Privacy Policy

1. Introduction

This Privacy Policy (“Privacy Policy”) describes and governs the manner in which Finerpoint, Inc., a Delaware corporation, d/b/a Bevel (“we,” “us,” “our,” or the “Company”) collects, uses, maintains, and discloses information about you when you visit our website and use our mobile application and other online services (the “Services”).

Please read this Privacy Policy carefully before you start to use the Services. By accessing and/or using the Services, you accept and agree to be bound by this Privacy Policy and our Terms of Service incorporated herein by reference, and to comply with all applicable laws, rules, and regulations. If you do not agree to this Privacy Policy and the Terms of Service, you must not access or use the Services. The Company is not a “covered entity” or “business associate” as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). However, the Company voluntarily applies data protection practices informed by the standards of the HIPAA Security Rule to reflect our commitment to the protection of health data. Your Health Information is governed by this Privacy Policy. You should not use the Services to store or transmit information that you believe requires HIPAA-level protection.

For purposes of this Privacy Policy, “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a particular individual.

‍

2. Information We Collect

We collect Personal Information in a variety of ways when you interact with our Services. The categories of Personal Information we collect depend on how you interact with us and are described below.

2.1 Information You Provide to Us
‍

‍

2.2 Information Collected Automatically

When you access or use the Services, we automatically collect certain technical and usage information:

‍

2.3  Third-Party Health Information

With your permission, our Services connect to third-party applications and services (“Third-Party Applications”), which may include Apple Health, laboratory and testing services, and other providers. We connect to these Third-Party Applications solely to import certain health information about you, including heart rate, sleep, movement and exercise activity, blood oxygen levels, respiratory rate, height, weight, age, and, if you permit access to laboratory services, blood test results. This imported health information is referred to collectively as “Health Information.”

If you do not enable Bevel Intelligence, Apple Health data is not transmitted to or stored on our servers. If you enable Bevel Intelligence, certain Apple Health data may be transmitted to and stored on our servers, encrypted in transit and at rest, in order to provide the feature. Health Information from other Third-Party Applications (such as Oura, Garmin, or Google Health) is stored on our servers for the duration of your account.

We never use Health Information for advertising or marketing purposes.

‍

3.  How We Collect Your Information

We collect Personal Information from the following sources:

‍

4.  Where Your Information Is Stored

To provide the Services, we store and process your Personal Information using secure infrastructure operated by trusted third-party providers. Personal Information may be stored and processed as follows:

Your Personal Information is stored and processed in the United States, where the Company is based, and may also be stored and processed in other countries where we or our trusted service providers operate. By using the Services or otherwise providing information to us, you understand and consent to having your Personal Information transferred to and processed in the United States and such other countries. See Section 13 for information on transfer safeguards applicable to EU and UK users.

‍

5.  How We Use Your Information

We may collect and use your Personal Information for the following purposes:

We do not use Health Information for advertising or marketing purposes.

‍

6.  How We Share Your Information

We do not sell your Personal Information. We do not share your Health Information with advertising networks, data brokers, or social media platforms for targeting or marketing purposes. We share limited categories of data only as described below. Certain analytics disclosures may be characterized as “sharing” under the California Consumer Privacy Act or similar state laws. You may opt out as described in Section 8.

If you choose to enable Bevel Intelligence, we share minimized and pseudonymized Health Information with our LLM partners solely to generate responses to you. This sharing occurs only at your direction. If you do not enable Bevel Intelligence, your Health Information is not shared with our LLM providers.

‍

7.  Bevel Intelligence & Third-Party AI Technology

Bevel Intelligence is an optional generative AI feature that uses your Health Information to provide personalized health coaching and guidance. You must actively enable it. If you do not enable it, none of your Health Information is transmitted to our LLM providers.

To provide this feature, we leverage third-party cloud hosting providers and AI technology from our large language model partners. If you enable Bevel Intelligence, certain Health Information (including certain Apple Health data) will be transmitted to and stored on our servers, encrypted in transit and at rest, and will be transmitted to and processed by our LLM partners solely for the purpose of generating responses and guidance.

Bevel Intelligence generates responses based on your inputs and Health Information, and those responses may be inaccurate, incomplete, or inconsistent. Bevel Intelligence does not provide medical advice and should never be relied upon as a substitute for professional medical care, diagnosis, or treatment. You should always consult a qualified physician or other licensed healthcare provider with any questions you may have regarding your health or medical conditions.

Our current sub-processors are listed below. We will update this list when material changes are made:

‍

8.  Your Choices

You have certain choices regarding how we collect, use, and share your Personal Information:

You may choose not to provide certain Personal Information to us; however, doing so may limit your ability to access or use some or all features of the Services.

‍

9.  Data Security & Retention

9.1  Information Security

We use commercially reasonable security technologies and procedures to protect your Personal Information from unauthorized access, use, or disclosure. The Company has achieved SOC 2 Type 2 certification, reflecting our commitment to the security, availability, and confidentiality of the data entrusted to us. However, no system is completely secure, and we cannot guarantee the complete safety of your information. It is your responsibility to keep your account information confidential.

In the event of a security breach or unauthorized access to your Personal Information, we will notify you in accordance with applicable law, including applicable state breach notification statutes and, where applicable, the FTC Health Breach Notification Rule. If you believe your account has been compromised, please contact us immediately at hello@bevel.health.

‍

9.2  Retention Periods

We retain your Personal Information for the least amount of time necessary for our relationship with you, to provide you access to the Services, and in accordance with our data retention policies and applicable law:

‍

9.3  Requesting Deletion

You may delete your account and associated Personal Information at any time directly through the Bevel app by navigating to Settings > Account > Delete Account. This is our preferred method, as it allows for immediate action without additional identity verification.

Alternatively, you may submit an erasure request or any other privacy rights request, including a Subject Access Request, by emailing hello@bevel.health. Requests submitted by email may require additional verification of your identity before we can process them, and we will respond within the timeframes described in Sections 12 and 13 as applicable.

Please note that we may not delete all of your information if: (1) we need it to complete a service as requested by you or perform under a contract with you; (2) we need such information to repair errors or detect security violations; or (3) we need such information to protect against fraud or illegal activity or to comply with applicable law.

‍

10.  Third-Party Links and Services

The Services may contain advertising, links, or other content from third-party websites and services. We do not control the content or links that appear on those services and are not responsible for the practices employed by such third parties. Browsing and interacting on any third-party service is subject to that service’s own terms and policies. A link to another site should not be construed as an affiliation or endorsement by Bevel.

‍

11.  Minor Users and Children

The Services are not directed to children under the age of 13. We do not knowingly collect Personal Information from children under 13. If we obtain actual knowledge that we have collected Personal Information from a child under 13 without verifiable parental consent, we will promptly delete it. If you believe we have mistakenly collected information from a child under 13, please contact us at hello@bevel.health.

Users between the ages of 13 and 17 may access only those features of the Services that are not designated as Age-Restricted Features, as defined in our Terms of Service. Age-Restricted Features — including sensitive health metrics, financial transactions, and other features designated by the Company — are available only to users 18 years of age or older.

‍

12.  U.S. State-Specific Privacy Rights

If you reside in California, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have the following rights under applicable state data privacy laws:

We will respond to verified requests within 45 days of receipt. We may extend this by an additional 45 days for complex requests and will notify you within the initial period if an extension is required. You may exercise these rights free from discriminatory treatment. You may also designate an authorized agent to submit requests on your behalf; we may require proof of the agent’s authority and independent verification of your identity.

California law requires that we disclose whether we have “sold” or “shared” Personal Information during the preceding 12 months. During that period, the Company has not sold any Personal Information. The Company has only disclosed Personal Information as described in this Privacy Policy. Certain analytics disclosures may constitute “sharing” under California law.

‍

13.  Information for EEA, UK, and Swiss Residents

This section applies if the processing of your Personal Information is subject to European Data Protection Laws, including the General Data Protection Regulation (“GDPR”) and UK GDPR. “Personal Information” in this section constitutes “personal data” as defined under the GDPR. In the event of any conflict between this section and any other provision of this Privacy Policy, this section shall control to the extent of such conflict.

‍

13.1  Controller and European Representatives

The Company is the controller of your Personal Information processed in connection with the Services. Our contact information is: hello@bevel.health.

This designation does not affect your right to take legal action against the Company directly.

‍

13.2  Legal Bases for Processing

We process your Personal Information only when we have a lawful basis to do so under applicable law. The legal bases we rely on are set out below:

You may withdraw consent for Health Information processing at any time by disconnecting Third-Party Applications or disabling Bevel Intelligence through app settings. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

‍

13.3  Your Rights Under European Data Protection Laws

In addition to any rights described elsewhere in this Privacy Policy, you may have the following rights under European Data Protection Laws:

We will respond to verified requests within one month of receipt. Where necessary due to complexity or volume, we may extend by a further two months and will notify you within the first month with reasons for the extension.

‍

13.4  Automated Processing and Profiling

We use automated processing of your Personal Information, including profiling under Article 4(4) GDPR, to generate health scores and coaching recommendations (including Recovery, Strain, Sleep, Stress, and Energy Bank scores, and Bevel Intelligence outputs). The logic involves analysis of biometric data imported from connected devices and, where enabled, inputs and conversation history from Bevel Intelligence. These outputs are informational and are intended to help you understand and improve your health and performance. They do not constitute medical advice and do not produce legal effects. You may object to this profiling at any time by emailing hello@bevel.health.

‍

13.5  International Transfers

Your Personal Information is transferred to and processed in the United States, where the Company is based, and in other countries where our service providers operate. We rely on the following transfer mechanisms:

Where Personal Information is transferred from the EEA or the United Kingdom to any other country not covered by an adequacy decision, we rely on the same Standard Contractual Clauses framework with the relevant provider. We do not rely on the EU-US Data Privacy Framework. You may request a copy of our transfer safeguards at hello@bevel.health.

‍

13.6  Complaints and Supervisory Authorities

You have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where an alleged infringement of European Data Protection Laws has occurred:

‍

14.  Changes to This Privacy Policy

We may update this Privacy Policy at any time. We will notify you of material changes by posting a notice on the Services or by email before they take effect. Material changes include, but are not limited to, changes to the categories of Personal Information we collect, the purposes for which we use it, or the third parties with whom we share it. Your continued use of the Services after the effective date of any disclosed change constitutes acceptance of the updated policy.

‍

15.  Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us as follows: