This Privacy Policy describes how RangePulse ("we," "us," or "our") collects, uses, stores, and protects information when you use the RangePulse application and related services (collectively, the "Service"). RangePulse is a health vitals tracking application available as a free self-hosted version and a cloud-hosted version (free and paid plans). Data collection differs significantly between them.
By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, do not use the Service.
We collect no personal or health data from self-hosted installations. No account data, health data, telemetry, or analytics is transmitted to RangePulse servers or any third party. Your data stays on your hardware and we never see it. One outbound request exists: the application fetches a static version file from our content delivery network to check whether a software update is available (triggered when a logged-in user opens the Account page). This request contains no account or health data. See Section 7 for details.
When you use the RangePulse cloud service, we collect the following:
Account Information:
Health Vitals Data:
All health vitals data is stored in Amazon DynamoDB, isolated per user account.
Session Data:
Payment Information:
We use collected information solely for the following purposes:
We do not use your health data for advertising, profiling, marketing, research, or any purpose other than providing the Service to you.
We do not sell, rent, lease, or trade your personal data or health data to any third party, under any circumstances. We have never sold user data and have no intention of doing so.
Cloud version data is stored on Amazon Web Services (AWS) infrastructure in the us-east-1 (N. Virginia) region. Specific measures include:
While we implement industry-standard security measures, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security, but we commit to promptly addressing any vulnerabilities discovered in our systems.
RangePulse is not a medical device. The Service is a personal health data tracking tool. It is not intended to diagnose, treat, cure, or prevent any disease or medical condition. Nothing in the Service constitutes medical advice.
RangePulse is not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). We are not a healthcare provider, health plan, or healthcare clearinghouse. The health data you enter is self-reported and user-entered; it is not clinically validated data from a medical device or healthcare provider system.
As a defensive measure, we maintain an AWS Business Associate Agreement (BAA) and apply security practices consistent with protecting sensitive personal information. However, the existence of a BAA does not make RangePulse a HIPAA-covered entity or business associate.
The clinical PDF reports generated by RangePulse are formatted summaries of your self-entered data. They are intended as a convenience for sharing your tracked vitals with your healthcare provider. They do not constitute medical records, clinical assessments, or diagnostic reports.
You are solely responsible for the accuracy of the health data you enter. RangePulse does not validate, verify, or clinically review any user-entered data.
The cloud version relies on the following third-party service providers. These providers may process your data only as necessary to provide their services to us:
We do not use any third-party analytics, advertising, tracking, or social media services. We do not embed third-party scripts that collect user data beyond the services listed above.
Data Export: You may export all of your health data at any time in CSV or JSON format through the Service's export functionality. This includes all blood pressure, heart rate, weight, and mileage entries you have recorded. Your data belongs to you, and you should always be able to take it with you.
Subscription Cancellation vs. Account Deletion: These are separate actions. Cancelling a paid subscription stops billing only — your account and all of your data are retained, and you move to the free plan. Account deletion, described below, is the action that removes your data.
Account Deletion: You may delete your account at any time from your Account page. Account deletion begins a 7-day grace period: during those 7 days you can sign back in and choose "Keep my account" to cancel the deletion, or use the "Delete Now" option to skip the grace period and delete immediately. When the deletion completes (at the end of the grace period, or immediately via Delete Now):
Data Retention After Deletion
When you delete individual health readings, they are moved to a Recycle Bin. For 35 days you can restore deleted readings yourself from the Recently Deleted section of your dashboard. After 35 days they can no longer be restored, and they are permanently and irreversibly removed from our systems within 90 days of deletion.
When your account deletion completes, all data — including any entries in the Recycle Bin — is permanently removed. Once completed, account deletion cannot be reversed.
We retain service activity logs (for example, login and billing events) after account deletion, but we remove your identity from them: entries are re-keyed to a one-way pseudonym, and email addresses and IP addresses are scrubbed. A minimal permanent deletion-audit record (a hashed identifier, event type, and timestamp — no health data) is kept to prove the deletion occurred.
We recommend exporting your data before deleting your account. After account deletion, we may retain server access logs containing your IP address for up to 90 days for security and abuse prevention purposes, after which they are automatically purged.
Unverified accounts: Accounts that never complete email verification and contain no health data may be removed 30 days after signup.
The self-hosted version of RangePulse collects no personal or health data. We have no telemetry and no analytics of any kind baked into the application. The application's only outbound request to our infrastructure is an update check, described below.
When you run RangePulse on your own server:
The cloud version of RangePulse uses session cookies for authentication only. These cookies are strictly necessary for the Service to function and allow us to keep you logged in during your session.
We do not use:
Because we use only strictly necessary session cookies, no cookie consent banner is required under most applicable privacy regulations.
RangePulse is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to delete that information promptly.
If you are a parent or guardian and believe your child under 13 has provided personal information to RangePulse, please contact us at hello@rangepulse.com so we can take appropriate action.
This policy is consistent with the requirements of the Children's Online Privacy Protection Act (COPPA).
In the event of a data breach that compromises the security of your personal information or health data, we will:
We may update this Privacy Policy from time to time. When we make changes:
We encourage you to review this policy periodically. The current version will always be available at this URL.
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
To exercise any of these rights, contact us at hello@rangepulse.com. We will respond to verifiable requests within 45 days.
RangePulse does not specifically target users in the European Economic Area (EEA) or the United Kingdom. However, if you access the Service from these regions, we acknowledge the following rights consistent with the General Data Protection Regulation (GDPR):
Our legal basis for processing your data is the performance of our contract with you (providing the Service you have subscribed to) and our legitimate interests in maintaining the security and functionality of the Service.
Data is stored and processed in the United States. By using the cloud version of the Service, you acknowledge that your data will be transferred to and processed in the United States.
Right to lodge a complaint: If you believe our processing of your personal data violates the GDPR, you have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or place of the alleged violation (GDPR Art. 77).
Data retention (EEA / UK users): Active accounts retain health data for as long as the account exists. Deleted entries are restorable for 35 days and permanently purged within 90 days of deletion. Cancelling a subscription does not delete your account or data. Account deletion has a 7-day grace period (or is immediate via the Delete Now option) before permanent removal. After deletion, legally-required billing records are retained for the periods required by applicable tax and accounting law, and service activity logs are retained for audit and integrity purposes with your identity removed (entries are re-keyed to a one-way pseudonym, and email addresses and IP addresses are scrubbed). Full retention details are in Section 6 above.
Data Protection contact: For all data-protection inquiries — access requests, erasure requests, supervisory-authority correspondence — contact hello@rangepulse.com with subject line "Data Protection Request". We will respond to verifiable EEA/UK requests within 30 days, consistent with GDPR Art. 12(3).
If you have questions about this Privacy Policy, wish to exercise any of your data rights, or have concerns about how your information is handled, contact us at:
Email: hello@rangepulse.com
Subject line: Privacy Policy Inquiry
We will respond to all privacy-related inquiries within 30 days.