Privacy Policy

Last Updated: June 26, 2026

1. Introduction

HO Smart Ring ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our mobile application, website, and related services (collectively, the "Services").

By using our Services, you agree to the collection and use of information in accordance with this policy.

2. Who We Are

Data Controller:

Company: Shanghai Shunpu Internet Technology Co., Ltd. (上海顺扑互联网科技有限公司, D-U-N-S 444046595)
Address: 1st Floor, Building 1, No. 15, Lane 588, Zhangliantang Road, Liantang Town, Qingpu District, Shanghai, P.R. China
Email: service@ho-ring.com

Data Protection Contact: service@ho-ring.com

3. Data We Collect

3.1 Account Information

Email address (for overseas / Global market accounts)
Password (encrypted)
Profile information (nickname, avatar, gender, date of birth)

3.2 Health Data (Special Category Data)

We collect the following health metrics from your HO Smart Ring device:

Data Type	Purpose	Legal Basis (EU)
Heart rate	Health monitoring, trend analysis	Explicit consent (GDPR Art. 9)
Blood oxygen (SpO2)	Health monitoring	Explicit consent (GDPR Art. 9)
Heart rate variability (HRV)	Stress and recovery analysis	Explicit consent (GDPR Art. 9)
Sleep stages (deep/light/REM)	Sleep quality analysis	Explicit consent (GDPR Art. 9)
Steps / activity	Activity tracking	Explicit consent (GDPR Art. 9)
Stress index	Wellness monitoring	Explicit consent (GDPR Art. 9)
Exercise/GPS track	Activity mapping	Explicit consent (GDPR Art. 9)

3.3 Device Information

Device model and operating system version
Device identifier (pseudonymized)
App version and crash logs

3.4 Usage Data (conditional)

Feature usage statistics and session duration — only if the host app integrates Firebase Analytics. The MoRing SDK itself does not collect usage analytics.

4. How We Use Your Data

Provide Services: Display health metrics, generate reports, enable family sharing
Push Notifications: Send alerts for abnormal health readings, reminders
Product Improvement: Analyze aggregated, anonymized data to improve algorithms
Customer Support: Respond to inquiries and troubleshoot issues
Legal Compliance: Fulfill legal obligations and protect our rights

We do NOT:

Sell your personal data to third parties
Use your health data for advertising
Share your data with insurance companies or employers without explicit consent

5. Where Your Data Is Stored

All overseas user data is stored in our EU (Frankfurt, Germany) data center; the applicable privacy law is determined by your region of residence:

🇪🇺 Users in the European Union / EEA

Storage Location: European Union (Frankfurt, Germany)

Legal Basis: General Data Protection Regulation (GDPR)

Data Controller (EU): Shanghai Shunpu Internet Technology Co., Ltd. (上海顺扑互联网科技有限公司, D-U-N-S 444046595)

Data is processed in the EU by Alibaba Cloud (Frankfurt) acting as our data processor (GDPR Art. 4(8)), not as a controller.

🇺🇸 Users in the United States and Other Regions

Storage Location: Frankfurt, Germany (EU)

Legal Basis: Applicable local privacy laws

Note: US and other non-EU user data is stored in our Frankfurt (Germany, EU) data center.

Cross-Border Access Safeguards: Your data is stored in the EU (Frankfurt) and isolated per region at the storage layer. Because our data controller is established in China, the following cross-border access scenarios apply, safeguarded under GDPR Art. 44–49:

Controller access from China: Shanghai Shunpu Internet Technology Co., Ltd. (the controller, established in China) may remotely access the Frankfurt (EU) database for support and maintenance. This constitutes a cross-border "access" transfer under Art. 44–49, mitigated via read-restricted access and access audit logging, and supported by Standard Contractual Clauses (SCCs) under Art. 46(2)(c) where applicable.
User-to-user sharing across regions: If you share health data via Couple Space or Family Care with a partner/friend registered in a different region (e.g., EU vs. China), the data may be transferred between regions to enable the sharing feature (see §6.5).

We do not transfer EU/EEA user data to China for storage or processing, except for the limited controller-access scenario described above.

6. Third-Party Services and Data Sharing

We use the following third-party services. Each service provider acts as a data processor under our instruction:

Service	Provider	Purpose	Data Shared	Region
Cloud Hosting (Global)	Alibaba Cloud Europe	Server infrastructure	All user data	EU (Germany)
Authentication	Google / Apple	Social login	Identity token	US/EU
Push Notifications (Android)	Firebase (Google)	Push messaging	Device token	US/EU
Push Notifications (iOS, Global market)	Apple APNs (direct, no third-party relay)	Push messaging	Device token	EU (Frankfurt)
Analytics (Optional)	Firebase Analytics	App usage analytics	Aggregated, anonymized	US

Important: We do not share your health data with any third party for advertising or profiling purposes.

No In-App Payments: The HO Smart Ring app does not process any payments. Ring hardware is purchased through external channels (our official website or partner channels), not within the app. We do not collect or process any payment card or billing information through the app.

6.5 How We Share Your Health Data With Other Users

When you enable Couple Space or Family Care features, the following health data may be shared with users you authorize (your partner, friends, or family members) — not with MoRing employees or third-party companies:

Heart rate (real-time BPM and trends)
Sleep stages
Blood oxygen (SpO2)
Stress index
Steps / activity

Sharing conditions:

Two-way consent: Both users must enable sharing. User A viewing User B's data requires B's consent, not A's.
Control: You can turn off sharing anytime in Settings (wholesale toggle). Per-data-type granular control (e.g., share heart rate but not sleep) is planned for a future update.
Cross-border notice: If your partner's/friend's account is registered in a different region (e.g., EU vs. China), data may be transferred between regions to enable sharing.
Relationship termination: Unbinding a partner or deleting a friend immediately revokes their access to your new data; their cached history is purged within 30 days.
Withdrawal: Turn off sharing in Settings at any time — takes effect immediately.

Legal basis (EU): Your explicit consent (GDPR Art. 9(2)(a)). Consent is voluntary, specific, and revocable; it is never bundled with relationship creation.

7. Data Retention

Data Type	Retention Period	Deletion Trigger
Account information	Until account deletion	Account deletion request
Health data	Until account deletion	Account deletion request
Device logs	90 days	Automatic purge
Crash logs	90 days	Automatic purge
Backup data	90 days after account deletion (backup cycle)	Automatic purge

8. Data Security

We implement the following security measures:

Encryption in Transit: All data transmitted between your device and our servers uses TLS 1.3.
Field-Level Encryption: Sensitive identifiers (e.g., tenant routing codes) are encrypted at the application layer using AES-ECB. Full database-level encryption at rest is not enabled at the application layer.
Access Control: Access to production systems is restricted to authorized personnel on a need-to-know basis. (Multi-factor authentication and a formal role-based access control system are on our roadmap and are not yet represented as fully in place.)
Incident Response: In the event of a personal data breach, we will notify the lead supervisory authority without undue delay, and where feasible within 72 hours of becoming aware of it, in accordance with GDPR Art. 33. Where a breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay (Art. 34).

9. Cookies and Tracking Technologies

Our app and website use the following:

Essential Cookies: Required for authentication and security (no opt-out)
Analytics Cookies: Help us improve the app (opt-out available in settings)

We do not use third-party advertising cookies or tracking pixels.

10. Children's Privacy

Our Services are not intended for children under 16. We do not knowingly collect data from children under 16. If you believe we have collected data from a child, please contact us immediately. See our separate Children's Privacy Policy for details.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

Posting the new policy on this page
Updating the "Last Updated" date
Sending an in-app notification for material changes

12. Contact Us

For questions about this Privacy Policy or to exercise your rights:

Email: service@ho-ring.com
Address: 1st Floor, Building 1, No. 15, Lane 588, Zhangliantang Road, Liantang Town, Qingpu District, Shanghai, P.R. China

EU Representative (Art. 27 GDPR): Pursuant to Art. 27 of the GDPR, Shanghai Shunpu Internet Technology Co., Ltd. — a controller not established in the Union — is in the process of appointing an EU/EEA-based representative to act on its behalf regarding data protection matters for EU/EEA users. The representative's name and contact details will be published in this section once appointed.

Interim contact for EU/EEA users: Until the EU Representative is appointed, EU/EEA users may direct all data protection enquiries — including requests to exercise their rights under this Policy — to service@ho-ring.com, and we will respond without undue delay and in any event within one month (Art. 12(3) GDPR).

EU/EEA users may also lodge a complaint with the supervisory authority in their country of residence (see §13).

13. Your Rights by Region

🇪🇺 Rights for Users in the EU/EEA (GDPR)

Under the General Data Protection Regulation, you have the following rights:

Right to Access (Art. 15): Request a copy of your personal data
Right to Rectification (Art. 16): Correct inaccurate data
Right to Erasure (Art. 17 — "Right to be Forgotten"): Request deletion of your data
Right to Restrict Processing (Art. 18): Limit how we use your data
Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
Right to Object (Art. 21): Object to processing based on legitimate interests
Right to Withdraw Consent (Art. 7): Withdraw consent for health data processing at any time
Right to Lodge a Complaint (Art. 77): File a complaint with your local Data Protection Authority

Data Protection Contact: service@ho-ring.com

EU Supervisory Authority: You have the right to lodge a complaint with the supervisory authority in your country of residence. A list of EU data protection authorities is available at: EDPB Members

🇺🇸 Rights for Users in the United States

California Residents (CCPA/CPRA):

Right to Know: Request disclosure of the categories and specific pieces of personal information collected
Right to Delete: Request deletion of personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out of Sale/Sharing: We do not sell personal information
Right to Non-Discrimination: We will not discriminate against you for exercising your rights
Shine the Light Law: California residents may request information about disclosure of personal information to third parties for direct marketing purposes

Other US States: Residents of Virginia, Colorado, Connecticut, and Utah may have similar rights under state privacy laws. Contact us for details.

Important Notice: We do not sell your personal information to any third party.

🌏 Rights for Users in Other Regions

If you are located outside the EU and the US, you generally have the right to:

Access your personal data
Request correction of inaccurate data
Request deletion of your data
Withdraw consent for processing

Please contact us at service@ho-ring.com to exercise these rights.

14. Data Export Request

In accordance with GDPR Art. 20 (right to data portability) and Art. 12(3) (one-month response window), you may request a complete export of your personal data in a structured, machine-readable format (JSON). As in-app self-service export is not available in the current version, requests are handled manually:

Email: Send a request to service@ho-ring.com with subject "Data Export Request"

We will provide your data within 30 days.

15. Account Deletion

You may delete your account and all associated data at any time:

Email: Send a request to service@ho-ring.com with subject "Account Deletion Request"

Upon deletion:

Your account and all personal data will be permanently deleted within 30 days
Aggregated, anonymized statistics may be retained for product improvement
Backup copies will be purged within 90 days