Legal
Privacy Policy
Updated
Who we are & scope
Your privacy matters to us. This Privacy Policy explains how Vire Health Oy (Business ID 3183533-4) (“Vire,” “we,” “us,” or “our”) collects, uses, and protects your personal data when you use the Vire app, the Vire clip device, subscribe to our newsletter, browse our websites and landing pages, or purchase our products.
Vire Health Oy is the data controller for the processing of your personal data under this policy.
We comply with the EU General Data Protection Regulation (GDPR). Where we rely on your consent, we ask for it separately: on our websites through the cookie banner, and in the Vire App before we collect or analyse any health-related data. The Vire App cannot provide its core features without your consent to process health-related data. You can withdraw consent at any time; this does not affect processing carried out before you withdrew it.
What data we collect
- Purchases & orders: name, email, phone number, delivery and billing address, order details, VAT, IP address for fraud checks, and payment tokens processed securely by our payment providers (we do not store full card numbers).
- Account & profile: email (for login) and profile details you choose to provide, such as name, date of birth, sex assigned at birth, height, weight, and self-assessed activity and fitness levels (used to personalize analyses).
- From the Vire Clip & app:
- Measured data (from device sensors and synced via the app), such as heart rate, heart rate variability (HRV), skin temperature, heat flux, electro-dermal activity, breathing rate, and steps.
- Calculated data (algorithmic insights derived from your measurements), such as energy expenditure, sleep quality and contributors, recovery and challenge analysis, sweating and core temperature.
- Data you provide (optional), such as events about meals and activities, and feedback.
- App & site activity (analytics and pixels): pages and screens visited, interactions, device and browser information, operating system, IP address and high-level location, marketing campaign source (e.g., UTM tags), and crash/error logs. Analytics and advertising pixels on our sites run fully only after you accept cookies in the banner.
- Communications: newsletter email address (and optional name), customer support messages.
- Device permissions: 2.4 GHz wireless connection permission, used only to connect your Vire Clip — not for location tracking.
We do not knowingly collect data from children under the age of 16.
Why we process your data
- To provide, operate, and personalize your user experience and deliver insights on sleep, recovery, and activity.
- To fulfill and deliver product purchases and pre-orders.
- To provide customer support and communicate with you (including newsletters, with your consent).
- To maintain and improve our products, features, and performance.
- To ensure security, prevent fraud, and troubleshoot issues.
- To comply with legal obligations (e.g., VAT, invoicing, and bookkeeping).
- To run analytics and ad measurement on our sites after you consent to cookies.
Legal bases for processing
- Consent: processing of health-related data and app/site analytics and marketing pixels; you may withdraw consent at any time in the app or via cookie settings/on-site tools, or by contacting us.
- Contract: providing the app and Clip functionality, and performing your purchase/pre-order.
- Legal obligations: complying with tax and accounting laws and other mandatory requirements.
- Legitimate interests: maintaining and improving services, fraud prevention, and protecting our users and systems (balanced against your rights and freedoms).
Sharing & recipients
We do not sell or rent your personal data. We may use trusted service providers (processors) who act on our instructions under appropriate contracts and confidentiality:
- Cloud & website hosting: Amazon Web Services (EU region, Frankfurt); Vercel Inc. (hosting and delivery of our website).
- E-commerce & payments: Shopify Inc. (EU data hosting region), Stripe / Shopify Payments (payment processing).
- Analytics & tag management: Google LLC (Google Analytics 4 and Tag Manager), Mixpanel (product analytics), Sentry (error monitoring).
- Advertising: Meta Platforms Ireland (Facebook/Instagram pixel; only after cookie consent) and Google Ads (conversion measurement).
- Cookie consent: CookieYes Limited (stores your cookie choices).
- Email & CRM: Klaviyo (EU region) for newsletters and email communications.
- Webinars & events: Zoom Communications, Inc. (registration and live sessions), Zapier, Inc. (passes webinar registrations to Zoom and Klaviyo), YouTube / Google (webinar recordings; loaded only when you press play).
- Forms: Tally BV (some of our sign-up and feedback forms).
- Support & Helpdesk: Zendesk (our help center and support tickets).
- AI-powered message generation: OpenAI and Anthropic (used to generate personalized messages; limited, pseudonymized input may be processed).
These partners process data only on our behalf and according to our instructions.
Additionally, we may use anonymized and/or aggregated data for research and commercial purposes.
International transfers
Some providers may process data outside the EU/EEA (for example, the United States). Where transfers occur, we use lawful safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and, where appropriate, additional measures to protect your data.
Cookies & similar technologies
We use cookies, SDKs, and pixels on our sites and, where applicable, within the app to support functionality, analytics, and advertising. Analytics and advertising cookies are set only after you accept them in the banner; before that, Google tags send only limited information that does not identify you, as explained in our Cookie Policy. You can change or withdraw your consent at any time via the cookie banner or settings.
For a detailed listing of cookies we currently use, please refer to our Cookie policy.
Data retention
- Account and health data: deleted within approximately 30 days after you delete your account.
- Newsletter: retained until you unsubscribe (one-click link in every email).
- Pre-order and purchase records: retained as long as legally required (e.g., six years under Finnish accounting law).
- Analytics: Google Analytics events are retained for 14 months and then deleted or aggregated.
- Aggregated/anonymized data: may be retained indefinitely for research, analytics, commercial purposes and service improvement.
Your rights
You have the right to access your data, correct inaccuracies, request deletion, restrict or object to certain processing, receive a copy of your data (data portability), and withdraw consent at any time (including cookie consent and newsletter preferences). You can exercise your rights by emailing hello@virehealth.com. We respond within 30 days. You also have the right to lodge a complaint with your local Data Protection Authority, including the Finnish Data Protection Ombudsman.
Information security
We use industry-standard safeguards to protect your data, including strict access controls for authorized personnel only. If you are a security researcher looking to report a vulnerability, please refer to our Vulnerability Disclosure Policy.
Changes to this policy
We may update this Privacy Policy from time to time. If significant changes are made, we will notify you through the app, by email, and/or on our websites before they take effect.
Contact
Vire Health Oy (Business ID 3183533-4)
Huoltotie 4, 04300 Tuusula, Finland