Oura Integration Privacy Policy

1. Introduction

Welcome to Inwardly, a body awareness training application designed to help you understand and develop a deeper connection with your physical self. Our app uses a framework called Feel, Form, Data to guide you through personalized check-ins and insights based on your biometric data.

This Privacy Policy explains how we collect, use, store, and protect your data from your Oura Ring when you integrate it with Inwardly. We take your privacy seriously and are committed to transparency about how we handle your personal information.

If you have any questions about this policy or our privacy practices, please contact us at support@goinwardly.com.

2. Beta Program Scope

Inwardly's Oura integration is currently in a closed beta program, limited to approximately 100 users. As a beta feature, this integration and its associated privacy practices may be updated, modified, or changed at any time.

We will provide 7 days advance notice of any material changes to this Privacy Policy. Your continued use of the Oura integration after such notice constitutes your acceptance of the revised policy.

3. Data We Collect from Oura

When you authorize Inwardly to access your Oura Ring data, we collect the following information:

Readiness and Recovery Metrics

• Readiness Score — Your daily readiness assessment
• Heart Rate Variability (HRV) — Measurements of variation between heartbeats
• Resting Heart Rate — Your heart rate during rest

Sleep Data

• Sleep Duration — Total hours slept
• Sleep Stages — Distribution of light, deep, and REM sleep
• Sleep Efficiency — Percentage of time in bed actually spent sleeping
• Sleep Latency — Time to fall asleep

Activity Data

• Daily Movement — Overall activity levels
• Steps — Daily step count
• Calories Burned — Estimated caloric expenditure

Heart Rate Data

• Daytime Heart Rate Trends — Patterns throughout active hours
• Nighttime Heart Rate Trends — Patterns during sleep and rest

Temperature Data

• Temperature Deviation — Variations in your body temperature trends

Personal Information

• Profile Data — Information you've shared with Oura, such as age, weight, and other demographic details relevant to biometric analysis

4. How We Access Your Data

Inwardly uses OAuth 2.0 to securely connect with Oura. This means:

• You authorize Inwardly through Oura's official consent screen
• We never see or store your Oura password
• You maintain control and can revoke access at any time
• We request specific data scopes limited to what we need

OAuth Scopes Requested:

• daily — Access to daily summary data
• heartrate — Access to heart rate data
• personal — Access to personal profile information
• session — Access to session and activity data
• workout — Access to workout and exercise data

These scopes are the minimum necessary to provide you with personalized body awareness insights within Inwardly.

5. How We Use Your Data

Your Oura data is used to enhance your experience within Inwardly:

Personalization

• Correlate your biometric data with your body awareness check-ins
• Create a personalized profile showing how your subjective awareness aligns with objective metrics
• Tailor recommendations and insights based on your unique patterns

AI-Generated Insights

• Generate personalized insights about your body and wellness patterns
• Provide context for your check-ins and help you understand your body better

Dashboard Display

• Display your Oura data on your personal Inwardly dashboard
• Show relevant metrics to your connected coach (if applicable) to facilitate coaching conversations

Product Improvement

• Use anonymized and aggregated data to improve Inwardly features
• Understand how users interact with biometric data within the app
• Develop better body awareness training methods

Important: We do not use your data for advertising, marketing, or any purpose outside of improving your Inwardly experience.

6. Data Storage

Your Oura data is stored securely in our infrastructure:

• Database: Firebase/Firestore
• Encryption: Encrypted at rest using industry-standard encryption protocols
• Location: Servers located in the United States
• Access: Access to your data is restricted to authorized Inwardly team members and systems only

We implement strict access controls to ensure your data is only accessed when necessary to provide Inwardly's services.

7. Data Sharing

We do not sell, trade, or share your personal data for advertising or commercial purposes.

Your Oura data may be shared in the following limited circumstances:

Connected Coach

• If you have an assigned coach within Inwardly, relevant metrics are visible on their coach dashboard to facilitate personalized coaching conversations
• Your coach is bound by confidentiality agreements and can only view data related to coaching

Infrastructure Partners

• Firebase and related Google Cloud services handle data storage and processing
• These partners operate under strict data processing agreements

Aggregated and Anonymized Data

• We may use aggregated, anonymized data to understand population-level patterns in body awareness
• This data cannot identify you and is used only for research and product improvement

Legal Requirements

• We may disclose your data if required by law, court order, or government request
• We will notify you of such requests whenever legally permitted to do so

8. Data Retention

During the Beta Program: Your Oura data is retained for the duration of the beta program plus an additional 30 days after the program concludes or your participation ends.

Deletion on Request: You can request deletion of your data at any time by contacting support@goinwardly.com. We will delete your Oura data and associated insights within 30 days of your request.

Automatic Deletion: If you disconnect your Oura account from Inwardly, historical data will be retained according to the beta program schedule but will no longer be updated with new information from your Oura Ring.

9. Your Rights

You have the following rights regarding your data:

Right to Access

• You can request a copy of all your data that Inwardly has collected from Oura

Right to Correct

• You can request corrections to inaccurate data
• Note: Oura biometric data is automatically collected and cannot be manually edited within Inwardly

Right to Delete

• You can request deletion of your Oura data and all associated insights

Right to Disconnect

• You can disconnect your Oura account from Inwardly at any time without penalty

Right to Data Portability

• You can request your data in a machine-readable format

To exercise any of these rights, contact us at support@goinwardly.com and include your full name and a clear description of your request.

10. How to Disconnect

You can disconnect your Oura account from Inwardly at any time through the app settings:

1. Open Inwardly on your device
2. Navigate to Settings
3. Select Wearable Devices
4. Find Oura Ring in your connected devices
5. Tap Disconnect
6. Confirm the disconnection

Once disconnected, Inwardly will stop pulling new data from your Oura Ring. Existing data will be handled according to our data retention policy.

You can also revoke Inwardly's access directly through your Oura account settings for additional assurance.

11. Security

We implement comprehensive security measures to protect your data:

Data in Transit

• HTTPS/TLS Encryption: All data transmitted between your device and Inwardly servers is encrypted using industry-standard HTTPS protocols

Data at Rest

• Encrypted Storage: Your Oura data is encrypted at rest in our Firebase/Firestore database

Authentication Tokens

• Secure Storage: OAuth tokens used to access Oura data are encrypted and stored securely
• Secret Manager: We use Google Cloud Secret Manager to protect sensitive credentials

Access Controls

• Only authorized Inwardly staff can access your data
• Access is logged and monitored
• We follow the principle of least privilege for all system access

While we implement robust security practices, no system is completely secure. If you become aware of a security vulnerability, please contact us at support@goinwardly.com.

12. Children

Inwardly is designed for adults and is not intended for users under 18 years of age. We do not knowingly collect data from children under 18. If we become aware that we have collected data from a minor, we will take steps to delete such data and terminate the child's account.

If you believe we have inadvertently collected information from a child, please contact us immediately at support@goinwardly.com.

13. Changes to This Policy

As part of our beta program commitment to transparency, we will provide 7 days advance notice of any material changes to this Privacy Policy. We will notify you of changes via:

• Email notification to your registered Inwardly account email
• In-app notifications
• Updates posted on our website

Your continued use of the Oura integration after the effective date of a revised policy constitutes your acceptance of the changes. We encourage you to review this policy regularly to stay informed about how we protect your privacy.

14. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or our privacy practices, please reach out to us:

We will respond to your inquiry within 14 business days.