Security, in one link.
EU hosting. You control the data. We process it. Every answer, vendor, and document is right here.
At a glance
EU
Hosting, storage, and video on AWS Frankfurt
You
Control the data. We process it.
0
Names or emails needed
DPA
With Standard Contractual Clauses where required
No
Training on your private content without your opt-in
Never
Selling of personal data
Last updated: 2 November 2026.
The answers
EU
Where is data hosted?
On AWS Frankfurt, in the EU. That covers hosting, storage, backups, and video delivery. AI features run on Google Cloud, which can process data outside the EU. See AI and subprocessors.
You
Who controls the data?
You do. For data you send through the API and Teams, your organisation is the controller. Hyperhuman is the processor. API customers agree to our DPA, with Standard Contractual Clauses where required. Need a copy? Contact us.
Ready to sign
What does the DPA cover?
Our DPA sets out how we process your data. To get yours ready for signature, send your legal name, registered address, company number, and privacy contact through our contact page.
- Standard Contractual Clauses, where required.
- 14 days' notice before a new subprocessor starts, with the right to object.
- Breach notice without undue delay.
- Deletion within 30 days of your written request after the agreement ends.
- One remote audit per 12 months, on 30 days' notice.
Not needed
Do you need names or emails?
No. We don't need to know who your users are.
- Identify members with your own external ID.
- Generate and recommend also work with anonymous profile attributes.
- We store a basic profile (goals, age, level) only if you send it.
Optional
How is health data handled?
You decide what to send. Health data powers fitness features. It is never used for marketing. HIPAA and a BAA are not included.
- Injuries and limitations: optional free text when you adapt or generate a workout.
- Activity, sleep, steps, and heart rate: optional health-data push.
- Readiness is computed from the signals you send. It is not a field you submit.
- Apple Health and Health Connect apply only if the user connects them.
- ROOK wearable sync applies only if you enable it.
No training
How does AI use our data?
AI features run on Google Cloud (Vertex AI and Gemini). They process the inputs you send, such as profile attributes, optional injury notes, and health signals, to generate and adapt workouts, write insights, and analyse videos. We do not use your private content to train general-purpose models unless you opt in.
- We may use aggregated, de-identified analytics to improve features and safety.
- CloneMotion makes silent exercise clips. No voice cloning.
- AI can make mistakes. Review outputs before you publish.
In place
What security is in place?
The measures in our Privacy Policy, plus how your content is protected.
- Encryption in transit (HTTPS/TLS)
- Encryption at rest for databases, media files, and backups
- Hardened networks
- Access controls and key management
- Endpoint protection and audits
- API keys scoped to your organisation
- Workout videos on time-limited signed URLs
Safeguarded
When does data leave the EU/EEA?
When a vendor outside the EU/EEA processes it. Today that includes Google Cloud for AI, Grafana Cloud for monitoring, Intercom for support, and Mailchimp for email. We use adequacy decisions or Standard Contractual Clauses for these transfers.
You decide
How long do you keep data?
While the account is active, or until you delete it. Backups and logs are kept for a limited period, then purged.
- Backups run automatically several times a day to redundant, encrypted storage in the EU.
- Ask us to delete data through our contact page. It completes within 10 business days.
- Rights requests are handled within 1 month.
- Members can delete their account in the app: Profile → Account → Delete Account.
- Legal and financial records are kept where the law requires it.
We notify
What if something goes wrong?
If an incident is likely to put people's rights at high risk, we notify you and the authorities, as the law requires. Found a vulnerability? Contact us. Our contact is also in security.txt.
No
Do you have ISO 27001 or SOC 2?
No. We don't hold ISO 27001, SOC 2, or ISO 13485 today. Enterprise can scope formal certifications. Send your security questionnaire in chat.
No
Is Hyperhuman a medical device?
No. Hyperhuman is fitness and wellness software. It does not diagnose, treat, cure, or prevent disease. Content is not medical advice.
24/7
What support and SLA do we get?
AI chat answers 24/7. Live uptime is on our status page. Custom Enterprise adds a named team, SSO, and a custom SLA.
Monthly or yearly
How do renewal and cancellation work?
Plans renew automatically, monthly or yearly, as you choose. Full details are in the Teams Terms, sections 14 to 16.
- Cancel in the app: Teams → Billing → Cancel Subscription.
- Cancellation takes effect at the end of the current term. You keep access until then.
- Yearly plans are a commitment for the full term.
- Changed your mind after a renewal? Cancel and request a refund of the plan fee in the app within 2 days of the charge.
- Export your data before the term ends. API keys are revoked after.
Documents
Request the DPA
Ask for a copy, with Standard Contractual Clauses.
Security measures
The technical and organizational measures we apply.
API Terms
Where the DPA and Standard Contractual Clauses are referenced.
Privacy Policy
What we collect, share, keep, and delete.
System status
Live uptime and incidents for the API and apps.
security.txt
Where to report a vulnerability.
All terms
Teams, API, and Club.
Subprocessors
The vendors that process customer data. Optional tools apply only if you turn them on.
| Name | Purpose | Location | Applies when |
|---|---|---|---|
| Amazon Web Services | Hosting, storage, backups, and video delivery, including the CDN | EU (Frankfurt) | Always |
| Google Cloud (Vertex AI, Gemini) | AI features: workout generation and adaptation, insights, video analysis, translation, and voice | United States and global | When you use AI features |
| Grafana Cloud | Logs, metrics, and app monitoring | United States | Always |
| Intercom | Support chat | United States | When someone opens chat or contacts support |
| Mailchimp | Account, invite, and product emails | United States | When we email your team or members |
| Stripe | Payment processing. We do not store full card numbers. | See the vendor | When you take payments |
| Firebase | Crash reports and push notifications | See the vendor | Apps that use them |
| Google Analytics | Product analytics | See the vendor | Site and product analytics |
| ROOK | Wearable sync | See the vendor | Only if you enable wearables |
| Zernio | Social publishing you turn on | See the vendor | Only if you publish to social channels |
| YouTube | Publishing you turn on | See the vendor | Only if you connect YouTube |
| Wix | Site embeds you turn on | See the vendor | Only if you use Wix |
More questions
Can we get a signed DPA?
Yes. API customers agree to our DPA, with Standard Contractual Clauses where required. Contact us for a copy.
Is data encrypted at rest?
Yes. Databases, media files, and backups are encrypted at rest on AWS Frankfurt. All traffic is encrypted in transit with HTTPS/TLS. See all our security measures.
What end-user data appears in your logs?
Logs can include IP address, device and browser data, and API call events. Send a name or email only if you need to.
Can we export or delete member data?
Yes. Member data is available through the API. Pushed health and nutrition entries can be deleted through the API. Wider exports are handled on request.
How do members of our app delete their account?
In the app: Profile → Account → Delete Account. Or through our contact page. Deletion completes within 10 business days.
Do you sell personal data?
No. We do not sell personal data.
Can we opt out of de-identified analytics?
Not self-serve today. Custom data rules are part of Enterprise.
Is HIPAA included?
No. We are not a HIPAA business associate. A BAA is not included unless agreed in writing.
How are workout videos protected?
Videos stream from time-limited signed AWS URLs. API keys are scoped to your organisation. DRM and offline packages are not available.
Which privacy laws do you cover?
GDPR and UK GDPR, with hosting in the EU. You give your users the privacy notice and collect any consent you need. We process on your instructions.
What age limit applies?
The services are for users 18 and over.
Is there a native SDK?
No. The API is the integration. Typed clients can be generated from the OpenAPI spec. AI Motion uses the Asensei SDK inside your app.
