Holi Privacy Policy

Effective date: 01.07.2026 Last updated: 01.07.2026

Introduction

This Privacy Policy describes how Denis Rossiev ("we", "us", "our", or the "Operator") collects, uses, maintains, and discloses information when you use the Holi mobile application and related online services (the "Services"). Holi is an iOS application for health, nutrition, and longevity that combines your personal health data with an AI assistant to help you understand your body and progress toward your goals.

The Operator is the data controller responsible for your personal data under the EU General Data Protection Regulation ("GDPR") and other applicable data protection laws.

By accessing and using the Services, you accept and agree to this Privacy Policy. If you do not agree, you must not access or use the Services.

Because Holi processes sensitive health data, we ask for your explicit consent before collecting and processing such data. You can withdraw that consent at any time, as described below.

Personal Data We Collect

We collect information that identifies, relates to, describes, or could reasonably be linked to you ("Personal Data") in the following categories.

Account and Profile Data

Name and username
Email address
Sign in with Apple identifiers (when you choose Apple sign-in)
Date of birth and sex
Lifestyle and physical activity level
Geolocation and city / general region

Health and Wellness Data (Special Category Data)

The core of the Services involves health data. This is "special category" data under Article 9 of the GDPR and is processed only on the basis of your explicit consent. It may include:

Body composition: weight, height, body mass index, body fat percentage and fat mass, lean body mass, skeletal muscle mass, bone mineral content, total, intracellular and extracellular body water, visceral fat level, phase angle, measured basal metabolic rate, and obesity degree, including per-segment lean and fat mass for the trunk and each arm and leg where your scale reports it
Body measurements: circumferences of the neck, shoulders, chest, upper arms, forearms, waist, abdomen, hips, thighs, and calves
Vital signs: heart rate and resting heart rate, heart rate variability (SDNN and RMSSD), heart rate recovery, stress index, blood oxygen saturation (SpO2), respiratory rate, wrist temperature, VO2max, blood glucose, and blood pressure
Lab biomarkers: laboratory test results and biomarker values, together with the lab reports you upload as PDF files or photos
Genetic data: DNA polymorphisms and genotyping results you provide or upload, and findings derived from them
Nutrition: meals, dishes, and food photos, with energy, protein, carbohydrates, total, saturated, monounsaturated and polyunsaturated fat, fibre, sugar, and sodium
Supplements and medications: name, active ingredient, dosage, and form
Daily activity: steps, walking and running distance, active and resting energy expenditure, exercise minutes, and stand minutes
Workouts: type, duration and timing, GPS routes, and workout telemetry such as heart rate, pace, speed, cadence, power, stride length, ground contact time, vertical oscillation, elevation gain and loss, swim stroke count and SWOLF
Sleep: sleep and wake times, duration, sleep stages, sleep debt, and circadian and regularity metrics
Menstrual and reproductive health: cycle and period days, flow, cycle phase and forecasts, and — only if you allow it in the Health app — recorded sexual activity events
Derived indicators and scores: values we calculate from the data above, including biological age, recovery, sleep and nutrition scores, monthly body, mind, activity, endurance, recovery and nutrition scores, total daily energy expenditure and its metabolic correction, VDOT, and training load metrics such as TRIMP, acute and chronic load, acute-to-chronic workload ratio, and strain
Environmental context: local air temperature, atmospheric pressure, and humidity for your location, which we use to interpret the metrics above

AI Assistant Data

Your chat history with the Holi AI assistant
AI assistant "memory" (context retained to provide continuity across conversations)
Files you attach to conversations, including images, documents, and audio

Apple HealthKit Data

With your permission, Holi reads the following data types from Apple HealthKit. This integration is optional, you choose each type in the iOS permission sheet, and you can change or revoke your choice at any time in the Health app.

Characteristics: date of birth and biological sex
Body: weight, height, body mass index, body fat percentage, lean body mass
Vitals: heart rate, resting heart rate, heart rate recovery, heart rate variability (SDNN), blood oxygen saturation, respiratory rate, VO2max, blood glucose, wrist temperature during sleep
Activity: steps, walking and running distance, active and resting energy, exercise minutes, stand minutes
Workouts: workouts and workout routes, cycling and swimming distance, running power, speed, stride length, vertical oscillation and ground contact time, cycling cadence, power and speed, swimming stroke count
Sleep: sleep analysis
Nutrition: energy consumed, protein, carbohydrates, total, saturated, monounsaturated and polyunsaturated fat, fibre, sugar, sodium
Reproductive health: menstrual flow and sexual activity

With your permission, Holi also writes back to Apple HealthKit only what you enter yourself: weight, height, body mass index, body fat percentage, lean body mass, and workouts you log manually together with their active energy and distance. We never write calculated, estimated, or smoothed values into HealthKit.

Our use of HealthKit data is described further in the "Apple HealthKit" section below.

Technical Data

To operate and secure the Services, we may process limited technical information such as device identifiers, app version, and diagnostic and error logs. We use Google Firebase Analytics to understand which parts of the app are used — these events record screen and feature names together with your account identifier, and never contain health values. Where you enable notifications, we store your device's Apple Push Notification token so that we can deliver them. Health measurements are stored together with metadata about their source, such as the name, model, and manufacturer of the recording app or device (for example, Apple Watch or a smart scale).

Payments for any subscriptions are processed by Apple through the App Store under Apple's own privacy policy. We do not receive or store your payment card details.

How We Collect Your Personal Data

We collect Personal Data:

Directly from you, when you register, complete your profile, log meals, workouts, supplements, or measurements, upload documents or photos, or interact with the AI assistant.
From Apple HealthKit, when you grant permission to import health metrics from your device.
From a connected service — WHOOP or intervals.icu — when you authorize the connection.
Automatically, in the form of limited technical and diagnostic data generated when you use the app.

How We Use Your Personal Data

We use your Personal Data for the following purposes:

To provide the Services: to store, sync, and display your health, nutrition, and longevity data, calculate biological age and health scores, and deliver personalized insights.
To power the AI assistant: to generate AI responses, coaching, and educational guidance based on your data and messages, and to maintain conversation history and memory for continuity.
To maintain and improve the Services: to fix errors, ensure reliability, and improve functionality.
To provide customer support: to answer your questions and respond to your requests.
To ensure security and prevent misuse: to protect the Services and users against fraud, abuse, and unauthorized access, and to comply with legal obligations.

We do not use your health data for advertising or marketing.

Legal Bases for Processing (GDPR)

We process your Personal Data only where we have a lawful basis under the GDPR:

Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)): for the processing of your health and other special-category data, including all biometric, lab, nutrition, reproductive, and related health information, and for its transmission to the AI processors described below. You may withdraw this consent at any time.
Performance of a contract (Art. 6(1)(b)): to provide the Services you request, including account management and the core app functionality.
Legitimate interests (Art. 6(1)(f)): to secure our systems, prevent fraud and abuse, and maintain and improve the Services, where such interests are not overridden by your rights.
Compliance with legal obligations (Art. 6(1)(c)): where processing is required to meet legal or regulatory requirements.

Where processing relies on consent, withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

AI and Third-Party Processing

The Services use artificial intelligence features to generate responses, insights, search results, voice output, and media. To provide these features, the relevant portions of your data (including, where necessary, health data, messages, and attached files) are transmitted to and processed by the following third-party sub-processors solely to generate the requested output:

Google — large language models, which generate the assistant's replies, insights, and web-search answers, and transcribe the voice messages you record

We transmit only the data reasonably necessary to generate a response. These providers process your data on our behalf and are subject to contractual confidentiality and data-protection obligations. Once your data is processed by a third-party provider, it is also subject to that provider's own systems and safeguards.

We do not sell your Personal Data, and we do not share your health data for advertising or marketing purposes.

Data Sharing and Processors

Beyond the AI providers named above, we may share Personal Data with:

Infrastructure and hosting providers, including our object-storage provider Hetzner (located in Germany, EU), where uploaded files such as lab documents, food photos, and attachments are stored.
Authorities, where disclosure is required by applicable law, legal process, or a lawful request, or where reasonably necessary to protect the rights, property, or safety of our users, the Operator, or others.
Successors in a business transfer, in the event of a reorganization, merger, or transfer of the Services, in which case any recipient will be required to protect your data consistent with this Policy.

Each processor acting on our behalf is bound by a data-processing agreement that limits their use of your data to providing services to us.

Storage, Security, and Location of Data

Your Personal Data is stored and processed in the European Union. Uploaded files are stored with Hetzner in Germany (EU), and our databases are hosted in Europe.

We use appropriate technical and organizational measures to protect your Personal Data against unauthorized access, use, alteration, or disclosure, including access controls, encryption in transit, and encryption at rest for stored credentials and for data retrieved from connected services. No method of transmission or storage is completely secure, and while we work to protect your data, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

If we become aware of a personal data breach affecting your information, we will notify you and the relevant supervisory authority where required by, and within the timeframes set by, applicable law.

International Transfers

Your Personal Data is stored and processed within the European Union. Where any processing by our sub-processors involves a transfer of data outside the European Economic Area, we rely on appropriate safeguards recognized under the GDPR, such as European Commission adequacy decisions or Standard Contractual Clauses, to ensure your data receives an equivalent level of protection.

How Long We Keep Your Data

We retain your Personal Data only for as long as necessary for the purposes described in this Policy:

Account, profile, and health data: retained for as long as your account is active, and for a reasonable period thereafter to meet legal obligations or resolve disputes. You may request deletion at any time.
AI assistant conversation history and memory: retained to provide continuity until you request its deletion or delete the relevant content in the app.
Diagnostic and log data: retained for a limited period for debugging, security, and quality assurance, and then deleted.

When you delete your account, it is closed immediately and you can no longer sign in or reach your data. We then permanently erase your Personal Data, including files you uploaded, within 30 days. The delay exists only so that an accidental deletion can be reversed if you contact us within that window; after it passes, the data cannot be recovered. We may retain a minimal record where we are required to by law, and residual copies may persist in encrypted backups for a short, limited period before those backups expire.

Your Rights (GDPR)

Subject to applicable law, you have the following rights regarding your Personal Data:

Access — to obtain confirmation of whether we process your data and a copy of it.
Rectification — to have inaccurate or incomplete data corrected.
Erasure — to have your data deleted ("right to be forgotten"), subject to legal exceptions.
Portability — to receive your data in a structured, commonly used, machine-readable format and, where feasible, have it transmitted to another controller.
Restriction — to request that we restrict processing in certain circumstances.
Objection — to object to processing based on our legitimate interests.
Withdraw consent — to withdraw your consent to health-data and AI processing at any time, without affecting the lawfulness of prior processing. Because the Services cannot be provided without processing your health data, withdrawing consent means ending your use of them: delete your account in the app (Profile → Settings), or write to us at info@holiwell.ai and we will do it for you. You can also revoke Apple HealthKit access at any time in the Health app, and disconnect any connected service in Holi, without deleting your account.
Complaint — to lodge a complaint with a supervisory authority in your country of residence, place of work, or the place of an alleged infringement.

To exercise any of these rights, contact us at info@holiwell.ai. We may ask you to verify your identity before responding, and we will respond within the timeframes required by applicable law.

Connected Services (Wearables)

At your request, Holi can connect to a third-party service. The connections currently available are WHOOP and intervals.icu.

intervals.icu is an aggregator rather than a device maker: it holds the data you have already synced there from Garmin, Polar, Coros, Suunto, Oura, or a similar device. When you connect it, Holi retrieves on your behalf the daily values it holds for you — such as heart rate variability, resting heart rate, sleep and body metrics — and, where available, your activities with their telemetry, GPS routes, and intervals. Everything said below about how we use, protect, and let you remove data from a connected service applies to intervals.icu in the same way as to WHOOP.

When you connect WHOOP, you authorize it directly, on WHOOP's own sign-in and consent screen — Holi never sees your WHOOP credentials. Holi then retrieves, on your behalf, the recovery data WHOOP has already produced for you: heart rate variability (RMSSD), resting heart rate, blood oxygen saturation, and skin temperature, together with the timing information needed to place each value on the correct day. When you first connect, we retrieve up to twelve months of your own history so that your trends and baselines are meaningful from the start.

We use this data only to provide the Services to you: to display your metrics and trends, to calculate your scores, and — as part of the health data described in "AI and Third-Party Processing" above — to generate the AI insights you ask for. We do not use it for advertising or marketing, we do not sell, license, or lease it, we do not use it to train artificial-intelligence models, and we do not make it available to other users or to any third party other than the sub-processors named in this Policy, who act on our behalf and only to deliver the output you requested.

Data retrieved from a connected service is stored in your own account record, encrypted in transit and at rest, and protected by the measures described in "Storage, Security, and Location of Data". You remain in control of it at all times:

You can disconnect the service at any time in Holi (Profile → Settings → Data sources). Disconnecting revokes Holi's access with the provider, and Holi stops retrieving data.
You can disconnect and delete, which additionally removes the data retrieved from that service from your Holi account, both on your devices and on our servers.
Deleting your Holi account removes it as well.

Values obtained from WHOOP are identified in the app as coming from WHOOP. WHOOP is a trademark of its owner, and WHOOP does not sponsor, endorse, or certify Holi.

Apple HealthKit

Where you enable HealthKit integration, our handling of data obtained through Apple HealthKit follows Apple's requirements:

We use HealthKit data only to provide you with health, nutrition, and longevity features within the Services (for example, displaying your metrics, calculating scores, and informing AI insights that you request).
We do not use HealthKit data for advertising, marketing, or any use-based data mining beyond providing the Services to you.
We do not sell HealthKit data, and we do not share HealthKit data with third parties except as necessary to provide the features you use (such as the AI processing you request) or as required by law.
You control HealthKit access at all times through your iOS settings and can revoke it whenever you wish.

Children

The Services are not directed to children, and we do not knowingly collect Personal Data from children under the age of 16 (or the minimum age required by the law of your country). If you believe a child has provided us with Personal Data without appropriate consent, please contact us at info@holiwell.ai, and we will delete it.

Medical Disclaimer

The Services, including AI-generated insights and coaching, are provided for informational and educational purposes only. AI responses may be inaccurate, incomplete, or inconsistent. Holi does not provide medical advice and must not be relied upon as a substitute for professional medical care, diagnosis, or treatment. Always consult a qualified healthcare provider with any questions about your health.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes — such as changes to the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — we will notify you within the app or by email before the change takes effect. Your continued use of the Services after the effective date of the updated Policy constitutes acceptance of it, to the extent permitted by law.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, you can contact the Operator, Denis Rossiev, at:

info@holiwell.ai