Privacy Policy
Who we are
PULS is an emergency alert application developed by Almas Sandykbayev. The app monitors heart rate, heart rate variability, and blood oxygen saturation, and automatically notifies emergency contacts when a potentially dangerous event is detected.
This policy explains what data PULS collects, why, how it is stored and protected, and what rights you have. Questions: sandykbayev.almas@gmail.com
What information PULS stores
- Account credentials. Your email address for authentication. Passwords are never stored in plain text — only a cryptographic hash.
- Profile information. Name, blood type, conditions, medications, allergies. Entered voluntarily, used only in SOS messages to emergency contacts.
- Emergency contacts. Names, phone numbers, relationships. Used only to send SOS notifications on your behalf.
- Biometric data. Heart rate, HRV, and SpO2 read from your smartwatch via Google Health Connect. Used for anomaly detection. Never sold or shared with third parties.
- GPS location. Captured only at the moment of an SOS event, not continuously tracked. Included in SOS messages to emergency contacts.
- SOS event records. Time, status, anomaly score, GPS coordinates. Used for your personal history.
- Settings. Sound, vibration, timer, language preferences.
Purpose of each data type
- Email — authentication and one-time launch notification.
- Profile & medical info — included in SOS messages to emergency contacts only. Never shared with third parties.
- Emergency contacts — receive SMS when SOS is triggered. Phone numbers sent to SMS provider (Mobizon) only at moment of delivery.
- Biometric data — anomaly detection algorithm, personal baseline calibration. Never sold or shared with insurers, employers, or any third party.
- GPS — included in SOS messages. Not used for tracking or advertising.
How your data is protected
All data is stored on Supabase (PostgreSQL on AWS, SOC 2 Type II certified). Encrypted in transit (TLS 1.2+) and at rest (AES-256). Sensitive health fields are additionally encrypted at the application level.
Access is governed by Row Level Security — each row of data is bound to your user ID at the database level. No query can return another user's data.
In the event of a security breach, you will be notified by email within 72 hours.
Who receives your data
- Supabase — database and auth provider. Does not use your data beyond providing the service.
- Mobizon — SMS delivery. Receives phone numbers and message content only at moment of SOS. Does not retain content beyond delivery.
- Your emergency contacts — receive SMS with your name, alert description, and GPS link during SOS events.
- Google Health Connect — local Android service. Data flows from your watch to Health Connect to PULS. No data is sent to Google by PULS.
PULS does not share data with advertisers, data brokers, insurers, employers, or government agencies (except where required by law).
How long we keep data
- Account data — retained while your account is active. Deleted within 30 days of account deletion.
- Health readings — temporary, used for current session and baseline only.
- SOS records — retained in your history indefinitely. You can delete individual events anytime.
- Waitlist emails — deleted after launch notification is sent.
What you can ask us to do
- Access — request a full export of your data (within 14 days).
- Correction — correct inaccurate data anytime from the app or by contacting us.
- Deletion — request permanent deletion of your account and all data (within 30 days).
- Portability — receive your data in JSON or CSV format.
- Withdraw consent — revoke location or health data access anytime through app settings.
Contact: sandykbayev.almas@gmail.com. Response within 14 days.
Medical disclaimer
PULS is an auxiliary tool. It is not a medical device and does not provide diagnosis or treatment. The algorithm may produce false positives and false negatives. If you experience symptoms of a cardiac or neurological emergency, call your local emergency services immediately.
Requirements
PULS is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18.
Policy updates
Material changes will be communicated by email at least 14 days before taking effect. The "Last updated" date at the top will be revised for minor changes.