Privacy Policy

1. Who We Are

AirwayLab B.V. (“we”, “us”, “our”) is a sleep and airway analysis tool, built on an open-source analysis engine, operated under the domain airwaylab.app. AirwayLab B.V. is not a medical device and is not cleared or approved by the FDA, CE, TGA, or any regulatory body. It is provided for educational and informational purposes only.

For privacy questions, contact us via our contact form.

2. How AirwayLab Processes Data

AirwayLab uses a two-tier architecture designed to keep your health data under your control:

3. What Personal Data We Collect

3.1 Account Data (if you create an account)

• Email address (for authentication and account communications)
• Password, only if you choose to set one (stored by our authentication provider, Supabase, as a one-way hash; we never see or store it in readable form)
• Name (optional, entered by you in account settings; used to greet you in the app and in our emails, never shown publicly)
• Subscription tier and billing status (via Stripe)
• How you first found us, recorded once when you create an account: the campaign tag, referral code or referring website of your first visit, never the pages you read. If the referral code belongs to one of our partners, that partner is credited when you subscribe.
• Country: the two-letter country of your connection when you first sign in, read from our hosting provider’s (Vercel) connection header. We store the country only, never your IP address. Our anonymous server-side usage events carry the same country, or the billing country from Stripe on a paid checkout, so we can see which countries people come from.
• Feedback submissions: When you submit feedback through the app, your feedback text is stored in our database (Supabase, EU-West). All feedback submissions are also forwarded to an internal admin-only Discord channel for operational triage, regardless of contact consent. Each submission, and each contact form message, also triggers an internal notification email to our team (sent via Resend) containing the feedback text and, where provided, your name and your email address so we can reply (for signed-in users who type a different address, it also includes the account email). Feedback submissions never include your analysis results. One exception applies to file content: if an oximetry file cannot be read and you explicitly choose to request support for its format, that submission includes the file name and the file’s first 5 lines (column headers and, in some cases, a few SpO2 or pulse readings). The request dialog tells you this before you send it. User-authored feedback text may also contain health context you have chosen to share.

3.2 Email Communications (Opt-In)

If you opt in to email updates, we send periodic emails about your analysis activity and new features. These include:

• Post-upload tips (after your first analysis)
• Feature education (how to use AI insights, exports, and reports)
• Re-engagement reminders (if you haven’t uploaded in 14+ days)

We may mention non-sensitive details like your last upload date, never your detailed therapy data. Otherwise emails contain general tips and links back to the app. Emails are sent via Resend. You can unsubscribe at any time via the link in each email or from your dashboard.

3.3 Payment Data

Payment processing is handled entirely by Stripe . We never see or store your credit card number, CVV, or full billing details. We receive only your Stripe customer ID, your subscription status, any promotion code you enter at checkout (and the partner it belongs to, so we can pay that partner their commission) and, if you cancel, the reason and comment you choose to give in the billing portal.

3.4 Health Data (registered users)

Account creation covers core service processing below. Research and raw device file contributions are each a separate, explicit opt-in, off by default, as noted in that item.

• Cloud Storage: EDF files and analysis data are stored on servers in the EU (Supabase, EU-West). Storage is unlimited. All data is linked to your account and can be deleted at any time from Account Settings.
• AI Insights: When you generate AI insights, analysis data is sent to Anthropic’s Claude for processing. Free accounts send aggregate scores. Paid accounts send per-breath summary data for deeper analysis. Raw waveform samples are never sent to the AI model.
• Chat (Champion, opt-in): When you ask the chat a question, your question, the earlier messages of that conversation and the metrics of the selected night and up to 14 recent nights (scores, settings and the machine summary) are sent to Anthropic’s Claude to write the answer. This needs its own consent, separate from AI insights, and you can turn it off at any time. Raw waveform samples are never sent. By default AirwayLab does not store your questions or the answers. We keep a usage record (time, model, token counts, and whether the answer was shown or replaced by a safety check) and your message balance.
• Help improve the chat (Champion, separate opt-in, off by default): If you turn this on, AirwayLab keeps your chat questions and the answers (including an answer our safety check replaced) in our database (Supabase, EU-West) to improve and train its chat. The metrics of your nights are not kept with them. This is a separate consent from the chat itself. Turning it off deletes what was kept.
• Analysis Data: Aggregate scores and per-breath summaries are stored to enable AI insights and service improvement.
• Data Contribution (Aggregate): Aggregate per-night summary metrics, device model, and your self-reported sleep quality rating (1–5 scale). Used for community insights and research. No dates, timestamps, names, or email addresses are included, and rows are stored under a random contribution ID. While your account exists we keep an internal record linking contributions to it. When you delete your account, that link is removed and the data remains in the dataset, permanently unlinkable to you. This requires your affirmative consent, enforced on our servers. You can turn data contribution on or off at any time in your account settings. Turning it off stops future contributions, and data already contributed is retained.
• Waveform, Oximetry & Therapy Trace Contribution: If you explicitly choose to contribute, flow waveform samples, oximetry traces, and low-resolution therapy trace channels (leak, snore, flow limitation, pressure, and respiratory rate) are uploaded to our servers for research purposes. Contributions carry no name or account identifier, and each recording is stored under a random contribution ID together with the therapy date of the recording. This requires your affirmative consent, which you can withdraw at any time in your account settings. Withdrawal stops future contributions. While your account exists, we keep an internal record linking your contributions to your account. When you delete your account, that link is removed and the recording remains in our research dataset, now permanently unlinkable to you.
• Raw Device File Contribution: If you explicitly choose to contribute, we store the files on your SD card and any other raw files you upload for analysis, such as oximetry recordings: your nights’ recording files, your device’s summary file (STR.edf, which can cover months of therapy history beyond the nights you analysed), your device’s settings files, and your device’s identification files (these contain your device’s serial number). A large card is sent over several days. Other files on the card are stored as the device wrote them. AirwayLab clears the EDF identity header fields from these files in your browser before upload. Unlike other contributions on this page, raw device files are stored linked to your account rather than under a random contribution ID. This requires a separate, affirmative consent action, enforced on our servers. Withdrawing consent deletes your stored raw files (an upload still in progress at the time of withdrawal is removed automatically within 48 hours). Deleting your account also deletes them.
• Symptom Contribution: If you explicitly choose to contribute, your self-reported symptom rating (1–5 scale) is collected alongside aggregate analysis metrics that carry no name or email (device model, PAP mode, pressure range). No dates, timestamps, names, or identifiers are included.
• Device pseudonymisation: When you upload therapy data, your device’s serial number or GUID is used to derive a pseudonymous device key (HMAC-SHA256 hash) and then immediately discarded — the raw value is never stored. The device key is stored server-side and used for: upload deduplication, distinct-device analytics, and per-device longitudinal research (if you have opted in to data contribution). This is pseudonymous personal data under GDPR Recital 26. Legal basis: legitimate interest (Art. 6(1)(f)) for core upload deduplication; consent (Art. 6(1)(a)) for per-device ML analytics (covered by data contribution consent). Device keys are deleted when you delete your account or submit an erasure request.
• Sharing: If you create a share link, your processed analysis results (scores and per-breath summaries, not raw EDF files) are uploaded to our servers (Supabase, EU-West). If you choose to include therapy data files, the raw EDF files for the shared night(s) only are uploaded too, encrypted at rest, and accessible solely via signed, time-limited download links generated for that share. Creating a share link is the consent event for this processing (Art. 6(1)(a)), captured via the share consent modal. Anyone with the share link URL can view the shared analysis, without needing an account. Share links do not expire by default; Champion-tier accounts can set a finite expiry (30 days, 90 days, or 1 year) when creating the link. You can revoke a share link at any time from Account Settings, which permanently deletes the shared data and any uploaded files.

3.5 Automatically Collected Data

• Page views & conversion events: Collected by PostHog (product analytics and session replay, privacy-first, cookie-free). Anonymous by default; if you opt in to analytics consent, PostHog links your usage events — which features you use, event counts, and technical metadata such as file sizes and durations — to your account (Section 4). This never includes therapy metrics, waveform data, or any values from your sleep sessions. PostHog session recording is disabled on all health-data pages.
• Error reports & session replay: Collected by Sentry when errors occur. Includes browser type, page URL, and error stack traces. On errors, an anonymised session replay may be captured (all text is masked and all media is blocked). Does not include health data.
• Performance monitoring: Collected by Vercel Speed Insights for page load performance (Core Web Vitals). No personal data or health data is included.
• Analysis session tracking: When you complete an analysis, we record anonymous session metrics (number of nights analysed, whether oximetry data was present, analysis duration, and which engines were used). No health data is included. Anonymous by default; if you opt in to analytics, these events are linked to your account like other usage events (Section 4).

3.6 What We Do NOT Collect

• Cookies (we use none)
• Browser fingerprints
• IP addresses for tracking (PostHog does not store IPs)
• Raw sleep waveforms for analytics purposes (uploaded only under your explicit cloud storage, sharing, or research-contribution consent -- see section 3.4)
• Device serial numbers or user names from PAP machines by default (raw values are never stored — see Section 3.4 for device pseudonymisation). If you separately opt in to raw device file contribution, the device’s identification file, which does contain the serial number, is stored linked to your account. See Section 3.4.

4. Legal Basis for Processing (GDPR)

The data controller for all personal data processed by this service is AirwayLab B.V., Helperpark 274-6, 9723 ZA Groningen, Netherlands.

If you are in the European Economic Area, we process your data under:

• Contract (Art. 6(1)(b)): Account creation, subscription management, and service delivery.
• Consent (Art. 6(1)(a)): AI insights, the chat, keeping chat questions and answers to improve the chat, data contribution, cloud storage, email communications, and analytics identification (linking usage events to your account when you opt in to analytics consent). You can withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)): Error monitoring (Sentry), anonymous usage analytics (PostHog, before analytics consent is granted), security protections, and upload deduplication via pseudonymous device keys.

5. Data Retention

• Browser localStorage: Analysis results auto-expire after 30 days. You can clear them at any time.
• Shared analysis links: Do not expire by default. Champion-tier accounts can set a finite expiry (30 days, 90 days, or 1 year) at creation. Expired links and any uploaded files are permanently deleted. You can revoke a link at any time from Account Settings, which permanently deletes the shared data and files.
• Chat usage records: 90 days. Your message balance is kept until you delete your account.
• Kept chat questions and answers (opt-in): 24 months, or until you turn the option off or delete your account, whichever comes first.
• Account data: Retained until you request deletion.
• Contributed data: Retained indefinitely for research purposes. Recordings carry no name or email, but while your account exists we keep an internal record linking them to your account. When you delete your account, that link is removed and the recordings remain in the dataset, permanently unlinkable to you.
• Contributed raw device files: Retained until you withdraw raw file contribution consent or delete your account, at which point they are deleted (an upload already in progress at the time of withdrawal is removed automatically within 48 hours).
• Cloud-stored files: Retained until you delete them or request account deletion.
• Device keys (pseudonymous): Retained until account deletion or DSAR erasure request.
• Analytics (PostHog): Anonymous by default. With opt-in analytics consent, identified usage events are linked to your account and retained while that consent stands. Withdrawing consent stops further identified analytics collection and unlinks your device immediately; it does not delete events already collected, but you can request deletion of previously collected analytics data at any time (Section 8).
• Error logs (Sentry): Retained for 90 days.
• Feedback submissions: Retained in our database until you request account deletion. Internal notification emails about feedback are team records and are deleted as part of normal team operations.

6. Service Providers & Data Processors

We use the following third-party services. Each processes only the minimum data required for its function:

7. Client-Side Storage (localStorage)

AirwayLab uses your browser’s localStorage (not cookies) to persist analysis results and preferences locally on your device. All keys are prefixed with airwaylab_.

• Analysis results (auto-expire after 30 days, 4MB cap)
• Disclaimer dismissal state
• Consent preferences (contribution, storage, AI insights)
• Feature gate state

This data never leaves your browser. You can clear it at any time via your browser settings or by clearing the AirwayLab analysis data from the dashboard.

8. Your Rights

Under GDPR, CCPA/CPRA, and similar data protection laws, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Portability: Export your analysis data as CSV, JSON, or PDF at any time from the dashboard — no request needed. You can also download all of your raw device files (EDF) and full analysis history as a structured JSON package via Account Settings ’ Download My Data. This covers all data held under GDPR Art. 20.
• Rectification: Update your account details via your profile settings.
• Erasure: Delete your account and its server-stored data instantly from Account Settings. This removes EDF files, analysis data, and pseudonymous device keys, and cancels any active subscription. Contributed research data is not deleted — it remains in the dataset, permanently unlinkable to you (see Data retention). Contributed raw device files are the exception: they are deleted with your account. Deletion takes effect immediately. If you cannot sign in to reach Account Settings, email us and we will complete the erasure within 30 days.
• Withdraw consent: Delete your account and its linked data at any time from Account Settings (contributed research data remains, as described under Erasure). Unsubscribe from emails via the link in each email or from your dashboard. You can also contact us to request full account deletion.
• Withdraw data contribution consent: If you have opted in to research data contribution, you can withdraw consent at any time via Account Settings > Data & Privacy. Withdrawal stops future sharing. Already-contributed rows are retained in the dataset and become permanently unlinkable to you when you delete your account (GDPR Art. 7(3)). For raw device files, withdrawal instead deletes your stored files.
• Opt out of analytics: PostHog respects your browser’s Do Not Track setting. You can also use a browser extension to block analytics.

To exercise these rights, contact us via our contact form. We will respond within 30 days.

9. Children’s Privacy

AirwayLab is intended for adults aged 18 and over who have been diagnosed with sleep-disordered breathing. We do not knowingly collect personal data from children under 16 (or 13 in jurisdictions where COPPA applies). If you believe a child has provided us with personal data, please contact us via our contact form and we will promptly delete it.

10. Data Breach Notification

In the event of a data breach affecting your personal data, we will:

• Notify the relevant supervisory authority within 72 hours (as required by GDPR)
• Notify affected users without undue delay via email
• Publish a notice on this page with details of the breach, data affected, and remediation steps

To report a security vulnerability, use our contact form.

11. International Data Transfers

AirwayLab B.V. is incorporated in the Netherlands (EU). Our primary database is hosted in the EU (Supabase EU-West region). Some services (Anthropic, Sentry, Resend, Upstash, Discord) process data in the US. For EU users, these transfers are governed by Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework where applicable.

AI insights are opt-in. If you choose not to use AI features, no health-related data is transferred outside the EU.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the CCPA/CPRA:

• Right to know what personal information we collect and how we use it
• Right to delete your personal information
• Right to opt out of the sale of personal information — we do not sell your data
• Right to non-discrimination for exercising your privacy rights

Categories of personal information collected in the preceding 12 months: identifiers (email), commercial information (subscription status), and internet activity (anonymous page views; identified usage data if you opt in to analytics). We do not sell or share personal information for cross-context behavioural advertising.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via a notice on the site and, for account holders, via email. The “Last updated” date at the top of this page indicates when the policy was last revised.

14. Contact

For privacy questions, data requests, or concerns:

• Contact form (select “Privacy & data request”)
• GitHub: airwaylab-app/airwaylab