1. Who we are

Hello Nila is operated by Ask Nila Solutions Limited, a company incorporated in British Columbia, Canada, trading as "Nila" ("Nila," "we," "us," "our"). For the personal data described in this notice, we're the organization responsible for your information (the data controller under GDPR / UK GDPR; the equivalent role under PIPEDA and BC's Personal Information Protection Act).

Privacy Officer. In line with PIPEDA Principle 1 (Accountability) and Quebec's Law 25, Ask Nila Solutions Limited has designated a Privacy Officer who's responsible for our compliance with this notice. You can reach the Privacy Officer at privacy@hellonila.com.

How to contact us. By email at info@hellonila.com (general) or privacy@hellonila.com (privacy and data requests). By post: Ask Nila Solutions Limited, Victoria, British Columbia, Canada. (A street address is available on written request for formal legal notices.)

2. Data we collect

We collect the following categories of personal data:

Account data: name or display name, email address, password (hashed), and optional profile details such as journey stage, bio, and avatar.
Content you create: community posts, comments, upvotes, symptom logs, check-ins, journal entries, goals, milestones, suggested research, reports of content, and partner inquiries.
Newsletter data: email and name (if you subscribe).
Support and correspondence: messages you send us.
Nila chat & AI-assisted tools: the questions and context you send to the Nila chat, and the inputs you provide to Premium tools such as the "draft a letter for your GP" feature, are processed to generate a response.

See section 5a below for how AI providers are involved.
Shared pathway snapshots: if you create a shareable link from your pathway (/shared/<token>), we generate a token and store a point-in-time snapshot of the non-identifying summary you chose to share (your current focus area, pathway answers, and aggregate signals).

We don't include your name, email, journal entries, or chat history in shared snapshots. You can revoke the link at any time from your account.
Usage and device data: log data, IP address, browser type, device identifiers, pages visited, and approximate location, collected via cookies and our hosting provider.
Apple Health / device metrics (optional): if you turn on health sync, you choose which of seven types to share: steps, sleep, heart rate variability, resting heart rate, heart rate, active calories burned, and exercise. We store daily summaries only for the types you select, never raw, minute-level, or continuous readings. See section 11b.
Subscription metadata: plan, status, and billing period (for Premium members). Card details are handled directly by our payment processor (Stripe), we never see or store them.

3. How we use your data

To create and manage your account and provide the Service;
To enable community features (posts, comments, upvotes, reporting);
To deliver newsletters and product updates you've signed up for;
To respond to support requests and partner inquiries;
To prevent fraud, abuse, and security incidents;
To improve the Service, including aggregated, non-identifying analytics;
To comply with legal obligations.

4. Legal bases for processing

For users in Canada, we rely on PIPEDA and BC's Personal Information Protection Act (PIPA), which generally require meaningful consent for the collection, use, and disclosure of personal information. For users in the UK and EEA, we rely on the following legal bases under GDPR and UK GDPR:

Contract: to provide the Service and process subscriptions you've purchased.
Legitimate interests: to keep the Service secure, improve it, and communicate with you about your account.
Consent: for newsletter sign-ups and any non-essential cookies, where required.
Legal obligation: to meet tax, accounting, and regulatory requirements.

5. Who we share data with

We share personal data only with:

Service providers / subprocessors who help us run Nila, includingSupabase, Inc. (United States), which hosts our application database, authentication, and file storage; our email delivery provider; and analytics tooling. They're contractually bound to protect your data and act only on our instructions.
PostHog, Inc. (United States), our product analytics provider, used on web and Android to understand aggregate feature usage and improve the Service. PostHog doesn't run inside the iOS app. Session recording and autocapture are disabled on any page containing symptom logs, journal entries, or community post content.
Stripe, Inc., our payment processor, for processing Premium subscriptions, recurring billing, invoicing, and fraud prevention. We pass Stripe your email address and the plan you selected; Stripe collects and stores your payment-card details directly, we don't see or store them. See Stripe's Privacy Policy.
AI model providers, accessed through an AI gateway, for generating responses in the Nila chat and Premium AI-assisted tools.

When you send a message, the text of that message (and recent conversation context) is transmitted to a large language model operated by Google (Gemini) or OpenAI (GPT) so it can generate a reply.

We don't pass your account email, billing details, or unrelated profile data with these requests. See section 5a for more detail.
Professional advisers such as legal and accounting professionals, when needed.
Authorities when required by law, court order, or to protect our rights and safety.

We don't sell, rent, trade, or licence your personal data to advertisers, brokers, or any third party for their own marketing. We have never done this and have no plans to. Per our published principles. We won't pass member-level data to affiliates or sponsors at any price.

Automated decision-making. We don't use your personal data to make automated decisions that produce legal or similarly significant effects about you (Quebec Law 25 disclosure).

5a. AI-assisted features

Parts of Nila use artificial intelligence to help you, including the Nila chat and the Premium "draft a letter for your GP" tool. When you use one of these features:

Your message text and recent conversation context are sent through an AI gateway to a third-party large language model (currently Google Gemini for free conversations and OpenAI GPT for Premium conversations and the GP letter drafter). The model returns a response, which we display to you.
Providers process this data on our behalf as service providers.
We retain a record of your chats and drafted letters tied to your account so the feature can show conversation history and so we can investigate abuse, safety issues, or quality problems. You can delete your chat history from your account, or close your account entirely, at any time.
AI responses can be incomplete, out of date, or wrong. They aren't medical advice. Please don't paste another person's identifying information (full name, contact details, medical record numbers) into the chat or letter tool, since that content will be sent to a third-party model on your behalf.
We don't use AI to make automated decisions that produce legal or similarly significant effects about you (Quebec Law 25).

6. International transfers

Hello Nila is operated from British Columbia, Canada. Some of our service providers, including Stripe, Inc. (United States) for payments, Supabase, Inc. (United States) for database, authentication, and file storage, and our email delivery provider (United States), and the AI model providers used by our AI-assisted features (Google and OpenAI, principally United States), process personal data outside Canada. Where personal data is transferred internationally, we rely on appropriate safeguards (provider contracts, Standard Contractual Clauses, or equivalent mechanisms) and on the comparable-protection principle under PIPEDA. Quebec residents are notified, in line with Law 25, that their personal information may be communicated outside Quebec (principally to the United States) for the purposes described in this notice.

7. How long we keep data

We keep your personal data for as long as your account is active and for a reasonable period afterward to comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymize it.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, withdraw consent, and request data portability. Canadian users have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada and (for BC residents) the Office of the Information and Privacy Commissioner for BC. Quebec residents may also lodge a complaint with the Commission d'accès à l'information du Québec. UK and EEA users have the right to lodge a complaint with their local supervisory authority. We aim to respond within 30 days.

To exercise any of these rights, email our Privacy Officer at privacy@hellonila.com.

9. Security

We use appropriate technical and organizational measures to protect your data, including encryption in transit, hashed passwords, role-based access controls, and row-level security in our database. No system is perfectly secure, but we work continually to keep your data safe.

Breach notification. If a breach of security safeguards creates a real risk of significant harm to you, we'll notify you and the Office of the Privacy Commissioner of Canada without unreasonable delay, in line with PIPEDA's mandatory breach-reporting requirements.

For Quebec residents, we'll also notify the Commission d'accès à l'information as required by Law 25.

9a. Marketing email and CASL

For commercial messages sent to recipients in Canada, we comply with Canada's Anti-Spam Legislation (CASL). We send marketing email (such as our newsletter) only with your express consent at sign-up, identify Nila as the sender with our contact details, and include a working unsubscribe link in every commercial message that takes effect within 10 business days. You can withdraw consent at any time by clicking unsubscribe or emailing privacy@hellonila.com.

10. Cookies

We use a small number of cookies and similar technologies. Essential cookies keep you signed in and the Service functioning. Analytics cookies, where used, help us understand how the Service is used in aggregate. Marketing cookies are limited to one Google Ads measurement tag that tells us when someone who clicked our ad becomes a member; it only loads if you accept marketing cookies in our consent banner, and you can change that choice any time via Cookie preferences in the footer. You can also control cookies through your browser settings. Google's privacy commitments for this measurement are at business.safety.google/privacy.

11. Children

Hello Nila is intended for adults aged 18 or older moving through perimenopause and menopause. We don't direct the Service to, or knowingly collect personal data from, anyone under 18. If you believe someone under 18 has provided personal data, please contact privacy@hellonila.com and we'll delete it.

11a. Sensitive health information

Some information you choose to share with Nila, including symptom logs, check-ins, journal entries, mood ratings, and notes about treatments, medications, or neurodivergence, is sensitive personal information about your health. We treat this data with extra care: it's stored under row-level access controls so only you (and, where strictly necessary, designated administrators investigating a safety or abuse issue) can read it; it isn't sold, rented, or shared with advertisers, brokers, sponsors, or affiliates; and it isn't used to make automated decisions about you. Hello Nila is a wellbeing and education platform, not a medical record, and isn't a "covered entity" under HIPAA or a "health information custodian" under PHIPA or equivalent regimes. You can export, delete, or close your account at any time from your account page.

11b. Apple Health and device metrics (optional)

Health sync is an optional feature. It is off by default — nothing is requested, read, or stored until you actively openthe sync settings , choose the categories you want to share, and tap Connect. Nothing about the rest of your account or your Nila experience depends on it.

You choose what syncs from these seven types. You can turn each type on individually:

Steps: daily step count.
Sleep: hours asleep per night.
Heart rate variability: one daily summary, in milliseconds.
Resting heart rate: one daily summary, in beats per minute.
Heart rate: average heart rate across the day.
Active calories burned: daily calories burned through movement.
Exercise: daily minutes of exercise.

Whatever you select, we only ever store daily summaries: one summary value per type per day. We don't collect, store, or display raw, minute-level, or continuous readings, for any data type, regardless of which types you choose. This applies to all seven types.

Because of how iOS handles permissions, we can't always confirm exactly which types were granted. The operating system doesn't give us a precise "you have access to X but not Y" answer. So rather than guess, we only store and display data for the categories that actually return values when we sync. If a type you selected doesn't come back, you'll see it marked as "not connected — nothing came back," never framed as a denial or an error on your part.

This data travels directly from Apple Health or Google Health Connect to the app on your device, and from there to our servers. It's never sent to Median's servers, and Median never stores it.

All synced metrics are treated as sensitive health information under section 11a. You can see exactly what's connected, turn any category off individually, or disconnect everything and delete all previously synced data at any time from the same sync settings page — without affecting the rest of your account. Deleting your account removes synced metrics along with everything else.

What we never do with health data. Data read from Apple Health or Google Health Connect is used solely to show you your own numbers alongside your own logs inside Nila. It is never used for advertising or marketing, never used for use-based data mining, profiling, or research, and never sold, rented, or disclosed to advertisers, data brokers, sponsors, affiliates, or any third party for those purposes. We don't write anything back to Apple Health or Google Health Connect, and we don't store health data in iCloud. Only you can read your synced rows; access is enforced at the database level.

12. Changes to this notice

We may update this notice from time to time. Material changes will be communicated through the Service or by email.

Before adding any health-sync type or expanding how we use health data, we'll update this notice and ask for your consent before collecting or using that additional data.

13. Contact

For privacy questions or requests, email our Privacy Officer at privacy@hellonila.com. For everything else, email info@hellonila.com. See also our Terms of Service and Refund Policy.

Privacy Notice

In plain English

The short version, before the legal one.