Privacy Policy

Last updated 26 September 2026

Shine OS is operated by Shine Health (“we”, “us”). This policy explains what we collect when you use the Shine OS website and app, why, and what rights you have. We have written it to meet the Australian Privacy Act 1988 and Australian Privacy Principles, the EU and UK GDPR, the California Consumer Privacy Act as amended by the CPRA, Canada's PIPEDA and comparable laws elsewhere.

Who is responsible

Shine Health is responsible for (the “controller” of) personal information processed through the service. Contact: [email protected].

What we collect

• Account details. When you sign in with Google we receive your name, email address, profile photo and a Google account identifier.
• Your health check-ins. Your answers to the Wheel of Health questions across 8 areas (sleep, exercise, nutrition, mental wellbeing, stress, hydration, medical check-ups and mobility) and the scores calculated from them.
• Habits and progress. The habits you add, how often you plan to do them, and the days and times you tick them off.
• Progress reports. The reports we generate from your scores and habit progress.
• Settings. How often you want to check in and whether you want report and reminder emails.
• Technical logs. Our server records errors and basic request details to keep the service running and secure. These logs are kept for no more than 30 days.
• Email you send us. If you write to [email protected], we keep your message and address for as long as needed to answer you and keep a record of the exchange.

We do not sell personal information and we never use your health information for advertising.

Your health information

Check-in answers, scores and habits are health information, which the law treats as sensitive. We only collect it because you choose to enter it, and we use it only to run the service for you: to show your Health Wheel, track your habits and write your progress reports. You can stop at any time and ask us to delete it.

How we use AI

To write your progress report we send your area scores and habit progress (such as habit names and how often you completed them) to Google's Gemini API. We do not send your name or email address. Google processes this information as our service provider under its API terms. If the AI service is unavailable, we write the report with fixed rules instead. Reports are general wellness information, not medical advice.

Legal bases (GDPR)

• Contract — to create your account and provide the service you signed up for.
• Explicit consent — for your health information (GDPR Article 9(2)(a)). You give it by entering your check-ins and habits, and can withdraw it by asking us to delete your data.
• Legitimate interests — technical logs, for security and reliability. You may object at any time.
• Consent — optional embedded content (see Cookies below), withdrawable through Cookie Preferences.

Cookies and similar technologies

We do not use advertising or analytics cookies. We use browser storage that the service needs to work: your sign-in session (kept by Google Firebase) and your cookie choice. These are strictly necessary and do not require consent.

The only optional item is the embedded YouTube video on the home page. YouTube (Google) may set cookies when it loads, so we only load it if you click “Accept All” or press play. Your choice is stored in your browser for 12 months, after which we ask again. Change it any time via Cookie Preferences in the footer, or clear site data in your browser settings.

Who processes your information

We use a small number of service providers, each only for the purpose listed:

• Google Firebase (Google Cloud) — sign-in and storing your account data.
• Google Gemini API — writing your progress reports, as described above.
• Our hosting provider — running the web server.
• Our email provider — sending report and reminder emails, if you turn them on.

If you join a plan that includes chat feedback or expert check-ins, the coach or expert working with you will be able to see your scores, habits and reports so they can support you.

Your information may be stored and processed outside your country, including in the United States. Where the law requires it, these transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

We keep your account, check-ins, habits and reports for as long as you have an account. If you ask us to delete your account, we remove this information within 30 days. Technical logs are kept for up to 30 days and correspondence for up to 24 months.

Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to the processing of your information; to receive it in a portable format; to withdraw consent; to opt out of sale or sharing (we do neither); and not to be treated differently for exercising any of these.

Write to [email protected] from the email address you sign in with and tell us which right you're exercising. We will respond within 30 days. You can also turn report and reminder emails off at any time in Settings. If you're unhappy with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or your local data protection authority; we would appreciate the chance to resolve it first.

Children

Shine OS is not intended for anyone under 16 and we do not knowingly collect their information. If you believe a child has signed up, contact us and we will delete their account.

Security

Your account data is stored with Google Firebase, which encrypts it at rest, and our database rules only let you read your own records. Scores and reports can only be written by our server. Access to our server is restricted. No system is perfectly secure, and we cannot guarantee absolute security.

Changes

We will update this page when our practices change and revise the date above. We will let you know in the app or by email about changes that materially affect your rights.