Privacy policy

Introduction

At DreamPhones (operated by SoulHeal Technology), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, purchase our products (including DreamPhones headphones and the DreamPhones companion wellness ring), use the DreamApp mobile application, or otherwise interact with our services.

Because we collect health-related information such as sleep data, heart rate, heart rate variability (HRV), blood oxygen saturation (SpO2), and stress indicators, we maintain a separate Consumer Health Data Privacy Policy under the Washington My Health My Data Act and similar state laws. The same disclosures are summarized in the "Consumer Health Data" section below.

By using our services, you acknowledge this policy. Where the law requires your consent — for example, before we collect consumer health data or camera-based biometric measurements — we will ask for it separately in the app. Your use of our products and services is also governed by our Terms of Service.

Information We Collect

Information You Provide

We collect information you voluntarily provide when you:

• Create an account or make a purchase
• Subscribe to our newsletter
• Contact our customer support
• Participate in surveys or promotions

This may include your name, email address, shipping address, phone number, and payment information. Our online store is hosted by Shopify and payments are handled by third-party payment processors; we do not store your full payment card number.

Information Collected Automatically

When you visit our website, we automatically collect certain information about your device and browsing activity, including:

• Device type, browser type, and operating system
• IP address and general location
• Pages visited and time spent on our site
• Referring website or source

Information Collected Through the Mobile App

When you use the DreamApp (our mobile app for iOS and Android), we may collect:

• Device and session data: DreamPhones headset serial number, session duration, taVNS (transcutaneous auricular vagus nerve stimulation) intensity settings, and session history
• Chat messages: Conversations with Sophia, our AI wellness companion. Sophia uses ElevenLabs for the live conversational interface. After a conversation, DreamPhones may store a transcript and use OpenAI to generate a summary or wellness report requested through the service.
• Push notification tokens: Device tokens for delivering session reminders and wellness insights (with your permission)
• Bluetooth data: We use Bluetooth Low Energy (BLE) to communicate with your DreamPhones headset. On Android devices running version 11 and below, BLE scanning requires location permissions as a system requirement — we do not use this permission to track your location

Information Collected by the DreamPhones Headset

The DreamPhones headset communicates with the mobile app over Bluetooth Low Energy (BLE). It does not independently send your usage data to our servers. Data flows as follows:

• Via the app: The headset shares its serial number, battery level, stimulation status, and session data with the mobile app over BLE. The app then transmits relevant data to our servers as described in the "Information Collected Through the Mobile App" section above
• Firmware updates: The headset connects to our server solely to check for and download firmware updates. These checks transmit only the device serial number and current firmware version
• On-device storage: The headset stores settings locally (such as stimulation intensity preference, audio volume, and device name). This data stays on the headset and is not transmitted to our servers

Information Collected by the DreamPhones Ring

If you pair a DreamPhones companion wellness ring with the DreamApp, the ring may collect and share wellness metrics with the app, including heart rate, heart rate variability (HRV), blood oxygen saturation (SpO2), stress indicators, sleep duration, sleep timing, sleep stages, and related sleep summaries. The ring communicates with the app over Bluetooth. The app transmits relevant ring data to our servers only as needed to provide app features such as dashboards, trends, session insights, and reports.

How We Use Your Information

We use the information we collect to:

• Process and fulfill your orders
• Communicate with you about your purchases and account
• Send promotional emails and updates (with your consent)
• Improve our website, products, and services
• Prevent fraud and ensure security
• Comply with legal obligations

Apple Health, Android Health Connect, Ring Data, Sleep Data, and Camera Biometrics

When you use the DreamPhones mobile app, we may process health-related data and optional camera-based measurements to deliver app features.

Apple Health Data

• We only access Apple Health data after you grant permission in iOS.
• On iOS, we may request heart rate variability (HRV), resting heart rate, and sleep data to support session insights, wellness tracking, sleep trends, and session reports.
• You can revoke Apple Health access at any time in the Health app settings.

Android Health Connect Data

• On supported Android devices, we only access Health Connect data after you grant permission.
• We may read data such as HRV, resting heart rate, and sleep records to power the Health screen, sleep-related insights, and session reports.
• You can revoke Health Connect access at any time in Health Connect or Android settings.

DreamPhones Ring Data

• If you use the DreamPhones ring, we may process ring-generated wellness metrics such as heart rate, HRV, SpO2, stress indicators, sleep duration, sleep timing, sleep stages, and sleep summaries.
• We use ring data to provide app features such as wellness dashboards, sleep trends, session insights, and reports. Ring data is not used to diagnose, treat, cure, or prevent disease.
• You can stop future ring data collection by unpairing the ring, disabling Bluetooth permissions, or deleting your account.

Camera-Based Measurements (rPPG)

• Before the first capture, the app displays a written notice describing what is collected, why it is collected, how long it is retained, and how it is deleted. We obtain your electronic consent before using the front camera. The feature is entirely optional.
• The video is processed using remote photoplethysmography (rPPG) to estimate measurements such as heart rate and HRV. We do not use camera-based measurements for facial recognition or identity verification.
• Raw camera video is used only to calculate the requested measurements. Temporary processing copies are deleted after processing and no later than 24 hours after capture. Derived measurements such as heart rate and HRV are stored with your account as described under "Data Retention."
• We do not sell, lease, trade, or otherwise profit from camera video, face-related data, or derived camera measurements. We disclose them only with your consent, to service providers that process them for us under contract, or as required by law. You can revoke camera access at any time in your device settings; camera-based features will then be unavailable.

Use Restrictions for Health and Biometrics Data

• We use this data only to operate and improve DreamPhones features, including session personalization, wellness dashboards, sleep trend presentation, report generation, and service reliability.
• We do not sell Apple Health data, Health Connect data, ring data, sleep data, biometric measurements, or related personal data.
• We do not use Apple Health data, Health Connect data, ring data, sleep data, or biometric data for advertising, ad targeting, or cross-app/cross-site tracking.
• We do not share Apple Health data, Health Connect data, or ring data with data brokers or ad networks.

Consumer Health Data (Washington My Health My Data Act)

SoulHeal Technology is based in Washington State. This section is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act and applies to the "consumer health data" we collect. It is also published as a standalone Consumer Health Data Privacy Policy. Similar protections apply under comparable laws in other states.

Consumer Health Data We Collect

• Sleep data, sleep summaries, sleep stages, and sleep trends
• Heart rate, heart rate variability (HRV), blood oxygen saturation (SpO2), stress indicators, and camera-based (rPPG) measurements
• taVNS session data, such as session duration, intensity settings, and session history
• DreamPhones ring data, such as ring-generated heart rate, HRV, SpO2, stress, and sleep metrics
• Health-related information you choose to share in conversations with Sophia, our AI wellness companion
• Data you authorize us to read from Apple Health or Android Health Connect

Sources and Purposes

We collect consumer health data directly from you, from your DreamPhones headset and DreamPhones ring via the DreamApp, from your device's camera (with your permission), and from Apple Health or Health Connect (with your permission). We collect it only with your consent or to the extent necessary to provide a product or service you have requested, and we use it solely to deliver and improve the features described in this policy — session personalization, sleep and focus insights, wellness dashboards, and session reports — and for security, troubleshooting, and legal compliance.

How We Share Consumer Health Data

We do not sell consumer health data, and we will not sell it without the separate, signed authorization required by law. We do not send app health metrics, Sophia conversations, ring data, camera video, or session history to advertising networks or data brokers.

• Categories of consumer health data shared: account identifiers connected to app health data; headset, ring, session, sleep, rPPG, and derived wellness metrics; Sophia chat messages that contain health-related information; support, privacy, and troubleshooting requests that include health-related information.
• Categories of third parties: cloud hosting, database, security, and infrastructure providers; contracted AI/model infrastructure providers that help operate Sophia; app platform and device-permission providers when you choose Apple Health or Android Health Connect; e-commerce, payment, customer-account, shipping, and support providers when purchase or support information may reveal your interest in a wellness product; professional advisors, compliance vendors, and government authorities when required by law.
• Specific affiliates: none currently. SoulHeal Technology does not currently share consumer health data with any affiliated company.

Named Service Providers and Recipients

• Microsoft Corporation (Azure): hosts DreamPhones app infrastructure and may process account, device, session, and wellness data needed to operate the app.
• Eleven Labs Inc.: provides the live conversational interface for Sophia and may process voice, text, conversation metadata, and transcripts. Contact: ElevenLabs Privacy Policy.
• OpenAI, L.L.C.: may process Sophia conversation text to generate requested summaries or wellness reports. Contact: OpenAI Privacy Policy.
• Alibaba Cloud: provides object storage and communications infrastructure and may process uploaded files, account contact information, and service logs. Contact: Alibaba Cloud Privacy Policy.
• Apple Inc. and Google LLC: provide app distribution, sign-in, device permissions, and, when you enable them, Apple Health or Android Health Connect integrations.
• Shopify Inc., Klaviyo, Inc., and Formspree, Inc.: process storefront purchases, customer accounts, email communications, or event lead forms. They do not receive Sophia conversations, ring metrics, camera video, or app session history from us.
• Google LLC and Meta Platforms, Inc.: may receive public-storefront events such as device identifiers, pages viewed, and purchase or conversion events. They do not receive Sophia conversations, ring metrics, camera video, Apple Health data, Health Connect data, or app session history from us.

These providers act as processors or service providers for the purposes described above, except where they independently control data under their own terms. We require processors to use consumer health data only to provide contracted services. If we add a provider that will process a new category of consumer health data or use it for a new purpose, we will update this policy and obtain consent when required.

Sophia AI Processing

Sophia is an AI wellness companion, not a doctor or medical service. Sophia uses ElevenLabs for the live conversational interface. After a conversation, DreamPhones may retrieve and store a transcript and use OpenAI to generate a summary or wellness report requested through the service.

We do not use consumer health data or Sophia conversations to train our own general-purpose models. We configure or contract with our AI processors, where available, so that DreamPhones inputs are not used to train their general models. If that protection is unavailable for a feature, we will obtain separate consent before sending consumer health data for that feature.

Your Consumer Health Data Rights

• Right to know and access: confirm whether we collect, share, or sell your consumer health data, and access that data, including a list of the third parties with whom we have shared it
• Right to withdraw consent: withdraw your consent to our collection or sharing of your consumer health data at any time
• Right to delete: have your consumer health data deleted, including from our backups and by our service providers

To exercise these rights, email contact@dreamphones.ai or use our Delete My Data page. We will not discriminate against you for exercising them. If we deny your request, we will explain why, and you may appeal by replying to our decision. If your appeal is denied and you live in Washington, you may raise a concern with the Washington State Attorney General at www.atg.wa.gov.

Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy:

• Account data: Retained while your account is active. Deleted within 30 days of an account deletion request.
• Session history and VNS data: Retained while your account is active to power your health dashboard and session reports.
• Chat messages: Retained while your account is active to provide continuity in your wellness conversations. They are deleted within 30 days after account deletion unless a longer period is required for security, legal compliance, or dispute resolution.
• Health and camera-based data: Raw camera video is deleted after processing and no later than 24 hours after capture. Derived camera measurements, Apple Health data, Health Connect data, and ring-generated metrics such as heart rate, HRV, SpO2, stress indicators, sleep summaries, and session reports may be stored while your account is active; they are deleted within 30 days after account deletion unless a longer period is required by law.
• Push notification tokens: Retained while your account is active and notifications are enabled. Tokens are removed when you disable notifications or delete your account.

We instruct processors that hold your consumer health data to delete it when we honor a verified deletion request. Data in backups is deleted or made inaccessible on the backup-rotation schedule and no later than six months after verification, unless the law requires longer retention. We may retain anonymized, aggregated data that cannot identify you for analytics and service improvement.

Information Sharing

We do not sell your personal information for money. Our public storefront uses advertising and analytics tools that may constitute "sale," "sharing," or targeted advertising under some state laws. We may share your information with:

• Service Providers: Third parties who assist with payment processing, e-commerce hosting (Shopify), shipping, email delivery, cloud hosting, and analytics, under contracts that limit how they may use your data
• Business Partners: When necessary to provide you with products or services you have requested
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, and this policy will continue to apply to it

Consumer health data and biometric measurements are shared only as described in the "Consumer Health Data" section above.

Relationship with Shopify

Our online store is hosted by Shopify. Shopify processes information needed to provide the storefront, checkout, customer accounts, fraud prevention, and related commerce services. Shopify may act as our processor and may also process information under its own terms. Learn more in the Shopify Consumer Privacy Policy or submit a request through the Shopify Privacy Portal.

Cookies and Tracking

We use cookies and similar technologies to operate the storefront, analyze traffic, measure advertising, and remember preferences. Google Analytics and Meta may receive device identifiers, page views, and purchase or conversion events from the public storefront. We do not send app health metrics, Sophia content, ring data, camera video, or session history to these tools.

You can use our Your Privacy Choices page to opt out of activity that may be considered a sale, sharing, or targeted advertising. Our website also recognizes Global Privacy Control (GPC) signals and treats them as an opt-out request where required by law.

Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information and account
• Opt out of marketing communications
• Request data portability

To exercise any of these rights, please contact us using the information below. We may need to verify your identity before fulfilling a request. If we decline a request, we will explain why, and depending on where you live you may have the right to appeal our decision.

To request deletion of your account and all associated data, visit our Delete My Data page. Deletion requests are processed within 30 days.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. In the last 12 months we have collected the categories of personal information described in "Information We Collect" above: identifiers (such as name and email), commercial information (such as purchase history), internet activity, general location inferred from IP address, and sensitive personal information (the health and biometric measurements described above). Your rights include:

• The right to know what personal information we collect, use, and disclose
• The right to request deletion of your personal information
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information used for targeted advertising through our Your Privacy Choices page or a Global Privacy Control signal
• The right to limit the use of sensitive personal information — we use health and biometric data only to provide the services you request, not for advertising or profiling
• The right to non-discrimination for exercising your privacy rights

You may use an authorized agent to submit a request on your behalf; we will ask the agent for proof of authorization.

EU, EEA, and UK Residents (GDPR)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Contract: to fulfill orders, manage your account, and provide the app and services you request
• Consent: for health and biometric data, marketing emails, and optional features such as camera-based measurements — you can withdraw consent at any time
• Legitimate interests: to secure and improve our services and prevent fraud
• Legal obligation: to comply with tax, accounting, and other legal requirements

You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local supervisory authority (or, in the UK, the Information Commissioner's Office).

International Data Transfers

We are based in the United States, and your information is processed on servers in the United States, which may have data protection laws different from those in your country. Where required for transfers from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK equivalent) with our service providers.

Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including encryption of data in transit and access controls. However, no method of transmission over the internet is 100% secure.

If a data breach affects your personal information, we will notify you and the relevant regulators as required by applicable law, without undue delay.

Children's Privacy

Our services are not directed to children, and you must be at least 18 years old to create an account or make a purchase. We do not knowingly collect personal information from anyone under 18 — and in particular not from children under 13 (or the higher age that applies in your country), consistent with the Children's Online Privacy Protection Act (COPPA). If you believe a child has provided us with personal information, please contact us at contact@dreamphones.ai and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. If a change materially affects how we handle your personal information — especially consumer health data — we will provide more prominent notice (such as email or an in-app notice) and, where the law requires it, ask for your consent.