Privacy Policy

1. Scope and U.S. Launch

This Policy applies to Heartbeat account holders and subscribers, emergency contacts listed or requested by an account holder, website visitors, and people who communicate with Heartbeat support. The Service is currently launched for the United States. Emergency contacts are not required to be paying customers and, unless they independently hold a Heartbeat account, do not need an account to respond.

Heartbeat is not presently offering a Canadian or other non-U.S. version of the Service. The application refuses known Canadian and Caribbean numbers at signup and when an account holder attempts to add a contact. Heartbeat may add other jurisdictions only after the applicable product and compliance review.

2. Information We Collect

Account and identity information may include a confirmed mobile number, optional verified email address, display name, sign-in identifiers, authentication information, device/session information, IP address, timestamps, app/build information, and the legal-document versions accepted at signup.

Pet and care-plan information may include pet names and characteristics, photographs, feeding/medication/walking/behavior notes, home address, unit information, entry instructions, gate/door/lockbox codes, and veterinary practice details.

Emergency-contact information supplied by an account holder may include a contact name or nickname, phone number, email address, relationship, personal invitation message, consent/decline status, block status, and owner/account association.

Check-in and incident information may include check-in timing and context, escalation timing, which contacts were asked, the channels used, delivery status, responses, and incident disposition.

Subscription information supplied by Apple or Google may include purchase tokens, receipts, entitlement status, and subscription events. Heartbeat does not receive full payment-card details.

From emergency contacts, Heartbeat may receive the phone number or email address used to accept or respond, consent/decline/opt-out/re-consent events, message responses, reports and notes they add to an incident, an email address they confirm or a choice to receive text updates on an incident, and ordinary technical information associated with a request or response link.

On Android, analytics tooling may receive the Android advertising identifier when enabled. Heartbeat uses it for analytics only, not to display ads or to build advertising profiles, and does not share it for advertising.

3. Location and Address Information

Heartbeat does not store the precise coordinates generated when you use the “Use my location” function. The phone’s own mapping/geocoding service - Apple on iPhone or Google on Android - receives the device position to turn it into an address. The coordinates are transmitted to that mapping service as part of the request.

If the resulting address is then used for a place, veterinary, or address search, the address/search terms may be sent to Google Places. If you choose to save a resulting street address as part of your care plan, Heartbeat stores the selected address, not the underlying “Use my location” coordinate.

Any separate background-location function is governed by the permissions and disclosures presented in the application and device operating system. Heartbeat does not use location information for advertising.

4. How We Use Information

Heartbeat uses personal information to create and authenticate accounts; operate check-ins and incident escalation; obtain and record contact consent; honor declines, blocks, unsubscribes, spam reports, STOP requests, and re-consent; provide care information to a confirmed responding contact; show the contacts asked about an incident its status and history, identifying contacts only by letter, and send incident updates to contacts who ask for them; send verification, security, service, and support communications; verify subscription status and paid-feature entitlement; provide address/place search; prevent fraud and abuse; diagnose failures and maintain reliability; respond to privacy/support requests; and comply with law and enforce agreements.

5. Emergency-Contact Information Provided by Someone Else

An account holder may provide another person’s contact information before that person has agreed to participate. Heartbeat uses unconfirmed information only for the limited invitation/consent process, suppression/abuse prevention, and related support. Heartbeat does not treat the person as an incident contact until the person accepts.

For a person who is not already a Heartbeat user, Heartbeat does not send incident SMS or calls before that person completes the phone-authenticated consent process. For an existing Heartbeat user, Heartbeat may send an account/service request using already-authorized account channels, but the person is not linked and is not authorized for incident communications until the person accepts the specific contact request.

6. Communications and Suppression

Heartbeat sends service communications and does not use emergency-contact information for advertising or unrelated marketing. On the free plan, emergency-contact outreach is email only. Eligible paid/member plans add text messaging and may add automated calls using artificial or synthesized speech where enabled, subject to the recipient’s consent.

Bird handles Heartbeat outbound email and related delivery-status, bounce, spam-report, and unsubscribe events. A spam report is treated as an email unsubscribe and email to that address stops. The product does not rely on inbound email replies as part of automated incident handling.

A supported STOP-type command or other clear revocation request stops texts and automated calls to the affected number. Email unsubscribe is handled separately. Heartbeat may honor a broader request to stop all channels when the request clearly asks for that result.

7. Service Providers and Disclosures

Heartbeat uses service providers to operate the Service. The principal categories currently include the providers listed below. Provider roles may change as infrastructure changes. We will update this Policy when a material processor or processing purpose changes in a way that requires an update.

8. No Sale or Behavioral Advertising

Heartbeat does not sell personal information, use emergency-contact information for targeted advertising, disclose personal information to data brokers for their own marketing, or display third-party advertising in the app. Android advertising ID use, if retained, is limited to analytics and is not used for ad personalization.

9. Retention

Heartbeat retains personal information according to the data category and operational purpose. Active account data is kept while the account is in use, subject to shorter link/token expirations and suppression rules. Signup acceptance records, app-store purchase records, and limited security, fraud-prevention, dispute, consent-version, and suppression information may be retained longer where reasonably necessary for those purposes or required by law.

When a verified account deletion is confirmed, Heartbeat immediately removes or overwrites the active account identity and sign-in data; ends sessions; erases the care plan, address and entry instructions, pets, pet photos, monitoring settings, check-in history, incident history, push tokens, blocks, and notification history; and removes identifying information for emergency contacts belonging to that account. For those owner-side contacts, Heartbeat retains only non-identifying dates showing when consent, decline, or opt-out occurred and the version of the consent wording that applied. Prisma database snapshots are retained for up to seven days and expire as whole snapshots, so deleted database rows age out of all backups within that period. Pet photos are not separately backed up.

10. Account Deletion and Emergency-Contact Requests

Account holders may use the in-app account-deletion process, which requires a code sent to the account’s verified mobile number. Deleting an account does not cancel an Apple or Google subscription. Signup acceptance records and applicable app-store purchase records are retained for contract, billing, refund, dispute, and compliance purposes; carrier-level STOP records held by Twilio and email suppressions held by Bird remain in place so Heartbeat does not resume communications to a suppressed destination.

If the deleted account holder was also an emergency contact for another owner, the other owner’s contact entry may remain because it belongs to that other owner, but it is no longer linked to the deleted Heartbeat account. Emergency contacts may also ask Heartbeat to stop communications, correct or delete contact information, or explain what information Heartbeat holds about them by contacting support@heartbeat.pet. Heartbeat may verify the request using the associated phone number or email address.

11. Privacy Rights

Depending on where you live and applicable law, you may have rights to request access, correction, deletion, information about use/disclosure, or withdrawal of consent. Heartbeat will respond to verified requests as required by applicable law. Some information may be retained or withheld where permitted by law, including records needed for security, fraud prevention, consent/opt-out evidence, legal claims, or the rights of another person.

12. Security

Heartbeat uses administrative, technical, and organizational safeguards designed for the nature of the information it handles, including encrypted network transport, authentication controls, multi-factor authentication for production administrative access, separation of development and production credentials/data, limited production access, secure credential handling, session revocation, signed or random-token links for non-account workflows, and dependency-vulnerability monitoring.

No system is completely secure. Heartbeat cannot guarantee that unauthorized access, loss, or misuse will never occur. If Heartbeat becomes aware of a security incident, it will investigate and provide notices required by applicable law.

13. Children

Heartbeat is intended for adults age 18 and older and is not directed to children. We do not knowingly permit a person under 18 to create an account. If we learn that an underage account holder provided personal information in violation of this restriction, we may close the account and delete or restrict the information as appropriate.

14. Changes to This Policy

We may update this Policy as the Service, law, or our practices change. We will change the effective date when we do. If a change materially affects how we use previously collected personal information, we will provide notice appropriate to the change and obtain additional consent where required by law. Heartbeat will maintain version records sufficient to identify the policy and consent language applicable to material consent events.

15. Contact Us

Privacy and support inquiries may be sent to support@heartbeat.pet. Mailing address: Heartbeat, 254 Chapman Rd, Ste 208 #26303, Newark, DE 19702.

16. Text Messages and Contact Opt-In

How a contact agrees to texts is described at https://www.heartbeat.pet/opt-in. A person who is not a Heartbeat user agrees by texting a six-digit code from their own phone to Heartbeat’s number; an existing Heartbeat user agrees on an acceptance page that names the owner. Nobody is texted about an incident before agreeing.

Mobile phone numbers and text-message opt-in data and consent are not shared with third parties or affiliates for marketing or promotional purposes. Service providers that deliver messages for Heartbeat, such as Twilio, receive them only to deliver those messages.

Reply STOP to any Heartbeat text to stop texts, or HELP for help. Message frequency depends on missed check-ins. Message and data rates may apply.