Eclipsia is built on a simple principle: your relationship with light is yours. This policy explains, in plain terms, what data the Eclipsia app handles, why, where it lives, and the control you keep over it.
1Who we are
This policy covers the Eclipsia website at eclipsia.ai — including the day reader at /app — and the Eclipsia companion application for the Eclipsia Band, a wrist-worn light-sensing wearable. The app is provided by Eclipsia, based in Coimbra, Portugal (“we”, “us”), in partnership with the Institute of Systems and Robotics (ISR) at the University of Coimbra as technical-scientific partner.
For matters concerning your data, contact us at info@eclipsia.ai.
2The app is not a medical device
Eclipsia is a general-wellness product. It does not diagnose, treat, cure, or prevent any disease, and it does not provide medical advice. Information shown in the app — including the Aura Score and light-exposure guidance — is informational and educational only. Always consult a qualified health professional for medical decisions.
3The website, and what stays on your device
The day reader at eclipsia.ai/app runs entirely in your browser. It works out the sun’s position for your date and place, and reads back the day you describe to it. Nothing you enter there is sent to us.
Specifically, the page keeps two items in local storage:
- Today’s entry — the place shown, its time zone, your skin type, how much skin was uncovered, your wake time, and the stretches you marked. It is discarded when the date changes.
- Your recent days — up to 30 days of date, Aura reading, minutes outdoors and skin load, used to draw the history strip.
Separately, the following happen when you use the site:
- Audience measurement. We use Vercel Web Analytics to count page views. It records the page, referrer, approximate country and device type in aggregate. It does not use cookies and does not track you across other websites.
- The waitlist. If you submit your email, we receive that address together with the place shown on the page, the stretches you had marked and your selected skin type, so we can understand how the reader is being used. This is sent through Formspree, our form processor.
- Location. Only if you press “Use my location”. Your browser asks you first, and you can refuse — the page then stays on its default city. Coordinates are used to compute the sun’s position and to look up cloud cover and a place name. We do not store them on any server.
Because the page is delivered to your browser, your browser also contacts these services directly. Each receives your IP address, as any web request does:
- Open-Meteo — receives coordinates, to return today’s cloud cover; and search text, when you look up a city.
- BigDataCloud — receives coordinates, only when you use “Use my location”, to return a place name.
- Google Fonts — serves the typefaces used across the site.
- Vercel — hosts the site and keeps standard server logs.
4What data the app and Band collect
We collect only what the app needs to function and, where applicable, to support the clinical pilot. Depending on how you use the app, this may include:
- Light and UV exposure data measured by the Eclipsia Band and received by the app over Bluetooth.
- App activity such as your Aura Score history and responses to in-app questionnaires.
- Approximate location, used only with your consent, to estimate the expected light available to you (sun position, daylight).
- Profile information you provide, such as skin type, and account or participant-identification details used to sign in.
- Technical data such as device model, operating-system version, app version, and crash diagnostics, used to keep the app working.
We do not collect more than the categories described here, and we do not sell your data to anyone. The app does not access your camera and does not collect any photos or other visual data.
5How we use your data
- To run the website and the day reader, and to keep them working.
- To answer you if you join the waitlist, and to tell you when the Band is ready.
- To operate the app and pair it with your Eclipsia Band.
- To calculate and display your Aura Score and personalized light guidance.
- To support the clinical pilot (for participants), including study analysis.
- To maintain security and improve reliability and performance.
- To produce aggregated, anonymized insights for scientific publication and product development — in a form that cannot identify you.
6Legal basis (GDPR)
We process personal data under the EU General Data Protection Regulation (Regulation (EU) 2016/679). Our legal bases are:
- Your consent (Art. 6(1)(a); for health-related data, Art. 9(2)(a)).
- Scientific research, for the clinical pilot (Art. 9(2)(j)).
- Our legitimate interest in operating and securing the website and the app, and in measuring audience in aggregate (Art. 6(1)(f)), balanced against your rights.
- For the waitlist and for location on the website, your consent — given by submitting the form, or by allowing your browser’s location prompt. You may withdraw either at any time.
7Where your data is stored, and who can access it
The website is hosted by Vercel. Waitlist submissions pass through Formspree. Anything you mark on /app is held in your browser and is not stored by us at all.
Data is pseudonymized: your identity is replaced with an identification code before it reaches us. Data sent from the app and Band is stored on servers we contract from Digital Ocean, located physically in the Netherlands (European Union), with encryption, in accordance with the GDPR.
For clinical-pilot participants, data is held at two separate levels:
| ULS Região de Leiria (clinical site) | Holds your directly identifiable data and the key linking your code to your identity. This key is never shared with us or with ISR. |
| Eclipsia & ISR Coimbra | Receive only pseudonymized (coded) data. At no point do we receive data that directly identifies you. |
We use Digital Ocean only as a hosting provider (a processor acting on our instructions). Any provider with access to data is bound to protect it to a standard consistent with this policy and the GDPR. Your data stays within the European Union.
8How long we keep it
For the website: what /app stores stays on your device until you clear it — today’s entry is discarded when the date changes, and the history strip holds at most 30 days. Waitlist emails are kept until you ask us to remove you, or until the Band has shipped and you have told us you no longer want to hear from us. Aggregate analytics contain nothing that identifies you.
For the clinical pilot, data is retained for 5 years after the study concludes, in line with good clinical-research practice and applicable legal obligations, after which it is securely deleted. Outside the pilot, we keep data only as long as needed for the purposes above or until you ask us to delete it.
9Your rights in the EU and UK
Under the GDPR you have the right to access your data; to correct it; to have it erased; to restrict or object to processing; to data portability; and to withdraw your consent at any time without affecting prior processing. Withdrawing consent or leaving the study has no negative consequence for you.
To exercise any of these rights, contact info@eclipsia.ai. Pilot participants may also contact the study’s clinical investigator, Dr. Inês Bispo Leão, at inesbispoleao@gmail.com. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).
10Your rights in the United States
If you are in the United States, state privacy laws — including the California Consumer Privacy Act as amended (CCPA/CPRA), and comparable laws in states such as Virginia, Colorado, Connecticut and Utah — may give you rights over your personal information.
The categories we may collect are: identifiers (your email address, if you join the waitlist); geolocation data (approximate, and only with your permission); internet activity (aggregate page views); and, for the app and Band, health-related wellness data (light exposure and the readings derived from it). We collect these for the purposes described above, and for no other.
Subject to the law that applies to you, you may ask us to confirm what we hold about you, to provide a copy, to correct it, or to delete it. You may also appeal a refusal where your state provides for that. We will not treat you differently for exercising any of these rights. Write to info@eclipsia.ai.
Much of what the website does is outside these rights simply because it never reaches us: what you mark on /app is held in your own browser, and you can erase it at any time by clearing your site data.
11Security
We apply technical and organizational measures including encryption in transit and at rest, pseudonymization, access controls, and EU-based hosting. No system is perfectly secure, but we work to protect your data proportionate to its sensitivity.
12Children
The app is not directed to, and is not intended for, anyone under 18. We do not knowingly collect data from minors. If you believe a minor has used the app, contact us and we will delete the data.
13Changes to this policy
We may update this policy as the product evolves. Material changes will be reflected here with a new effective date, and where required we will seek your consent again.
14Contact
Questions about this policy or your data: info@eclipsia.ai
Eclipsia — Coimbra, Portugal