Terms of service

Effective date: 27 October 2026

These terms govern your use of Latido: the API at api.getlatido.com, the console and hosted connect page at app.getlatido.com, the MCP server, the TypeScript SDK, the documentation and the website at getlatido.com (together, the "Service"). They include the Data Processing Addendum below.

A Spanish version of these terms is available on request at tech@feynman.es. If the two versions differ, the English one prevails, unless the law requires otherwise.

#Who we are

The Service is provided by Optionality Partners, S.L. (trading as Feynman; Latido is its product), tax ID (CIF/NIF) B26834515, registered office Carrer del Turia 53, 46008 Valencia, Spain, email tech@feynman.es, phone +34 960 73 06 71 ("we", "us").

#Acceptance and who may use Latido

By creating an account, activating a licence or using the Service, you accept these terms on behalf of the company or organization you represent, or on your own behalf if you act as an individual professional ("you", the "customer"). You confirm that you have the authority to do so.

Latido is a service for businesses and developers. It is not offered to consumers. You must be at least 18 and use the Service for purposes related to your trade, business, craft or profession. Nothing in these terms limits any right that mandatory law gives you and that cannot be waived by contract.

#The Service

Latido lets you connect your users' accounts at health and fitness platforms (such as Garmin, Polar, Suunto, COROS, Strava, Oura, WHOOP, Withings, Wahoo, Dexcom, Huawei Health and Google Health), and receive data uploaded from Apple Health and Health Connect, and read that data in one normalized format through a REST API, signed webhooks, an SDK and an MCP server for AI agents. Your end users are called members. The hosted connect page lets members choose a platform and authorize it; test mode and a simulated "Latido Demo" provider let you build without real devices.

The features, the platforms available and the status of each one are described in the documentation and in the console. We continuously develop the Service and may add, change or remove features. We will not materially reduce the core functionality of a paid plan during its term without notice as described in Changes to the Service.

#Not a medical device

Latido is not a medical device and is not intended for diagnosing, treating, curing, mitigating or preventing any disease or medical condition. The data comes from consumer devices and third-party platforms and may be incomplete, delayed or inaccurate. If you build a product that is or may be a medical device, or that is used in clinical care, you are solely responsible for its regulatory status (including under Regulation (EU) 2017/745), its validation and its clinical safety.

#Accounts

• You must give accurate information when you sign up and keep it up to date.
• You are responsible for everything done in your account, including by the team members you invite. Keep your password confidential and tell us at once at tech@feynman.es if you suspect unauthorized access.
• One person may not share a login with others; invite them as team members within your plan's seats.

#API keys and credentials

• API keys (lat_test_…, lat_live_…), personal MCP tokens and webhook signing secrets are shown once. You are responsible for storing them securely, keeping them on your servers (never in a mobile app, a browser or a public repository) and revoking any key you believe is exposed.
• Activity performed with your keys is treated as yours, and counts towards your plan's limits, until you revoke the key.
• If you use your own provider credentials ("bring your own keys"), you are responsible for keeping them valid and for complying with the terms under which the platform issued them. We store them encrypted and use them only to provide the Service to you.

#Acceptable use

You must not, and must not allow anyone to:

• use the Service in breach of any law, including data protection, consumer protection, health and medical device law;
• process a member's data without a valid legal basis, or use it for a purpose the member was not told about;
• resell, sublicense or provide raw access to the Service or to platform data as a standalone data feed, or in any other way the relevant platform's terms forbid;
• break the developer terms of any platform you connect. When you use your own provider credentials, you are bound directly by that platform's developer agreement, and you must follow it, including its rules on displaying data, rate limits, branding, intermediaries and AI;
• send Strava or Oura data, or data from any other platform whose terms forbid it, to AI models, including by forwarding data you read through the REST API to an AI model yourself. Latido never returns such data through its MCP server, but what you do with data you read through the API is your responsibility;
• probe, scan or test the vulnerability of the Service, or bypass its security, authentication or limits, without our written permission (we welcome responsible disclosure at tech@feynman.es);
• interfere with the Service or other customers, including by sending excessive traffic or using automated means to create accounts;
• upload malicious code, or content that is unlawful or infringes anyone's rights;
• use the Service to build a competing product by copying its features, documentation or interfaces, or reverse engineer it, except where the law allows it despite this restriction.

#Your obligations as controller of members' data

For the personal data of your members, you are the controller and we are your processor. You are responsible for:

• having a valid legal basis for collecting and processing your members' data, which for health data is in most cases their explicit consent under GDPR article 9(2)(a), and recording it;
• giving your members a clear privacy notice that explains what data you collect through Latido, why, for how long, and that Latido processes it on your behalf;
• answering your members' requests to exercise their rights, using the tools we provide (for example, erasing a member through the API or the console);
• the instructions you give us through your configuration of the Service, and the lawfulness of the data you upload or ask us to collect;
• complying with any obligations that apply to the data in your own systems once you receive it through the API, webhooks or MCP.

#Plans, licences and payment

#Plans and limits

The Service is offered on a free plan and on lifetime tiers. Each plan has limits, such as projects, connected members, API requests per month, webhook endpoints, team seats and data retention, which are listed on our pricing and in the documentation. The limits in force when you obtain a plan are the ones that apply to it. When a limit is reached, the API refuses the request that exceeds it until usage falls below it or you move to a higher tier.

#Lifetime licences sold on AppSumo

Lifetime licences are sold through AppSumo. For those purchases:

• AppSumo is the seller of record. It takes the payment, issues the receipt and handles refunds under its own terms. You can ask AppSumo for a refund within its 60-day refund window; when AppSumo refunds a licence, the licence is deactivated and the account returns to the free plan.
• A licence gives access to its tier's limits for the lifetime of the Latido product, including future updates to the features of that tier, with no recurring fee.
• Upgrades and downgrades between tiers are made through AppSumo; the account follows the tier of its licence.
• No stacking: one licence per account; licences cannot be combined to add up limits.
• A licence is not transferable and cannot be resold, except as AppSumo's own terms allow before activation.
• "Lifetime" means the lifetime of the Latido product, not of the customer or of any person. If we ever decide to discontinue Latido, we will give licence holders at least 12 months' notice by email and a way to export their data during that period.
• Lifetime licences do not include Latido-managed apps for platforms that charge for access or limit it to partners (today Garmin, Oura, WHOOP, Dexcom and Google Health); those work with your own provider credentials on every tier.

#Other paid plans

If we offer other paid plans, their prices, billing periods and any taxes will be shown before you buy, and the specific terms shown at purchase will apply together with these terms.

#Fair use

Lifetime and free plans are designed for the normal use of an app by its members within the plan's limits. We may contact you, and if needed throttle or limit the traffic concerned, where usage is abusive or puts the Service at risk for others, for example sustained bursts far above normal patterns, automated re-syncing with no purpose, or use that evades the limits (such as splitting one product across several accounts). We will tell you what we observed and give you a reasonable opportunity to fix it, except in an emergency.

#Availability and support

We work to keep the Service available and to fix faults promptly, but we do not offer a service level agreement (SLA) on the free plan or on lifetime licences. The Service may be interrupted for maintenance, updates, or reasons beyond our control. Support is provided by email at tech@feynman.es, on a reasonable-efforts basis.

#Third-party platforms

The data Latido delivers comes from third-party platforms that we do not control. Each platform may change its API, its terms, its pricing or its approval criteria, limit or revoke access for us or for you, or shut down (as Fitbit's legacy API did). We are not responsible for such changes or for the resulting unavailability of a platform or its data. We will make reasonable efforts to adapt Latido, keep the normalized format stable, and tell you in the console or by email about changes that affect you. A platform becoming unavailable is not a breach of these terms and does not entitle you to a refund from us.

#Intellectual property

We, or our licensors, own all rights to the Service, the software, the documentation, the normalized data model and the Latido name and brand. Subject to these terms, we grant you a non-exclusive, non-transferable, revocable right to use the Service, and the SDK and documentation for the purpose of integrating with it, during your subscription or licence.

You keep all rights to your data and to your members' data. You grant us the rights needed to host, process and transmit it only to provide the Service to you, as the Data Processing Addendum describes.

#Feedback

If you send us suggestions or ideas, we may use them freely, without any obligation to you, but we will not name you without permission.

#Suspension and termination

• By you: you can stop using the Service at any time and ask us to close your account at tech@feynman.es. Before closing, you can export your data through the API.
• By us: we may suspend access, in whole or in part, immediately if you seriously or repeatedly breach these terms, if your use puts the Service, other customers or members at risk, if a platform or an authority requires it, or if we must do so by law. Where reasonable we will warn you first and give you a chance to fix the problem. We may terminate your account for a material breach you do not fix within 15 days of our notice.
• On termination, your right to use the Service ends, and we delete your data and your members' data as described in the privacy policy and the Data Processing Addendum. Sections that by their nature should survive (such as liability, indemnity and governing law) survive termination.

#Changes to the Service

If we make a change that materially reduces the core functionality of your plan, we will tell you by email at least 30 days in advance, except where a platform, a security issue or the law forces a faster change.

#Disclaimers

Except as expressly stated in these terms, and to the extent the law allows, the Service is provided "as is" and "as available". We do not warrant that it will be uninterrupted or error-free, that every platform will remain available, or that the data from third-party platforms is complete, accurate or fit for a particular purpose, including any medical, clinical or safety-critical purpose.

#Limitation of liability

To the extent the law allows:

• neither party is liable for indirect or consequential loss, loss of profits, revenue, business, goodwill or data (other than our obligations to restore data under the Data Processing Addendum where possible);
• our total liability arising out of or in connection with the Service is limited to the amounts you paid for the Service in the 12 months before the event giving rise to the claim. For free plans, and for lifetime licences where the payment was received by AppSumo, this means the amount we received for your account in that period, or one hundred euros (EUR 100) if that amount is lower or nothing was paid.

Nothing in these terms limits liability for fraud, wilful misconduct or gross negligence, for death or personal injury caused by negligence, or any other liability that cannot be limited by law.

#Indemnity

You will defend and indemnify us against claims by third parties, including members, platforms and authorities, arising from your breach of these terms, your breach of a platform's developer terms, your use of data obtained through the Service, or your failure to obtain a valid legal basis or consent for the data you process, and you will cover the reasonable costs and fines that result. We will tell you promptly about any such claim and cooperate reasonably with you.

#Data Processing Addendum

This addendum forms part of these terms and applies whenever we process personal data on your behalf as your processor, as required by article 28 of the GDPR and the Spanish Organic Law 3/2018 on data protection (LOPDGDD). If it conflicts with the rest of the terms, this addendum prevails for personal data.

Subject matter and duration. We process members' personal data to provide the Service, for as long as you use it and until the data is deleted as described below.

Nature and purpose. Collecting data from the platforms and uploads you or your members authorize; storing, normalizing and securing it; delivering it to you through the API, webhooks, the SDK and the MCP server; and deleting it.

Types of data. Member identifiers and metadata you provide; platform user ids and labels; platform OAuth credentials; health and fitness data, which is special-category data (workouts, routes, sleep, daily activity, heart rate and heart rate variability, body measurements, blood pressure, temperature, glucose and similar); connection and sync information.

Data subjects. Your members, that is, your end users who connect a platform or whose data you upload.

1. Instructions. We process the data only on your documented instructions, which are these terms, your configuration of the Service and your use of the API, unless the law requires otherwise, in which case we will tell you before processing unless the law forbids it. We will tell you if we believe an instruction breaches data protection law.
2. Confidentiality. Everyone we authorize to process the data is bound by confidentiality, contractually or by law.
3. Security. We implement and maintain the technical and organizational measures described in the security section of our privacy policy, including TLS in transit, AES-256-GCM encryption of credentials at rest, hashed API keys, signed webhooks, separation of projects and modes, and restricted access to production systems. We may update these measures as long as the overall level of protection is not reduced.
4. Sub-processors. You authorize us to use the sub-processors listed in the privacy policy (today OVHcloud for hosting in Germany). We will give you at least 30 days' notice by email before adding or replacing a sub-processor that processes member data, during which you may object on reasonable data protection grounds; if we cannot address the objection, you may terminate the affected Service. We impose on each sub-processor data protection obligations equivalent to these and remain responsible for them. Health platforms that your members connect are not our sub-processors: they are independent controllers under their own terms.
5. International transfers. We store and process member data in the European Union and will not transfer it outside the European Economic Area without appropriate safeguards under chapter V of the GDPR and prior notice to you.
6. Assistance with rights. Taking into account the nature of the processing, we help you respond to members' requests, chiefly through self-service tools (reading a member's data and erasing it through the API or the console). If a member contacts us directly, we will forward the request to you without undue delay and will not answer it ourselves unless you ask us to.
7. Assistance with compliance. We provide the information you reasonably need for your data protection impact assessments and any prior consultation with a supervisory authority, relating to our processing.
8. Personal data breaches. We will notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting your members' data, with the information you need to meet your own obligations, and we will take reasonable steps to contain it and mitigate its effects.
9. Deletion or return. At the end of the Service you can export your data through the API. We then delete members' personal data within 30 days, unless the law requires us to keep it. During the Service, records are deleted automatically at the end of your plan's retention period, and immediately when you erase a member.
10. Audits. We make available the information necessary to demonstrate compliance with this addendum, primarily through documentation: this addendum, our security description and written answers to reasonable questionnaires. If that is not enough to demonstrate compliance, or a supervisory authority requires it, you may audit our processing once a year, at your expense, with 30 days' notice, during business hours and under confidentiality, in a way that does not compromise the security or other customers' data.

#Changes to these terms

We may update these terms. For material changes we will notify you by email at least 30 days before they take effect; minor changes (for clarity, or that do not reduce your rights) take effect when published here. If you do not agree with a material change, you may stop using the Service and close your account before it takes effect; continuing to use the Service after that date means you accept the new terms.

#General

• Entire agreement. These terms, together with the privacy policy and any terms shown when you buy a plan, are the entire agreement between us about the Service.
• Assignment. You may not transfer your rights under these terms without our consent. We may transfer them to a company that succeeds us in the business of the Service, with notice to you.
• Severability. If a provision is found invalid, the rest remain in force and the invalid one is replaced by a valid provision closest to its purpose.
• No waiver. Not enforcing a right is not a waiver of it.
• Notices. We send notices to the email address of the account owner; you send them to tech@feynman.es.
• Force majeure. Neither party is liable for failures caused by events beyond its reasonable control.

#Governing law and jurisdiction

These terms are governed by Spanish law. Any dispute will be submitted to the courts of the city of Valencia, Spain, and both parties waive any other jurisdiction that might apply, except where mandatory law grants a party the right to bring proceedings elsewhere, which this clause does not limit.

#Contact

Optionality Partners, S.L., Carrer del Turia 53, 46008 Valencia, Spain. Email tech@feynman.es, phone +34 960 73 06 71.