Privacy policy

Effective date: 27 October 2026

This policy explains what personal data Latido processes, why, on what legal basis, for how long, who else is involved and what rights you have. It covers the website at getlatido.com, the console at app.getlatido.com, the hosted connect page and the API at api.getlatido.com (together, "Latido" or "the Service").

A Spanish version of this policy is available on request at tech@feynman.es.

#Who we are

Latido is a product of Feynman, the trading name of:

In this policy "we", "us" and "our" mean Optionality Partners, S.L. We have not appointed a data protection officer, as the law does not require one for us; every privacy question goes to tech@feynman.es.

#Our two roles

Latido is an API for businesses and developers ("customers") who build apps that read health and fitness data from wearables and health platforms. Two different kinds of people therefore have data in Latido, and our role differs for each:

1. We are the controller for the data of people who visit our website and of our customers' users of the console (account holders and their team members). We decide why and how that data is processed.
2. We are a processor (article 28 of the General Data Protection Regulation, "GDPR") for the data of our customers' end users, called members in Latido: the people who connect their Garmin, Oura, Strava or other account to a customer's app. The customer is the controller of that data. We process it only to provide the Service and on the customer's documented instructions, under the Data Processing Addendum in our Terms of service.

If you are a member and want to know what an app does with your data, read that app's privacy notice and contact it first: it decides what is collected and why. You can also write to us, and we will pass your request to the customer and help them answer it.

#Data we process as controller

#Website visitors

The website has no analytics, no advertising and no third-party trackers, and it sets no cookies. It loads its fonts and scripts from our own servers only.

Like any web server, ours record technical request data: IP address, date and time, the page or resource requested, the response status, the referring page and the browser's user agent. We use it only to deliver the site, keep it secure and fix faults.

• Legal basis: our legitimate interest in operating a secure website (GDPR article 6(1)(f)).

#Customer accounts and the console

When you create an account or are invited to a team, we process:

• Account data: your name, email address, the name of your account or company, the projects you create, your team memberships and roles.
• Credentials: your password, stored only as an argon2 hash we cannot reverse. API keys and personal MCP tokens are stored only as SHA-256 hashes plus a short display prefix; we show each secret once, at creation.
• Licence and billing data: if you buy a lifetime licence on AppSumo, we receive from AppSumo the licence key, its tier and status, and the notifications AppSumo sends about it (activation, upgrade, downgrade, refund), which can include the email address of the buyer. AppSumo processes the payment; we never receive card or bank details.
• Usage and security logs: the API requests made with your keys (time, endpoint, response status, the project and mode), monthly request counts, webhook delivery logs, an audit log of the actions taken in your account, and the IP address and user agent of requests to the console and the API.
• Communications: the emails you send us and our replies, for support, sales or any other question.

We do not send marketing emails without your consent, we do not sell personal data, and we do not use your data for profiling or automated decisions with legal or similarly significant effects.

#Data we process as processor

When a customer's app sends a member to Latido's hosted connect page and the member connects a health platform, or when the customer uploads data from Apple Health or Health Connect through our ingest API, we process on the customer's behalf:

• Identifiers: the Latido member id, the identifier the customer gives the member (externalUserId), any metadata the customer attaches, and the member's user id and display label at each connected platform.
• Provider credentials: the OAuth access and refresh tokens each platform issues. They are encrypted at rest with AES-256-GCM, never returned by the API, and deleted when the connection is revoked.
• Health and fitness data: workouts (including routes, heart rate, power, laps and activity files where the platform provides them), sleep sessions and stages, daily summaries (steps, energy, resting heart rate, heart rate variability, stress, readiness, SpO2), body measurements (weight, body composition, blood pressure, temperature), heart rate series and glucose readings, together with the platform's original payload for each record.
• Connection data: which platforms are connected, granted scopes, sync status and errors.

Health data is a special category of personal data (GDPR article 9). The customer, as controller, must have a valid legal basis for it, which for most apps is the member's explicit consent (article 9(2)(a)), and must give members a privacy notice that covers Latido's processing. The hosted connect page names the customer's project that will receive the data and that the member can disconnect at any time, and each health platform then shows its own consent screen listing the data the member agrees to share. We process member data only to provide the Service to the customer: storing it, normalizing it, delivering it through the API, signed webhooks, the SDK and the MCP server, and deleting it.

Erasure and disconnection. A customer can erase a member at any time, through the API (DELETE /v1/members/{memberId}) or the console: this revokes every connection and deletes the member's records, credentials and connection data, and removes the entries of our logs that name them. Revoking a single connection (from the customer, or by the member at the platform) deletes the stored tokens and stops all further syncing.

#Health platforms are independent controllers

Garmin, Strava, Polar, Suunto, COROS, Oura, WHOOP, Withings, Wahoo, Dexcom, Huawei, Google and the other platforms a member chooses to connect are not our sub-processors. They hold the member's account and data under their own terms and privacy policies, and they decide what they share. When a member authorizes a connection, the platform sends the data the member agreed to, and the platform's own terms apply to that account. Apple Health and Health Connect store data on the member's phone; the customer's app reads it there with the member's permission and uploads it.

#Who receives data: our sub-processors

We use a small number of service providers. Each processes data only on our instructions under a data processing agreement.

AppSumo acts as an independent controller for the purchase you make on its marketplace; its privacy policy applies to that purchase.

We may also disclose personal data to our professional advisers (lawyers, auditors) under a duty of confidentiality, to public authorities or courts when the law requires it, and to a successor in the event of a merger or acquisition, which would remain bound by this policy. We give customers notice of new sub-processors as the Data Processing Addendum describes.

#International transfers

Latido itself keeps data in the European Union: our production infrastructure is in Germany. We do not transfer customer or member data outside the European Economic Area ourselves.

When a member connects a platform based outside the EEA (for example a US-based service), the data flows between the member's account at that platform and Latido because the member, and the customer's app, chose to connect it. That platform is responsible for its own processing and transfers under its own terms. The same applies if a customer configures webhooks or reads the API from servers outside the EEA: that transfer is the customer's, as controller.

#How long we keep data

Backups follow the same rules: deleted data disappears from them as they rotate.

#Security

We protect data with measures appropriate to its sensitivity, including:

• Encryption in transit with TLS on every public endpoint.
• Encryption at rest of every provider credential and of customers' own provider app secrets with AES-256-GCM.
• Passwords hashed with argon2; API keys and MCP tokens stored only as SHA-256 hashes.
• Webhooks signed with HMAC-SHA256, so customers can verify that a delivery comes from us; live webhook URLs must be public HTTPS, and requests to private or internal network addresses are blocked (protection against server-side request forgery).
• Strict separation between projects and between test and live data: an API key reaches only its own project and mode.
• Access to production systems limited to the staff who need it, with individual credentials; secrets kept in a dedicated secrets manager, never in source code.
• Logs that never contain request bodies, passwords, tokens or health data, and an audit trail with secrets redacted.

No system is perfectly secure. If a personal data breach affects you, we will inform you and, where required, the supervisory authority, as the law provides.

#AI and the MCP server

Latido offers an MCP server so that a customer's AI agent can read the customer's data with the customer's API key. It is the customer who decides to connect an agent and which AI provider runs it.

• Data from platforms whose terms forbid AI use (today Strava and Oura) is never returned through the MCP server. Raw platform payloads are never returned through it either.
• We do not train AI models on customer or member data, and we do not send that data to any AI provider ourselves.

#Not a medical device

Latido is not a medical device. The data it processes comes from consumer devices and platforms and is not intended for diagnosing, treating, curing or preventing any disease or condition.

#Cookies and local storage

The website (getlatido.com) sets no cookies. If you switch between the light and dark theme, your choice is saved in your browser's local storage under latido-theme; it never leaves your device.

The console (app.getlatido.com) uses only storage that is strictly necessary for it to work, or that keeps a choice you made. Nothing is used for analytics or advertising, and nothing is shared with third parties:

Because these are strictly necessary or keep a preference you set, they do not need consent under article 22.2 of the Spanish Information Society Services Act (LSSI). You can delete them at any time in your browser settings; you will then be signed out.

#Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate data;
• erase your data;
• restrict our processing in certain cases;
• object to processing based on our legitimate interests;
• portability: receive the data you gave us in a structured, machine-readable format;
• withdraw consent at any time, where processing is based on consent, without affecting what was done before.

To exercise them, email tech@feynman.es from the address linked to your account, or tell us how we can verify who you are. We answer within one month, which the law allows us to extend by two further months for complex requests; we will tell you if we do.

If you are a member, the customer whose app you connected is the controller of your data: please contact them. If you write to us, we will forward your request to that customer without undue delay and help them answer it.

You also have the right to lodge a complaint with a supervisory authority. In Spain it is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You may also complain to the authority of the EU country where you live or work. We would appreciate the chance to address your concern first.

#Children

Latido is a service for businesses and developers. The console is not directed at children and we do not knowingly create accounts for anyone under 18. Customers whose apps serve minors are responsible, as controllers, for obtaining the consent the law requires (in Spain, from a parent or guardian for members under 14).

#Changes to this policy

We may update this policy to reflect changes to the Service or the law. We will publish the new version here with a new effective date and, for material changes, notify account holders by email at least 30 days before they apply.

#Contact

Optionality Partners, S.L., Carrer del Turia 53, 46008 Valencia, Spain. Email tech@feynman.es, phone +34 960 73 06 71.