residents. The California Consumer Privacy Act, as amended (the “CCPA”), requires us to make the following disclosures. In the preceding 12 months, we have collected the following categories of personal information: identifiers (such as name, email address, postal address, phone number, device identifiers, and IP address); customer records (such as billing and payment information); characteristics of protected classifications (such as age or sex, where you provide them); commercial information (such as products purchased and subscription history); internet or other electronic network activity (such as usage and interaction data); geolocation data; professional or employment information (for job applicants); inferences drawn from the above (such as readiness or recovery insights); and sensitive personal information (such as account log-in credentials, precise geolocation where you enable it, and health information). The sources of personal information, the business and commercial purposes for collecting it, and the categories of recipients to whom we disclose it are described in the sections above.
No sale or sharing. We do not “sell” or “share” your personal information as those terms are defined under the CCPA, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16 years of age.
Sensitive personal information. We use and disclose sensitive personal information only for purposes permitted under the CCPA, such as providing the Services you request, and not to infer characteristics about you.
Retention. We retain each category of personal information for the periods described under Data Retention below.
Shine the Light. California Civil Code § 1798.83 permits California residents to request information about disclosures of personal information to third parties for those third parties’ direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.
Financial incentives. From time to time we may offer programs, such as a referral program, that could be considered a “financial incentive” under the CCPA. Where we offer such a program, participation is voluntary, you may withdraw at any time, and we will provide the material terms of the program when you enroll. Any difference in price or service is reasonably related to the value of your data to us.
Residents of other states. If you reside in a state with a comprehensive privacy law, you have the rights described above to the extent your state’s law provides, including the rights to access, correct, delete, and obtain a copy of your personal information, and to opt out of targeted advertising, the sale of personal information, and certain profiling. As noted, we do not sell personal information or use it for targeted advertising. Several of these laws require your consent before we process sensitive data, including health information; where required, we obtain your consent. You may also appeal a denied request as described above.
Data Security
We implement technical, organizational, and physical safeguards designed to protect the personal information we collect, appropriate to the risk associated with the processing. These include encryption of personal information in transit and, where appropriate, at rest; pseudonymization and anonymization where feasible; strict access controls that limit access to authorized personnel on a need-to-know basis; employee training and confidentiality obligations; mechanisms to detect, prevent, and respond to security incidents; and regular testing, monitoring, and updating of our systems. However, no security measures are failsafe, and we cannot guarantee the security of your personal information. We recommend that you use the latest available versions of our applications, firmware, and software.
Data Retention
We retain personal information only for as long as necessary for the relevant purpose or as required by law. The retention period depends on the category of data, the purpose of processing, and applicable statutory retention obligations. For example, we generally retain contact and inquiry data for as long as needed to handle your request and any follow-up; account and service data for the duration of your use of the Services; measurement and program data for as long as necessary to provide the relevant functionality; marketing data for as long as you remain subscribed or until you opt out; technical and usage data for as long as required for security, performance, and improvement purposes; and contractual, billing, and tax-related data for legally required retention periods. Once personal information is no longer required, we delete or anonymize it; where legal obligations prevent deletion, we restrict processing to what is strictly necessary. You may also request deletion of your personal information as described above, subject to applicable legal retention obligations.
International Data Processing
We are headquartered in Switzerland and may store or process personal information in the United States, Switzerland, and other countries. We take steps to ensure that your personal information receives appropriate protection wherever it is processed.
Children
The Services are intended for adults and are not directed to children. We do not knowingly collect personal information from children under 13, and we do not knowingly sell or share the personal information of consumers under 16. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it. If you believe a child has provided us with personal information, please contact us at legal@aktiia.com.
Job Applicants
When you apply for a job with us, including through our applicant management provider, Workable, we collect the information you provide in connection with your application, such as your contact details, application documents (e.g., CV, cover letter, certificates), professional background, qualifications, and communications with us. We use this information to manage the application process, assess your suitability for the position, and communicate with you. If your application is unsuccessful, we generally delete your information after a reasonable period (typically up to six months), unless a longer retention period is required by law or you have consented to longer storage (for example, inclusion in a talent pool).
Relationship to HIPAA
Hilo is not a “covered entity” under the U.S. Health Insurance Portability and Accountability Act (“HIPAA”), and information you provide through the Services is generally not “protected health information” governed by HIPAA. Where we act as a “business associate” to a HIPAA-covered entity, the applicable business associate agreement and that entity’s notices govern our handling of protected health information; see also Third-party facilities above.
Changes to This Privacy Policy
We reserve the right to modify this Privacy Policy at any time. If we make material changes, we will notify you, for example via our website, by email, or by push notification, and by updating the date of this Privacy Policy.
How to Contact Us
The company responsible for your personal information under this Privacy Policy is Aktiia SA, c/o Aktiia Inc 75 State Street, Ste 100, Boston, MA, 02109, USA. If you have questions or concerns about this Privacy Policy or our privacy practices, or if you would like to exercise your privacy rights, you can contact us by email at legal@aktiia.com, by mail at the address above, Attn: Privacy, or at +1 555 971 3663.