Privacy Policy

Before going into the details, here is what matters most:

• Your data is encrypted in transit and at rest. All data moving between your device, our backend, and our service providers is protected with industry-standard encryption, and stored data is encrypted at rest.
• Access is strictly restricted. Access to stored data is limited to authorized systems and personnel, only as needed to operate and provide the Service, and is governed by controls that have been independently audited under SOC 2 Type I.
• We do not sell your personal data. We do not sell, rent, license, or trade your personal data, and we do not use it for advertising or to train third-party AI models for unrelated purposes.
• Sensitive features are opt-in. Health data and location access are off by default and only operate if you explicitly enable them.
• You can delete your data. You can request export or deletion of your data at any time.

To use the Service, you interact with the Agents through a messaging platform (WhatsApp, iMessage, or Telegram), through the NatureOS application, or by voice through HumanPods earbuds. To provide context-aware, continuous assistance, our backend stores certain data associated with your account identifier, as described below.

If you enable the Health feature (off by default), NatureOS reads the following data from Android Health Connect (or Apple HealthKit on iOS): heart rate, heart-rate variability, sleep stages and duration, steps, distance, active calories burned, and VO2 max.

This data is sent over an encrypted connection to our backend and used to give the Agent context about your activity and recovery, so its responses fit your day. This health and fitness data:

• Is not used for advertising;
• Is not sold; and
• Is not used to train AI models.

You can disable Health access at any time in Settings or in Android Health Connect / Apple HealthKit. Health and fitness data is retained for the lifetime of your account unless you request deletion. For residents of Washington or Nevada, or individuals whose consumer health data is collected in those states, please also see the consumer health data disclosures on our Privacy Rights page (Washington My Health My Data Act; Nevada Consumer Health Data Privacy Law).

If you enable the Location feature (off by default), NatureOS reads your device location, including in the background. We use low-power, significant-change updates (approximately every 500 meters) rather than continuous GPS.

The location is sent to our backend and used as context for the Agent: when you start a conversation — including from your earbuds while the app is closed or the screen is off — the Agent uses your latest known location to make its responses relevant to where you are. We store only your most recent location: each update overwrites the previous one, so we do not keep a location history. Your location:

• Is not used for navigation;
• Is not shared with other users; and
• Is not used for advertising.

You can disable Location at any time in Settings. Your latest location is retained for the lifetime of your account, until you disable Location or request deletion.

You can request deletion of any or all of your data at any time (see Section 8). We action verified deletion requests within 30 days.

We share the minimum necessary data with the following service providers, who act on our behalf under data-processing agreements and may not use your data for their own purposes:

• ElevenLabs — receives your real-time voice audio, conversation text, and your account identifier to provide speech-to-text, language-model responses, and text-to-speech for voice conversations. Operates under a zero-retention configuration and does not retain your conversations.
• AI model providers — receive your conversation content, together with the context the Agent uses to respond (such as your location, and your health data when the Agent retrieves it), to generate the Agent's responses. As explained in our AI Disclosure, we do not name the specific providers for security reasons.
• Composio — receives your account identifier for authentication.
• Expo (Expo Application Services) — receives a push notification token to deliver notifications to your device (forwarded to Google FCM or Apple APNs).
• Twilio — carries the voice/telephony connection used for voice calls with the Agents.
• Cloudflare — hosts our backend infrastructure and stores media such as voice notes.
• Supabase — our database provider; stores your account data, conversation history, and — where you opt in — your health and location data.
• Vercel — hosts our website (natura.inc).
• Google — only if you connect Gmail or Calendar integrations (opt-in); accessed in real time to fulfill your requests.
• Telegram and WhatsApp — used only as channels through which you send your pairing code to link your account; we do not access your message history on these platforms.
• Payment Processors — any financial transactions are handled by third-party payment providers. Natura does not process or store your payment card information.

We do not sell your personal data.

The third-party messaging and platform providers also operate under their own privacy policies, which we encourage you to review: WhatsApp (Meta Platforms, Inc.), iMessage (Apple Inc.), and Telegram (Telegram FZ-LLC).

We use the data described above to:

• Provide the Service and generate Agent responses;
• Maintain conversational context across sessions and let you review your History;
• Provide voice conversations and voice-note playback;
• Give the Agent context about your activity, recovery, and location where you have opted in;
• Deliver push notifications;
• Authenticate you and maintain your account;
• Maintain the security, integrity, and reliability of the Service; and
• Comply with legal obligations.

We do not use your personal data for advertising, and we do not sell it.

• Encryption. Data is encrypted in transit and at rest using industry-standard protocols.
• Restricted access. Access to stored data is limited to authorized systems and personnel, only as needed to operate and provide the Service. Access is governed by internal controls and access policies.
• SOC 2 Type I. Our security controls have been independently audited under SOC 2 Type I, which evaluates the design of those controls at a point in time against standards established by the American Institute of Certified Public Accountants (AICPA).
• Limitations. No method of transmission or storage is completely secure. While we work to protect your data, we cannot guarantee its absolute security, and you provide data at your own risk.

You can request export or deletion of any or all of your data — including conversation history, voice notes, health data, and location data — at any time. You may also disable Health and Location access at any time in Settings.

To submit a request, use the in-app request flow, our Privacy Rights page, or contact us at ops@natura.inc. We will verify your identity before acting on a request and will respond within the timeframe required by applicable law.

For detailed rights under specific laws (CCPA/CPRA, VCDPA, CPA, CTDPA, GDPR, and the Washington and Nevada consumer health data laws), see our Privacy Rights page. California residents may also see our Do Not Sell (CA) page.

Our Service is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at ops@natura.inc and we will take appropriate steps to delete it.

If you access our Service from outside the United States, your data may be transferred to, stored in, and processed in the United States. All data is encrypted in transit and at rest regardless of origin or destination. Where required, we rely on appropriate safeguards for international transfers as described on our Privacy Rights page.

We may update this Privacy Policy from time to time. We will notify Users of material changes by posting the updated policy, updating the “Last Updated” date, and/or through the Service. Your continued use of the Service after any changes constitutes your acceptance of the revised Privacy Policy.

If you have any questions or concerns about this Privacy Policy, or if you would like to exercise any of your rights, please contact us:

Natura Inc
Email: ops@natura.inc