1. Introduction and scope

Effective date: 10/16/2026

This Privacy Policy explains how Nuvio, Inc. (“Nuvio,” “we,” “us”) collects, uses, shares, and protects information when you use the Nuvio Connect mobile app, the Nuvio mobility device, and related services (together, the “Services”).

Nuvio Connect helps you and the people you care about understand how someone is getting around: walks, walking pace, active time, and endurance. Because this is personal information about a person’s body and movement, we treat it as health information and handle it with extra care. Our Consumer Health Data Privacy Policy in Section 9 adds detail required by certain state laws.

The Services are a general wellness product. They are not a medical device and do not diagnose, treat, or prevent any disease. Nuvio is not a healthcare provider, and this information is not protected health information under HIPAA.

This policy applies to people in the United States. It does not cover third-party apps or websites you reach through the Services.

The short version:

• We collect movement data from the Nuvio device to show walking and activity insights.
• We share it only with people you choose and with vendors who help us run the Services.
• We do not sell your data, and we do not use health data for advertising.
• You can see, download, and delete your personal data at any time. De-identified data that can no longer be linked to you may be kept to improve our algorithms (see Section 6).

2. Information we collect

Consumer health data. Mobility and activity data, and inferences we draw from it (for example, whether walking pace is within a typical range), are consumer health data. We collect it only with your consent, given when you connect a device. That consent covers using it to provide the Services and to train and improve our algorithms.

Camera. The app uses your camera only to scan QR codes for pairing a device or accepting an invite. We do not store camera images.

Location. The Nuvio device and app do not collect precise location. We collect gait and mobility data only, never GPS.

We do not collect Social Security numbers, financial account information, or biometric identifiers such as face or fingerprint data.

3. How we use information

We use information to provide the Services you ask for and for nothing unrelated. Specifically, we use it to:

• Create and secure your account, verify your email, and reset your password.
• Pair and manage Nuvio devices.
• Calculate and display walks, walking pace, active time, endurance, trends, and weekly summaries.
• Let you share data with the people you choose, and manage invites and ownership transfers.
• Send service messages, such as verification codes, invite notices, and important changes.
• Provide educational content in the Learn section.
• Fix bugs, keep the Services secure, and prevent fraud and abuse.
• Develop, train, and improve our algorithms and the Services using mobility and activity data that we de-identify first.
• Comply with law and enforce our Terms of Service.

We do not use consumer health data for advertising, and we do not use it to make decisions about insurance, employment, credit, or housing.

If we de-identify data, we keep it in de-identified form, do not try to re-identify it, and require recipients to do the same.

4. How we share information

We share information only in the ways below. We do not sell personal information or consumer health data, and we do not share it for targeted advertising.

People you choose. When you send an invite (by code, link, or QR code) and someone accepts it, they can see the data you chose to share, such as walks, walking pace, and weekly summaries. Invite codes expire, and you can remove an invite or a person’s access at any time from Share. Removing access stops future viewing but cannot undo what they already saw.

Account owners and managers. If someone set up a device for you, they can see your data until ownership transfers to you (Section 5).

Service providers. We use vendors for cloud hosting, email delivery, crash reporting, analytics, and customer support. They process data only on our instructions and under contracts that limit their use.

Legal and safety. We may disclose information to comply with law, a valid subpoena or court order, or to protect the rights, safety, or property of users, Nuvio, or others. Where allowed, we will notify you first.

Business transfers. If Nuvio is involved in a merger, acquisition, or sale of assets, information may transfer to the new owner, who must honor this policy. We will notify you before your data becomes subject to a different policy.

With your consent. We share information in other ways only with your separate, express consent.

5. Setting up a device for someone else

You can set up a Nuvio device for another adult, such as a parent. You then manage their data until they take over the account.

You need their permission. Before you set up a device for someone else, you must have their consent, or the legal authority to act for them (for example, as a guardian or under a power of attorney). You confirm this when you add them. We may suspend a managed account if we learn this consent or authority is missing.

What we collect. For the person you set up, we collect the information in Section 2: their name, relationship to you, an optional email address, and their mobility and activity data.

Ownership transfer. If you add their email and they create a Nuvio account with it, they become the owner of their data and their account. If they don’t have an account yet, we send them an invitation. After transfer, they control who can see their data, including whether you keep access. You can also start a transfer later from the Menu.

Their rights. The person whose data is collected can contact us at any time to see, correct, or delete their data, or to stop collection, even before ownership transfers. We will verify their identity first.

6. Retention and deletion

We keep information only as long as needed to provide the Services or meet legal obligations.

• Active accounts: while your account is open, we keep account information and raw gait and mobility data only as long as reasonably necessary to provide the Services, including showing your history. We review stored data periodically and delete or de-identify raw data we no longer need.
• Deleted accounts: when you delete your account, we delete your data from our systems right away, except where law requires us to keep it. Copies in encrypted backups are overwritten within 90 days. De-identified data already used to train our algorithms is kept, but it can no longer be linked to you.
• Removed devices: removing a device stops new data collection. Past data stays in the account until you delete it.
• Inactive accounts: we may delete accounts with no sign-in for 24 months, after notifying you by email.

People you shared with lose access when your data is deleted.

7. Security

We protect information with encryption in transit and at rest, access controls that limit staff access to those who need it, and regular security reviews. Passwords are stored hashed, and sensitive changes such as email and password updates require a verification code.

No system is perfectly secure. If a breach affects your information, we will notify you, and where required, regulators including the FTC, as required by law.

8. Your choices and rights

Wherever you live in the US, you can:

• Access and download your data, including a list of the people and companies we shared it with.
• Correct inaccurate account information in Profile.
• Delete specific data or your whole account from the Menu, or by contacting us.
• Withdraw consent to collecting or sharing health data by removing your device, removing shared access, or deleting your account.
• Control sharing by removing invites or people from Share at any time.
• Manage notifications in your phone’s settings.

To make a request, use the in-app options or email [email protected]. We verify your identity before acting, usually by confirming a code sent to your account email. You can use an authorized agent; we will ask for proof of their authority.

We respond within 45 days, and may extend once by 45 days if needed, telling you why. If we deny a request, you can appeal by replying to our decision; we answer appeals within 45 days. We will not treat you differently for exercising your rights.

9. State-specific rights and Consumer Health Data Privacy Policy

Consumer Health Data Privacy Policy (Washington, Nevada, Connecticut, and similar laws)

This section is our consumer health data privacy policy under the Washington My Health My Data Act, Nevada SB 370, Connecticut law, and similar state laws.

• Data we collect: mobility and activity data, and inferences about mobility, as described in Section 2.
• Sources: the Nuvio device, you, and the person who set up the device.
• Purposes: to provide the Services, as described in Section 3.
• Who receives it: people you choose, the account manager described in Section 5, and service providers (Section 4).
• Consent: we collect consumer health data only with your consent, and share it with people other than service providers only with separate consent.
• No sale: we do not sell consumer health data.
• Your rights: to confirm whether we collect your data, access it, see a list of all third parties and affiliates who received it, withdraw consent, and delete it. Make requests as described in Section 8. Washington residents may appeal a denial and contact the Washington Attorney General.

California

If the California Consumer Privacy Act applies to us, California residents have the right to know what personal information we collect, use, and disclose; to delete and correct it; to limit use of sensitive personal information; and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we use sensitive personal information only for purposes allowed by law. The categories we collect are listed in Section 2, sources in Section 2, purposes in Section 3, and recipients in Section 4.

Other states

Residents of states with comprehensive privacy laws, such as Colorado, Virginia, Texas, Oregon, and others, have similar rights to access, correct, delete, and port their data, and to appeal. Use the process in Section 8.

10. Minors

The Services are only for adults 18 and older, and we do not knowingly collect personal information from anyone under 18. You may not set up a device for anyone under 18. If we learn we have collected a minor’s information, we will delete it. Parents who believe this has happened can contact us at [email protected].

11. Changes and contact

We may update this policy. For material changes, especially any new use or sharing of health data, we will notify you in the app or by email before the change takes effect and ask for consent where required. The effective date at the top shows the latest version.

Questions or requests:

Nuvio, Inc.
Attn: Privacy
[email protected]