Privacy Policy

1. Introduction and Our Commitment to Privacy #

Virtusan is a Swiss wellness technology company. The Virtusan Ring and Virtusan App are designed to help users better understand general wellness indicators, sleep, recovery, activity and daily habits.

We understand that the data you entrust to us, including wellness, biometric and health-related information, is personal and sensitive. Protecting it is a core part of how we operate.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, with whom we may share it, and what rights you have.

The Services are intended for general wellness and informational purposes only. They are not medical devices and are not intended to diagnose, prevent, monitor, treat or cure any disease, medical condition or injury.

2. Controller, Scope and Contact #

This Privacy Policy applies when you use the Virtusan Ring, the Virtusan App, our websites, our online shop, or any related products or services (together, the Services).

In this Privacy Policy, Virtusan, we, us or our means Virtusan AG. Where a product, device, service, order, website or digital service is provided by Virtusan Spaces AG, the applicable contracting entity will be Virtusan Spaces AG, as identified at checkout, in the order confirmation, or in the relevant agreement. In that case, references to Virtusan, we, us or our include Virtusan Spaces AG as applicable.

Data subjects and data protection authorities in the EU/EEA and the United Kingdom may contact our representatives on all matters relating to the processing of personal data, including to exercise data subject rights, at: https://app.prighter.com/portal/12214795798

3. Applicable Law and International Users #

Virtusan AG is domiciled in Switzerland and is subject to the Swiss Federal Act on Data Protection (nFADP/DSG).

Where we offer Services to users in the EU/EEA or the United Kingdom, the GDPR, UK GDPR and related local rules may also apply to our processing of personal data. Where applicable laws impose different requirements, we apply the standard required by applicable law.

If you are located outside Switzerland, the EU/EEA or the United Kingdom, you may also have mandatory rights under your local law. Nothing in this Privacy Policy limits mandatory rights that cannot be excluded under applicable law.

4. Age Requirement #

The Services are intended for users aged 18 and above. They are not directed to children or minors. We do not knowingly collect personal data from individuals under 18.

If we become aware that we have collected personal data from a minor without appropriate authorisation, we will take steps to delete it where required by law.

5. Categories of Personal Data We Collect #

We collect and process the following categories of personal data, depending on how you use the Services. Providing your account data is necessary to create an account and use the Services. Providing other data is voluntary, but some features may not be available without it.

5.1 Account, Contact and Purchase Data

This may include:

• name, email address, phone number, shipping address and billing address;
• profile information such as date of birth, age, height, and weight;
• account credentials, with passwords stored in protected form;
• order, subscription, payment and billing information;
• customer support communications and related records.

Payment card details are processed by our authorised payment providers. Virtusan does not store full payment card details.

5.2 Ring, Biometric and Wellness Data

Depending on the features available and enabled, the Virtusan Ring and App may process wellness, biometric and health-related data such as:

• heart rate and heart rate variability;
• blood oxygen saturation;
• skin temperature and temperature trends;
• sleep data, including sleep duration and sleep phases;
• respiration-related indicators;
• activity, steps, movement and recovery indicators;
• derived wellness scores, such as readiness, sleep quality, activity or recovery scores;
• firmware, device and diagnostic data relating to the Virtusan Ring.

Google Health. If you choose to connect Google Health, we access your data directly through the Google Health API. With your permission, we read (read-only) your steps, heart rate, heart rate variability, resting heart rate, blood oxygen saturation and sleep stages. We use this data only to show your metrics in the App, calculate your Readiness score and generate personalised AI insights. We store this data on Microsoft Azure in Switzerland, encrypted in transit and at rest, and share it only with Microsoft as our hosting and AI service provider (see Section 8). We do not sell it or use it for advertising. The use of information received from the Google Health API will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements.

If you choose to connect a third-party device or app (such as a smartwatch or another fitness app), we use Terra Enabling Developers, Inc. (“Terra”), our health data integration provider, to connect to and retrieve the health and wellness data available from that device. In some cases, Terra may collect this data directly from your wearable device rather than through the device manufacturer’s official API. This data is combined with data collected directly through the Virtusan Ring and processed under the same legal basis described in this Section.

By choosing to connect a third-party device through Terra, you also acknowledge and agree to Terra’s End User Privacy Policy, which describes how Terra processes your data as part of enabling this connection.

This data may qualify as sensitive personal data under Swiss law and, where applicable, special-category data under GDPR/UK GDPR. We process such data only where we have an appropriate legal basis, including your explicit consent where required.

5.3 App Data and User-Provided Wellness Context

Depending on the features you use, you may choose to provide additional information, such as goals, habits, notes, feedback or other wellness-related context. Please do not provide medical information unless a feature specifically asks for it and you are comfortable doing so.

5.4 Data Not Collected by the Virtusan Ring

The Virtusan Ring is not designed to collect GPS, precise location or similar location-based data. The Virtusan Ring does not capture microphone or audio data.

The Virtusan App may process approximate location data, such as country or region derived from your IP address, device settings, app store country, account settings or similar technical signals. We use this for purposes such as localisation, security, fraud prevention, analytics, tax, shipping or legal compliance.

We do not collect precise GPS location data unless a future feature specifically requires it and we ask for your permission where required by law.

5.5 Device, Technical and Usage Data

We may process device and technical data such as:

• IP address, browser type, operating system and device type;
• app version, session duration, feature interactions and log data;
• crash reports and performance data;
• Virtusan Ring serial number or device identifiers;
• cookie and tracking data.

The Virtusan App uses analytics technology (such as device identifiers and similar tracking mechanisms) to understand how the App is used and to improve our Services.

6. Purposes and Legal Bases for Processing #

We process personal data for the purposes described below.

6.1 Providing and Operating the Services

We process personal data to operate the Virtusan Ring and App, provide account functionality, generate wellness insights, process orders, deliver products, manage subscriptions and provide the core functionality of the Services.

Where GDPR or UK GDPR applies, the legal basis is performance of a contract. For wellness, biometric or health-related data, we rely on explicit consent where required.

6.2 Customer Support and Communications

We process personal data to respond to inquiries, resolve technical issues, manage account requests and communicate with you about the Services.

Where GDPR or UK GDPR applies, the legal basis is performance of a contract and our legitimate interest in providing support.

6.3 Safety, Security and Fraud Prevention

We process personal data to protect users, systems and data, detect fraud, prevent misuse, investigate security incidents and maintain the integrity of the Services.

Where GDPR or UK GDPR applies, the legal basis is our legitimate interest in securing the Services and protecting users.

6.4 Service Improvement, Analytics and Product Development

We may use personal data, preferably in aggregated, anonymised or pseudonymised form where feasible, to improve the Services, develop new features, enhance algorithms, understand wellness trends and improve product performance.

Where GDPR or UK GDPR applies, the legal basis is our legitimate interest in improving the Services. For wellness, biometric or health-related data, we rely on explicit consent where required.

We may use aggregated or anonymised data, which no longer identifies you, to improve the Services, develop new features, enhance algorithms, conduct internal research, understand wellness trends and improve product performance. This data is not personal data where it can no longer be linked to an identifiable individual.

Data received from the Google Health API is not used for research, and is not used to develop, train or improve AI or machine learning models, including in aggregated or anonymised form. It is used only for the user-facing features described in Section 5.2.

6.5 Marketing Communications

We send marketing communications only where you have consented or where otherwise permitted by applicable law. You can unsubscribe at any time using the unsubscribe link in the communication or by contacting us at support@virtusan.com.

6.6 Legal Compliance and Claims

We process personal data where necessary to comply with legal obligations, including tax, accounting, product safety, consumer protection and regulatory obligations, and to establish, exercise or defend legal claims.

7. Consent for Wellness, Biometric and Health-Related Data #

Where we process wellness, biometric or health-related data that is sensitive under applicable law, we rely on your explicit consent where required.

Where this data is collected through a third-party device connected via Terra, your consent also covers Terra’s collection of that data directly from your device or through the device manufacturer’s API, as described in Section 5.2 and in Terra’s End User Privacy Policy.

Disconnecting a connected data source, such as Google Health, stops further syncing but does not delete data already synced. To delete it, you can delete your account in the App or contact us at support@virtusan.com, and we will delete it within 30 days.

You may withdraw consent at any time by using available settings in the App where provided or by contacting us at support@virtusan.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, but it may limit your ability to use certain features of the Services. Upon withdrawal, we will stop using your wellness, biometric and health-related data for further processing, and will delete or anonymise it in accordance with Section 10.

8. Sharing of Personal Data #

Virtusan does not sell or rent your personal data.

We may share personal data with the following categories of recipients where necessary and lawful:

• cloud hosting and infrastructure providers, including Microsoft Azure;
• payment processors and e-commerce providers;
• delivery, logistics and fulfilment partners;
• customer support, email and communication providers;
• analytics, security, monitoring and performance providers;
• health data integration providers, in particular Terra Enabling Developers, Inc., used to connect and retrieve data from third-party wearables or fitness apps you choose to link. See Section 5.2 for further detail on this integration;
• AI infrastructure providers, namely Microsoft Azure OpenAI Service, used to generate wellness insights and Readiness explanations as described in Section 13. We send metric values with a pseudonymous identifier, without your name or email. Microsoft does not use this data to train its models;
• professional advisors, auditors, insurers and legal counsel;
• public authorities, courts or regulators where required by law;
• acquiring or successor entities in the event of a merger, acquisition, restructuring or sale of assets.

We do not share identifiable wellness, health-related or biometric data with clinics, coaches, hospitality partners, corporate clients, real estate partners or Virtusan Spaces partners unless you have expressly requested this, given your explicit consent, or the sharing is necessary to provide a specific service you have chosen.

If you choose to connect the Services with a third-party app, platform or provider, we may share or receive data only as needed to enable that connection and subject to your choices or consent. Third-party services are governed by their own privacy policies.

9. International Data Transfers #

Virtusan AG is domiciled in Switzerland. Our primary cloud infrastructure is hosted on Microsoft Azure in the Switzerland North region.

Personal data may also be processed in other countries where our service providers or partners are located. Recipient countries may include Switzerland, the EU/EEA, the United Kingdom, Canada, the United States, China (for the shipment of Virtusan Ring orders) and the Philippines (for customer support). This includes, for our health data integration provider Terra, processing that may take place in the United Kingdom and, where necessary, the United States.

Where personal data is transferred to a country that does not provide an adequate level of protection under applicable Swiss, EU/EEA or UK data protection law, we use appropriate safeguards, such as standard contractual clauses, data-processing terms, technical and organisational measures, and other safeguards permitted by applicable law.

10. Data Retention #

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, or as required by law.

In general:

• account data is kept while your account is active. We consider an account inactive if you have not logged in for 24 consecutive months. Before closing an inactive account and deleting the associated personal data, we will make reasonable efforts to notify you in advance and give you the opportunity to keep your account active;
• wellness, biometric and health-related data is kept while your account is active and is deleted or anonymised after account deletion or withdrawal of consent within 30 days, unless longer retention is required by law or necessary for legitimate purposes;
• invoice, payment, tax and accounting records may be retained for up to 10 years where required by Swiss commercial law;
• support records are retained until the request is closed and for 24 months thereafter;
• analytics and usage data is retained for 14 months;
• consent records are retained as needed to demonstrate compliance;
• aggregated or anonymised data may be retained for longer because it no longer identifies you.

When personal data is no longer needed, we delete or anonymise it in accordance with our internal processes and applicable law.

11. Data Security #

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction. These measures may include encryption in transit and at rest, access controls, role-based permissions, monitoring, pseudonymisation, security testing, employee confidentiality obligations and other safeguards appropriate to the sensitivity of the data.

No system is completely secure. If you become aware of a potential security incident, please contact us at support@virtusan.com.

12. Your Rights #

Depending on your location and applicable law, you may have rights in relation to your personal data, including:

• the right to access your personal data;
• the right to correct inaccurate or incomplete data;
• the right to request deletion of your data;
• the right to restrict or object to certain processing;
• the right to data portability;
• the right to withdraw consent where processing is based on consent;
• the right not to be subject to solely automated decisions with legal or similarly significant effects;
• the right to lodge a complaint with a competent data protection authority.

If account deletion is available directly in the Virtusan App, you may use that feature. You may also request deletion of your account or exercise your privacy rights by contacting us at support@virtusan.com.

We may need to verify your identity before responding to a request. We will respond within the timeframe required by applicable law.

If you are in Switzerland, the competent supervisory authority is the Federal Data Protection and Information Commissioner. If you are in the EU/EEA or the United Kingdom, you may contact the competent supervisory authority in your place of residence, workplace or location of the alleged infringement.

13. Automated Insights and Profiling #

The Services may use algorithms to generate wellness insights, scores, trends or recommendations based on data from the Virtusan Ring, the App and information you choose to provide. These outputs are for general wellness and informational purposes only.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

14. Cookies and Similar Technologies #

When you visit our websites or online shop, we may use cookies and similar technologies. For details about the types of cookies we use and how you can manage your preferences, please see our Cookie Policy.

15. Third-Party Links and Services #

The Services may contain links to third-party websites, apps or services. We are not responsible for the privacy practices of those third parties. You should review their privacy policies before sharing personal data with them.

16. Privacy by Design and Risk Management #

Given the nature of the data processed by the Services, Virtusan assesses privacy and data protection risks as part of its product and compliance processes and implements appropriate technical and organisational safeguards.

17. Changes to This Privacy Policy #

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or Services. The “Last updated” date at the top indicates the latest revision.

If we make material changes, we will notify you by posting a notice on our website, through the Virtusan App, by email, or by other appropriate means where required by law.

18. Contact Us #

If you have questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your personal data, please contact us at: