Privacy Policy
This policy explains how HALO collects, uses, shares, stores and protects personal data, including sensitive personal health data, across the website, the online store, the Halo app and the Halo Ring and Halo Band devices.
Please read it carefully. By creating an account in the Halo app, you confirm that you have read and understood this policy.
1. Who is the controller of your data
HALO LTDA Company registration number (CNPJ): 61.525.025/0001-01 Address: Cond. Quintas da Alvorada, 118, Jardim Botânico, Brasília, Federal District, Brazil Website: halodevice.com.br General email: contato@halodevice.com.br
HALO acts as the controller of the personal data processed under this policy, pursuant to Article 5, VI of Brazilian Law No. 13,709/2018 (the Brazilian General Data Protection Law, or "LGPD").
Data Protection Officer (DPO) Name: Pedro Rabelo Email: contato@halodevice.com.br
2. Who this policy applies to
This policy applies to everyone who:
- visits halodevice.com.br;
- makes a purchase in the HALO online store;
- uses the Halo app on iOS or Android devices;
- uses the Halo Ring and Halo Band devices;
- contacts our support team by email, WhatsApp or social media;
- takes part in a corporate health program contracted by their employer.
3. Definitions
Personal data: information relating to an identified or identifiable natural person.
Sensitive personal data: data concerning racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical or political organization, data concerning health or sex life, and genetic or biometric data, when linked to a natural person.
Data subject: the natural person to whom the personal data relates.
Processing: any operation carried out with personal data, such as collection, use, access, storage, sharing and deletion.
Processor: the party that processes personal data on behalf of the controller.
4. What data we collect
4.1 Data you provide directly
Registration and account in the Halo app: name or nickname, email address, password (stored in encrypted form), date of birth, biological sex, height, weight and profile picture (optional).
Purchases in the online store: full name, tax identification number (CPF), email, phone number, shipping address and billing address.
Payment: card, PIX and bank slip details are collected and processed directly by our contracted payment providers. HALO does not store full credit card numbers.
Customer service and support: the content of the messages you send, phone number, order number and any attachments you share with us.
Optional communications: email address and phone number for our newsletter, the HALO Club community and promotional communications, where you have given permission.
4.2 Health and wellness data collected by the devices
This is sensitive personal data and receives enhanced protection. The Halo Ring and Halo Band devices collect, on a continuous or periodic basis:
- heart rate;
- heart rate variability (HRV);
- stress indicators derived from HRV;
- sleep stages and sleep quality (light, deep, REM, duration, awakenings);
- peripheral body temperature trend;
- peripheral oxygen saturation (SpO₂);
- steps, distance, calories and energy expenditure;
- workout sessions started manually in the app;
- menstrual cycle records, if you choose to use that feature;
- sleep and activity scores from 0 to 100 calculated by the app.
All of the data above is collected by the device, transmitted to the app over Bluetooth and synchronized with our servers so that you have history, backup and account recovery.
4.3 Data collected automatically
App: device model, operating system and version, app version, device identifier, language, time zone, IP address, error and crash logs, feature usage data, serial number and battery level of the Halo Ring or Halo Band.
Website: IP address, browser type, pages visited, time spent on the site, referral source and data collected through cookies, as described in Section 20.
4.4 Permissions requested by the app
| Permission | What it is used for | What happens if you decline |
|---|---|---|
| Bluetooth | Connecting to and syncing with the Halo Ring or Halo Band | The device will not work with the app |
| Approximate location (Android) | Required by the Android system in order to scan for Bluetooth devices. We do not use this permission to track your location and we do not store your coordinates | The device cannot be paired |
| Notifications | Reminders, alerts and app notices | You will not receive alerts |
| Physical activity and body sensors | Step counting and activity recognition | Activity features will be limited |
| Camera and photos | Profile picture, sending images to support | None. This is optional |
| Apple Health or Health Connect | Syncing data with your phone's health app | None. This is optional |
You can revoke any permission at any time in your phone's settings.
5. Why we use your data and on what legal basis
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Creating and maintaining your account, authenticating access | Registration data | Performance of a contract, Art. 7, V |
| Processing orders, payments, deliveries and exchanges | Registration, purchase and payment data | Performance of a contract, Art. 7, V |
| Issuing invoices and meeting tax and accounting obligations | Registration and purchase data | Compliance with a legal obligation, Art. 7, II |
| Displaying, calculating and storing your sleep, activity, HRV, SpO₂, temperature and menstrual cycle metrics | Health data | Specific and highlighted consent, Art. 11, I |
| Providing technical support and customer service | Registration, purchase and support data and, where you send it to us, health data | Performance of a contract, Art. 7, V, and Art. 11, I |
| Keeping accounts secure and preventing fraud | Technical and registration data | Legitimate interest, Art. 7, IX, and Art. 11, II, "g" |
| Fixing bugs, measuring performance and improving the app | Technical and usage data | Legitimate interest, Art. 7, IX |
| Developing and improving algorithms and scores | Aggregated and anonymized health data | Anonymized data, Art. 12 |
| Sending promotional communications, newsletters and community invitations | Email, phone number | Consent, Art. 7, I |
| Exercising rights in judicial, administrative or arbitration proceedings | All relevant data | Art. 7, VI, and Art. 11, II, "d" |
| Retaining application access logs | Technical data | Compliance with a legal obligation, Art. 15 of the Brazilian Internet Act |
Where we rely on legitimate interest, we carry out a balancing test in advance, and you may object to the processing through the channels listed in Section 12.
6. Processing of sensitive health data
The data described in item 4.2 is sensitive personal data. Accordingly:
- Processing takes place on the basis of specific and highlighted consent, collected the first time you open the Halo app, on a dedicated screen, separate from the Terms of Use and with no pre-ticked boxes.
- Consent for menstrual cycle data is collected separately, and only if you turn that feature on.
- Consent for the Apple Health or Health Connect integration is collected separately, and only if you turn that integration on.
- You may withdraw your consent at any time, free of charge and through a simple process, in the app settings or by writing to contato@halodevice.com.br. Withdrawal does not affect the lawfulness of processing carried out before it.
- If you withdraw your consent, the health monitoring features stop working and your health data is deleted within the periods set out in Section 11.
7. What HALO does not do with your data
So that there is no doubt, we make the following commitments:
- We do not sell personal data to third parties.
- We do not use health data for advertising, ad targeting, remarketing or the creation of commercial profiles.
- We do not share health data with insurers, health plans, financial institutions, employers or credit bureaus.
- We do not use data obtained from Apple Health or Health Connect for advertising, marketing, data mining or any purpose other than health, fitness and wellness, and we do not disclose it to third parties for those purposes.
- We do not make automated decisions that produce legal effects or significantly affect your interests, such as denial of credit, insurance or employment.
8. Who we share data with
We share only what is necessary, with contracted processors that act on HALO's instructions and are bound by contractual confidentiality and security obligations.
| Category | Purpose | Examples |
|---|---|---|
| E-commerce platform and checkout | Running the store and processing orders | Shopify, Yampi |
| Payment processors | Processing payments and preventing fraud | Mercado Pago |
| Logistics and delivery | Shipping and tracking orders | Correios, carriers and import agents |
| Cloud infrastructure and app backend | Hosting accounts and health data | Railway, United States (Virginia) |
| Analytics and crash monitoring tools | Measuring performance and fixing errors | QRing SDKs |
| Communication and customer service | Responding to requests | Email provider, WhatsApp Business |
| Marketing | Sending authorized communications | Email marketing platform |
| Consultants, accountants and lawyers | Legal compliance and defense of rights | Where strictly necessary |
| Public authorities | Compliance with a legal or court order | Upon formal request |
We may also share data in the event of a corporate reorganization, merger or acquisition, in which case the acquiring party will be bound by this policy and you will be informed in advance.
9. International data transfers
Part of our infrastructure and some of our suppliers are located outside Brazil, including in the United States, the European Union and China. This means that your personal data, including health data, may be transferred to and stored abroad.
These transfers are made on the basis of Article 33 of the LGPD and are accompanied by:
- specific contractual data protection clauses with each supplier;
- a requirement that security standards be equivalent to those applied in Brazil;
- specific and highlighted consent from the data subject, where applicable.
You may request information about the destination countries and the safeguards in place by writing to contato@halodevice.com.br.
10. Integrations with your phone's health apps
If you give permission, the Halo app can write data to Apple Health (iOS) or Health Connect (Android) and read data from those platforms.
- The integration is optional and depends on your specific authorization.
- You may revoke it at any time in your operating system settings.
- Data read from those platforms is used solely to complement your metrics inside the Halo app.
- The commitments in Section 7 apply in full.
11. How long we keep your data
| Data | Retention period |
|---|---|
| Account and health data | For as long as the account is active |
| Health data after a deletion request or withdrawal of consent | Deleted within 30 days, except for backup copies, which are deleted within 90 days |
| Inactive account | Notice after 24 months without access, and deletion within 30 days if there is no response |
| Order, invoice and payment data | 5 years, for tax purposes and for defense in the event of a claim, in accordance with Article 27 of the Brazilian Consumer Protection Code and tax legislation |
| Customer service records | 5 years |
| Application access logs | 6 months, in accordance with Article 15 of the Brazilian Internet Act |
| Marketing data | Until consent is withdrawn, with a record kept of the withdrawal |
Once these periods expire, the data is deleted or irreversibly anonymized.
12. Your rights as a data subject
Under Article 18 of the LGPD, you may at any time request:
- Confirmation that processing is taking place;
- Access to your data;
- Correction of incomplete, inaccurate or outdated data;
- Anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
- Portability of your data to another service or product provider;
- Deletion of data processed on the basis of consent;
- Information about the public and private entities with which we share data;
- Information about the possibility of not giving consent and about the consequences of refusing;
- Withdrawal of consent, at any time, free of charge and through a simple process;
- Objection to processing carried out on the basis of legitimate interest;
- Review of decisions taken solely on the basis of automated processing.
How to exercise these rights: send your request to contato@halodevice.com.br, or use the Privacy menu inside the Halo app.
We will respond in simplified form immediately or, where that is not possible, within 15 days, in accordance with Article 19 of the LGPD. We may ask for additional information to confirm your identity, solely for your own protection.
You may also file a complaint with the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd.
13. How to delete your account and your data
You can delete your account and all associated data, including health data, in two ways:
In the app: Profile, Settings, Privacy, Delete my account.
By contacting us: contato@halodevice.com.br
Deletion is permanent. Once confirmed:
- health data, history and scores are deleted within 30 days;
- backup copies are deleted within 90 days;
- only data we are legally required to retain remains, as set out in Section 11, kept under restricted access and not used for any other purpose.
If you wish, you can export your data before deletion using the portability feature.
14. Information security
We adopt technical and administrative measures consistent with Article 46 of the LGPD, including:
- encryption of data in transit (TLS) and at rest;
- password storage using hash functions;
- role-based access control and the principle of least privilege;
- strong authentication for administrative access;
- separation of identification data from health data wherever technically feasible;
- access logging for databases containing sensitive data;
- security assessment of suppliers and contractual data protection clauses;
- periodic staff training.
No system is entirely immune to incidents. For that reason we maintain a response plan, and we recommend that you use a unique password and keep the app up to date.
15. Security incidents
In the event of a security incident that may result in relevant risk or harm to data subjects, HALO will notify the ANPD and the affected data subjects within a reasonable period, in accordance with Article 48 of the LGPD, describing the nature of the data involved, the risks, the measures taken and our recommendations to the data subject.
16. Children and adolescents
The Halo app and the Halo Ring and Halo Band devices are intended for people aged 18 or over.
We do not knowingly collect data from people under 18. If we identify an account belonging to a minor without the specific and highlighted consent of at least one parent or legal guardian, as required by Article 14 of the LGPD, the account will be closed and the data deleted.
If you are a legal guardian and have identified an account in this situation, please write to contato@halodevice.com.br.
17. Scores and automated processing
The Halo app automatically calculates sleep and activity scores on a scale of 0 to 100 and displays HRV as an absolute value. These scores are generated by algorithms based on the data collected by the device.
They are wellness information and are estimates in nature. These calculations produce no legal effects and do not restrict your access to products, services, credit or employment.
You may request information about the general criteria used in these calculations, subject to commercial and industrial secrecy, under Article 20, paragraph 1 of the LGPD.
18. Halo is not a medical device
The Halo Ring and Halo Band devices and the Halo app are wellness and fitness products. They are not medical devices, they do not diagnose, treat, cure or prevent any disease, and they are not a substitute for assessment, guidance or follow-up by a qualified healthcare professional.
The information shown is an estimate and may vary depending on how the device is worn and fitted and on individual characteristics. Never make clinical decisions based solely on the app's metrics. If you have symptoms or concerns about your health, consult a healthcare professional.
19. Corporate programs and B2B customers
Where Halo is provided through a program contracted by a company, the following additional rules apply:
- The contracting company has no access to the individual health data of its employees.
- The company receives only aggregated and anonymized reports, with no possibility of re-identification, and only where the group has a minimum number of participants sufficient to prevent individual identification.
- Employee participation is voluntary and depends on the employee's own consent, given directly to HALO.
- Declining to take part may not result in any detriment to the employee.
- The employee may withdraw consent and leave the program at any time, without having to notify the company.
- With respect to individual health data, HALO remains the controller, and the contracting company acts neither as a controller nor as a processor.
20. Cookies and similar technologies
Cookies are small files stored on your device when you visit our website.
The categories we use:
| Category | Function | Legal basis |
|---|---|---|
| Strictly necessary | Login, cart, checkout, security | Legitimate interest. These cannot be disabled |
| Performance and analytics | Understanding navigation and improving the site | Consent |
| Functional | Remembering preferences and language | Consent |
| Advertising | Measuring campaigns and showing relevant ads | Consent |
Your control: the first time you visit the site, you will see a cookie notice where you can accept, decline or choose category by category. Non-essential cookies are only activated after you give consent. You can change your choice at any time through the Cookie preferences link in the site footer, or in your browser settings.
Disabling non-essential cookies does not prevent you from using the site, but it may reduce some functionality.
21. Changes to this policy
This policy may be updated to reflect legal, technical or product changes. The current version will always be available at halodevice.com.br/politica-de-privacidade, with the date it was last updated.
In the event of a significant change, in particular regarding the purposes of processing or the sharing of health data, you will be notified by email or through a notice in the app, with reasonable advance warning. Where a change requires a new basis of consent, we will ask you to give it again.
22. Contact
Privacy questions and exercise of your rights contato@halodevice.com.br Data Protection Officer: Pedro Rabelo
General support, orders and customer service contato@halodevice.com.br
HALO LTDA CNPJ 61.525.025/0001-01 Cond. Quintas da Alvorada, 118, Jardim Botânico, Brasília, Federal District, Brazil
23. Governing law and jurisdiction
This policy is governed by the laws of the Federative Republic of Brazil, in particular Law No. 13,709/2018 (LGPD), Law No. 12,965/2014 (Brazilian Internet Act) and Law No. 8,078/1990 (Consumer Protection Code).
The courts of the consumer's place of residence are elected to settle any disputes, in accordance with Article 101, I of the Brazilian Consumer Protection Code.
