Introduction
Lowkey Enterprises, Inc. ("LOWKEY," "we," "us," or "our") provides the LOWKEY mobile application and related services (collectively, the "Services"), a personal pattern detection and notification system that passively notices behavioral patterns using objective data you authorize us to collect from your device. When statistical deviations from your established baseline are detected, you receive a notification first. You may optionally designate recipients (your "Supporters" in your "Constellation") to receive escalation notifications.
This Privacy Policy explains how we collect, use, store, and protect your information. This Privacy Policy is incorporated into, and forms part of, our Terms of Service (the "Terms"), which govern your use of the Services. Capitalized terms used but not defined here have the meanings given in the Terms.
Core Principle: Your privacy is a core priority. We collect only what is necessary to detect pattern deviations and send alerts to you. We process sensitive data on your device whenever possible, and we do not sell your personal data. Except as described in this Privacy Policy, no personal information is shared with your Supporters in your Constellation unless you specifically choose to share it.
Information We Collect
Data You Provide
- Account Information: Name, email address, phone number, date of birth, and sex assigned at birth.
- Supporter Information: Contact information for your chosen Supporters in your Constellation.
- User Preferences: Notification settings and pattern tracking preferences.
How We Differentiate Data
To protect your privacy, LOWKEY distinguishes between high-granularity "raw" signals from your device, daily totals ("Summary Metrics"), and the higher-level context we use to help you and your Supporters understand meaningful changes ("Contextual Insights").
- Raw Sensor Data: High-frequency heart rate timestamps, raw accelerometer pings, and exact GPS coordinates. We do not share raw sensor data with your Supporters or any third party.
- Summary Metrics: Daily totals such as number of steps, total hours slept, and number of house exits. You may choose to share certain summary numbers with your Supporters where the product offers that control.
- Contextual Insights: Percentage changes, baseline deviations, and pattern alerts, such as “Steps decreased by 30%” or “A deviation from your baseline was detected.” This is the primary type of context Supporters receive to help them check in without exposing granular data.
Data We Collect Automatically
Health & Activity Data (via Apple HealthKit): We may collect and analyze any HealthKit data types you authorize (read access, and where applicable write access) to support non-diagnostic pattern detection and to look for patterns that may indicate improvement or decline over time. Examples include steps, heart rate, active calories, exercise minutes, walking or running distance, flights climbed, sleep, HRV, and other categories that may be present depending on your devices and connected apps. This data is aggregated hourly and stored securely. You control HealthKit permissions through iOS Settings.
Motion Data: Phone pickup patterns detected through iOS motion sensors and used to understand engagement patterns.
Location Pattern Data: GPS coordinates are processed entirely on your device and never transmitted to our servers. Only anonymized location pattern IDs, such as “Home” or “Work,” are stored. We track when you enter or leave user-defined locations, not your precise GPS coordinates.
Geofencing Notice: LOWKEY does not use geofencing to identify, track, or advertise around any health care facility or other in-person location. Our geofencing features are used solely for your personal, user-defined location-pattern detection, only at your direction and with your consent, and we never use them for advertising or marketing purposes.
Usage Data: App interaction patterns, feature usage, alert responses, device model, iOS version, and app version. Technical data is used for troubleshooting only.
How We Use Your Information
- Pattern Detection: Analyze patterns to detect deviations from your personal baseline.
- Notifications: Notify you when pattern deviations are detected. If you have chosen Supporters in your Constellation, they receive notifications only if you have invited them to be a part of your network and they accept the invitation and agree to purchase the App.
- Service Improvement: Improve algorithm accuracy and app functionality.
- Research & Development: Use de-identified data and aggregated population trends to improve and develop the Services, including the accuracy of our pattern detection. We use health data obtained through Apple HealthKit only to provide and improve health and wellness features of the Services and, where we conduct medical research, only with your separate consent. We do not use HealthKit data or any other health data for advertising or use-based data mining.
- Support: Respond to your questions and technical issues.
- Safety & Security: Prevent fraud and maintain service security.
Geographic Community Awareness
We may use anonymized, aggregated zip code data to help us grow the LOWKEY community.
- Aggregated Analysis: We analyze which general areas, identified by zip code, benefit most from LOWKEY.
- Geographic Advertising: We may use this aggregate data to run localized awareness campaigns in those zip codes through third-party platforms such as Google. These campaigns use only aggregated zip code data. We never use HealthKit data or any other health or activity data for advertising.
- Your Privacy: We do not upload your specific name, email, or individual zip code to these platforms for targeting. Our ads are shown to everyone in a geographic area, so your personal identity remains private and unlinked to our marketing efforts.
Privacy by Design
On-Device Processing
- GPS coordinates never leave your phone.
- Location calculations happen entirely on-device.
- Only anonymized pattern IDs are transmitted.
Minimal Data Collection
- We collect only what is necessary for the Services to work.
- We do not use advertising IDs or cross-app tracking.
- We do not use device fingerprinting.
Aggregation
- Health data is aggregated hourly, not stored second-by-second, and is stored on our secure servers rather than in iCloud.
- Notifications to your Supporters contain only high-level Contextual Insights, never raw metrics.
Data Sharing
We Do Not Sell Your Personal Data. We do not sell your personal information—including your name, email, phone number, GPS coordinates, raw health metrics, and any data that identifies you—to advertisers, data brokers, insurance companies, or other third parties.
Limited Sharing
- Your Supporters in your Constellation: Receive only notifications with high-level context when patterns are concerning. They never see raw health data, GPS coordinates, or detailed activity logs.
- Service Providers: We use trusted third-party services for hosting, notifications, and analytics. These providers are bound by strict data protection agreements and cannot use your data for their own purposes.
- Legal Requirements: We may disclose information if required by law, court order, or to protect safety in emergency situations.
- Business Transfers: In connection with a merger, acquisition, financing, or sale of all or part of our business or assets, your information may be transferred to the successor entity, which will remain bound by protections consistent with this Privacy Policy.
Except as described in this Privacy Policy, we do not share your data with advertisers or marketing companies, data brokers, insurance companies, or employers.
Data Security
Encryption
- TLS 1.3 encryption for all data in transit.
- AES-256 encryption for data at rest.
- Secure authentication with JWT tokens.
Access Controls
- Row-level security ensures you can access only your own data.
- Bcrypt password hashing.
Infrastructure
- SOC 2-aligned security architecture; LOWKEY is not currently SOC 2 certified.
- Automated backups with seven-day retention.
Your Rights & Controls
You have the right to:
- Access: View all data we have collected about you.
- Export: Download your data in a portable format.
- Delete: Permanently remove your account and all associated data.
- Pause: Suspend pattern tracking at any time using Vacation or Illness Mode.
- Control: Adjust what data is collected through iOS permissions and app settings.
- Object: Opt out of optional data collection.
To exercise these rights, email support@lowkeyprotection.com or use the in-app settings.
Data Retention
- Active accounts: Data is retained while your account is active.
- Deleted accounts: All data is permanently deleted within 30 days of account deletion.
- Backups: Deleted data is removed from backups within seven days.
Children's Privacy
The Services are intended for users 18 and older, consistent with the eligibility requirements in our Terms. We do not knowingly collect information from anyone under 18. If you believe we have collected data from someone under 18, contact us immediately and we will delete it.
Third-Party Services
We use:
- Supabase: Secure database and authentication.
- Firebase Cloud Messaging: Push notifications.
- Apple HealthKit: Health data access governed by Apple's privacy policies. We use HealthKit data solely to provide and improve the health and wellness features of the Services, consistent with Apple's HealthKit requirements, and we do not share HealthKit data with third parties for advertising or use-based data mining.
These services are carefully selected for their security and privacy practices. Personal health information is never sent to Firebase or analytics services.
Automated Decision-Making
LOWKEY uses algorithms to detect pattern deviations from your personal baseline and generate notifications. Internally, this baseline deviation approach may be referred to as the Baseline Deviation Score (or "BDS"). These algorithms analyze your data, including steps, sleep, location patterns, and phone usage, to identify meaningful changes.
- Not real-time monitoring: The Services are not a real-time safety monitor. Signals may be delayed or incomplete due to data availability, device settings, or other technical factors.
- Reliability & Data Availability: Some users will have less available signal, such as phone-only users or users with missing HealthKit categories. When signal is limited, our system may suppress or adjust notifications to reduce false alerts.
- Feedback: You can provide feedback on notifications directly in the app to improve accuracy for your unique patterns.
- Algorithmic transparency: Alerts are statistical deviations, not clinical diagnoses. You may adjust sensitivity or opt out of sharing Contextual Insights with Supporters at any time in Settings.
- No solely automated decisions: We do not use solely automated processing to make decisions that produce legal or similarly significant effects concerning you. Our notifications are informational wellness signals only.
California Privacy Rights
Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have the right to:
- Request information about what personal data we collect and how we use it.
- Request deletion of your personal data.
- Opt out of the sale of personal data, although we do not sell personal data.
- Not be discriminated against for exercising these rights.
To exercise these rights, email support@lowkeyprotection.com or use the in-app data controls in Settings.
Other U.S. State Privacy Rights
Depending on where you live, you may have additional rights under your state's privacy law, including Colorado, Virginia, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, and other states with comprehensive privacy statutes. Subject to your state's law and applicable exceptions, you may have the right to:
- Confirm whether we process your personal data and access that data.
- Correct inaccuracies in your personal data.
- Delete personal data we have collected about you.
- Obtain a portable copy of your personal data.
- Opt out of the processing of your personal data for targeted advertising, the sale of personal data, and certain profiling that produces legal or similarly significant effects.
- Consent to, or withdraw consent for, our processing of sensitive data, including health data and precise geolocation. Where required, we process sensitive data only with your consent.
Sensitive data and opt-in consent: Certain data we process, such as health information and precise geolocation, is considered "sensitive" under many state laws. Where required, we obtain your consent before collecting or processing sensitive data, and you may withdraw that consent at any time in Settings. Your continued use of the Services, and your acceptance of this Privacy Policy or the Terms, do not by themselves constitute consent to process sensitive data or consumer health data; we rely on your separate, affirmative, opt-in consent for those purposes.
Universal opt-out mechanisms: In states that require it, such as Colorado and California, we honor recognized universal opt-out signals, including Global Privacy Control (GPC), as a valid request to opt out of the sale of personal data and processing for targeted advertising.
How to exercise your rights: Email support@lowkeyprotection.com or use the in-app data controls in Settings. We will respond within the time required by your state's law, generally 45 days with an extension where permitted. We may need to verify your identity before fulfilling your request. You may use an authorized agent to submit requests where the law permits, subject to verification.
Right to appeal: If we decline to act on your request, you may appeal by emailing support@lowkeyprotection.com with the subject line "Privacy Appeal." We will respond to your appeal within the time required by applicable law. If your appeal is denied, you may contact your state Attorney General to raise concerns.
Consumer Health Data
Because LOWKEY processes information relating to your physical and behavioral health, some of the data we collect may qualify as "consumer health data" under laws such as the Washington My Health My Data Act (MHMDA), Nevada SB 370, and comprehensive state privacy laws. This section supplements the rest of this Privacy Policy for residents of those states.
Depending on your jurisdiction, you may have rights to confirm whether we collect, share, or sell your consumer health data; to access it and receive a list of third parties and affiliates with whom it has been shared; to delete it; to withdraw your consent to its collection or sharing; and to correct inaccuracies. We collect, use, and share consumer health data only with your separate, affirmative, opt-in consent where required, to the extent necessary to provide the Services, or as permitted by law. We do not sell it or use it for advertising.
For complete details about our consumer health data practices, your rights, and the consents required to use and share this information, review our Consumer Health Data Privacy Policy.
Changes to This Policy
We may update this Privacy Policy to reflect service changes or legal requirements. We will notify you of material changes through email or an in-app notification and update the Effective Date above. Your continued use of the Services after changes take effect means you accept the updated Privacy Policy.
Contact Us
Questions about this Privacy Policy or our data practices?
Email: support@lowkeyprotection.com
Address: Lowkey Enterprises, Inc., 2525 Arapahoe St Unit E4 #715, Boulder, CO 80302