Scope. This Canada and Québec Privacy Notice forms part of the Hues Within Privacy Policy and applies when Hues Within handles personal information about people in Canada. If the documents differ, this notice applies to the extent required by applicable Canadian or Québec law. Nothing in either document limits a privacy or consumer right that cannot legally be waived.
Insights is optional and off until you turn it on. It analyzes your recorded answers on this device, including frequently used tag suggestions. This choice is separate from accepting the Terms and consenting to sensitive-data processing. With Insights off and the required consent in place, you can still record, read History and export recorded information; new reports omit analysis.
Turning Insights off does not delete records or files already created or shared. The choice applies on this device before it is sent to your account. Offline choice records are saved for retry. If the device cannot save the choice, it may not remain off after restarting. Withdrawing sensitive-data consent is a separate choice: check-ins, History, Insights and backup pause until you consent again. Privacy information, support and urgent-support information, Apple subscription management, sign-out, account deletion and the applicable guest-erasure control remain available.
Where information is kept. Your working records stay on your device. With an account and the required sensitive-data consent, Hues Within also backs up saved check-ins, personal details (including an optional birthday), current and past prescriptions, custom questions and tags, and app settings. Settings include tracking and comparison choices, language, reminders, touch feedback, seasonal effects and app lock. Period and medication answers are included in their saved check-ins.
What remains specific to a device. Insights and phase estimates are calculated on your device. Exports are separate copies. A new phone needs its own notification permissions and unlock method; device passcodes and biometric credentials are not backed up. Pending changes retry when synchronization is available. An offline or failed backup is not a confirmed account copy.
Signing out. Signing out keeps your account and backups. Records are cleared from the phone only after their backup is confirmed. Otherwise they remain in this account’s separate storage on the phone for your next sign-in. If local cleanup fails, you remain signed in to retry.
Deleting your account. Account deletion removes active Hues Within backups. Provider recovery copies, limited purchase and Apple sign-in records, and files saved or shared outside the app have separate retention limits below.
Records erasure. Erasing recorded data while keeping an account is currently unavailable.
1. Privacy accountability
Hues Within is operated by Cynthia Salinas Treviño. Cynthia is the individual accountable for Hues Within’s privacy program and serves as its Privacy Lead, including responsibility for privacy requests and complaints, privacy-impact reviews, service-provider oversight, retention and destruction, and incident response. Contact: hello@hueswithin.com. Legal domicile: Manuel Alanis 6, Col. Lomas del Hipico, 64989 Monterrey, Nuevo León, Mexico.
2. What Hues Within handles and why
The general Privacy Policy explains the information Hues Within handles, where it is stored, its sources, the purposes for which it is used, and the providers involved. In summary, this may include account and profile information; daily check-ins; mood, emotional-wellbeing, symptom, sleep, movement, activity, medication, menstrual-cycle, note, and custom-answer information; descriptive patterns and user-requested files; purchase entitlements; technical and security records; and support or privacy correspondence.
Hues Within limits collection, use, and disclosure to purposes a reasonable person would consider appropriate, seeks consent where required, and handles information without consent only where applicable law specifically permits. It does not sell personal or health information, use it for advertising, share it with data brokers, provide it to insurers or employers, or use private records to train an artificial-intelligence model.
3. Sensitive information and meaningful consent
Mood, mental-health, medication, symptom, menstrual-cycle, free-text, and gender-identity information is sensitive. Hues Within requests express consent separately from agreement to the Terms. The consent identifies the sensitive categories and purposes, including device storage and display, descriptive insights, user-requested reports or share images, and signed-in backup and restoration. Hues Within does not treat acceptance of the Terms or merely opening the app as sensitive-information consent.
You may decline optional questions and features. You may withdraw consent for future processing through the consent control in the app’s Settings or by contacting the Privacy Lead. Withdrawal does not make earlier lawful processing unlawful, but core tracking features may no longer be available. Separate deletion controls remain available.
4. Descriptive insights and Québec profiling
Hues Within analyzes records you choose to enter to create descriptive patterns, comparisons, and summaries. This may constitute profiling under Québec law. It is not used to decide eligibility, healthcare, employment, insurance, credit, or access to services. Insights is off by default and operates only after you separately choose to turn it on, in addition to the required sensitive-data consent. You may later turn Insights off in Settings without deleting your records; withdrawing sensitive-data consent and requesting deletion remain separate choices.
5. Service providers and processing outside Canada or Québec
Hues Within is operated from Mexico, so Canadian information may be accessed and handled in Mexico. Supabase supports authentication, signed-in backup, entitlements, purchase-restoration records, the restricted Apple-revocation retry queue, database security, and server functions. Apple handles the Apple sign-in and App Store functions you choose. Google Workspace provides the support and privacy-request mailbox and processes messages, participants, attachments, and related delivery and security metadata. Public-site hosting infrastructure may process limited website request and security logs. These providers may process information in countries where they operate, where it may be subject to local law and lawful access by courts, law-enforcement agencies, or national-security authorities.
Hues Within remains accountable for personal information under its control and uses contractual, organizational, and technical safeguards appropriate to its sensitivity. Before information governed by Québec law is communicated or entrusted outside Québec, Hues Within will complete the assessment and written arrangement required by applicable Québec law.
6. Retention and destruction
Hues Within keeps information only for the period needed for the disclosed purpose, an active account, security and fraud prevention, a legal or complaint hold, or another requirement permitted by law. Successful deletion removes the authentication account, active Plus entitlement, and ordinary Hues Within account records from active cloud systems; limited copies may remain temporarily in provider backups or be blocked against ordinary use until the applicable period ends. Restricted App Store purchase-verification records remain without the deleted Hues Within account identifier so the same Apple purchase can be restored and duplicate or conflicting claims can be prevented; a separate record of purchase notifications prevents the same App Store notification from being applied twice. A failed Apple sign-in revocation credential remains in a restricted record for manual disconnection retries until revocation succeeds or the first later retry run after it reaches 14 days. Device-only information remains under your device controls. The Data deletion page explains operational steps and the exact fields retained.
7. Canadian and Québec rights
Depending on the law that applies, you may ask Hues Within to confirm whether it holds personal information about you; explain its use and disclosure; provide access; correct inaccurate or incomplete information; withdraw consent; challenge compliance; and delete information through available controls or where continued retention is no longer authorized or necessary.
Québec residents may also request eligible computerized information collected from them, excluding information created or inferred by Hues Within, in a structured and commonly used technological format unless doing so raises serious practical difficulties.
8. How to make a request or complaint
Send a written request to hello@hueswithin.com with the subject “Canada privacy request.” Identify the right you wish to exercise, your account email if applicable, your province or territory, the request’s scope, and your preferred response format. Do not send journal entries, medication information, passwords, or unnecessary identity documents. Hues Within may verify identity through the signed-in account, account email, a one-time code, or another proportionate method.
Hues Within responds in writing as soon as reasonably possible and ordinarily no later than 30 days. For a request governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) outside Québec, the period may be extended where the law permits, with notice explaining the reason, new deadline, and complaint right. Québec access and correction requests will be answered no later than 30 days. Ordinary electronic requests are free. If a permitted reproduction or transmission charge could apply, Hues Within will disclose the estimated amount in advance. A refusal will explain the reason and available recourse.
9. Privacy governance and incidents
Access will be limited to what is needed to operate and protect the service.
If a suspected incident occurs, Hues Within will assess it under each applicable law, keep the required record, take reasonable steps to reduce harm, and notify affected people and the Office of the Privacy Commissioner of Canada and/or the Commission d’accès à l’information du Québec when the applicable legal threshold is met.
10. Escalating a concern
Please contact the Privacy Lead first so Hues Within can investigate and respond. If you remain dissatisfied, you may contact the Office of the Privacy Commissioner of Canada. Québec residents may also contact the Commission d’accès à l’information du Québec. Depending on the subject and cross-border handling, more than one law or regulator may be relevant.
11. Changes
Changes will be posted at this URL with a new version or date. Hues Within will provide additional notice and seek renewed consent before a material new use when applicable law requires it.