Privacy Policy

01Information we collect

We collect only the information necessary to provide you with personalised health coaching. This falls into three categories:

We do not collect precise GPS location, payment information, or contacts.

02How we use your data

Your data is used exclusively to power and improve your coaching experience:

• Generating personalised fitness and wellness programs tailored to your goals and metrics
• Providing proactive insights and push notifications about your health trends (e.g. low HRV recovery alerts)
• Enabling AI chat and voice coaching through Myra — your health context informs every conversation
• Calculating your daily Wellness Score across fitness, sleep, nutrition, mindfulness, and mood pillars
• Improving our AI models and coaching quality — only using de-identified, aggregated data
• Sending service-related communications (account updates, critical app notices)

We never use your health data to target advertisements, and we do not build advertising profiles.

03Health & HealthKit data

HealthKit data accessed by Myra may include: steps, active energy, resting heart rate, heart rate variability, sleep analysis, workout data, mindfulness minutes, and blood oxygen. We access Apple Watch sensor data where available, as it provides the most accurate source.

HealthKit data is:

• Stored as daily summaries in our secure cloud backend — we do not store raw per-second sensor readings
• Used only to personalise your coaching and generate insights within Myra
• Never sold, rented, or shared with insurance companies, employers, or data brokers
• Never used for advertising or marketing purposes, consistent with Apple's HealthKit guidelines

04Data sharing

We share your data only with trusted service providers who help us operate Myra, and only to the extent necessary:

All third-party providers are contractually bound to process your data only as instructed by us and in compliance with applicable data protection law. We do not sell your data to any third party.

05Data retention

We retain your data for as long as your account is active. Specific retention periods:

• Health summary data and coaching history: retained for the life of your account
• Voice and chat session content: retained for 90 days to support conversation continuity
• Usage and analytics data: retained for 24 months in aggregated, de-identified form
• Account information: deleted within 30 days of account deletion

When you delete your account, we initiate deletion of all personal data within 30 days, except where retention is required by law.

06Your rights

Under the Swiss Federal Act on Data Protection (revDSG) and the EU General Data Protection Regulation (GDPR), you have the following rights:

• Access — request a copy of all personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request erasure of your personal data
• Portability — receive your data in a structured, machine-readable format
• Restriction — request that we limit processing of your data
• Objection — object to processing based on legitimate interests
• Withdraw consent — revoke HealthKit permissions at any time in iOS Settings

To exercise any of these rights, contact us at privacy@myra.coach. We will respond within 30 days.

07California residents (CCPA)

The following categories of personal information are collected by Myra:

As a California resident, you have the right to:

• Know — request disclosure of collected information
• Delete — request deletion of personal information
• Correct — request correction of inaccurate personal information
• Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising, so this right does not apply, but we will honour any such request
• Limit use of sensitive information — you may request that we limit use of sensitive personal information (including health data) to what is necessary to provide the service
• Non-discrimination — we will not discriminate against you for exercising any of your CCPA rights

To submit a CCPA request, contact us at privacy@myra.coach with the subject line "CCPA Request". We will respond within 45 days. You may also designate an authorised agent to make requests on your behalf.

In the preceding 12 months, Myra has not sold personal information to third parties and has not disclosed personal information for cross-context behavioural advertising purposes.

08Security

We implement industry-standard technical and organisational measures to protect your data:

• All data transmitted between the app and our servers is encrypted using TLS 1.2 or higher
• Data at rest is encrypted in Google Cloud Firestore using AES-256
• Access to your data within our systems is restricted to authorised personnel on a need-to-know basis
• Firebase Authentication is used for secure identity management
• We conduct regular security reviews of our infrastructure and third-party integrations

In the event of a data breach affecting your personal data, we will notify you and relevant authorities within 72 hours as required by law.

09Children's privacy

Myra is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

For users in the United States, we comply with the Children's Online Privacy Protection Act (COPPA) and do not knowingly collect personal information from children under 13.

10International data transfers

Myra is operated from Zug, Switzerland. Your data may be transferred to and processed in countries outside Switzerland and the European Economic Area, including the United States, where our cloud infrastructure and AI providers operate.

Such transfers are governed by appropriate safeguards including Standard Contractual Clauses approved by the European Commission, ensuring your data receives a level of protection equivalent to that in Switzerland and the EEA.

11This website and cookies

This section covers www.myra.coach. Visiting the website does not require an account, and we do not use the website to collect health data.

Google Analytics, only with your consent. If you click "Accept" in the cookie banner, we use Google Analytics 4 (Google Ireland Ltd. / Google LLC) to understand how visitors find and use the site: pages viewed, clicks on buttons such as "Join the challenge", approximate location (country/city), device and browser type, and referring website. Google Analytics sets cookies (_ga, _ga_*) to recognise returning visitors; they expire after up to 2 years. Google Analytics 4 does not log or store IP addresses. We do not use Google Analytics for advertising: advertising storage and ad personalisation are always switched off.

If you click "Decline", or until you choose, no analytics script is loaded and no analytics cookies are set. We store your choice in your browser's local storage (myra-analytics-consent) so we don't ask again; this is strictly necessary and contains no personal data.

Legal basis and withdrawal. We process this data on the basis of your consent (Art. 6(1)(a) GDPR, Art. 31 revDSG). You can withdraw it at any time, as easily as you gave it, through the "Cookie settings" link at the bottom of every page; we then remove the analytics cookies.

Transfers. Google may process this data in the United States. Google LLC is certified under the EU-US and Swiss-US Data Privacy Frameworks, and Google's data processing terms include Standard Contractual Clauses.

Hosting. The website is hosted on Firebase Hosting (Google Cloud). To deliver pages securely, the hosting provider processes technical data such as your IP address and browser information in server logs. This is necessary to provide the website (legitimate interest, Art. 6(1)(f) GDPR) and does not depend on your consent.

Email. If you write to us, for example to request a beta invite, we use your email address and message only to reply and to send the invite, and delete them when they are no longer needed for that purpose.

12Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your data, please reach out:

• Data protection enquiries privacy@myra.coach
• Registered address Myra Coach AG | Zug, Switzerland

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch, or with the data protection authority in your country of residence.