Privacy Policy
Data Controller & Legal Basis
Habit Mastery Institute (hereafter ‘we,’ ‘us’) processes personal data under GDPR (Art. 6) and CCPA. Our lawful bases include consent (opt-in for behavioral tracking), contractual necessity (service delivery), and legitimate interest (improving habit algorithms).
Information We Collect
- Personal Identifiers: Name, email, billing address, encrypted payment tokens (via PCI DSS-compliant processors).
- Behavioral Data: Habit completion logs, self-report scales (e.g., SRHI), app usage patterns.
- Biometric Data: Only with explicit consent: heart rate variability, sleep cycles, activity levels (via wearables).
How We Use Data
- Personalize habit coaching using collaborative filtering and reinforcement learning.
- Aggregate anonymized data for research published in peer-reviewed journals (de-identified per HIPAA Safe Harbor).
- Send behavioral nudges via email/SMS (opt-out anytime).
Sharing & Third Parties
We share data only with: (1) Subprocessors under DPA (e.g., AWS, Mailchimp), (2) Regulatory bodies if legally compelled, (3) Academic collaborators under IRB-approved protocols. No sale of personal data.
Your Rights
Residents of EU/UK: right to access, rectification, erasure, portability, object to processing. CCPA: right to know, delete, opt-out of sale. Exercise via [email protected], verified within 30 days.
Data Retention
Habit logs retained for 24 months post-last interaction; financial records for 7 years (tax compliance). Anonymized research data kept indefinitely.
Security Measures
- Encryption at rest (AES-256) and in transit (TLS 1.3).
- Regular penetration testing by independent firms.
- Employee training on data minimization and privacy by design.
International Transfers
Data hosted in US (AWS us-east-1) with Standard Contractual Clauses for EU transfers. Compliant with Privacy Shield Frameworks (registration with DOC).