myatmos Privacy Policy

Effective 2026-10-15

Contact: testflight@atmoshealth.tech

Your room and your choices

myatmos helps a household organize familiar activities, communicate and control selected room devices. This policy covers the myatmos app and its supporting access, care-sharing and optional intelligence services. It is not an emergency response or medical monitoring service.

You choose this device's role, its room connections and which optional features to enable. Installing the app or signing in does not grant access to a room, Apple Home, care sharing or an AI provider. A resident's account anchors their room; separately authorized Room managers use their own accounts to invite people and manage access. Each device also needs its own authorization.

Information on your device

Depending on the features you use, the app stores room settings, device connection details, schedules, preferences, care notes, activity history, family messages, photos and voice memories. These records can include information about a person's daily life or health. Avoid adding information you do not intend to share with the people you authorize.

Device credentials and private keys are stored in this device's protected Keychain. Authored app records are protected on the device and excluded from ordinary device backups where supported. Device-only credentials do not transfer to a replacement device. Keep any explicit recovery materials secure; installing an update preserves existing app storage, but deleting the app or losing a device can lose local records.

Sign-in sessions, unfinished account setup, invitation requests and recovery attempts are saved in protected device storage so an interrupted response does not silently replace an existing identity or room. Completed account-operation receipts retain identifiers and request/response hashes rather than their original email codes or account-operation secrets. Other pending invitation and recovery records can retain the secrets needed to resume; protect access to the device.

Apple sign-in and your myatmos account

Continue with Apple authenticates your Apple account through Supabase Auth. myatmos receives an Apple account identifier, a separate myatmos account identifier, session information and, when Apple supplies it, a name and verified email address. Apple may supply a private relay address. Authentication proves control of that Apple account; a displayed name is a label and does not verify someone's legal identity or authority to act for a resident.

A resident needs their own Apple account, myatmos account and separately verified email address, distinct from representatives, caregivers and other Circle members. A representative may help with setup, then manages through their own explicitly delegated account. Typing an address, sharing an iCloud account or receiving a link does not establish ownership. If the required resident address differs from the address verified by Apple, the app uses a separate email verification process through Supabase Auth. With secure email change enabled, confirmation may be needed at both the current and new addresses.

Supabase Auth processes sign-in credentials, authentication tokens, email addresses, verification messages and session records. The myatmos service records the verified account/email binding and short-lived evidence that a session came from the Apple sign-in flow. It does not store Apple identity tokens, email verification codes or raw device bearer credentials in its application database. The app keeps the session credentials it needs in protected Keychain storage. Apple and the configured email-delivery provider also process the information needed to provide their services.

Apple Home, cameras, photos and calendars

Apple Home permissions are separate from myatmos family access. The app uses the accessories and live camera view you select. Apple handles Home access and its associated services under Apple's terms. Local camera perception, when explicitly enabled and commissioned, analyzes the selected local stream for room observations; it is not an identity or medical diagnosis system.

The app accesses photos, a selected calendar, the microphone, speech recognition, the local network or the camera only for the corresponding enabled feature and system permission. The phone or iPad camera is used to scan connection codes. Local camera streams, your photo library and calendar contents are not automatically submitted to an AI provider. Choosing a family photo or voice memory for sharing creates a separate app copy for that purpose.

Room access and cloud sharing

Apple CloudKit carries supported encrypted room commands, responses and shared content. It also processes routing information, record identifiers and operational metadata. Authorized devices hold the keys needed for the content they receive. Room control requires the Room Controller to be available; an accepted cloud request is not proof that a device acted. Account-authorized Full Room Managers use a separate encrypted channel for Room settings and supported plans. This channel requires a current account-bound device permission; the Room's existing choices still control disclosure of plan, care, presence, schedule and other optional content.

The Supabase care service maintains room, account and device identifiers, public keys, access permissions, credential and invitation status, expiry times, consent records and operational receipts. Supported care payloads are encrypted for their intended recipient devices. Routing and delivery metadata, account details, membership records and invitation labels are not hidden by that content encryption. Current membership, device credentials and sharing consent determine access.

Workspace sharing consent selects the kinds of information, recipients and retention period, from 1 to 30 days. The separately configured caregiver escalation service has its own case-history retention setting, from 1 to 365 days, with a 30-day default. Open escalation cases remain until they reach a terminal state; the configured history interval then determines cleanup eligibility. Service access records and security receipts can remain after content expires to enforce revocation, prevent replay and support recovery. Revoking access stops future authorized service access; it cannot recall information already read, exported or copied by a recipient.

Circle membership and invitations

The service records room and person identifiers, display labels, Circle roles, permissions, who authorized a change, device/public-key bindings and invitation decisions. Authorized members receive the room label and the resident's verified contact email; access to rosters and shared content depends on their permissions. A Full Room Manager can invite people, change sharing and manage devices and other delegated managers. Those powers do not transfer ownership of the resident's account.

An invitation link contains a secret capability. The app submits that capability to the care service when you use it; the ordinary landing-page request does not include the link's URL fragment. Share the link privately. A forwarded link does not itself grant room access: the applicant signs in with Apple, the request is bound to that account and device keys, and an authorized manager approves the request. Invitation names are display labels, so the person approving should confirm whom they invited. Approved members can authorize additional devices under their current membership.

Invitation and approval windows expire. Personal invitation/request details become eligible for service cleanup within 14 days for an unapproved link, or up to 21 days from original creation when approved near its original expiry. Cancelling a link does not revoke a device that already enrolled; use the device or membership revocation controls for that purpose.

Optional intelligence and voice providers

An explicitly approved intelligence request can send the text and context shown for that request through the Supabase service to the provider selected for that request, Anthropic or OpenAI. The app does not automatically grant an AI provider access to the room or execute its suggested actions. When you enable and start the voice feature that identifies OpenAI, it sends microphone audio and approved context: the preferred name, room label and time zone, reported television state, current and next agenda titles, and the names and action labels of selected contacts. Enabled voice can request only listed permitted actions; authorization and execution checks still apply. The separate reviewed ElevenLabs voice preview sends a fixed nonpersonal sample sentence, not your room records or recordings.

Supabase is configured for Canada Central for these managed services. This does not mean that every network hop, operational log or external AI provider processes data only in Canada. Anthropic, OpenAI, ElevenLabs and Apple have their own processing locations, retention practices and terms. Do not submit sensitive information unless you accept the provider and the disclosure shown for that feature. Provider requests may incur costs, and cancellation cannot guarantee that a request already sent was not processed.

Notifications and diagnostics

If you enable caregiver notifications, the app registers its Apple push token with the configured care service. Notifications use generic text and an event identifier rather than a care-note body. Lock-screen notification visibility remains controlled by your device settings. Delivery depends on Apple, network availability and service configuration and is not guaranteed.

The app keeps bounded operational records to show what happened and investigate failures. Service providers may process request metadata such as network addresses, timestamps and error information. During the beta, Apple TestFlight processes installation, usage, crash and feedback information according to Apple's TestFlight terms. Anything you choose to include in feedback or an emailed diagnostic attachment is shared with the recipient.

Retention and deletion

Active account, room, membership and device records remain while needed for the service. Apple-session attestations expire after 21 days; pending email-change recovery evidence expires after 24 hours. Room-attachment setup records become eligible for cleanup seven days after their 24-hour expiry, and source-device replacement requests seven days after their seven-day expiry. Membership-decision events become eligible for cleanup after one year; workspace audit events after 30 days. Expiry prevents authorization immediately, while removal of eligible records depends on the service cleanup process. These periods do not describe Apple, Supabase Auth, email-provider or infrastructure-log retention.

Use the in-app account deletion control and confirm the account being deleted. The service disables that account's access and its bound workspace devices, removes its verified contact email and personal membership labels, and removes associated temporary setup and invitation details. Authentication-provider deletion can remain pending until confirmed; the app reports that state. Deleting a representative's or family member's account does not delete or transfer the resident's account. Deleting the resident's account requires a separate, explicit room-retirement confirmation: retirement revokes that room's workspace and caregiver escalation credentials and removes its service-held workspace content and escalation state.

Some identifier, public-key and hash records remain after deletion or revocation to prevent reuse of old invitations and credentials, preserve account/room separation and support deletion-receipt recovery. These records include disabled account identifiers, retired room bindings, revoked device, membership and Apple-session identifiers, invitation bindings and deletion-request hashes. They currently have no automatic purge date and can still be associated with earlier service activity; they are not anonymous. Contact us to ask about these retained records.

Deleting an account does not erase all local room records, photos, messages, device keys, CloudKit records or copies on other people's devices. Shared records in an active room follow that room's content and retention controls. The app removes matching account sessions and account-operation secrets on the device completing deletion while preserving unrelated room configuration and other people's accounts. Previously configured caregiver escalation credentials that were not linked to a Circle account require their own revocation; ordinary Circle account deletion cannot identify them as belonging to that person.

The app attempts to revoke Sign in with Apple authorization when the required fresh Apple authorization and server configuration are available. If that cannot be completed, the app identifies the remaining Apple action separately and directs you to remove the app's access in your Apple account settings. This does not prevent deletion of your myatmos account. Removing Apple access alone does not delete myatmos records, and uninstalling the app is not an account-deletion request.

Your controls and requests

Review Circle membership, connected devices and sharing choices in the app. You can stop optional sharing, revoke authorized access, disable notifications and change Apple system permissions. Use each feature's deletion controls for its local content and the account deletion control for the account lifecycle described above. Before deleting the app, review local records and recovery needs.

For access, correction, deletion or privacy questions about information controlled by the myatmos service, email testflight@atmoshealth.tech. Include only enough non-sensitive information to identify the request; never send a password, enrollment secret or recovery key. We may need to verify your authority before changing a room's records. We do not sell personal information or use it for advertising or cross-app tracking.

Changes to this policy

The effective date identifies this version. Material changes to optional data use require an updated disclosure and, where applicable, a new choice before that feature is enabled. A new app version does not itself authorize broader family access or additional care sharing.