Who we are
Laya is published by Axxtreme Labs (“Laya”, “we”, “us”). For the little personal data we do receive, described below, we are the data controller (under the GDPR and UK GDPR) and the data fiduciary (under India’s Digital Personal Data Protection Act, 2023).
Write to us at support@layahealth.app about anything in this policy. That address also reaches the person responsible for handling privacy questions and grievances.
What stays on your phone
Laya is built so that your health data has no copy anywhere but your phone. Everything below is stored only in the app’s private storage on your device:
- the health records Laya reads from Health Connect or Apple Health;
- everything it works out from them: scores, your usual ranges, trends, patterns, insights, experiments, plans and reports;
- everything you enter: your profile (an optional name, birth year and sleep goal), tags, notes, your log of supplements, medications and late meals, cycle logs, context such as illness or travel, and your settings and choices;
- lifting history you import from a Hevy export file.
We cannot see, access or recover any of it. Free and Plus have no account and no server. During setup, Laya asks for your consent to process your health data on the phone to give you insights. You can withdraw it by deleting everything (see Keeping and deleting data).
Usage analytics, if you opt in, sends anonymous events about how you use the app, never the health data above. See Optional usage analytics.
The health data Laya reads
Laya asks Health Connect (Android) or Apple Health (iPhone) for permission to read the types below. You choose which to allow, type by type, and can change your choice at any time in Health Connect or the Health app. Laya works with whatever you allow and reads only on your phone.
| Kind | Types Laya can ask to read | Used for |
|---|---|---|
| Heart and breathing | Heart rate, heart rate variability, resting heart rate, respiratory rate, blood oxygen | Recovery, your usual ranges, heart rate above your usual |
| Sleep | Sleep sessions and stages | Sleep, naps, bedtime suggestions |
| Temperature | Body, skin and basal body temperature (and wrist temperature on iPhone) | Your usual ranges, cycle context |
| Activity | Workouts, routes recorded by your watch, distance, steps, active and total calories, speed, cadence, power, elevation, floors, wheelchair pushes, activity intensity, VO₂ max, planned workouts, mindfulness sessions | Movement, strain, workout details and maps |
| Body | Weight, height, body fat, lean mass, bone mass, body water, basal metabolic rate | Profile and body trends |
| Vitals | Blood pressure, blood glucose | Vital pages and the doctor checklist |
| Cycle | Menstruation, ovulation tests, cervical mucus, spotting between periods, sexual activity | The cycle page and cycle-aware baselines |
| Food and water | Nutrition and hydration | Food logging, where available |
On Android, Laya also asks to read in the background (so mornings are ready when you open the app) and to read data from before you installed it (so it can learn your usual sooner). Both are optional.
What Laya writes back
Writing is off by default. Only if you turn it on, one type at a time, Laya saves what you log in Laya into Health Connect or Apple Health, so your other apps can see it: cycle logs (on Android), meals and water, weigh-ins and workouts. Once written there, that data is managed by Health Connect or Apple Health, and stays there if you delete Laya.
What leaves your phone
Only these, and only for the reason given. None of them includes your health data unless you send it yourself.
| When | What is sent, and to whom | Why |
|---|---|---|
| You view or buy a plan | An anonymous app user id, your purchases and store country, and basic device and app details, to RevenueCat and to Google Play or the App Store. No name, email or health data. | To sell, restore and check subscriptions |
| You opt in to usage analytics | Anonymous usage events, such as screens opened and buttons tapped, with an anonymous install id and basic app and device details, to PostHog (EU cloud). Never a health value. Off unless you turn it on. | To see which parts of the app work and which confuse people |
| You connect Google Health (optional) | Requests to Google’s Health API, signed in with your Google account. Your data comes from Google to your phone; nothing goes back. | To bring in Fitbit or Pixel data that is not in Health Connect |
| You turn on map tiles (optional, off by default) | Your IP address and the map area shown, to the OpenStreetMap tile server. The route itself never leaves the phone. | To draw a map under a workout route |
| You send a bug report | An email you write and send from your own mail app, with a diagnostics file of sync and connection details. It contains no health values. | So we can help you |
| You export, share, copy or back up | A file, image, PDF or copied text that you save, paste or send through your phone’s share sheet, to wherever you choose. | Your choice; we never receive it unless you send it to us |
| You open a link | Links to this website, the store or another app open in your browser or that app. | Their own policies apply |
Notifications are scheduled on the phone itself; Laya uses no push service. Background updates read Health Connect and need no network connection.
Optional usage analytics
To learn which parts of Laya help and which get in the way, Laya can send anonymous usage events. It asks you once, during setup, and does nothing unless you say yes. You can turn it on or off at any time in Laya’s Settings.
- What is sent: events such as which screens you open and which buttons you tap, with the app version and basic device details (such as the phone model, operating system and language).
- What is never sent: any health value or record, anything you type (notes, names, tags), your email, or recordings of your screen. Laya uses no session replay.
- Who you are to us: a random install id that the app creates. It is not linked to your name, email, Google account or purchases, and you can reset it in Settings to start fresh.
- Where it goes: PostHog, on its EU cloud (eu.posthog.com), which stores the events for us in the European Union. Your IP address is discarded, not stored.
- How long: only as long as the events help us improve the app; then we delete them.
We use these events only to improve Laya, never for advertising, and we do not sell or share them. Our legal basis is your consent, which you can withdraw at any time by turning analytics off.
Purchases
Paid plans are sold through Google Play on Android and the App Store on iPhone. They handle your payment details under their own terms and privacy policies; we never see your card or bank details.
The app uses RevenueCat, Inc. to manage subscriptions. RevenueCat receives an anonymous id that the app creates, your purchase and subscription history, the store country and basic device and app details. It does not receive your name, email or any health data from Laya. Its privacy policy is at revenuecat.com/privacy. We use this information only to give you what you paid for, and to keep the records that tax and accounting law require.
The Google Health connection
Where Laya offers it, you can choose to connect your Google account so Laya can read your Fitbit or Pixel data from Google’s Health API. It is optional and off until you connect.
- What Laya asks for: read-only access to your health metrics and measurements, sleep, and activity and fitness. Read-only access to a workout’s location is asked separately, only when you open a GPS workout and allow it.
- Where the data goes: straight from Google to your phone, where it is treated like everything else in Laya. It is never sent to us or anyone else, and Laya never writes to your Google account.
- Sign-in: Google Sign-In on your phone handles your access. Laya keeps only that you are connected, your Google account id, a masked email (such as s***a@example.com) and the permissions you granted, on the phone.
- Disconnecting: disconnect in Laya, or remove Laya’s access in your Google Account settings. Delete everything also disconnects it.
Laya’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Health Connect and Apple Health
Data Laya reads from Health Connect or Apple Health is used only to show you your own health and wellness information inside Laya. In particular:
- It is not used for advertising or marketing, and never sold, rented or given to data brokers, advertising platforms or information resellers.
- It is not used to decide anyone’s eligibility for credit, insurance, employment or housing.
- It is not shared with anyone. It stays on your phone.
- No person at Laya reads it, because it never reaches us.
Laya’s use of data received from Health Connect follows the Health Connect permissions policy, including its Limited Use requirements. On iPhone, Laya follows Apple’s HealthKit rules: HealthKit data is not used for advertising or data mining, not shared with third parties, and Laya does not store it in iCloud.
What we never do
- Sell your data, or share it for advertising.
- Show ads, or track you across other apps and websites.
- Put advertising code in the app.
- Send a health value in usage analytics, or record your screen.
- Use your health data for anything other than showing it back to you.
- Train AI models on your data.
Permissions the app asks for
On Android
- Health Connect permissions for the types listed above, reading in the background and reading past data. All optional.
- Notifications, for the morning brief and the reminders you choose. Optional.
- Physical activity, for step counts on recent Android versions.
- Run at startup, to re-arm your scheduled notifications after the phone restarts.
- Internet, for purchases, usage analytics if you opt in, and the optional connections above. Vibration, for haptic feedback.
- Seeing which watch apps are installed (such as Samsung Health or Fitbit), so Laya can open them and check their battery setting. Laya does not read their data this way.
Laya asks for no location, camera, microphone, contacts or photo access.
On iPhone
- Apple Health read access for the types listed above, and write access only for the types you turn on.
- Notifications. Optional.
This website, and buying on it
This website uses no cookies, analytics, trackers or ads. Your theme and country choices are kept only in your own browser. The site is hosted by Cloudflare, which processes your IP address to deliver pages and protect against abuse. Fonts load from Google Fonts, so Google receives your IP address when a page loads.
If you buy a plan on this website, or sign in to the app with your email to unlock a website purchase, our server (run on Cloudflare) processes:
| What | Why | How long |
|---|---|---|
| Your email, plan, its status and renewal date, and Dodo Payments’ customer, subscription and payment ids | To unlock what you paid for and send the reminder before a trial ends or a year renews | While the purchase runs; finished purchases are removed when you delete your account, except records tax law requires |
| A 6-digit sign-in code, stored only as a one-way hash | To prove the email is yours | 10 minutes at most |
| A random device id the app creates (not a hardware id) and a session record | To keep the app signed in | Until you sign out or delete your account |
| Your IP address, briefly, with rate-limit counters keyed by a one-way hash of it | Security and abuse prevention | Counters: up to 2 days |
Dodo Payments is the merchant of record for website purchases: it collects your payment details, handles tax and sends receipts under its own privacy policy. Resend delivers the sign-in and reminder emails. None of them receives any health data. We never ask for your name, date of birth, location or contacts.
Some of these services process data outside your country, including in the United States. Where the law requires it, transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses.
Who processes data for us
- RevenueCat manages in-app subscriptions (anonymous id and purchase history).
- PostHog, EU cloud, stores usage analytics, only if you opt in.
- Cloudflare hosts this website, our server and its database.
- Dodo Payments is the merchant of record for website purchases.
- Resend sends sign-in and reminder emails for website purchases.
Google Play and the App Store handle in-app payments under their own privacy policies. Google also serves this site’s fonts and, if you connect it, the Google Health API. None of these receives your health data from us.
Keeping and deleting data
- On your phone: Laya keeps your data until you delete it. Settings›Privacy›Delete everything removes all records, scores, insights, notes, reports, consents and settings, disconnects Google Health and returns the app to setup. Uninstalling Laya, or clearing its storage, does the same. There is no copy anywhere else, so export first if you want to keep anything (Settings›Your data).
- Backups: on Android, Laya’s data is left out of Google’s cloud backup and device-to-device transfer on purpose. To move to a new phone, save a backup file in Settings›Your data and restore it there.
- Health Connect and Apple Health keep what your devices, and Laya if you allowed it, wrote to them. Manage or delete that in Health Connect or the Health app.
- Usage analytics: turn it off in Settings to stop sending events, and reset the install id to separate past events from you. Ask us and we will delete the events for your install id.
- Purchases: Google, Apple and RevenueCat keep purchase records under their own policies and the law. Ask us and we will ask RevenueCat to delete the anonymous record linked to your purchases.
- Our server (website purchases only): delete your account in the app with Settings›Subscription›Delete my data on Laya’s servers, or write to us. A purchase that is still running is kept so you can restore it; ask us and we will erase it once it ends or you cancel it.
Security
Your data lives in Laya’s private app storage, which other apps cannot read, protected by your phone’s own encryption and screen lock. Sign-in tokens are kept in the Android Keystore or the iOS Keychain. Every connection Laya makes uses HTTPS. Because we hold no copy of your health data, a breach of our systems could not expose it. Keep your phone locked and up to date; anyone who can unlock it can open Laya.
Your rights
Your health data is on your phone, so you exercise most rights yourself, at any time: see it in the app, correct it at its source, export it in Settings›Your data, and delete it with Delete everything. For the data we or our providers hold (purchases, usage analytics if you opted in, website sign-in and support emails), you can ask us to:
- confirm what we hold, and give you a copy;
- correct or complete it;
- delete it;
- stop or limit using it, or object to how we use it;
- move it to another service, where that applies;
- withdraw a consent you gave, without affecting what was done before.
Write to support@layahealth.app. We answer within 30 days, or sooner where the law requires, and we do not charge for it. We may need to confirm the request is yours, for example by replying from the email linked to your purchase.
If you are in the EU, the UK or the EEA
We use purchase and account data to perform our contract with you, security data for our legitimate interest in keeping the service safe, and anything optional (usage analytics, the Google Health connection) with your consent. You can complain to your local data protection authority.
If you are in India
Under the Digital Personal Data Protection Act, 2023, you can ask for a summary of your personal data and how it is used, its correction, completion, updating and erasure, and you can nominate someone to exercise your rights if you cannot. Write to us first so we can resolve any grievance; if we do not, you can complain to the Data Protection Board of India.
If you are in the United States
We do not sell personal information or share it for cross-context behavioural advertising, as those terms are used in California and other state laws, and we do not use sensitive information to infer anything about you. You have the rights listed above whatever state you live in, and we will not treat you differently for using them. If we decline a request, you can appeal by replying to our answer.
Consumer health data privacy policy (US)
Washington’s My Health My Data Act, Nevada’s consumer health data law and similar state laws protect “consumer health data”. Laya is designed so that we do not receive your health records: the app reads and processes them only on your phone, and none of them is sent to us. Because these laws define collecting broadly, we explain here how Laya handles it anyway.
- Categories: the health data listed in The health data Laya reads and what you enter in the app, including cycle and sexual-activity records. The fact that you bought a health app could also count, and so could usage events that show which parts of the app you open (for example the cycle page). That is why purchase records and opt-in analytics are covered here too.
- Sources: Health Connect, Apple Health, Google Health (if you connect it), files you import, and you.
- Purpose: only to show you your own health and wellness information in the app, and to provide what you bought.
- Sharing: we do not share or sell it. Only the processors described above handle purchase records and opt-in usage events, for us. Usage events never include a health value.
- Your rights: to confirm whether we collect, share or sell your consumer health data, to get a list of any third parties or affiliates it was shared with (there are none beyond our processors), to delete it, and to withdraw consent. Use Delete everything in the app, or write to support@layahealth.app. If we decline, you can appeal by replying; if the appeal is denied, you can contact your state attorney general.
Children
Laya is not meant for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has bought a plan or written to us, contact us and we will delete what we hold.
Changes to this policy
If we change how Laya handles data, we will update this page and its effective date first. If a change matters, for example a new kind of data leaving your phone, we will tell you in the app before it applies, and ask for your consent where the law requires it. Features that would use our servers, such as a coach, will not be switched on until this policy describes them.
Contact
Axxtreme Labs
support@layahealth.app