Consumer Health Data Policy

01 Health Data We Collect and Why

• Body signals from Apple Health, Health Connect, or Fitbit / Pixel Watch (only if you connect them): heart rate, resting heart rate, heart rate variability, skin or wrist temperature, sleep times and stages, workouts, active energy, blood oxygen, respiratory rate and noise exposure
• Health-related answers you give COSI: whether you run hot or cold, your resting heart rate, and comfort feedback such as “too warm” or “too cold”
• Information derived from these: whether your body seems warm, cool or stressed compared with your normal, and a body comfort score
• Why: to adjust your temperature and lights to how your body is doing (only if you allow automatic adjustments), to time Comfort Wake, to show you your readings and sleep history, and to keep the service secure. We do not use it for advertising

02 Where It Comes From

• Directly from you, in the app
• From Apple Health or Health Connect on your phone, with your permission
• From Google (Fitbit and Pixel Watch data through the Google Health API), with your permission

03 Who We Share It With

• Service providers that process it only on our behalf: Google Cloud / Firebase (hosting and storage)
• We do not sell consumer health data, and we do not share it with advertisers, data brokers or other third parties for their own purposes
• Friends you allow to see your Comfort Score see only the overall score, not the health readings behind it
• We may disclose it if the law requires us to; we have no affiliates that receive it

04 Consent

• We only collect consumer health data after you give permission in Apple Health, Health Connect or Google, and only use it to adjust your home after you say yes to automatic adjustments
• If we ever want to collect a new kind of health data or use it for a new purpose, we will ask for your consent first
• You can withdraw consent at any time: Profile → Automatic adjustments, disconnect a health app in COSI, or turn off access in the Health app or Health Connect

05 Your Rights

• Know and access: confirm whether we collect, share or sell your consumer health data, and get a copy (Profile → Export My Data, or email us)
• Third parties: get a list of the third parties and affiliates we’ve shared it with
• Withdraw consent as described above
• Delete: Profile → Delete Account deletes your account and health data; you can also ask us by email
• Email hello@cosicomfort.com with “Health Data Request” in the subject. We’ll verify it’s you and respond within 45 days (we may extend once by 45 days if needed and will tell you why)
• Appeal: if we decline your request, reply with “Appeal” in the subject and we’ll answer within 45 days. If you’re still not satisfied, you can contact your state Attorney General (for Washington: atg.wa.gov)

06 Contact