Innsightful Privacy Policy
1. Introduction, Scope, and Important Health Notice
Innsightful, Inc. (“Innsightful,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information when you use our websites, mobile applications, wearable-enabled services, wellness programs, research-related activities, coaching or support services, and other online or offline services that link to or reference this Privacy Policy (collectively, the “Services”).
This Privacy Policy applies only to Services offered in connection with U.S.-based programs, studies, organizations, and operations. Services offered outside the United States will be governed by separate or supplemental privacy notices, consent materials, and terms appropriate to the applicable country.
The Services may support wellness, resilience, self-awareness, healthy lifestyle practices, research, program evaluation, and related informational or educational purposes. They are not medical care, mental health treatment, psychotherapy, diagnosis, crisis intervention, emergency monitoring, or emergency services. The Services are intended only for individuals who are at least 18 years of age and are not offered to minors.
2. Contact Us and Privacy Requests
If you have questions, concerns, or complaints about this Privacy Policy or Innsightful’s privacy, data-collection, data-use, or data-protection practices, you may contact us at:
privacy@innsightful.com
You may also use this contact information to report a potential security or privacy issue or to submit a request concerning your personal information, including a request to access, correct, delete, or obtain a copy of your information, or to withdraw consent or limit certain uses where required by applicable law.
Before responding to a request, Innsightful may take reasonable steps to verify your identity and confirm that the request relates to information associated with you. Innsightful will respond to requests as required by applicable law. Certain requests may be subject to legal exceptions or limitations, as described in the “Your Choices and Privacy Rights” section below.
3. Information We Collect
The information Innsightful collects depends on the Services you use and the program or research study in which you participate. We may collect information directly from you; from devices, applications, sensors, or integrations you authorize; automatically through your use of the Services; and, when applicable, from a sponsor, participating organization, or research partner for enrollment, eligibility, or program administration.
We may collect the following categories of information:
- Account, contact, and enrollment information
When you create an account, enroll in a program or research study, contact us, or use the Services, we may collect information such as your name, email address, phone number, username, login credentials, age or year of birth, organization or program affiliation, participant or study identifier, and information needed to confirm your eligibility or enrollment. - Communications and materials you provide
We may collect messages, comments, feedback, uploaded files, and other materials you choose to provide through the Services. If you communicate with Innsightful personnel, coaches, support staff, or program personnel, we may collect the content of those communications and related information. - Wellness, health-related self-report, and participation information
Depending on the Service, program, or research study, we may collect responses to questionnaires, surveys, and check-ins concerning topics such as stress, mood, anxiety, depression, trauma-related symptoms, substance use, resilience, fatigue, sleep, activity, coping, and functioning. We may also collect information about enrollment, attendance, completion of activities, engagement with the Services, and responses to program prompts or exercises. - Wearable, sensor, device, and physiological information
If you use or connect a wearable device, mobile device, sensor, or other supported technology, we may collect information such as device identifiers, device type, connection status, activity and sleep data, heart rate, heart rate variability, movement, physiological signals, sensor-derived measurements, and timestamps. - Task, research, and derived information
Some Services, programs, or research studies may present questionnaires, tasks, prompts, sounds, images, videos, or other materials designed to measure attention, cognitive performance, emotional response, stress, fatigue, or related outcomes. Innsightful does not collect images or video of participants through these activities. We may collect participants’ responses, task performance, timing information, response patterns, physiological or sensor-derived responses, speech-related features or metrics, and other measurements described in the applicable Data Collection Notice or consent materials.
Some activities may temporarily capture or process voice or audio to generate measurements or derived information. Innsightful does not use voice or audio information to identify or authenticate individuals and does not create voiceprints or speaker-identification templates. Raw voice or audio recordings are not retained after the applicable processing is completed.
- Payment and billing information
If you purchase or pay directly for the Services, Innsightful or its third-party payment processor may collect information needed to process the transaction, such as your name, billing address, payment method details, and transaction information. Innsightful does not directly store complete payment card numbers or security codes. Payment information processed by a third-party payment provider is also subject to that provider’s privacy practices. - App, device, log, and usage information
When you use the Services, Innsightful and its service providers may automatically collect information such as browser type, operating system, internet protocol address, device type and identifiers, app version, pages or screens viewed, interactions with the Services, referring and exit pages, timestamps, crash reports, and performance information. Cookies, software development kits, analytics tools, and similar technologies used for these purposes are described later in this Privacy Policy.
4. How We Use Information
Innsightful uses information only for the purposes described in this Privacy Policy, any applicable Data Collection Notice, and any consent materials presented to you. Depending on the Services you use, we may use information for the following purposes:
- To provide and support the Services
We may use information to create and manage accounts, confirm eligibility and enrollment, provide access to features, administer programs or research studies, deliver wellness content and activities, support coaching or program interactions, respond to questions, provide technical assistance, and maintain the operation of the Services. - To personalize your experience
We may use information about your preferences, activity, responses, and engagement to tailor content, prompts, feedback, and features made available to you. - To generate wellness-related information and feedback
Where applicable, we may use self-report, wearable, sensor-derived, physiological, task, and participation information to generate scores, trends, summaries, reports, or other insights related to wellness, resilience, stress, fatigue, activity, sleep, attention, emotional response, or related outcomes. - To conduct research, program evaluation, and service improvement
We may use information to evaluate the usability, engagement, safety, performance, and outcomes of the Services, programs, and research activities. Identifiable or coded information may be used for a research study when authorized by the applicable consent materials and study requirements. For secondary research or program evaluation outside a specific study, Innsightful uses aggregated or permanently deidentified information. - To develop and evaluate analytics, algorithms, and models
We may use aggregated or permanently deidentified information to develop, test, validate, and improve analytics, algorithms, models, measurement methods, and related technologies. Innsightful does not use directly identifiable participant information for these purposes unless specifically described and authorized through applicable research consent materials. - To process payments
If you purchase or pay directly for the Services, we may use billing and transaction information to process payments, maintain payment records, address billing questions, and prevent fraudulent transactions. - To communicate with you
We may use your contact information to send service-related messages, respond to inquiries, provide administrative notices, request feedback, and notify you about changes to the Services or this Privacy Policy. We may also send promotional communications where permitted by law, and you may opt out of those communications. - To protect security, comply with obligations, and address safety concerns
We may use information to maintain the security and integrity of the Services; detect and prevent fraud, misuse, technical problems, or security incidents; enforce applicable terms; comply with legal, contractual, or research obligations; and protect the rights and safety of Innsightful, users, or others. Innsightful does not monitor the Services for emergencies, but may use information to respond to a safety concern that comes to our attention.
5. How We Share Information
Innsightful does not sell personal information or consumer health data. We do not share personal information for cross-context behavioral advertising, and we do not use health, physiological, wellness, or research information for advertising.
Innsightful does not provide identifiable participant-level information to sponsors, employers, colleges or universities, military organizations or commands, healthcare organizations, program administrators, or research partners. These organizations may receive only aggregated or permanently deidentified information that is not reasonably capable of identifying an individual.
We may disclose information in the following limited circumstances:
- Within Innsightful
Authorized Innsightful employees, contractors, coaches, research staff, support personnel, and technical personnel may access information only as needed to provide, operate, secure, administer, evaluate, or support the Services and applicable programs or research studies. - With service providers acting on Innsightful’s behalf
We may disclose information to service providers that perform functions on our behalf, such as hosting and data storage, payment processing, communications, customer support, security, analytics, and research-support services. These providers may process information only as necessary to perform services for Innsightful and are subject to applicable contractual confidentiality, security, use, retention, and deletion requirements. They may not use identifiable participant information for their own independent purposes. - For legal, safety, and security reasons
We may disclose information when we reasonably believe disclosure is required by law, regulation, subpoena, court order, or other valid legal process; is necessary to investigate or respond to fraud, misuse, or a security incident; or is necessary to protect the rights, safety, or property of Innsightful, a user, or another person. Innsightful does not monitor the Services for emergencies but may act on a serious safety concern that comes to our attention. - In connection with a business transaction
If Innsightful is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction, information may be disclosed or transferred as part of that transaction, subject to applicable law and appropriate confidentiality and privacy protections.
6. Sponsors, Employers, Colleges and Universities, Military Organizations, and Program Administrators
Some Services may be offered through or in collaboration with a sponsor, employer, college or university, military organization, healthcare organization, research partner, or other program administrator. These organizations may help make the Services available, support enrollment, or establish program eligibility.
Innsightful does not provide these organizations with identifiable participant-level information, including wellness or health-related information, physiological data, questionnaire responses, coaching or support communications, task or emotional-response data, or app-use information.
Sponsors and program partners may receive aggregated, group-level, or permanently de-identified information, such as participation counts, engagement trends, completion rates, program outcomes, or technical performance information, provided that individuals are not reasonably identifiable.
7. Research Studies, Pilots, and Program-Specific Notices
Some Services may be offered as part of a research study, pilot program, evaluation, demonstration project, or sponsored deployment. Before participation, Innsightful will provide any additional notices or consent materials required for the applicable activity.
When informed consent is required for a research study, the study-specific consent materials will describe the study purpose and procedures, foreseeable risks or discomforts, potential benefits, compensation if any, confidentiality and data handling, retention, withdrawal rights, contact information, and any future research use of the information collected.
Participation in research is voluntary. Refusing to participate or withdrawing from a research study will not involve a penalty or loss of benefits to which you are otherwise entitled, although withdrawal may end your participation in that study. The applicable consent materials will explain what withdrawal means for information already collected.
Any program- or study-specific materials supplement this Privacy Policy and apply only to the relevant activity.
8. Aggregated, Permanently Deidentified, and Coded Information
Innsightful may create aggregated, permanently deidentified, or coded information from information collected through the Services.
Aggregated information combines information from multiple individuals so that it does not identify a particular person. Permanently de-identified information has been processed so that it is not reasonably capable of being associated or linked, directly or indirectly, with a particular individual, and any code, key, or other information that could reconnect the information to that individual has been destroyed or is no longer available. Coded or pseudonymized information does not directly identify an individual but can still be linked back to that individual using a separate code, key, or other information.
Innsightful treats coded or pseudonymized information as personal information and protects it accordingly. Coded information may be used internally for an applicable program or research study, subject to the relevant consent materials and study requirements. Innsightful does not provide coded information to sponsors, program partners, employers, colleges or universities, military organizations or commands, or other participating organizations.
Innsightful may use aggregated or permanently deidentified information for research, program evaluation, service improvement, analytics, development and evaluation of algorithms or models, reporting, scientific analysis, publications, presentations, and other business or operational purposes. Innsightful may disclose aggregated or permanently deidentified information to sponsors, research partners, or other organizations, provided that the information cannot reasonably be used to identify an individual.
Innsightful does not attempt to reidentify permanently deidentified information and maintains safeguards designed to prevent unauthorized reidentification.
9. AI, Algorithms, Analytics, and Automated Insights
Innsightful may use analytics, statistical methods, algorithms, machine learning, artificial intelligence, and similar technologies to operate, evaluate, personalize, and improve the Services; identify patterns; generate scores, trends, summaries, or wellness-related feedback; evaluate engagement and outcomes; and support research and program evaluation.
For general development, testing, validation, or improvement of algorithms and models, Innsightful uses aggregated or permanently de-identified information as described in Section 8. Identifiable or coded information may be used within a specific research study only when authorized by the applicable consent materials and study requirements.
Any automated scores, trends, feedback, summaries, or other outputs provided through the Services are for wellness, informational, research, or program-evaluation purposes. They are not medical diagnoses, clinical assessments, treatment recommendations, or emergency monitoring.
Innsightful does not use automated outputs to make employment, academic, disciplinary, command, insurance, eligibility, or legal decisions about individuals.
10. Cookies, Analytics, and Third-Party Technologies
Innsightful and its service providers may use cookies, software development kits, analytics tools, and similar technologies to operate and secure the Services, remember preferences, understand how users interact with the Services, measure engagement, improve performance, troubleshoot technical issues, and prevent misuse.
These technologies may collect technical and usage information described in Section 3, such as device and browser information, app interactions, pages or screens viewed, timestamps, referring pages, crash reports, and performance information. Analytics and technology providers process this information on Innsightful’s behalf and are not permitted to use identifiable information for their own independent purposes.
Innsightful does not use these technologies for cross-context behavioral advertising and does not use or disclose health, physiological, wellness, questionnaire, task, or research information for advertising.
If you connect or use a third-party device, application, or integration with the Services, that third party may collect and process information under its own terms, privacy policy, permissions, and settings. The Services may also contain links to websites, applications, or services that Innsightful does not operate or control. This Privacy Policy does not govern information collected directly by those third parties.
Where required by applicable law, Innsightful will provide appropriate choices or obtain consent before using certain cookies or similar technologies.
Where applicable law recognizes an opt-out preference signal, Innsightful treats a Global Privacy Control (GPC) or similar universal opt-out signal received through a supported browser or platform as a valid request to opt out of the sale or sharing of personal information and of targeted advertising based on personal information collected through the Services. Innsightful does not engage in the sale of personal information or in cross-context behavioral advertising, and does not use health, physiological, wellness, questionnaire, task, or research information for advertising purposes.
11. Your Choices and Privacy Rights
Depending on where you live and the information involved, you may have the right to confirm whether Innsightful collects, shares, or sells consumer health data concerning you; access, correct, or delete personal information; obtain a copy of certain information and, where applicable, a list of third parties and affiliates with whom consumer health data has been shared or sold; withdraw consent from future collection or use; limit certain processing; or appeal a decision concerning a privacy request. Innsightful will not unlawfully discriminate against you for exercising an applicable privacy right.
- Account, device, and app choices
You may be able to review or update certain account information through the Services. You may stop some future data collection by changing device permissions, disconnecting a wearable device or integration, or uninstalling the application. These actions may limit the availability or functionality of certain Services and do not automatically delete information already collected. - Communication choices
You may opt out of promotional emails by following the unsubscribe instructions in those messages or by contacting Innsightful. You may continue to receive non-promotional communications concerning your account, security, program or study participation, transactions, or changes to the Services or this Privacy Policy. - Submitting a privacy request
You may submit a privacy request using the contact information in Section 2. Innsightful may take reasonable steps to verify your identity and the authenticity of the request. We will respond within 45 days of receiving a verifiable request, with a 45-day extension available where reasonably necessary under applicable law. We will provide notice if an extension is required. If Innsightful denies your request in whole or in part, you may appeal that decision by sending a written appeal to privacy@innsightful.com within 60 days of receiving the denial. Your appeal should reference the original request and describe the basis for the appeal. Innsightful will respond to appeals within 60 days of receipt with a written decision explaining the outcome and, if the appeal is denied, information about how to contact the applicable state attorney general or supervisory authority. - Withdrawal of consent and research participation
When processing is based on your consent, you may withdraw that consent from future collection or use. Withdrawal does not affect processing that occurred before the withdrawal and may prevent continued use of features that require the applicable information. Withdrawal from a research study is governed by the applicable consent materials, as described in Section 7. - Limits on requests
Innsightful may deny or limit a request only as permitted by applicable law. Information that has been permanently deidentified can no longer reasonably be linked to you and therefore cannot be accessed, corrected, or deleted as information associated with you. Other information may need to be retained when required or permitted by law or by applicable research, security, transaction, or recordkeeping obligations.
12. State-Specific Privacy and Consumer Health Data Rights
Certain information collected through the Services may be considered consumer health data or sensitive personal information under applicable state law. Where applicable, this Privacy Policy also serves as Innsightful’s consumer health data privacy policy and should be read together with any Data Collection Notice and consent materials presented to you.
The categories of consumer health data Innsightful collects and the sources of that data are described in Section 3; the purposes for which the data is collected and used are described in Section 4; disclosures and categories of recipients are described in Sections 5 and 6; and applicable consumer rights are described in Section 11.
When required by applicable law, Innsightful will obtain your separate, affirmative consent before collecting or using consumer health data or other sensitive information. Where the law requires separate authorization for sharing consumer health data, Innsightful will obtain that authorization before the sharing occurs.
Additional state-specific rights include the rights described in Section 11, such as access, correction, deletion, withdrawal of consent, receipt of a copy of certain information, and appeal of a privacy-request decision. You may exercise any applicable rights using the contact information in Section 2.
13. Data Retention
Innsightful retains identifiable personal information only for as long as reasonably necessary to provide the Services, administer the applicable program or research study, fulfill the purposes described in this Privacy Policy and applicable consent materials, comply with legal or contractual obligations, maintain security, and resolve disputes. When identifiable information is no longer needed for these purposes, Innsightful deletes it or permanently deidentifies it.
Innsightful applies the following retention periods:
- Account, contact, and enrollment information: Retained while your account is active or while you participate in the applicable Service, and for 3 months afterward.
- Wellness, physiological, task, and participation information: Retained in identifiable or coded form for 3 months after completion of the applicable program or study, unless a different period is disclosed in applicable research consent materials or required by law. After that period, the information is deleted or permanently de-identified.
- Coded research information: Retained for the period described in the applicable research consent materials and study requirements. When the ability to reconnect the information to an individual is no longer needed, Innsightful destroys the code or key and takes any other steps necessary to permanently deidentify the remaining information or deletes the information.
- Payment and transaction information: Retained for 6 months after the transaction, or longer when required for tax, accounting, fraud-prevention, or other legal purposes.
- Technical, usage, and security information: Retained for 3 months, unless a longer period is reasonably necessary to investigate a security incident, prevent misuse, or comply with law.
- Raw voice or audio recordings: Not retained after the applicable processing is completed.
- Backup copies: Information deleted from active systems may remain temporarily in backups until it is overwritten or deleted through Innsightful’s ordinary backup cycle, which generally occurs within 3 months. Consumer health data subject to an authenticated deletion request will be deleted from archived or backup systems within six months after authentication of the request, or sooner when required by applicable law.
Aggregated and permanently de-identified information may be retained for research, program evaluation, service improvement, analytics, algorithm or model development, reporting, scientific analysis, and other purposes described in this Privacy Policy. Innsightful does not attempt to reconnect permanently deidentified information to an individual.
Deletion requests are handled as described in Section 11 and applicable law.
14. Security
Innsightful maintains reasonable administrative, technical, physical, and organizational safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, loss, or destruction. Access to personal information is limited to authorized personnel and service providers who need the information for permitted purposes and are subject to applicable confidentiality and security obligations.
Innsightful also maintains procedures for identifying, investigating, and responding to potential security incidents. If a security incident affects personal information, Innsightful will provide notice to affected individuals, regulators, or other parties when required by applicable law.
No method of transmission, network connection, or electronic storage is completely secure. Although Innsightful takes reasonable steps to protect information, we cannot guarantee that unauthorized access, disclosure, loss, misuse, or alteration will never occur.
If you believe your account, information, or the Services may have been compromised, or you wish to report a potential security issue, contact us at: security@innsightful.com.
15. Changes to This Privacy Policy
Innsightful may update this Privacy Policy from time to time. When we do, we will make the revised Privacy Policy available through the Services and update the “Last Updated” date.
If a change materially affects your privacy rights or Innsightful’s collection, use, or disclosure of personal information, we will provide additional notice before the change takes effect, such as by email, an in-app notice, or another appropriate method.
Where applicable law requires affirmative consent for a new collection, use, or disclosure of information, Innsightful will obtain that consent before applying the change. Continued use of the Services does not substitute for consent when consent is legally required.