Privacy Policy

DuoVitals is an independent third-party application. We are not affiliated with, endorsed by, or sponsored by Oura Health Oy or the Oura Ring product.

Contact: hello@duovitals.app

When you connect your Oura account via OAuth, we access data from the official Oura API based on the permissions you grant.

Account & profile

• Email address
• Age, biological sex, height, and weight
• Oura user identifier

Daily health metrics

• Sleep, readiness, and activity scores and contributors
• Detailed sleep periods (stages, HRV, heart rate, bedtime)
• Daily stress and resilience data
• Cardiovascular age and pulse wave velocity
• VO₂ max estimates

Heart rate

• Heart rate samples throughout the day (typically 5-minute intervals)

Workouts

• Activity type, intensity, duration, calories, and distance

SpO₂

• Nightly blood oxygen averages and breathing disturbance index

Tags & sessions

• Tags you log in the Oura app (e.g. caffeine, alcohol, sick)
• Meditation and breathwork session data

Ring information

• Ring hardware type, size, color, firmware version
• Battery level and charging status

Technical data

• Encrypted OAuth access and refresh tokens
• Session cookies for authentication
• Partner link relationships (invite codes, partnership status)
• Notification delivery logs (to prevent duplicate emails)

We use your data solely to:

• Display your Oura health statistics in your dashboard
• Share your statistics with your explicitly linked partner
• Cache data for fast dashboard loading and offline resilience
• Send optional email notifications when your partner's scores update
• Send optional weekly email recaps of your recent trends
• Maintain your account, sync data, and operate the Service

We do not use your health data for advertising, sell your data to third parties, or use it for purposes unrelated to the Service.

Your health data is shared only with the partner you explicitly link via invite code. Linking is voluntary and you may unlink at any time from Settings.

We may share limited data with service providers who help us operate the Service:

• Hosting provider — application and database hosting
• Resend — transactional email delivery when enabled: partner score notifications and optional weekly digest recaps
• Oura Health Oy — we retrieve your data from Oura via their official API; we do not send data back to Oura

A current list of subprocessors and data-processing details is available on our Subprocessors page.

We may disclose information if required by law, court order, or to protect the rights and safety of users.

• Oura OAuth tokens are encrypted at rest using AES-256-GCM
• All data in transit is protected via HTTPS/TLS
• OAuth tokens are never exposed to your browser or partner's browser
• Session cookies are HTTP-only and secure in production
• Database access is restricted to the application server

No method of transmission or storage is 100% secure. We implement reasonable safeguards but cannot guarantee absolute security.

Cached Oura data is retained while your account is active to provide the Service.

Delete your account in Settings to remove your profile, OAuth tokens, cached Oura data, and partner links. Deletion is scheduled with a 30-day grace period and signs you out on every device; signing back in before the window ends cancels it. After the window, all data is permanently purged.

Ending your browser session ("Disconnect session") logs you out but keeps your account and cached data until you delete your account or revoke DuoVitals from your Oura account at cloud.ouraring.com.

Notification logs used to prevent duplicate emails are automatically purged after 90 days.

You may:

• Export your data — download a JSON copy from Settings
• Delete your account — schedule permanent removal (with a 30-day grace period) from Settings
• Revoke Oura access — remove DuoVitals from your connected apps at cloud.ouraring.com
• Unlink your partner — stop sharing data immediately from Settings
• Manage email preferences — toggle partner score alerts and weekly digest in Settings

Depending on your location, you may have additional rights under GDPR, CCPA, or similar laws (access, correction, portability, objection). Contact hello@duovitals.app for help exercising these rights.

We use a single session cookie (duovitals_session) to keep you logged in. It is HTTP-only and secure in production. This cookie is essential and always set when you sign in.

Optional analytics: we may load Plausible Analytics only if you choose "Accept analytics" in our cookie banner. Plausible collects anonymous page-view statistics — no cross-site tracking, no advertising cookies, and no personal health data. If you choose "Essential only," Plausible is not loaded.

Your choice is stored locally in your browser (duovitals_analytics_consent). You can change it by clearing site data or contacting us.

The Service is not intended for users under 18. We do not knowingly collect data from children. Contact us if you believe a child has provided data and we will delete it.

Your data may be processed and stored on servers located outside your country. By using the Service, you consent to this transfer.

We may update this Privacy Policy from time to time. We will post the revised policy on this page with an updated date. If changes are material, we may ask you to re-accept the updated Terms and Privacy Policy before continuing to use the Service.

This Service uses the Oura API. Your use of Oura data is also subject to Oura's Terms and Conditions and Oura's Privacy Policy.

Questions about this Privacy Policy? Email hello@duovitals.app.

DuoVitals · duovitals.app