Intended use, privacy and subscription terms

PULSE OS is a wellness and self-monitoring tool, not a medical device. It does not diagnose, treat, cure or prevent any disease, and it must never be used to make a decision that a clinician would otherwise make.

Every figure the app shows is derived from consumer wrist sensors. Photoplethysmography, single-lead ECG, wrist temperature and derived respiration are estimates with published error bounds; the app labels values as measured or estimated precisely so that no reading is mistaken for a clinical observation. Blood pressure is never measured — where a score needs it, the app marks it as absent rather than guessing.

Early-warning scoring (NEWS2), arrhythmia screening and the Aegis sentinel tier are decision support for a lay user. A green tier is not clearance to ignore symptoms. If you feel unwell, have chest pain, breathlessness, fainting or any acute symptom, contact emergency services immediately regardless of what the app displays.

Automated escalation messages depend on your handset, your network and your contact being reachable. Treat them as a convenience, never as a guaranteed alarm path or a substitute for a medical alert service.

Measurements stay on your device by default. Beat streams, HRV, ECG strips, body-composition records, calibration baselines and the handover archive are held in your browser's local storage on the device that recorded them. They are not uploaded for analytics, advertising or model training.

Account data. If you sign in, we store your account identifier, session and subscription state on our backend so that billing and cross-device setup work. That record contains no vitals. Separately, if you enable Web console sync in Permissions, weigh-ins, body measurements and calibration baselines are stored in your private account. This sharing starts off for new decisions; previously saved choices remain. Switching sync off stops new requests, but does not erase earlier uploads.

Share links and QR snapshots. A shared dossier is redacted before it leaves the device and expires at the time you set. The handover QR code encodes its payload after the # in the URL, which browsers never transmit to a server — scanning it moves data from paper to phone, not to us.

Escalation messages. When you send an alert, the message and timestamps go to the contact you nominated, through your own SMS, WhatsApp or mail app, or through our messaging provider when server dispatch is enabled. We keep a masked dispatch log on your device only.

Diagnostics. Crash and error reports are collected only if you opt in. They carry technical context — route, error type, stack — and are scrubbed of measurement values. Bug reports you file yourself, and the automated health checks, are itemised field by field in bug reports and health-check data.

Your controls. You can export your baselines and history as files, clear all local data from the device, and request deletion of your account record by writing to support@pulse-os.app. Deleting the app's local storage erases the measurement history irreversibly, because we do not hold a copy.

Nothing optional runs before you agree. On your first visit we ask, and until you answer, no analytics script is loaded and no diagnostics client is started. Refusing is a single tap and is exactly as easy as accepting.

Strictly necessary storage — your sign-in session, day/night preference and the on-device health record — is always active, because the app cannot function without it. It is first-party, stays on your device, and is never used to profile you.

Usage analytics (optional). Google Analytics 4 with IP anonymisation, Google signals and ad personalisation switched off. We send the page path only, with share tokens and query strings stripped, so no measurement or snapshot can travel with it.

Crash diagnostics (optional). Sentry error and performance monitoring, with console output dropped, URLs stripped of query strings, share tokens redacted and replay text masked.

Withdrawing. Use the button below at any time. Withdrawal stops the trackers immediately, clears the analytics cookies this site set, and closes the diagnostics client — it is not merely a preference for future visits. We re-ask whenever this policy's categories change.

Manage cookie preferences

A bug report is the only thing in PULSE OS that sends a technical snapshot of your session off the device, and it is only ever sent when you press Send report in the “Report a problem” dialog. Nothing is collected in the background, and the dialog shows you the exact text before you send it.

What a bug report contains

• What you typed — the category, your one-line summary and the reproduction steps. Please do not type personal or health details into these boxes.
• Environment — app release id, the route you were on, browser user-agent, language, viewport size and pixel ratio, online flag, whether the app is running in a frame, secure-context and installed-app flags, IANA time-zone name and the capture timestamp.
• Transport state — whether the browser exposes a Bluetooth API, the adapter state, whether the host is a Samsung/One UI device, your transport override (auto / BLE / relay) per saved watch, the watch's display name and how long ago it was last seen.
• Consent state — whether you have answered the cookie prompt and which optional categories you allowed, so we can tell a genuine fault from a disabled feature.
• Storage health — names (not contents) of local keys that were evicted or found corrupt.
• The last 80 link-log lines — connection, discovery and stream events, with MAC addresses, LAN addresses, Bluetooth device ids and e-mail addresses replaced by placeholders ([mac], [lan], [id], [email]) before they leave the device.

What it never contains

No heart-rate, HRV, SpO₂, temperature, ECG or respiration values; no body-composition or calendar records; no calibration baselines; no emergency contacts, dossier share tokens, handover documents, account password or payment details; no precise location; and no screenshots.

Where it is sent

The report is posted to our own backend endpoint, which forwards it as an event to Sentry (Functional Software, Inc.), our error-monitoring processor, tagged with the app release so the fault can be traced to a specific build. Sentry stores it on our behalf and deletes it automatically at the end of our configured retention window. Because the report is relayed by our backend rather than posted from your browser, your device's IP address is not passed to Sentry, and personally identifying context is switched off in our monitoring configuration. We do not sell this data, use it for advertising, or use it to train models.

If the send fails — you are offline, or the endpoint is rate-limited — the report is held in a queue in your browser's local storage and retried with a backoff schedule (up to six attempts over roughly two hours). You can inspect, retry or permanently discard anything in that queue from the maintenance view, and discarding removes it before it is ever transmitted. You can also copy or download the report as a text file and send nothing.

Health checks

The automated health check is a build-time suite that runs on our own continuous-integration servers against a freshly built copy of the app. It requests every route, exercises the transport state machine and replays storage migrations using synthetic fixtures. It runs before a release is published, never inside your browser, and it reads no user account, device or measurement data.

In-app self-tests — link diagnostics, adapter probes, the consistency checks and the ingest probe in the maintenance view — execute locally on your device and write their results to local storage. The one exception is the ingest probe, which by design sends a test event down the same path as a bug report so that path can be verified; it contains no personal data.

Your controls

Per-section toggles. The report dialog carries an independent switch for each of the four collected sections above — device context, watch link settings, recent link events, and self-test/storage telemetry. Anything you switch off is replaced with withheld in the payload preview and never transmitted. Self-test telemetry is off by default; your last choices are remembered on the device only.

Confirmation before every send. The Send button stays disabled until you tick the consent box, and that tick is asked for again on each new report rather than stored as a standing permission. Copy and Download work without it and transmit nothing. The maintenance view's test envelope has its own separate confirmation.

Filing a report is always voluntary and per-incident. Optional crash diagnostics are separate and off until you accept them in the cookie prompt; withdrawing that consent shuts the diagnostics client down immediately. To have a submitted report deleted, e-mail support@pulse-os.app with the report's timestamp and route and we will remove it from the issue stream.

Subscriptions are billed by our payment providers. Prices shown at checkout include any taxes the provider is required to collect. Your plan renews automatically each period until cancelled.

Cancellation. Cancel at any time from the billing page; access continues to the end of the paid period and the plan does not renew afterwards.

Refunds. Where consumer law grants a cooling-off period, it applies. Beyond that, contact support@pulse-os.app within 14 days of a charge and we will review the request on its merits.

Availability. The service is provided as-is. We aim for continuous availability but do not warrant uninterrupted operation, and we are not liable for outcomes arising from reliance on the app's output, to the extent permitted by law in the Republic of South Africa.

Acceptable use. Do not resell access, attempt to bypass authentication or rate limits, or use the app to make clinical decisions for another person.

Questions about this page, a data request, or a billing issue: support@pulse-os.app. The service is operated by the PULSE OS operator.