Privacy Policy

⚠️ Draft only — Halia is in private testing and not yet publicly available.

Halia is in private testing and not yet publicly available. This draft explains how we aim to handle your data, and will be reviewed by a qualified solicitor before public launch.

1. Who we are

Halia is built by Ardela Labs Ltd, a company registered in England and Wales (company number 17292415).

Data controller: Ardela Labs Ltd.

2. What Halia is

Halia is an AI wellness companion — an automated system, not a human. Conversations are processed by AI systems (see sub-processors below).

3. What data we collect

We collect the following categories of data:

Account data: name, email, date of birth, phone number.
Health data (special category under UK GDPR Article 9): T1D diagnosis confirmation, insulin management type, CGM device type, CGM readings, meal logs, injection records.
Wearable data (if connected): sleep, activity, readiness, heart rate.
WhatsApp conversation content.

4. Lawful basis

Health data: explicit consent, Article 9(2)(a) UK GDPR, captured at registration.
Other personal data: contract performance and legitimate interests.
Anonymised research: separate explicit consent (optional, captured at registration).

5. Sub-processors and data transfers

We use the following sub-processors to operate Halia. For US-based processors, international transfers rely on the EU-US Data Privacy Framework and the UK GDPR Data Transfer Addendum:

Supabase Inc. — database (UK region, London).
Railway Corporation — API server hosting.
Meta (WhatsApp LLC / Meta Platforms Inc.) — message delivery; Meta is also an independent controller for its own purposes.
Anthropic — AI conversation processing (Claude).
Google — meal and food analysis (Gemini).
Oura Ring / Ouraring Inc. — wearable data (if connected).

6. Retention

You can ask us to delete your data at any time — contact support@halia.health or send "delete my data" to Halia on WhatsApp. Our retention periods are:

Conversation logs: deleted after 90 days (automated).
CGM readings: retained while your account is active.
Account data: retained until you request deletion.

7. Your rights

You have the right to access, rectification, erasure, restriction, portability, and objection (UK GDPR Articles 15–21), and the right to withdraw consent at any time (Article 7(3)).

If you have concerns, you can contact the supervisory authority: the Information Commissioner's Office (ICO), ico.org.uk.

8. AI disclosure

Halia discloses that she is an AI at account creation, at the start of any new conversation, and whenever you ask directly.

AI model providers: Anthropic (Claude) and Google (Gemini).

9. Business transfers

If Ardela Labs Ltd is involved in a merger, acquisition, or sale of assets, your data may be transferred to the new owner as part of that transaction. We will ensure it remains subject to the protections set out in this policy, and we will notify you via WhatsApp before it becomes subject to any different policy.

10. Contact

For any privacy question, contact us at support@halia.health.