Privacy Policy

Version 2.1. 11 September 2026.

October Health Limited operates and maintains a website (located at https://october.health) (the “Site”) and the October online platform, which provides predictive and proactive mental health support and resources for high performing staff and human resource teams (the “Platform”). The Platform includes a 24/7 live data platform that provides real-time business intelligence on employee mental wellness, team and corporate culture and performance with actionable insights (the “Data Portal”), employee-facing mobile application (the“Mobile App“) which includes self-guided content, live, audio-only, proactive, interactive, digital, psycho-educational and support group sessions and other coaching and companionship services generated by artificial intelligence (collectively with the Site, the “Services” or “Service”). The Mobile App is published as "October Health" by October Health Limited, a company registered in England and Wales (company number 13365509), 2nd Floor, 168 Shoreditch High St, London E1 6RA, United Kingdom.

This Privacy Policy explains what personal information we collect from individuals who use our Mobile App and other individuals, such as representatives of our business customers, whose interactions with us include browsing our Site, subscribing to our newsletters or other communications, or interacting with us on social media. We refer to all of these individuals collectively as “users” or“you”. This Privacy Policy explains how we handle your personal information and your choices regarding our data practices.

This Privacy Policy does not apply to personal information pertaining to authorized users of the Data Portal or information that your employer, insurer, or related institution provides us to verify your eligibility for and facilitate your access to the Platform (such as your name, email address, and relationship to the organization). We process this information as instructed by our customers, in our capacity as a service provider/data processor, in accordance with the terms of our customer agreements.

Any reference in this Privacy Policy to "October", "we", "us" or "our" is a reference to October Health Limited, a company incorporated in England and Wales (company number 13365509) whose registered office is at 2nd Floor, 168 Shoreditch High Street, London E1 6RA, and to its subsidiaries from time to time (each an "October group company"). October Health Limited is the controller of, and is responsible for, the personal information described in this Privacy Policy. Its subsidiaries process that information on its behalf and in accordance with this Privacy Policy.

Personal Information We Collect

We collect the following categories of personal information about you:

Information you provide to us:

• Contact information that you provide when you sign up for our newsletter or contact us about our Services, such as your first and last name, email and mailing addresses, and phone number.
• Account information that you provide when you create an account on our Mobile App, such as your username, password, age range, selected interests, and your profile picture and gender information if you voluntarily choose to provide it.
• Health and wellness information and other user content that you may choose to provide when you use the Mobile App, including any text or audio information that you upload. For example, you may choose to provide information about your mental health and well-being when you use our AI-powered coaching tool, share comments in the Forest (being October’s core peer support community feature within the Mobile App), or write in your October journal. Where required by applicable law, we will collect this information only with your consent.
• Fitness module (opt-in). If you choose to participate, you may connect a device/app and share activity data in the Mobile App. You can also choose to provide additional health/wellness inputs for your own use in-app (e.g., weight, BMI, body composition, sleep, steps, exercise, heart rate, location or other biometrics).
• Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.
• Marketing information such as your preferences for receiving our marketing communications and details about your engagement with them.
• Other information not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Information we obtain from cookies and other automated technologies, such as information about the devices you use to engage with our Services, and online activity data. For more details about the technologies we use, the categories of information we collect, and how we use this information, please review our Cookie Policy.

Information we obtain from other sources:

• Social media. We may maintain pages on social media platforms, such as X, LinkedIn, and other third-party platforms. When you visit or interact with our pages on those platforms, the platform provider’s privacy policy will apply to your interactions and their collection, use and processing of your personal information. You or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.
• Connected health platforms (opt-in). If you choose to link health data from your Huawei, Apple or Android device, we receive only the categories you have authorised and as set out under Connected health platform data. These may include steps, exercise minutes, workout duration, heart rate and sleep duration for delivery of the Services, We may also receive limited technical metadata (e.g., device type, sync timestamps) needed to operate the connection.
• Other sources. We may obtain personal information from other third parties, such as marketing partners, publicly available sources, and data providers.

How We Use Personal Information

We use personal information for the following purposes or as otherwise described at the time of collection:

To provide our Services. We use personal information to operate, maintain, and provide you with our Services. In particular, we use personal information to perform our contractual obligations under our terms of service, except where consent is required under applicable law.

To communicate with you about our Services. It is in our legitimate business interests to use personal information to respond to your requests, provide customer support, and communicate with you about our Services, including by sending announcements, updates, security alerts, and support and administrative messages.

To improve, monitor, personalize, and protect our Services. It is in our legitimate business interests to improve and keep our Services safe for our users, which includes:

• Understanding your needs and interests, and personalizing your experience with the Services and our communications.
• Troubleshooting, testing and researching, and keeping the Services secure.
• Investigating and protecting against fraudulent, harmful, unauthorized, or illegal activity.

Employer-Mandated Learning & Development (L&D) Activities. For certain employer-mandated activities—such as coaching courses, assessments, or training sessions—October Health may track attendance and provide a list of participating company email addresses to the employer strictly for verification purposes. This applies only to designated L&D or engagement activities. No usernames, pseudonyms, engagement details, health information, or personal insights will be disclosed.

Gamification & Public Display. At October Health, we use a few fun features like leaderboards, streaks, and activity highlights to help make wellness feel more engaging and motivating. These are all about celebrating small wins and encouraging friendly interaction—not about competition or pressure. To keep things social, your chosen display name (nickname) might be visible to others in features like leaderboards, Forest sessions, and friend suggestions. You’re always in control: you can set a nickname that feels comfortable and there's no need to use your real name if you prefer not to. Plus, joining in on these features is completely up to you. We’re here to create a positive, supportive space where everyone can feel good about showing up for their mental health—however it suits them best.

For research and development. We may use personal information for research and development purposes where it is in our legitimate business interests, including to analyze and improve the Services and our business. As part of these activities, we may create or use aggregated, de-identified, or other anonymized data from personal information we collect. We make personal information into anonymized data by removing information that makes the data personally identifiable to you. We may use this anonymized data and share it with third parties, such as your employer or related institution, for our lawful business purposes, including to analyze and improve the Services and promote our business.

For marketing and advertising, including for:

• Direct marketing. We may send you direct marketing communications as permitted by law, including by email. You may opt-out of our marketing communications as described in the Opt-out of marketing communications section below. Except where consent is required, we undertake such marketing on the basis of our legitimate business interests. Where we seek your consent, you may withdraw your consent at any time.
• Interest-based advertising. We use cookies and similar technologies to engage in interest-based advertising. Please review our Cookie Policy for more information. Where required by applicable law, we will engage in interest-based advertising only with your consent.

For compliance and protection. We may use personal information to comply with legal obligations, and it is in our legitimate business interests to enforce our terms of service and to defend our business against legal claims or disputes, including to:

• Protect our, your, or others’ rights, privacy, safety, or property (including by making and defending legal claims).
• Audit our internal processes for compliance with legal and contractual requirements and internal policies.
• Enforce the terms and conditions that govern the Services.
• Prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks and identity theft.
• Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.

Personal Information Disclosure

How We Disclose Personal Information

We may disclose personal information to the following individuals or entities:

Service providers. Companies and individuals that provide services on our behalf or help us operate the Services of our business (such as hosting, information technology, customer support, email delivery, and website analytics services).

Advertising vendors. Third-party advertising companies, including for the interest-based advertising purposes described above, that can collect information on our website through cookies and other automated technologies. Please review our Cookie Policy for more information.

Professional advisors. Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.

Employers. If you access our Services as part of an employer-sponsored business package, we may need to verify your employment status to ensure your eligibility for continued access. To facilitate this, we may share your company email address with your employer or its designated representative for the sole purpose of confirming your active employment status. In addition, we may share information in the following instances:

• Aggregated and Anonymized Data: October Health shares aggregated and anonymized data with employers for purposes such as organizational insights and wellness tracking. This may include usage trends, feature engagement, or redemption activity. Such data does not identify any individual user.
• Leaderboard Data: If an employee user opts into the leaderboard, their name and related utilization metrics (e.g., sessions attended, coaching courses completed, assessments completed, and features utilized) will be visible on company-wide leaderboards accessible to other users and administrators of the employer organization. No underlying engagement content or individual input data is shared. Leaderboard data is kept wholly separate from any health-related or engagement-derived insights. We do not correlate session content or user responses with leaderboard standings.
• Employer Mandated Activities. October Health does not disclose personal information to your employer, insurer, or a similar related institution. In the case of employer-mandated Learning & Development (L&D) or engagement activities, such as coaching courses, assessments, pulse surveys, or training sessions, we may provide attendance or completion records associated with company email addresses to confirm participation. No pseudonyms, usernames, health data, or engagement details will be shared—only confirmation of attendance or completion for the required activity.
• Fitness Competitions & Top Performers (Opt-In; Limited Disclosure)
  • Definitions. “Fitness Metrics” means: (i) Daily Steps (count); (ii) Exercise Minutes (total active minutes per day); and (iii) Sleep Duration (hours/minutes per night). “Top Performers” means the top percentile cohort for a given competition period, as defined in the program rules.
  • Scope of sharing (Top Performers only). If you opt in to the fitness module and participate in an employer-run competition, October may disclose to your employer, for Top Performers only and limited to the applicable competition period:
    • the Fitness Metrics; and
    • the company email addresses of such Top Performers solely to verify results and administer rewards.
  • No other disclosures. October does not disclose any other health metrics (e.g., weight, BMI, body composition, heart rate, location, or other biometrics), engagement content, personal insights, or underlying session data for this purpose. Leaderboard data remains segregated from health-related insights and is not correlated with session content or user responses.
  • Consent & withdrawal. By connecting your device/app and opting in, you consent to the processing and limited disclosures above. You may withdraw at any time by disconnecting your device/app or disabling fitness participation in settings; upon withdrawal you will be removed from leaderboards/competitions and will not be eligible for awards tied to shared metrics.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above. While October may choose to make such a disclosure to law enforcement when requested or required by law, you acknowledge and agree that October has no obligation to disclose information regarding a user who is at high risk of committing suicide or harming others.

Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, our business (including, in connection with a bankruptcy or similar proceedings).

How You Disclose Personal Information

Other users. You may disclose personal information to other users of the Services. For example, you may participate in digital group sessions where you can learn, ask questions, and listen to others on topics from parenting to depression. You only disclose the personal information you voluntarily choose to provide.

Third-Party AI Technology

Our Platform leverages third-party AI technology provided by our service providers in connection with our website chatbot and AI coaching tool. The AI coaching technology is trained on real-world data to generate intelligent and personalized coaching and companionship. To enable us to provide you with these personalized services, we will share your personal information with the AI service providers that power our products. We require these providers to use your information only for the purpose of allowing us to provide our Services to you, and we do not allow the providers to train their AI models using your data.

Privacy Rights and Choices

Opt out of marketing communications. You may opt out of marketing-related emails and other communications by following the opt-out or unsubscribe instructions in the communications you receive from us or by contacting us as provided in the How to Contact Us section below. You may continue to receive Services-related and other non-marketing emails.

Opt out of push notifications. If you opt in to receive push notifications within the Mobile App, we may send push notifications or alerts to your mobile device from time to time. You can deactivate push notifications and alerts at any time by changing your device settings, changing the push notification settings within the application, or deleting the App.

Personal information requests. We also offer you choices that affect how we handle the personal information that we control. Depending on your location and the nature of your interactions with our Services, you may request the following in relation to personal information:

• Information about how we have collected and used personal information. We have made this information available to you without having to request it by including it in this Privacy Policy.
• Access to a copy of the personal information that we have collected about you. Where applicable, we will provide the information in a portable, machine-readable, readily usable format.
• Correction of personal information that is inaccurate or out of date.
• Deletion of personal information that we no longer need to provide the Services or for other lawful purposes.
• Withdrawal of consent, where we have collected and processed your personal information with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• Additional rights, such as to object to and request that werestrict our use of personal information.

Employee Rights and Choices

Employees participating in employer-mandated L&D activities acknowledge that their attendance or completion rates may be recorded and shared with their employer via their company email address for verification purposes. Employees will be clearly informed in advance if a session, course, or assessment falls under this requirement. Participation in all other October Health services remains fully anonymous and confidential.

To make a request, please email us or write to us as provided in the How to Contact Us section below. We may ask for specific information from you to help us confirm your identity. Depending on where you reside, you may be entitled to empower an authorized agent to submit requests on your behalf. We will require authorized agents to confirm their identity and authority, in accordance with applicable laws. You are entitled to exercise the rights described above free from discrimination.

Limits on your privacy rights and choices. In some instances, your choices may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights. If you are not satisfied with how we address your request, you may submit a complaint by contacting us as provided in the How to Contact Us section below. Depending on where you reside, you may have the right to complain to a data protection regulator where you live or work, or where you feel a violation has occurred.

Other Sites and Services

Our Services may contain links to websites and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions. This Privacy Policy does not apply to such third-party sites or services.

Security

We use reasonable organizational, technical, and administrative measures designed to protect against unauthorized access, misuse, loss, disclosure, alteration, and destruction of personal information we maintain. Unfortunately, data transmission over the Internet cannot be guaranteed as completely secure. Therefore, while we strive to protect your personal information, we cannot guarantee the security of personal information.

Retention of Personal Information

Where required under applicable laws, we retain personal information only for as long as is necessary to fulfill the purposes for which it was collected and processed, in accordance with our retention policies, and in accordance with applicable laws and regulatory obligations or until you withdraw your consent (where applicable).

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of personal information, the purposes for which we use personal information and whether we can achieve those purposes through other means, and the applicable legal and regulatory requirements.

Job Applicants

When you visit the Careers portion of our Site, we collect the information that you provide to us in connection with your job application. This includes but is not limited to business and personal contact information, professional credentials and skills, educational and work history, and other information of the type that may be included in a resumé. This may also include diversity information that you voluntarily provide and that we process on the basis of your consent. We use this information on the basis of our legitimate business interests to facilitate our recruitment activities and process employment applications, such as by evaluating a job candidate for an employment activity, to monitor recruitment statistics, and to respond to surveys. We may also use this information to provide improved administration of the Services and as otherwise necessary (i) to comply with relevant laws or to respond to subpoenas or warrants served on us, (ii) to protect and defend our or others’ rights or property, (iii) in connection with a legal investigation and (iv) to investigate or assist in preventing any violation or potential violation of the law, this Privacy Policy or our terms.

Children

The Services are not intended for use by children under 16 years of age. Children between the ages of 16-18 affirm that they have obtained the approval of their parent or guardian to utilize the Mobile Application, where required by law. If we learn that we have collected personal information through the Services from a child without the consent of the child’s parent or guardian as required by law, we will delete it.

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Where we do so, we will update the version number and effective date of this Privacy Policy and post it on the Site and in the Mobile App.

Where we make material changes to the usage, processing, or storage of health data, or changes affecting data received from a connected health platform, we will present the new version to you in the Mobile App and ask you to accept it before you continue to use the Service. We will not treat your continued use of the Mobile App as acceptance of these material changes.

For all other changes, we will notify you by reasonable means.

How to Contact Us

Responsible entity. October is the entity responsible for the processing of personal information under this Privacy Policy (as a controller, where provided under applicable law).

Contact us. If you have any questions or comments about this Privacy Policy, our privacy practices, or if you would like to exercise your rights with respect to your personal information, please email us at help@october.health or write to us at:

October Health
2nd Floor, 168 Shoreditch High St
London, E16RA

COOKIE POLICY

This Cookie Policy explains how October (“we”, “our”, or“us”) uses cookies and similar technologies in connection with our Services. This Cookie Policy should be read in conjunction with our Privacy Policy.

If you have any questions or concerns about the Cookie Policy, please contact us at help@october.health or as otherwise described in our Privacy Policy.

What are cookies and similar technologies?

• Cookies are text files that websites store and access on a visitor’s device to uniquely identify the visitor’s browser or to store information or settings in the browser to allow us distinguish you from other users of our Services for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, helping us understand activity and patterns, and facilitating online advertising.
• Local storage technologies, like HTML5, provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications.
• Web beacons, also known as pixel tags or clear GIFs, are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.

This Cookie Policy refers to all these technologies, and other types of tracking technologies used through our Services, collectively as “cookies”.

How do we use cookies and other similar technologies?

We use both persistent cookies and session cookies. Persistent cookies stay on your device for a set period of time or until you delete them, while session cookies are deleted once you close your web browser. We use persistent cookies, for example, to record your choice of language and country location. The cookies placed through your use of our Site are either set by us (first-party cookies) or by a third party at our request (third-party cookies).

We also allow our advertising partners to collect this information through our Site.

What types of cookies and similar technologies do we use?

We use the following categories of cookies:

Essential cookies: These cookies are required to enable basic website functionality. They cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the Services may not work.

Advertising cookies. These cookies are used to deliver advertising that is more relevant to you and your interests. They may also be used to limit the number of times you see an advertisement and measure the effectiveness of advertising campaigns.

Functional cookies. These cookies allow the Site to remember choices you make (such as your user name, language, or the region you are in) and provide enhanced, more personal features.

Analytics cookies. These cookies help us understand how the Site performs, how visitors interact with the Site, and whether there may be technical issues.

Analytics and Advertising

We use analytics services, such as Google Analytics, to help us understand how users access and use the Site. In addition, we work with agencies, advertisers, ad networks, and other technology services to place ads about our products and services on other websites and services. For example, we place ads through Google and Facebook that you may view on their platforms as well as on other websites and services.

As part of this process, we may incorporate tracking technologies into our own Services as well as into our ads displayed on other websites and services. Some of these tracking technologies on our Site and within our emails and advertisements may track your activities across time and services for purposes of associating the different devices you use, and delivering relevant ads and/or other content to you.

How can you control the use of cookies?

Depending on where you access the Site from, you may be presented with a cookie banner or other tool to provide permissions prior to non-Essential cookies being set. In this case, we only set these non-Essential cookies with your consent.

You can also limit online tracking by:

• Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.

Use the following links to learn more about how to control cookies and online tracking through your browser:

• Firefox;Chrome; Microsoft Edge; Safari (Mac); Safari (Mobile/iOS)
• Blocking advertising ID use in your mobile settings Your mobile device settings can provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
• Using privacy plug-ins or browsers. You can block our Site from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third party cookies/trackers.
• Advertising industry opt out tools You can also use these opt out options to limit use of your information for interest-based advertising by participating companies:
  • Digital Advertising Alliance for Websites: https://optout.aboutads.info/ and https://www.aboutads.info/appchoices (for mobile opt outs);
  • Network Advertising Initiative: optout.networkadvertising.org
• Platform opt-outs. Some of our advertising partners offer opt-out features that let you opt out of use of your information for interest-based advertising, including:
  • Google
  • Facebook
• Mobile App technologies You can stop all collection of information via our Mobile App by uninstalling the App. For Apple iOS, we will only receive access to your device's Ad ID (known as an IDFA) if you provide consent. You can reset your device's Ad Id at any time through your device settings, which is designed to allow you to limit the use of information collected about your device.

Please be aware that if you disable or remove tracking technologies some parts of the Services may not function correctly.

Note that because these opt out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use.

Do Not Track. Some Internet browsers can be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Legal Basis for Processing
We process personal information on the following legal grounds:

• Account registration & service delivery
  Data: Contact information, account details, health/wellness inputs
  Purpose: To create and maintain your account, provide access to our app, personalize support
  Legal basis: Contract (Art. 6(1)(b) GDPR)
• AI-powered coaching, journaling, Forest sessions
  Data: Health and wellness information, user content, audio/text inputs
  Purpose: To provide proactive mental health support, workplace support
  Legal basis: Explicit Consent (Art. 9(2)(a))
• Connected devices / fitness data
  Data: Activity, biometrics, device metadata
  Purpose: To deliver optional fitness tracking and competitions
  Legal basis: Consent (Art. 6(1)(a); Art. 9(2)(a))
• Communications (support, service updates)
  Data: Contact details, account info
  Purpose: To respond to enquiries, send security or admin notices
  Legal basis: Legitimate Interests (Art. 6(1)(f)) or Contract
• Marketing & newsletters
  Data: Contact details, engagement metrics
  Purpose: To send promotional communications
  Legal basis: Consent (opt-in) or Legitimate Interests (opt-out model, where permitted)
• Employer-mandated learning & development reporting
  Data: Company email, attendance/completion records
  Purpose: To verify participation in mandatory training
  Legal basis: Legitimate Interests (employer verification)
• Analytics & service improvement
  Data: Usage data, device data, anonymized insights
  Purpose: To maintain, secure, and improve services
  Legal basis: Legitimate Interests
• Compliance & legal obligations
  Data: All categories where relevant
  Purpose: To comply with laws, respond to authorities, enforce rights
  Legal basis: Legal Obligation (Art. 6(1)(c))

Categories of Data Collected

• Identity & Contact: name, email, phone, address
• Account Information: username, password, age range, preferences
• Special Categories (sensitive data): health and wellness information, mental health disclosures, biometrics (if opted in)
• Device & Technical: device IDs, IP addresses, cookies, activity logs
• Employment-Linked: company email, attendance in employer-mandated activities
• Engagement Data: journaling entries, group participation, leaderboard stats (optional)

International Data Transfers

October Health primarily stores and processes personal information in the United States, with limited processing in the United Kingdom and South Africa. This means that your information may be transferred outside of your home country.

When we transfer personal information internationally, we take steps designed to ensure that it receives an appropriate level of protection, including through:

• Requiring our service providers to implement contractual commitments and security safeguards consistent with applicable privacy laws
• Using encryption, access controls, and monitoring to protect information during transfer and storage
• Where applicable, relying on frameworks such as Standard Contractual Clauses (SCCs) or other legally recognized mechanisms for cross-border data transfers
• POPIA Section 72 measures for South African data transfers, ensuring the recipient jurisdiction has adequate protection or that appropriate contractual safeguards are in place
• Technical safeguards such as encryption at rest and in transit, strict access controls, and audit logging

You can request a copy of the relevant transfer safeguards by contacting us at legal@october.health

Connected health and fitness platforms

This section applies to health and activity data that October receives from a connected health platform, where you have chosen to link one to the Mobile App. It applies to every connected health platform we support. Except as expressly provided in this section, these restrictions take precedence over any broader permissions to use or disclose information elsewhere in this Privacy Policy, including provisions concerning research, advertising, aggregated data, anonymised data, and disclosures to employers.

Platforms we support.

On iOS we receive data from Apple Health (HealthKit). On Android we receive data from Google Health Connect. On Huawei devices that do not have Google services, we receive data from HUAWEI Health, through HUAWEI Health Service Kit. We do not connect directly to Samsung Health, Fitbit, Garmin or any other health platform. If you have linked one of those apps to Google Health Connect, data it writes to Health Connect may reach us through Health Connect, in the categories you have authorised. If we add a further platform, we will update this section and the version of this Privacy Policy, and we will ask for your authorisation before receiving any data from it.

What we receive, and why each category is necessary.

We receive four categories, and we receive each of them from each of the platforms listed above. We receive only the categories you have authorised, on a per-category basis, and only for the purposes stated below.

Step count

Received as daily totals. We use it to show your movement against a daily goal in the Health & Fitness hub, as an input to the personalised guidance and recommendations we show you, and to unlock step-based challenge content. If you opt in to the fitness module, we also use it to calculate your position in a company leaderboard. We need this category because it is the only measure of ordinary daily movement available to us, and it cannot be derived from heart rate, sleep or workout data.

Heart rate

Received as individual timestamped readings. We use it for two purposes only: to show you your own readings and trends in the Health & Fitness hub, and to inform the personalised guidance and recommendations we give you there. It is never used in a leaderboard or challenge, is never disclosed to your employer, and is not used for any other purpose. We need this category because it is the only physiological signal we receive, and step, sleep and workout data do not substitute for it.

Sleep

Received as individual sleep sessions, which include when each period of sleep began and ended. We use it for two purposes only: to show how much you have slept against a nightly goal in the Health & Fitness hub, and to inform the sleep-related guidance and recommendations we give you there. It is never used in a leaderboard or challenge, is never disclosed to your employer, and is not used for any other purpose. We need this category because no other category records when or for how long you slept.

Workout duration (exercise minutes)

Received as daily totals. We use it to show time spent in deliberate exercise against a weekly goal, to distinguish structured exercise from incidental movement when generating activity guidance, and to unlock exercise-based challenge content. If you opt in to the fitness module, exercise minutes are one of the leaderboard metrics. We need this category because step count alone cannot distinguish a workout from ordinary movement through the day, which would produce inaccurate guidance.

How and when we collect it.

Before any operating system permission prompt appears, we ask for your permission in the Mobile App itself. If you decline, no data is collected and every sync is blocked. If you agree, your device then asks you to confirm which categories we may read, and we receive only those you allow. Where you have given permission, we collect data when you open the Mobile App, when you open a leaderboard screen, when you ask us to sync, periodically in the background, and when your device notifies us that new data is available, in each case while the Mobile App is installed and your permission remains in place. We only read from a connected health platform. We do not write, modify or delete any data in Apple Health, Google Health Connect, HUAWEI Health, or any other connected health platform. If you do not authorise a category, only the features that depend on it are unavailable; the rest of the Mobile App works normally.

Not a medical device.

The Mobile App is not a medical device. Data we receive from a connected health platform is shown to you for information only. It is not a medical measurement or a diagnosis, it is not a substitute for assessment by a qualified healthcare professional, and it must not be used as a basis for medical diagnosis or any other medical decision. Readings taken by a consumer device or phone may be inaccurate or incomplete. Where a connected device includes features that are regulated in their own right, those features are the manufacturer's and the manufacturer's own information about them applies, not this Privacy Policy. Our Terms of Service explain that October does not provide medical services or medical advice.

Storage, retention and protection.

Data received from a connected health platform is uploaded to our servers and stored in our primary database, operated by Amazon Web Services in the us-east-1 region, United States. We do not store the readings themselves on your device: the Mobile App holds them only in memory for as long as is needed to display and transmit them, and retains only the bookkeeping records needed to know what has already been synced. Data held within the connected platform itself stays on your device or in that provider's account and is governed by that provider's terms and privacy policy, not by this Privacy Policy. Backups are retained for 30 days, save for certain backups which are retained for 12 months. This data is stored against your account identifier and is therefore identifiable. The safeguards described under International Data Transfers above apply to it, including encryption in transit and at rest, access controls and audit logging.

Sharing.

We do not disclose data received from a connected health platform to any third party for that third party's own purposes. We do not send any health reading to our analytics, product or error-monitoring providers; those providers receive only whether you granted or declined permission, which screens you visited, which platform you connected, and technical counts of how many records were synced. We do not use data received from a connected health platform, and do not permit any provider to use it, for marketing, advertising, interest-based advertising, audience building, measurement or other use-based data mining, or to create, train or improve artificial-intelligence or machine-learning models. The only exception is the disclosure described under Fitness Competitions & Top Performers (Opt-In; Limited Disclosure) above: if you opt in to the fitness module and to an employer competition, your daily steps and exercise minutes may be disclosed to your employer if you are a Top Performer for that competition period, together with your company email address, and you may withdraw at any time. Heart rate and sleep are never disclosed to your employer.

Withdrawing, and what happens to data already collected.

You can disconnect a connected health platform at any time in the Mobile App. You can also withdraw our access in the platform itself, using that platform's own privacy and permission settings: in Apple Health, under Sharing in the Health app or under Privacy & Security in iOS Settings; in Google Health Connect, under App permissions; and in HUAWEI Health, in the privacy settings under your profile. Each platform's own help pages give the current steps. Removing our permission in a connected platform stops us receiving further data, but it does not delete anything already held in that platform, which you can delete in the platform itself. When you disconnect we stop receiving further data immediately, and we ask you whether the data already collected should be kept or deleted. If you ask us to delete it we do so within 30 days in our live systems; residual copies in backups are removed as those backups expire. Your rights to access, export, correct and delete your personal information, and to withdraw consent, are set out under Privacy Rights and Choices above and apply to this data.

Authorisation and records.

We receive data from a connected health platform only on your explicit authorisation, given per category, with nothing selected on your behalf in advance. We keep a record of the version of this Privacy Policy and the Terms of Service you accepted, when you accepted them, and when you granted or withdrew authorisation for each category and each platform. Where we change this Privacy Policy in a way that affects this data, the renewed-consent process under Changes to This Privacy Policy applies.

Google Workspace data and Limited Use

This section applies to information received from Google Workspace APIs through October services, including October People. These restrictions take precedence over any broader permissions to use or disclose information elsewhere in this Privacy Policy, including provisions concerning research, advertising, aggregated data and anonymised data.

October's use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. This applies to raw, aggregated, anonymised and derived data alike.

We use Google Workspace data only to provide the user-facing features that you or your organisation authorise. We do not transfer, sell, or use this data to create, train or improve any artificial intelligence or machine learning model, beyond a model personalised to you for the specific feature you have authorised. Where an authorised feature uses an AI service, the same restriction applies to that service provider.

Google Workspace data and Limited Use

This section applies to information received from Google Workspace APIs through October services, including October People. These restrictions take precedence over any broader permissions to use or disclose information elsewhere in this Privacy Policy, including provisions concerning research, advertising, aggregated data and anonymised data.

October's use of information received from Google Workspace APIs, including raw, aggregated, anonymised and derived data, complies with the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements.

We use Google Workspace data only to provide the user-facing features that you or your organisation authorise. We do not use, transfer or sell this data to create, train or improve foundational or general-purpose artificial intelligence or machine learning models. Where an authorised feature uses an AI service, the same restrictions apply to that service provider: Google Workspace data must not be used for model training or other secondary purposes prohibited by the Limited Use requirements.