HydrHealth

← Back to Home

Privacy Policy

Last updated: May 13, 2026

Effective date: May 13, 2026

1. Introduction

HydrHealth: Kidney Stone Free ("HydrHealth," "we," "our," or "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy ("Policy") explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App"), available on iOS and Android devices.

By accessing or using the App, you consent to the collection and use of information in accordance with this Policy. If you do not agree with our practices, please do not use the App.

This App is designed for users aged 16 and older and is intended primarily for a North American audience.

2. Information We Collect

2.1 Information You Provide Directly

We collect only the information necessary to operate the App. The categories of personal information you may provide include:

  • Account information: email address, username (nickname), and a profile avatar image (selected from our preset library or uploaded by you).
  • Health tracking data (self-entered): daily water intake logs, jumping/exercise duration records, pain level ratings (1–10 scale), stone size, stone strategy, and medical plan type.
  • User-generated content: kidney stone journey stories, comments, feedback submissions, and content bookmarks you choose to save.

We do not collect or store any of the following:

  • Credit card numbers, bank account details, or other financial account information
  • Government-issued identification numbers (e.g., Social Security Number, passport number, driver's license)
  • Real name, physical address, or mailing address
  • Phone numbers
  • Precise date of birth, gender, or age
  • Geolocation data or GPS coordinates
  • Biometric data (e.g., fingerprints, facial recognition)
  • Genetic data

2.2 Health-Related Information

The App may collect health-related information you voluntarily enter. All such information is:

  • Provided by you on a self-reporting basis
  • Stored as general health tracking data, not as protected health information (PHI) under HIPAA
  • Used solely to provide you with tracking, analytics, and educational features within the App

HydrHealth is NOT a HIPAA-covered entity. We do not act as a healthcare provider, health plan, or healthcare clearinghouse. The App does not create, store, or transmit protected health information (PHI) as defined under HIPAA.

2.3 Automatically Collected Information

When you use the App, we and our third-party service providers may automatically collect:

  • Device information: device type, operating system and version, unique device identifiers, app version
  • Usage data: app session length, pages/screens visited, feature usage, click/tap patterns
  • Log data: IP address, browser type, error logs, crash reports, performance metrics
  • Local storage data: app preferences, cached content, and encrypted nutrition keys stored locally on your device

2.4 Information from Third Parties

We may receive limited information from third-party services you use to sign in, including:

  • Apple Sign In: email address (if you choose to share) and Apple user identifier
  • Google Sign In: email address and basic profile information (nickname, avatar URL)

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, maintain, and improve the App's features and functionality
  • Create and manage your user account, including authentication and session management
  • Enable health tracking features (water intake, exercise, pain level monitoring) and generate personal reports
  • Display personalized content, including diet guidance, nutrition recommendations, and knowledge articles
  • Process and manage Pro subscriptions through the App Store or Google Play Store
  • Enable social features, including posting and viewing journey stories, comments, and likes
  • Send you transactional communications (e.g., email verification codes, subscription confirmations)
  • Respond to your support requests, comments, and feedback
  • Detect, prevent, and address fraud, abuse, security issues, and technical problems
  • Generate aggregated, anonymized statistical data for internal research and product improvement
  • Comply with legal obligations and enforce our Terms of Service

4. Legal Basis for Processing (GDPR/UK GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal information based on the following legal bases:

  • Performance of contract: to provide the App's core functionality you requested
  • Legitimate interests: to improve and secure the App, prevent fraud, and analyze usage
  • Consent: for optional marketing communications and certain analytics features
  • Legal obligation: to comply with applicable laws and regulations

5. Data Storage, Security, and Retention

5.1 Storage

Your account and user data are stored securely on servers provided by Supabase, Inc., using PostgreSQL databases with Row Level Security (RLS) policies enabled at the database level. Your data may be processed and stored in the United States.

5.2 Security Measures

We implement industry-standard technical and organizational measures to protect your information, including:

  • End-to-end TLS/HTTPS encryption for all data in transit
  • Row Level Security (RLS) policies ensuring each user can access only their own data
  • XOR-based content obfuscation for sensitive article and story payloads transmitted through Edge Functions
  • AES-256 encryption for nutrition data at rest (where applicable)
  • Secure authentication via OTP email verification and OAuth (Google/Apple Sign In)
  • Role-based access control and service-role keys restricted to server-side functions only

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

5.3 Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected:

  • Account information: retained for the lifetime of your account plus 30 days after deletion
  • Health tracking data: retained for the lifetime of your account; deleted upon account closure
  • User-generated content: retained until you delete it or request removal
  • Usage and log data: retained for up to 12 months for analytics and security purposes

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following limited circumstances:

6.1 Service Providers

We share information with trusted third-party service providers who assist us in operating the App, subject to confidentiality and data protection obligations:

  • Supabase, Inc. — database hosting, authentication, and Edge Function execution
  • Cloudflare, Inc. — object storage (R2), CDN, and DDoS protection
  • RevenueCat, Inc. — subscription management and receipt validation
  • Apple Inc. / Google LLC — app distribution and in-app purchase processing
  • Resend — transactional email delivery (verification codes, receipts)

6.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal requests (e.g., subpoenas, court orders, or government demands), or to:

  • Comply with legal obligations
  • Protect and defend our rights or property
  • Prevent or investigate possible wrongdoing in connection with the App
  • Protect the personal safety of users or the public

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of such transaction. We will notify you of any such change and any choices you may have regarding your information.

6.4 With Your Consent

We may share your information with third parties when you give us explicit consent to do so.

7. Your Rights and Choices

7.1 All Users

Regardless of your location, you may:

  • Access and update: review and update your profile information (email, nickname, avatar) through the App's Me section
  • Delete your account: request deletion of your account and associated data by contacting support@hydrhealth.com
  • Delete content: delete journey stories, comments, and feedback you have posted at any time
  • Export your data: request a copy of your personal data in a portable, machine-readable format
  • Cancel subscriptions: cancel your Pro subscription at any time through your device's app store settings

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

  • Right to know what personal information is collected, used, and disclosed
  • Right to request deletion of personal information
  • Right to opt out of the "sale" or "sharing" of personal information (we do not sell your personal information)
  • Right to non-discrimination for exercising your privacy rights
  • Right to correct inaccurate personal information

To exercise these rights, please contact us at support@hydrhealth.com, We will respond to verifiable consumer requests within 45 days.

7.3 EEA/UK Residents (GDPR)

If you are located in the EEA or UK, you have the right to:

  • Request access to, rectification of, or erasure of your personal data
  • Restrict or object to processing of your personal data
  • Data portability
  • Withdraw consent at any time (where processing is based on consent)
  • Lodge a complaint with your local supervisory authority

7.4 Opt-Out of Communications

You may opt out of marketing communications at any time by following the unsubscribe instructions in the email or by contacting support. Transactional communications (e.g., verification codes, subscription confirmations) cannot be opted out of.

8. Children's Privacy

The App is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@hydrhealth.com. If we become aware that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to delete that information.

9. International Data Transfers

If you are accessing the App from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located. The data protection laws of the United States may not be as comprehensive as those in your country. By using the App, you consent to the transfer of your information to the United States.

10. Third-Party Links and Services

The App may contain links to third-party websites, services, or content that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. We strongly advise you to review the privacy policy of every site you visit.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the App after any changes constitutes your acceptance of the new Privacy Policy. We encourage you to review this Policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

  • Email: support@hydrhealth.com
  • In-app: Me → Contact Support

For privacy-related inquiries specifically, you may also contact:

  • Privacy inquiries: support@hydrhealth.com