Legal · Ally app

Privacy Policy

Last updated 5 October 2026Version 2026-10-05

01Who we are

Ally is operated by AiVALON Health Technologies Inc., a health technology company based in Montréal, Canada (“AiVALON”, “we”, “us”).

AiVALON is responsible for the personal information described in this policy. For the purposes of the GDPR and equivalent laws, we are the controller of that data.

  • General contact, privacy and data requests: support@aivalon.ai
  • Privacy Officer, the person in charge of the protection of personal information at AiVALON, reachable at support@aivalon.ai

02What this policy covers

The Ally mobile app and the services it talks to. It does not cover any third party website or service you reach from a link inside the app.

03What Ally is, and is not

Ally is intended only for general wellness, fitness, educational and self-tracking purposes. It is not intended to be a medical device, and is not intended to diagnose, screen for, treat, cure, monitor or prevent any disease or medical condition. Ally’s estimates are not medical diagnoses and should not replace professional medical care. See the Terms of Service for the full disclaimer.

04The data we collect

4.1 Account data

Collected when you create an account: first name, last name, email address, and a password (stored only as a salted hash, we never see or store the password itself).

If you sign in with Google, we do not receive a password at all. Google gives us only your name, email address, the fact that Google has verified that address, and your Google account identifier, the last being a stable code Google uses for your account, which lets you sign back in even if you later change your email address. We use this only to create your Ally account and sign you in. We do not receive, request or store your Google password, and we do not read your Gmail, Drive, contacts, calendar or any other Google service.

Ally’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not transfer this information to anyone except as described in section 6, we do not use it for advertising, and we do not allow humans to read it except with your consent, for security or legal reasons, or where it has been aggregated and made anonymous.

If an account created with a password and one signed in with Google share the same verified email address, they are treated as the same account rather than two, so you reach the same data whichever way you sign in.

4.2 Health and measurement data

This is special category / sensitive personal data. It is the reason the sign-up screen asks for your explicit consent separately from accepting the Terms.

A check-in produces a pulse signal, which our servers analyse. There are two ways that signal can be captured, and only one of them applies to any given check-in.

Capture with your phone camera. Each frame is processed on your device and reduced to a single number. That sequence of numbers, with their timestamps, is the pulse (PPG) signal, and it is what we send to our servers.

No video, photograph, or camera image is ever uploaded, stored, or retained by us. Frames are processed in memory on your device and discarded.

Capture with Apple Watch. If you choose to run a check-in from your Apple Watch, the watch’s own sensor measures your heart rate and we read those values through Apple HealthKit. In this case we send the heart rate values and their timestamps for that check-in to our servers instead of the camera signal. Everything after that point is identical.

Reading from HealthKit requires your separate permission, which iOS asks for the first time you use the watch check-in. It is independent of the consent you gave at sign-up, and you can revoke it at any time in Apple’s Health app, see section 9.

We request the minimum HealthKit data needed: heart rate recorded during a check-in. We do not read your wider Health history, and we do not write anything back into HealthKit. In line with Apple’s requirements, HealthKit data is used to produce your check-in results and, only if you separately opt in, to improve the accuracy of the models behind those results (see section 5). It is never used for advertising, marketing or data mining, and it is never shared with third parties for those purposes.

Whichever source a check-in used, our servers store the signal we received and the results computed from it, and keep them so your history and trends remain available:

  • the pulse signal for that check-in, the samples captured from a camera check-in, or the heart rate values read from your Apple Watch
  • heart rate over the course of the test (estimated by us for a camera check-in; measured by the watch for a watch check-in)
  • heart rate variability and breathing-response measures
  • a cardiovascular fitness score and related derived indicators
  • the timestamp, duration and quality indicators of each check-in

4.3 Data you enter yourself

  • how you say you are feeling before a check-in
  • your date of birth, and any body measurements you enter (e.g. height, weight)
  • your answers to the lifestyle questionnaires (activity, nutrition, sleep, stress and similar), which are processed and stored by our lifestyle service

4.4 Device and technical data

Device model and manufacturer, operating system version, app version, and coarse technical characteristics of the capture (frame rate, resolution, or, for an Apple Watch check-in, the watch model and sampling rate). We use this to interpret measurements correctly across hardware and to debug capture problems.

4.5 Diagnostics and crash data

Our backend keeps its own error logs and crash reports on our servers, in the same Google Cloud region as the rest of your data. In the mobile app we use Datadog to collect crash reports and app performance telemetry. This helps us find and fix defects. Either may include your account identifier so we can connect a fault to the session that produced it.

4.6 Notifications

If you enable check-in reminders, we store your reminder schedule. Reminders are scheduled locally on your device.

4.7 What we do not collect

We do not collect your precise location, we do not access your contacts, photos, or files, we do not upload camera images, and we do not sell your personal data or share it with advertisers.

If you use the Apple Watch check-in, we read only the heart rate recorded for that check-in. We do not read steps, sleep, workouts, blood oxygen, ECG, menstrual or reproductive health, medical records, or any other category in your Health store, and we never write to it.

05Why we use it, and our legal basis

We use your account data to create your account, keep it secure and sign you in. That is what we need to give you the app you signed up for, so our basis is our contract with you. The same applies to the name, email address and account identifier Google gives us when you choose Sign in with Google: they are used to create and authenticate your account, and for nothing else.

We use your health and measurement data to produce your check-in results, scores and trends. Because this is sensitive data, we rely on your explicit consent, the consent you gave separately at sign-up, as well as our contract with you. Your lifestyle questionnaire answers are stored and processed on the basis of your consent.

Improving our models, optional, and off unless you turn it on. With your explicit consent, we may also use your pulse signal data, your HealthKit heart rate data, or both to improve the accuracy and reliability of the models that generate your check-in results. This is a separate choice from the consent you gave at sign-up, it is never required to use Ally, and you can withdraw it at any time in Settings → Data & privacy. Our basis is your explicit consent. We do not use this data to improve anything outside our health and fitness features.

We use device and diagnostics data to keep the app working and to find and fix crashes and defects. Where applicable, we rely on our legitimate interest in running a reliable, accurate product, and on your consent where the law requires it.

If you turn on reminders, we use your reminder schedule to send them, on the basis of our contract with you and your request for them.

Finally, we use whatever data is strictly necessary to meet our legal obligations and to establish or defend legal claims, relying on those legal obligations and, where applicable, on our legitimate interests.

You can withdraw your consent at any time (see section 9). Withdrawal does not affect processing that already happened, but Ally cannot produce results without it.

06Who we share it with

We do not sell your data. We share it only with processors acting on our instructions under a written contract:

  • Google Cloud Platform (Google LLC), hosting and storage of the backend and all account, check-in and health data, on Compute Engine in the us-central1 region (Council Bluffs, Iowa, United States)
  • Datadog, Inc., crash reporting and performance telemetry from the mobile app (United States)
  • Amazon Web Services, Inc., transactional email such as password resets, via Amazon Simple Email Service (United States). Receives your email address and the content of the message sent to you.

Sign in with Google works the other way around: nothing is shared with Google. Your phone asks Google who you are, Google hands your phone a signed proof of identity, and your phone passes that to us. Google learns that you signed in to Ally; it receives none of your check-in, health or questionnaire data, and we send it nothing about you.

We may also disclose data where we are legally required to, or to establish or defend legal claims.

07International transfers

AiVALON is based in Montréal, Canada, but your data is stored in the United States. Our backend runs on Google Cloud Platform in the us-central1 region (Iowa); our mobile diagnostics provider Datadog and our email provider Amazon Web Services are also US-based. This means your personal information, including your health data, is processed outside Canada and is subject to the laws of the United States, where it may in principle be accessible to US authorities under US law.

Wherever Ally is available, your personal information is transferred to and processed in the United States.

We protect it by contract with each provider, by encryption in transit and at rest, and by the access controls described in section 10.

If you are in the European Economic Area or the United Kingdom, your data leaves your country to reach us. For transfers that require a safeguard, we rely on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum for UK users. Where a provider is certified under the EU–US Data Privacy Framework, we rely on that adequacy decision instead. These are accompanied by the technical measures described in section 10.

You can request details of the safeguards that apply to you at support@aivalon.ai.

08How long we keep it

We keep the data that identifies you for as long as you keep your account, your check-in history is only useful to you if it stays complete, and we delete it when you ask us to.

  • Account data, kept while your account is open.
  • Check-in results and health data, kept while your account is open, so your trends remain meaningful. This includes the data you enter yourself and the raw pulse signal for each check-in (the samples from a camera check-in, or heart rate values from your Apple Watch), which we retain alongside the results.
  • Camera video and images, never stored, on our servers or anywhere else. Frames exist only in memory on your device during the test and are discarded immediately after the pulse value is taken from each one.
  • Diagnostics and crash logs, 180 days.
  • Internal audit and security logs, records of changes made to your account and check-in records, kept for up to 365 days.

When you ask us to delete your data, it stops being visible in the app immediately. We then erase it permanently from our live systems within 30 days of your request. Copies inside routine encrypted backups are overwritten as those backups roll over, within 90 days of your request, and are not accessed in the meantime.

That window also means an accidental deletion can be undone: contact us at support@aivalon.ai within 28 days of your request and we can restore your account. After the erasure runs, the data is gone and cannot be recovered.

We keep nothing back. A deletion request erases your account and every check-in, result, questionnaire answer and pulse signal attached to it.

If you opted in to model improvement, the copies held for that purpose are deleted too and are not used again. Models we had already trained before your request cannot be untrained; they hold no copy of your check-ins and are not used to identify you or to reconstruct your data.

The only thing we keep is a dated record that the deletion took place, containing no information about you or your results, so that we can confirm it was carried out if you ever ask.

09Your rights and your controls

Depending on where you live, you have the right to access your data, obtain a copy in a portable format, have it corrected or erased, restrict or object to processing, and withdraw consent.

If you think we have handled your personal information improperly, please come to us first, we would rather fix it. You also have the right to complain to the data protection authority responsible for where you live, and we will tell you which one that is if you ask.

In the app:

  • Settings → Data & privacy, review what Ally stores, and turn model improvement on or off
  • Settings → Export my data, get a copy of your data
  • Apple Health app → Sharing → Ally (iOS), turn off our access to your heart rate at any time. Doing so stops future Apple Watch check-ins; results already produced remain in your Ally account until you delete them.
  • [Settings → Delete my account], permanently erase your account and results

Or email support@aivalon.ai. We respond to requests within one month. Deletion takes effect immediately in the app and completes as described in section 8.

10Security

Data is encrypted in transit (TLS) and at rest. Authentication tokens are held in the platform secure keystore (Android Keystore / iOS Keychain), not in plain storage. Access to production data is restricted to staff who need it and is logged. No system is perfectly secure; we will notify you and the relevant authority of a qualifying breach without undue delay.

11Minimum age

Ally is intended for people aged 14 and over, or the minimum age for consenting to the use of your personal information where you live, whichever is higher. The 14 comes from Québec law, which requires a parent or guardian to consent on behalf of anyone younger before their personal information may be collected, and Ally has no way to obtain that consent.

We do not knowingly collect data from anyone under 14. If you believe an account belongs to a child, contact support@aivalon.ai and we will delete it.

12Changes to this policy

If we change how we use your data in a way that materially affects you, we will notify you in the app and, where the law requires it, ask for your consent again before the change applies to you. The version number at the top of this page identifies the wording you agreed to.

13Contact

AiVALON Health Technologies Inc., Montréal, Canada, support@aivalon.ai