Summary
Haiven is operated by Haiven Labs LLC ("Haiven," "we," "us"). This policy explains what information we collect, how we collect it, how we use it, who we share it with, and the choices you have.
- Haiven collects what you write, what you self-report, and health metrics from wearables you choose to connect.
- We use an external AI provider — Anthropic (Claude) — to generate written insights, summaries, and report narratives. This requires your explicit, separate consent, and you can decline or withdraw it at any time.
- We never send raw wearable readings (such as heart rate variability, resting heart rate, or sleep measurements) to any AI provider. Only category labels derived by our own scoring engine are sent.
- We do not sell your personal information.
- You can withdraw consent, export, or delete your data at any time.
If you have questions about anything here, contact us at hello@haiven.co.
Information We Collect and How We Collect It
Information you provide directly
- Account details — email address, password credentials, and (optionally) your name, entered when you create an account
- Free-text you write — daily check-in entries, journal entries, and chat messages you type into the app
- Onboarding and values-profile answers, including free-text responses, entered during onboarding and the Foundations questionnaire
- Self-reported ratings and sliders used in daily check-ins
- Date of birth and demographic details, entered during onboarding
- Care-team preferences — for example, whether you see a provider and your session day — entered in your profile settings
- Payment information — collected and processed directly by Stripe; Haiven does not receive or store full payment card numbers
Information from wearables and health services you connect
If — and only if — you choose to connect a device or service, we receive health metrics from it. This is optional; Haiven works without any wearable connected.
- Oura — connected via OAuth authorization. We receive sleep, readiness, activity, and heart-rate data from Oura's service. Haiven does not pair with, connect to, or control the Oura ring itself; your ring syncs to Oura, and Haiven reads from Oura's service with your authorization.
- Apple Health (HealthKit) — with your permission, we read heart rate variability, sleep, resting heart rate, and step data from your device.
You can disconnect any of these at any time in the app, and revoke access from the provider's own settings (or, for Apple Health, in iOS Settings → Privacy & Security → Health).
Health Data
Haiven does not use Apple HealthKit data for advertising, marketing, or data-mining, and does not disclose HealthKit data to third parties for those purposes.
Information collected automatically
- Error and crash diagnostics — collected by Sentry, automatically when errors occur, to diagnose and fix problems
- Basic usage and app events — logged by our backend as you use the app, to operate and improve the service
Crash reports contain technical error data — the type of error, where in the app it occurred, and device or browser information — together with an internal account identifier. They never include journal text, messages, or health data: our error monitoring is configured to exclude request contents and in-memory variables from every report. Sentry is the only error-monitoring tool we use, and we use no advertising or product-analytics services.
How We Use Your Information
We use the information described above to:
- Create and maintain your account and authenticate you
- Compute your Signal scores, domain scores, trends, and history
- Generate written insights, summaries, and report narratives (see "Use of a Third-Party AI Service" below)
- Produce reports you can choose to share with a provider or practitioner
- Support practitioner features, if you are linked to a practitioner and have consented to that link
- Process payments and manage subscriptions
- Diagnose errors, maintain security, and improve the service
- Communicate with you about the service
- Comply with legal obligations
We do not sell your personal information, and we do not use it for advertising or behavioral targeting.
Use of a Third-Party AI Service (Anthropic)
This section describes data shared with a third-party AI provider, and is subject to your separate, explicit consent.
Haiven uses Anthropic's Claude models, accessed through Anthropic's API, to generate written content — insights, narrative summaries, report language, chat responses, and to help categorize the themes present in what you write.
What is sent to Anthropic
When you have granted AI data-sharing consent, the following may be transmitted to Anthropic:
- Text you have written — daily check-in entries, journal entries, chat messages, and free-text answers from onboarding and the values profile.
- Numeric wellness scores and trends computed by Haiven — your Signal score, domain scores, streaks, and changes over time.
- Category labels derived from wearable data — for example, sleep, recovery, or energy described as "high," "medium," "low," or "unclear."
What is never sent to Anthropic
- Raw wearable readings are never sent. Specific heart rate variability values, resting heart rate values, sleep scores, and readiness scores are not transmitted to Anthropic. These are processed by Haiven's own scoring engine, and only the resulting category label is included in any request.
- Direct identifiers are not sent. Requests to Anthropic do not include your name, email address, account identifier, date of birth, or payment information.
- Your data is not used to train AI models. Anthropic's Commercial Terms, which govern API use, state that Anthropic may not train models on Customer Content — which includes both what we send and what is returned.
Who receives it and for what purpose
The recipient is Anthropic, PBC, which processes the request and returns generated text. The purpose is limited to producing the insight, summary, narrative, or categorization you see in the app. Anthropic automatically deletes API inputs and outputs from its systems within 30 days, except where longer retention is required by law or to enforce its usage policies.
Anthropic's privacy practices are described at anthropic.com/legal/privacy.
Your consent, and what happens if you decline
We ask for your consent to AI data sharing before any of your content is sent, during onboarding. Consent is affirmative and separate — it is not bundled into our Terms of Service, and it is not pre-selected.
If you decline, Haiven continues to work. Specifically:
- Your total Signal score, Body domain score, and Signal history are computed entirely by Haiven's own proprietary algorithms and remain fully available.
- Your Mind and Behavior domain scores remain available, computed from your self-reported check-in responses alone. They do not incorporate the additional layer normally derived from your written entries, so they reflect a narrower set of inputs.
- Insights, summaries, and report text are generated by Haiven's own rule-based system instead, using plainer language.
- Deep Dive analysis is unavailable, because it cannot be produced without the AI service. You will see an explanation where it would normally appear.
You can change this decision at any time in your settings. Withdrawing consent takes effect immediately and stops further transmission of your content to Anthropic.
Sharing Your Information
We share information only as described here.
Service providers
We use the following providers to operate Haiven. Each is bound by contract to protect your information, to use it only to provide services to us, and to maintain protections at least equivalent to those described in this policy.
- Anthropic — AI text generation, as described above
- Supabase — database and authentication; account data, entries, scores
- Render — backend hosting; application processing
- Vercel — frontend hosting; application delivery
- Stripe — payments; payment and subscription data
- Sentry — error monitoring; technical error data and an internal user ID, never your written content or health data
- Oura, Apple — wearable data sources; health metrics you authorize
Subscription payments are processed through our website, not inside the mobile app.
Subprocessors used by our providers
The providers listed above engage their own subprocessors to deliver their services. Each is contractually required to impose data protection obligations on those subprocessors that are substantially equivalent to the obligations it owes us, and to remain responsible for their compliance. We receive advance notice of changes to authorized subprocessors and can object to them.
Practitioners you choose to link with
If you link your account to a practitioner, and separately consent to that link, the practitioner can see the information disclosed to you at the time of consent — protocol completion and signal information.
Your journal and check-in text is never shared with a practitioner without your explicit consent and approval. Where you choose to share written material, you control what is included — you may share selected excerpts, high-level summaries, or nothing at all, and Haiven works fully either way. You can revoke a practitioner link, or any individual share, at any time.
Reports you choose to share
When you generate a shareable report, you control whether written excerpts are included. Share links can be revoked by you at any time.
Legal and safety
We may disclose information if required by law, or where necessary to protect the rights, safety, or security of users, the public, or Haiven.
Business transfers
If Haiven is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.
Research Use
Separately from AI processing, we may ask for your consent to use irreversibly anonymized and aggregated information for research and product improvement — for example, to study which behavioral protocols tend to produce better outcomes across groups of people, and to improve how Haiven interprets patterns.
This is a distinct consent from AI data sharing, and declining it does not affect your use of Haiven in any way.
- Anonymized and aggregated means the information cannot be linked back to you or to any individual, and it is never combined with identifiers to re-identify anyone.
- We never sell or disclose raw individual data for research purposes.
- We do not use your information — including anonymized or derived information — to train, fine-tune, or develop artificial intelligence models.
- Where anonymized aggregate findings inform features or published insights, no individual's data is identifiable within them.
Because this information is irreversibly anonymized, it may be retained after account deletion as noted in "Data Retention" below. You can withdraw research consent at any time, which stops any further use of your information for these purposes.
Data Retention
We retain your information for as long as your account is active, so that your history, trends, and long-term patterns remain available to you — that continuity is a core part of what Haiven does.
When you delete your account, we remove your personal information from our production systems. Information that has been irreversibly anonymized and aggregated — meaning it can no longer be linked back to you or any individual — may be retained as described in "Research Use" above. If you request full deletion of your data, we will honor that request within 3–5 business days.
To request deletion, contact hello@haiven.co or use the in-app account deletion option.
Security
We protect your information using encryption in transit and at rest, access controls, row-level security on our database, and monitored infrastructure. No system is perfectly secure, but we work to protect your information and to respond promptly if a problem occurs.
Your Rights and Choices
Regardless of where you live, you can:
- Access the information we hold about you
- Correct inaccurate information
- Delete your account and associated data
- Withdraw consent for AI data sharing or research use at any time
- Disconnect any wearable or health service
- Revoke any share link or practitioner link
To exercise any of these, use the in-app settings or contact hello@haiven.co.
Haiven is offered to users in the United States and is not offered in the European Union or the United Kingdom. Depending on your state of residence, you may have additional rights under laws such as the California Consumer Privacy Act, including the right to data portability and the right to know what information we have collected about you.
Children
Haiven is not intended for anyone under 18, and we do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it. Our onboarding includes an age check.
Health Information
Haiven is a wellness product. It does not diagnose, treat, cure, or prevent any disease or medical condition, and it is not a substitute for professional medical advice. Information shown in the app is for your own reflection.
Haiven is not a covered entity or business associate under HIPAA, and does not operate under a Business Associate Agreement. Haiven is a direct-to-consumer wellness service; the information you provide is not protected health information held by a healthcare provider. If this changes — for example, if Haiven begins working directly with licensed healthcare providers in a way that creates HIPAA obligations — we will update this policy and notify you before that change takes effect.
Changes to This Policy
We may update this policy. If we make material changes — particularly to how your information is shared with AI providers — we will notify you in the app and, where required, ask for your consent again before the change takes effect.