KIWEAR Privacy Policy

1. About this policy

This Privacy Policy explains how KiWear, Inc. (“KIWEAR,” “we,” “us,” or “our”) handles personal information when you use the KIWEAR smart ring, the KIWEAR mobile application, and related services (together, the “Services”). You can contact us at privacy@kiwear.com.

The Services provide general wellness and lifestyle information. They are not medical devices and do not provide medical diagnosis, treatment, or healthcare services.

This Policy describes the information we handle, why we handle it, when we share it, how long we retain it, and the choices available to you. Where applicable law requires consent, we will ask for it before the relevant processing. You may withdraw consent using the app or your device settings, or by contacting us. Withdrawing consent does not affect processing already carried out lawfully.

2. Information we handle

Account, profile, and authentication information

When you create or use an account, we may handle your mobile phone number and/or email address, SMS or email verification code, username, password, user ID, login token, and account or login status. We use this information to register and authenticate your account, maintain your login session, reset your password, and process account requests. You may also provide a nickname, gender, age or date of birth, height, and weight. Some of these details may be used to calculate stride length, estimated exercise calories, or other activity metrics. Other profile details are optional. SMS and email verification codes are used to verify your phone number or email address. These codes are single-use and expire within 10 minutes. We do not retain the verification code itself after it is successfully used or expires. Masked delivery and verification records may be retained for up to 30 days.

Goals, preferences, and avatar

You may set goals such as daily steps, activity calories, or exercise duration. We handle these goals, along with your ring gesture mappings, control schemes, notifications, vibration, and theme preferences, to provide the features you configure. You may take a photo or select an image for your avatar. On iOS, the app uses the system photo picker to access the image you select rather than the entire photo library. The app requests camera or photo access when you use a feature that needs it. The camera may also be activated by a ring gesture when you use the ring’s remote camera-control feature.

Ring health and activity information

The ring may collect:

• Heart rate and measurement time;
• Blood oxygen saturation and measurement time;
• Stress values;
• Experimental body-temperature data or temperature trends;
• Steps, active calories, and resting calories;
• Sleep start and end times, duration, stages, type, and score;
• Workout type, start and end times, and duration;
• Workout steps, average heart rate, calories, speed or pace, and estimated distance; and
• Daily, weekly, and monthly health summaries and trends, health scores, and activity completion information.

We use this information to display your health, sleep, and workout records; generate summaries and trends; support measurements you initiate; calculate activity metrics using your profile; and provide ring-based monitoring features. Some historical health information may be temporarily stored on the ring and synced to your phone when the app connects. Health information is uploaded to and processed on our cloud servers and associated with your account so that it can be displayed across your devices and retained with your account.

Health and wellness information is sensitive personal information in some jurisdictions. We handle it only for the purposes described in this Policy and obtain consent or rely on another legal basis where applicable law permits and requires it. Where separate consent is required, we will request it separately before processing.

Location and workout distance

If you actively start an outdoor run or ride and grant permission, the app may access your device location to calculate distance in real time. Location permission may also be required on some older Android versions to find nearby Bluetooth devices. We may process your location-permission status to support ring discovery and connection. The workout report stores calculated results such as distance and pace. We do not save or upload full workout routes or latitude-and-longitude paths. We do not retain or upload raw latitude-and-longitude points, record them in server logs, analytics events, or diagnostic packages, or provide them to third-party analytics services.

Ring and connected-device information

We may handle the ring’s name, device identifier, and Bluetooth address; ring model, firmware version, and SDK version; battery and charging status; Bluetooth connection, binding, and pairing status; names, types, and Bluetooth addresses of control devices paired with or stored on the ring; the current control target; firmware-update status and history; and device settings such as wearing hand, gesture settings, and health-monitoring switches. We use this information to find, connect to, distinguish, and manage your ring and connected devices; show device status; restore connections; perform firmware updates; and switch between control targets.

Gestures, controls, and personalization

We may handle gesture events generated by the ring, such as taps, swipes, pinches, and rotations; gesture-to-function mappings; touch positions and joystick-area settings; pointer or air-mouse calibration settings; quick-panel configurations; control targets and button schemes; control schemes you create, save, import, or share; and preferences such as tones, vibration, notifications, and themes. We use these details to provide the ring-control functions you configure.

Optional Android app-usage access

If you grant Android Usage Access, the app may read recently foregrounded app package names and times; names, package names, and icons of launchable apps; apps you select for quick launch or gesture control; and gesture schemes you configure for particular apps. We use this information to support features such as returning to the previous app, choosing apps to open from the ring, and applying different gesture schemes to different foreground apps. As part of account synchronization, we automatically upload your quick-launch app selections, including package names and order, and your general and app-specific gesture settings to our servers solely for backup and restoration. Your full installed-app list and app-usage history remain on your phone and are not uploaded. We do not read the content, accounts, messages, or information you enter in third-party apps. Usage Access is optional. If you do not grant it, the related features may not work.

Android phone-control permissions

On Android, the app may request phone-state, call, or answer permissions to detect incoming calls and let you answer or end calls from the ring. These permissions are used only for those call-control functions. We do not use them to read or upload your contacts, call recordings, SMS content, call history, your phone number, IMEI, or call content.

Connected vehicle account and control services

If you choose to connect a third-party vehicle account, you authorize the connection through the relevant vehicle service’s authorization process. We may handle the OAuth authorization code, access token, refresh token, and authorization status needed to establish and maintain the connection. Depending on the vehicle service and the features you use, we may handle vehicle identifiers and information such as vehicle ID, vehicle identification number (VIN), vehicle name and model, online and lock status, mileage, software version, battery and charging status, cabin and exterior temperature, climate and charging settings, and virtual-key pairing status. We also handle the vehicle-control commands you initiate through the app, such as locking or unlocking the vehicle, sounding the horn, flashing the lights, or controlling climate or charging.

This information is used to provide the vehicle-account connection and the vehicle-control features you request. The information may be transmitted between KIWEAR’s backend systems and the relevant vehicle-account or vehicle-control service to carry out your request. OAuth authorization codes are used only to obtain authorization credentials and are not retained long term. To maintain the connection, KIWEAR may retain access tokens, refresh tokens, vehicle ID, VIN, vehicle name, your selected vehicle, and virtual-key pairing status in secure storage on your device or in encrypted storage on KIWEAR servers. Real-time vehicle status is processed temporarily to carry out your requests and cached for no more than 24 hours. Vehicle-command and security audit records may be retained for up to 90 days. You may disconnect the service in the app’s vehicle-account settings. Credentials held by KIWEAR are deleted or invalidated within 24 hours after disconnection. Related vehicle information is also deleted when your KIWEAR account is deleted, subject to the retention and deletion rules in Section 7. We do not use connected-vehicle information for advertising or combine it with ring health information for analysis.

Technical, operational, and support information

We may handle app, SDK, and ring firmware versions; phone operating-system version, device model, language, and time zone; Bluetooth and connection status; ring battery level; SDK command events, execution counts, and failures; firmware-upgrade and feature-usage events; performance measurements and operation or network-request durations; error codes, crash stack traces, connection-error and Bluetooth debug logs; network request times and response status; IP addresses; pseudonymized account or device identifiers; and the time and description of issues you report.

The app may automatically upload operational, performance, crash, network-error, Bluetooth-connection, SDK-command, firmware-upgrade, and feature-usage events containing the types of information described above. This information may be transmitted to and processed on our cloud servers for service operation, reliability and performance analysis, troubleshooting, and security. Logs may contain personal information, and pseudonymized identifiers remain personal information where they can be linked to you. Our code attempts to redact phone numbers, email addresses, passwords, verification codes, and identity tokens, but redaction may not remove all personal information. Routine raw logs are retained for up to 90 days; logs needed for security, fraud prevention, or incident investigation may be retained for up to 12 months; and de-identified or aggregated statistics may be retained for up to 24 months.

A diagnostic package is different from routine technical or error information. It is generated when you choose to create it and is not automatically uploaded. It is sent only after you explicitly confirm an upload to KIWEAR servers for troubleshooting and technical support or choose to share it through an available app or support channel. If you contact support, we also handle the information you choose to provide, such as the time and description of the issue.

3. App permissions

Depending on your device, operating system, and the features you use, the app may request:

• Bluetooth and nearby-device access to find, connect to, and maintain a connection with the ring;
• Notifications to show connection, battery, control status, and necessary reminders;
• Background Bluetooth or foreground-service operation to maintain ring features when the screen is locked or you switch apps;
• Overlay access to display the ring-control panel;
• Permission to modify system settings or Do Not Disturb settings to perform system actions you configure;
• Camera access for avatar photos, remote camera control, or flash control;
• Photo or file access to select an avatar or firmware file, or export a diagnostic package;
• Vibration for operation feedback;
• Battery-optimization exemption to improve background connection stability;
• Location access for outdoor distance calculation or, on some older Android versions, nearby Bluetooth discovery;
• Android Usage Access for the optional app-usage features described above; and
• Android phone-control permissions for the call features described above.

A permission allows the app to access a system capability. A permission request does not by itself mean that information is collected or uploaded. We access and handle information from a capability only as described in this Policy and when you use the relevant feature.

4. Information we do not collect

We do not collect or use contacts or address-book information; SMS content; call content or recordings; microphone or audio recordings; calendar information; browsing history; payment-card or bank-account information; advertising identifiers; Apple Health or HealthKit data; or face or fingerprint information used to identify you. We do not use personal information for cross-app or cross-site advertising tracking, and we do not use health information for targeted advertising. We may use first-party analytics to understand feature usage, reliability, and performance, as described in Section 2. If we introduce analytics service providers or additional analytics or crash-reporting SDKs, we will disclose the applicable collection, use, and sharing in this Policy and in the applicable app-store privacy information before that processing begins, and obtain consent where required. A permission request alone does not mean that information is collected.

5. How we use information

We use information to provide and maintain the Services; display health, sleep, workout, and device information; calculate activity metrics and generate summaries and trends; support ring-control, gesture, and connected-device features; create, authenticate, recover, secure, and delete accounts; respond to support requests; understand feature usage and assess reliability and performance; operate, troubleshoot, and protect the Services; and comply with legal obligations. We do not use health information for advertising, marketing profiling, or purposes unrelated to providing the Services. We do not sell or rent personal information.

6. How we share information

Service providers

We share information with service providers that process it on our behalf, including cloud hosting and storage providers, SMS providers, and email delivery and verification providers. These providers may process information only for authorized purposes and must protect it under applicable contractual requirements. When you use a connected vehicle feature, we share information needed to authenticate the connection and carry out your requested vehicle-control commands with the relevant vehicle-account or vehicle-control service.

Legal requirements and safety

We may disclose information if required by law or when reasonably necessary to comply with a legal obligation, protect our rights or property, or protect the safety of users or others.

Business transfers

If we are involved in a merger, acquisition, reorganization, or asset sale, personal information may be transferred as part of that transaction, subject to applicable law. We will provide notice of material changes where required.

7. Retention and deletion

We retain each category of personal information only for as long as necessary for the purposes described in this Policy, to operate your account, resolve disputes, protect the Services, or comply with legal obligations. The applicable retention periods or criteria are:

• Account, profile, and authentication information: for as long as your account remains active. After account deletion, this information is deleted or irreversibly anonymized from active systems within 30 days, unless a longer period is required by law. Backup copies are deleted or overwritten within 90 days after deletion from active systems.
• Health and activity records: for as long as your account remains active or until you delete the relevant records. After account deletion, these records are deleted from active systems within 30 days and from backups within 90 days after deletion from active systems.
• Connected-vehicle information: while the vehicle account remains connected. Access credentials are deleted or invalidated within 24 hours after disconnection. Real-time vehicle-status caches are retained for no more than 24 hours. Vehicle-command and security audit records may be retained for up to 90 days. After account deletion, related personal information is deleted from active systems within 30 days and from backups within 90 days after deletion from active systems, subject to the exceptions described below.
• Workout results derived from location: as health and activity records, for as long as your account remains active or until you delete the relevant records, subject to the same account-deletion and backup periods stated above. We do not retain full routes or raw latitude-and-longitude points.
• Device, connection, and feature-usage information: for as long as needed to provide device-management and synchronization features. After device unbinding, this information is deleted or irreversibly anonymized within 90 days. Account-associated personal information is deleted or irreversibly anonymized from active systems within 30 days after account deletion. De-identified or aggregated product analytics may be retained for up to 24 months, subject to applicable deletion rights.
• Support and privacy requests: for up to two years after the request is closed, to follow up on requests, document their handling, and resolve disputes, unless a longer period is required by law.
• Routine technical, performance, crash, and error logs: for up to 90 days. Security, fraud-prevention, and incident-investigation logs may be retained for up to 12 months. De-identified or aggregated statistics may be retained for up to 24 months, subject to applicable deletion rights.
• Verification information: SMS and email verification codes are single-use and expire within 10 minutes; the code itself is not retained after successful use or expiration. Masked delivery and verification records may be retained for up to 30 days.
• Backup copies: for up to 90 days after deletion from active systems. During this period, backup data is isolated from ordinary use and retained only for disaster recovery.

You may request deletion of your account:

• In the app: KIWEAR app > Me (Settings) > Account > Delete Account.
• Outside the app: email privacy@kiwear.com and state that you want to delete your KIWEAR account. Please identify the email address or mobile phone number associated with your account. Do not send us your password or verification code. We may request additional information reasonably necessary to verify your identity.

When we receive a deletion request, we will delete your account and associated personal information from active systems within 30 days, except for information we are legally required or permitted to retain for the purposes and periods described in this Section. We may ask for information reasonably needed to verify your request. If we retain information for a legal or security purpose, we will restrict its use to that purpose and delete it when the retention period ends. The longer retention periods for support and privacy requests and security or audit logs do not override applicable deletion rights. Information in backups will be deleted or overwritten within 90 days after deletion from active systems. We will notify you when deletion from active systems is complete, explain any applicable retention exceptions and the backup-deletion timetable, or notify you if additional time is needed where permitted by applicable law.

8. Your choices and rights

In some regions, consumer-health-data laws may require an additional privacy notice, a separate consent before collecting health information, or a separate authorization before sharing it. We will provide these notices and controls where required by law. The available rights and procedures may vary by location.

Depending on your location and applicable law, you may have the right to access, correct, delete, or obtain a portable copy of certain personal information; withdraw consent; object to or restrict certain processing; or complain to a privacy regulator. You may also be able to delete health data in the app settings, revoke device permissions in your operating-system settings, disconnect a vehicle account, or turn off Android Usage Access. Some features may not work after you withdraw permission or disconnect an account.

To exercise a privacy right, contact us at privacy@kiwear.com. We may request information reasonably needed to verify your identity and will respond within the period required by applicable law.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. However, no storage or transmission method is completely secure.

10. International data transfers

We may process or store personal information in countries or regions outside the country or region where you reside. Where required by applicable law, we will take appropriate measures to protect personal information transferred across borders and comply with applicable requirements relating to cross-border data transfers.

If applicable law requires us to provide additional information about a cross-border transfer, obtain your consent, or implement specific safeguards before transferring your personal information, we will do so as required by law.

11. Children’s privacy

The Services are intended only for individuals aged 18 or older. We do not knowingly allow individuals under 18 to create an account or use the Services. If we learn that an individual under 18 has created an account or that we have collected their personal information, we will take appropriate steps to restrict the account and delete the information, unless we are legally required or permitted to retain it.

If we learn that we have collected a child’s personal information without an appropriate legal basis, we will take steps to delete it.

12. Changes to this Policy

We may update this Policy from time to time. We will post the revised Policy and update the “Last updated” date. If a change is material, we will provide notice and obtain renewed consent before the changed processing begins where required by law.

13. Contact us

KIWEAR Privacy Team

Email: privacy@kiwear.com
Website: www.kiwear.com
Legal entity: KiWear, Inc.