Privacy Policy

Last updated: April 20, 2026

NightSherpa ("we," "us," or "our") is committed to handling your personal information responsibly and transparently. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights with respect to that data.

By using NightSherpa, you agree to the practices described in this policy.

1. Information We Collect

We collect the following categories of information:

Account Information

When you create an account, we collect your name and email address. This information is used to create and manage your account and to communicate with you about your service.

Health and Sensor Data

To perform your sleep study, you upload a CSV data file exported from the Wellue O2Ring device. This file contains raw overnight measurements including:

• Blood oxygen saturation (SpO2) readings
• Pulse rate measurements
• Motion/movement data

This data is the core input to your automated report. It is sensitive health-related information and we treat it accordingly.

Shipping Address

We collect a shipping address to mail your rental device and study kit. This address is used solely for fulfillment and is not used for marketing.

Payment Information

Payment processing is handled by Stripe. When you pay for the service, your card details are submitted directly to Stripe and are never stored on NightSherpa's servers. We receive only a tokenized reference and basic transaction metadata (e.g., last four digits, card type, transaction status) necessary to manage your order and handle billing for equipment fees.

Usage Analytics

We use Ahoy, a self-hosted analytics library, to collect information about how visitors and users interact with our website — such as which pages are visited and which features are used. This data is stored on our own infrastructure and is used exclusively for internal product improvement and marketing analytics. We do not share Ahoy data with third parties.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide the service: Your sensor data is processed by our automated system to generate your PDF sleep study report.
• To manage equipment rental: Your shipping address is used to send and track your device kit. Your payment information is used to charge for the rental and any applicable equipment fees.
• To communicate with you: We send transactional emails related to your order, including order confirmation, shipping notifications, study check-ins, report availability notifications, and return reminders.
• To improve our product: Anonymized and aggregated usage analytics help us understand how the service is used and guide product development decisions.

What we do not do with your data:

• We do not sell your personal data or health data to any third party.
• We do not share your health data with insurers, employers, pharmaceutical companies, or advertising platforms.
• We do not use your health data for any purpose other than generating your report and providing the service.
• We do not use your data to train machine learning models for external use.

3. Data Retention

We retain different types of data for different lengths of time:

• Sleep study reports (PDF): Deleted 180 days after the report is generated. We strongly recommend downloading your report as soon as it is available.
• Raw sensor data (CSV files): Deleted 90 days after processing is complete.
• Account data (name, email, order history): Retained for as long as your account is active. If you close your account or submit a deletion request, we will delete your account data within a reasonable time, subject to any legal retention obligations.
• Shipping addresses: Retained for the duration of your order and a reasonable period thereafter for fulfillment records.

4. Data Security

We take reasonable technical and organizational measures to protect your data. Specifically:

• All data transmitted between your browser and our service is encrypted using TLS (HTTPS).
• Your files and reports are stored on Cloudflare R2 infrastructure, which provides encryption at rest.
• Access to your data is restricted to automated systems and a minimal number of authorized personnel for operational purposes.

While we implement these safeguards, no system is perfectly secure. We cannot guarantee that unauthorized access, disclosure, or loss of your data will never occur. If we become aware of a security incident affecting your data, we will notify you as required by applicable law.

5. Third-Party Services

NightSherpa uses the following third-party service providers to operate the service. Each provider processes data only as necessary to perform their role:

• Stripe — Payment processing. Stripe handles all card transactions and is PCI-DSS compliant. See Stripe's Privacy Policy.
• Postmark — Transactional email delivery. Postmark is used to send order confirmations, notifications, and other service-related emails. See Postmark's Privacy Policy.
• Cloudflare — File storage and infrastructure. Your uploaded data files and generated reports are stored on Cloudflare R2. See Cloudflare's Privacy Policy.

We do not use third-party advertising networks, behavioral tracking services, or data brokers.

6. Your Rights

You have the following rights with respect to your personal data:

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may request that we correct inaccurate or incomplete information about you.
• Deletion: You may request that we delete your account and associated personal data. Note that some data may be retained for a limited period to satisfy legal obligations or resolve disputes.
• Withdrawal of consent: Where processing is based on consent, you may withdraw that consent at any time, though this will not affect processing that occurred before withdrawal.

To exercise any of these rights, contact us at support@nightsherpa.com. We will respond within a reasonable time and in accordance with applicable law.

7. Children's Privacy

NightSherpa is intended for use by adults only. Our service is not directed at children under the age of 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted data through our service, please contact us at support@nightsherpa.com and we will promptly delete that information.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice within your account, and we will update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Your continued use of NightSherpa after changes are posted constitutes acceptance of the updated policy.

9. Contact

If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us at:

NightSherpa Support
support@nightsherpa.com