Privacy policy and regional addenda

Last updated: October 4, 2026

At S U L E (operated by Nordic Topothea), your health data privacy is not a feature — it is the foundational boundary of our product design. This Privacy Policy explains how we collect, process, secure, and delete your information when you use our personal health HUD at https://thesule.com.

Part 1: Global privacy policy

1. Data we collect and how we use it

Because S U L E acts as a unified timeline for your health story, we process data in three distinct categories:

• Account data: your verified email address, used strictly to securely bind, authenticate, and scope access to your private profile.
• Health telemetry and device feeds: clinical parameters (heart rate, oxygen, blood pressure), lab uploads, imaging, and synced metrics from third-party wearable makers mapped within our catalog. This data is strictly aggregated to display your personalized health HUD dashboard.
• Market study inputs: voluntary names, emails, and phone numbers submitted via public forms to help optimize system scale.

2. Zero-monetization and sharing boundaries

• We never sell your data: Nordic Topothea does not sell, lease, or monetize your health charts, parameters, or personal profiles to insurance firms, pharmaceutical groups, or third-party advertisers.
• Ad-free environment: the platform maintains a strict 0% advertising standard; no tracking pixels or cross-site marketing tools are integrated into your private environment.
• User-directed sharing: your data is only shared if you explicitly initiate a workflow, such as inviting a family member via Family Connect or granting access to a clinician before an appointment.

3. Security measures

• Transit security: every byte of data moving between your wearables, web dashboard, and our servers is forced through HTTPS/TLS transport encryption.
• Strict access scoping: your personal chart is completely isolated architecturally and bound strictly to your authenticated login token, preventing horizontal data exposure.

4. Absolute data sovereignty and erasure

You maintain permanent ownership over your records. You have the right to completely wipe your operational record at any moment. Doing so immediately and irrevocably flushes your profile, timeline history, and connected mappings from our active live databases:

• In-app control: use the dedicated Delete Account pipeline built directly into your client dashboard settings, or the delete page.
• Direct request: email our privacy team directly at contact@thesule.com to initiate a manual system purge.

Part 2: Strict regional regulatory addenda

1. European Union and United Kingdom rider (GDPR / UK GDPR)

For users accessing S U L E from the EU or UK, Nordic Topothea operates as the Data Controller under European Union medical software blueprints (designed in structural alignment with ISO 13485 standards).

• Legal basis for processing: we process your standard metadata based on contractual necessity to run the service. Because your wearable timeline, clinical inputs, and lab documents qualify as Special Category Data (Health Data) under GDPR Article 9, we process this information strictly based on your explicit, affirmative consent, which you grant upon creating an account and pairing your devices.
• Right to erase (Art. 17): the right to clear your dashboard entirely using our delete tools.
• Right to access and portability (Art. 15 and 20): you may request a clean export of your 92 clinical parameters in a structured, machine-readable format at any time.
• Right to withdraw consent: you can disconnect any wearable maker or rescind clinician visibility instantly, stopping further processing pipelines.
• Cross-border transfers: if data crosses regional boundaries, it remains heavily guarded under standard contractual clauses (SCCs) to match original European protections.

2. United States rider (HIPAA and state privacy protections / CCPA / CPRA)

• HIPAA framework boundary: S U L E is built with robust cybersecurity access controls modeled after HIPAA technical safeguards to protect health telemetry. When you use S U L E as an individual consumer to aggregate your own records, it operates as a direct-to-consumer health tool. If you link your timeline to a US-based covered healthcare provider, our architecture safeguards that transmission link securely.
• No “sale” or “sharing” of personal or sensitive information: we explicitly do not sell your personal data or share your sensitive medical metrics for cross-context behavioral marketing profiles.
• Right to limit use of sensitive personal information: you have absolute control to limit our use of biometric and health-related parameters exclusively to the core visualization and tracking utilities you choose to activate.
• Right to know and delete: US residents can contact contact@thesule.com to receive a full breakdown of their profile data or request immediate account purging.

Part 3: Legal correspondence

For security verifications, data deletion escalations, or regional privacy exercises, please contact our dedicated compliance handler:

• Corporate desk: Nordic Topothea
• Platform domain: thesule.com
• General support desk: admin@thesule.com
• Privacy desk: privacy@thesule.com