Privacy Policy

1. Introduction

Welcome to HALO (Holistic Ascension Life Optimization). This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the HALO application at app.halo.fit and our marketing site at halo.fit (collectively, the "Service").

We are committed to protecting your privacy and ensuring that your personal data is handled responsibly and in compliance with the General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws.

Please read this Privacy Policy carefully. By creating an account or using the Service, you acknowledge that you have read and understood this policy.

Data Controller:
Khejan, LLC, d/b/a HALO
Contact: privacy@halo.fit

2. Data We Collect

We collect only the data necessary to provide and improve the Service. The categories of personal data we process are set out below.

2.1 Account Data

When you create an account, we collect:

• Name — to personalise your experience
• Email address — for authentication, account recovery, and essential communications
• Password — stored in hashed form only; we never store or have access to your plaintext password

2.2 Health and Wellbeing Data (Special Category Data)

If you choose to use our health tracking features, we may collect:

• Hydration logs — daily water intake amounts and timestamps
• Fitness data — exercises, workout plans, session logs including sets, reps, and weights
• Mood logs — mood levels, notes, and tags
• Sleep logs — sleep hours, bedtime, wake time, and quality ratings
• Pain logs — body location, sensation type, intensity, and notes
• Nutrition data — dietary tracking information
• Energy levels — daily energy tracking
• Reproductive and sexual-health data — if you choose to use the Cycle tracker: menstrual cycle dates, ovulation and fertility indicators, related symptoms, and notes

Important: Health data constitutes "special category data" under Article 9 of the GDPR. We process this data only with your explicit consent, which you provide when you voluntarily enter this information into the Service. You are never required to use these features, and you may stop using them at any time.

Reproductive and sexual-health data is especially sensitive. We collect it only after you give separate, explicit opt-in consent on a dedicated consent screen within the Cycle tracker — ordinary use of the Service does not enable this collection. You may withdraw this consent at any time, which stops further collection. This data is stored with field-level encryption, and it is never sold, shared with third parties, or used for advertising.

2.3 Financial Data

If you choose to use our wealth management features, we may collect:

• Financial accounts — account names, types, and balances
• Transactions — transaction descriptions, amounts, dates, and categories
• Budgets — budget categories and amounts
• Recurring expenses — expense descriptions, amounts, and schedules
• Debt information — debt balances and payment tracking

Financial data receives enhanced security protections as described in Section 7.

2.4 Goals, Habits, and Tasks Data

• Goals — titles, categories, SMART framework fields, target dates, milestones, and progress
• Habits — habit names, schedules, tracking entries, and streak data
• Tasks — task lists, task details, priorities, due dates, time tracking, and subtasks

2.5 Family Data

If you choose to use family-related features, we may collect:

• Family member information — names and relevant details you choose to enter about family members

You are responsible for ensuring that you have the appropriate authority or consent to enter information about other individuals.

2.6 Home Data

If you choose to use home management features, we may collect:

• Home maintenance data — maintenance schedules, tasks, and related notes

2.7 Technical Data

We automatically collect limited technical data necessary to operate the Service:

• Session data — essential session cookies required for authentication and security
• Server logs — IP addresses, browser type, and access timestamps retained for security purposes
• Website analytics — when you visit our public website, we record the page requested, the referring website, any campaign tag in the link you followed, your browser and device type, your operating system, and your browser’s preferred language. Your IP address is used only to generate a daily, one-way identifier that lets us count returning visits within a single day; it is not stored with this record, and the identifier changes every day, so it cannot be used to recognise you tomorrow or to build a profile over time. This applies to our website only — the HALO application and the mobile apps are not covered by it.
• Sign-up source — if you create a HALO account after following a link that carries one of our campaign tags, we keep that tag and the page you first landed on with your account, so that we can tell which of our own campaigns lead to sign-ups. It is stored only with your account, included when you export your data, deleted with your account, and never shared with an advertising network or any other third party. No cookie is used to carry it.
• Meta pixel — to measure our advertising on Facebook and Instagram, our public website and our sign-up page can use the Meta pixel, a tool provided by Meta Platforms. When it runs, it tells Meta that you visited our public website, which pages you viewed, and — if you go on to create a HALO account — that an account was created, together with the technical information your browser sends with any web request (such as your IP address and browser type) and cookies Meta uses to recognise browsers (such as _fbp). We do not send Meta your name, email address, or anything you put into HALO. If you are in the European Economic Area, the United Kingdom, or Switzerland — or we cannot tell where you are — the pixel runs only if you choose “Allow”. Elsewhere it runs unless you opt out or your browser sends a Global Privacy Control signal. You can change your choice at any time with “Cookie choices” at the foot of every page on our website. Meta processes this information under its own privacy policy, and may use it for its own purposes, including advertising.

3. Lawful Basis for Processing

Under the GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:

Where we rely on consent, you have the right to withdraw that consent at any time (see Section 9). Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

4. How We Use Your Data

We use your personal data exclusively for the following purposes:

• Providing the Service — displaying your dashboards, tracking your health, finances, goals, habits, tasks, and other features you choose to use
• Account management — authentication, account recovery, and essential account-related communications
• Security — protecting against unauthorised access, fraud, and other security threats
• Service improvement — aggregated, anonymised analytics to improve features and fix issues (no individual tracking)
• Measuring our own marketing — counting, in aggregate, how many people reached our public website and which of our own campaigns or channels brought them, so that we can understand how the site performs and where we are visible. This is a count of arrivals, never a profile of a person: no individual is identified, nothing is shared with an advertising network or any other third party, and the daily identifier described in Section 2 cannot connect one visit to the next. The one exception is described under “Sign-up source” in Section 2: if you go on to create an account, the campaign tag you arrived with is kept with that account.
• Measuring our ads — where your cookie choice allows it, using the Meta pixel (see Section 2.7) to learn whether our Facebook and Instagram ads bring people to our website and lead to sign-ups.

We do not use your data for:

• Advertising or marketing profiling based on anything you put into HALO
• Selling to third parties
• Automated decision-making or profiling (see Section 11)
• Any purpose incompatible with those listed above

5. Third-Party Services

We share data with a limited number of third-party service providers, strictly as necessary to operate the Service. We do not sell, rent, or trade your personal data.

Each third-party provider processes data under their own privacy policy and in accordance with their obligations as data processors. We have data processing agreements in place with these providers as required by Article 28 of the GDPR.

First-party systems. Real-time features (such as live updates to shared data) are served from our own infrastructure and are not routed through a third-party messaging service. Where your organisation uses HALO’s client-portal integration, team and membership information is shared only with systems operated by Khejan, LLC (our own company) and not with an external third party.

Google Calendar integration is entirely optional. If you connect your Google Calendar, you may disconnect at any time from Settings, which revokes our access and deletes the stored OAuth tokens.

Google API Services — Limited Use. HALO’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google APIs — Google Sign-In and the Google Calendar API — is:

• used only to provide and improve the sign-in and calendar synchronisation features that are visible to you within HALO;
• never transferred to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition (in which case we will give notice);
• never used for advertising, including personalised, retargeted, or interest-based advertising;
• never read by humans, except where you give explicit consent for us to investigate a specific issue, where required for security purposes or to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

Our website analytics are collected and stored entirely on our own servers, and no third party receives them. The one exception on our public website and sign-up page is the Meta pixel described in Section 2.7, which runs only as your cookie choice allows. Nothing inside the HALO application — your health, finances, tasks, journal, or any other content — is ever sent to Meta or any other advertising network.

We do not use:

• Analytics services that track individual users
• Tracking pixels or advertising tools inside the HALO application

6. Cookies

In the HALO application we use only essential session cookies that are strictly necessary for the Service to function. These cookies:

• Maintain your authenticated session
• Provide CSRF (cross-site request forgery) protection
• Do not track you across websites
• Do not collect data for marketing or advertising
• Expire when your session ends or after a reasonable inactivity period

Because these cookies are strictly necessary for the operation of the Service, they do not require consent under the ePrivacy Directive.

On our public website and sign-up page we also store your cookie choice (halo_ad_consent, kept for six months), and — only when that choice allows it — the Meta pixel sets Meta’s own advertising cookies. These are not essential, so in the European Economic Area, the United Kingdom, and Switzerland they are set only with your consent. See our Cookie Policy.

7. Data Security

We take the security of your data seriously, particularly given the sensitive nature of health and financial information.

Technical Measures

• Encryption in transit — all data transmitted between your device and our servers is encrypted using TLS (HTTPS)
• Encryption at rest — all stored data is encrypted at rest on our servers
• Password hashing — passwords are stored using strong, one-way hashing algorithms and are never stored in plaintext
• Secure hosting — data is hosted on secure servers with access controls and monitoring
• Network protection — protection against common network attacks is provided at the hosting/infrastructure layer; a dedicated CDN/DDoS provider (such as Cloudflare) is planned but not yet in use

Organisational Measures

• Access to personal data is restricted to authorised personnel on a need-to-know basis
• Regular security reviews and updates
• Incident response procedures in place

Financial Data Protection

• Strict access controls limiting who can access financial data
• We do not store full payment card numbers (these are handled directly by Stripe)
• Financial account data is encrypted alongside all other data at rest

Despite our efforts, no method of transmission or storage is 100% secure. If you become aware of any security issue, please contact us immediately at privacy@halo.fit.

8. Data Retention

We retain your personal data in accordance with the following principles:

• Active account data — retained for as long as your account remains active and you continue to use the Service
• Deleted account data — when you delete your account, all of your personal data is permanently deleted from our systems within 30 days of account deletion
• Server logs — retained for a limited period necessary for security purposes, then automatically deleted
• Website analytics records — retained for no more than 13 months, then automatically deleted
• Backups — data in encrypted backups is purged in accordance with our backup rotation schedule, and no later than 30 days after account deletion

We do not retain data longer than necessary for the purposes described in this policy.

9. Your Rights

9.1 Rights for All Users

All users of the Service have the right to:

• Export your data — download a complete copy of all your data in CSV/ZIP format at any time through your account settings
• Delete your account — permanently delete your account and all associated data through your account settings

9.2 Rights Under the GDPR (EU/EEA and UK Users)

If you are located in the European Union, the European Economic Area, or the United Kingdom, you have the following rights under the GDPR:

• Right of access (Article 15) — request a copy of the personal data we hold about you
• Right to rectification (Article 16) — request correction of inaccurate or incomplete personal data
• Right to erasure (Article 17) — request deletion of your personal data ("right to be forgotten")
• Right to restriction of processing (Article 18) — request that we limit how we use your data
• Right to data portability (Article 20) — receive your data in a structured, commonly used, machine-readable format (CSV/ZIP)
• Right to object (Article 21) — object to processing based on legitimate interest
• Right to withdraw consent (Article 7(3)) — withdraw consent for processing of special category data at any time

How to Exercise Your Rights

You can exercise most of these rights directly through the Service:

• Data export is available in your account settings
• Account deletion is available in your account settings
• Data correction can be done by editing your data within the Service

For any other requests, or if you need assistance, contact us at privacy@halo.fit. We will respond to your request within 30 days as required by the GDPR.

Right to Lodge a Complaint

If you believe that we have not handled your personal data properly, you have the right to lodge a complaint with your local data protection supervisory authority.

10. International Data Transfers

If your data is transferred outside of the EU/EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Compliance with the EU-US Data Privacy Framework where relevant

Our third-party providers (such as Stripe) maintain appropriate data transfer mechanisms as required by the GDPR.

11. Automated Decision-Making and Profiling

We do not engage in automated decision-making or profiling as defined under Article 22 of the GDPR. No decisions with legal or similarly significant effects are made about you based solely on automated processing.

Any statistics, charts, or summaries displayed within the Service (such as streak counts, progress bars, or health correlations) are purely informational tools for your personal use and do not constitute profiling or automated decision-making.

12. Age Restriction

The Service is intended for users aged 16 years and older, in accordance with Article 8 of the GDPR. We do not knowingly collect personal data from individuals under 16.

If we become aware that we have collected personal data from a person under 16 without appropriate parental or guardian consent, we will take steps to delete that data promptly. If you believe that a child under 16 has provided us with personal data, please contact us at privacy@halo.fit.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will update the "Last Updated" date at the top of this policy
• We will notify you via email or through a prominent notice within the Service before the changes take effect
• Where required by law, we will obtain your consent to material changes

14. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by Article 34 of the GDPR
• Document all breaches, including their effects and the remedial action taken

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: privacy@halo.fit

We aim to respond to all enquiries within 30 days.

16. Summary of Key Points

Related Documents

• Data Processing Agreement (DPA)
• Data Protection Impact Assessment (DPIA)