Hume Health

"Mobile Device Access. We may request access or permission to certain features from your mobile device, including your mobile device's bluetooth, sensors, reminders, camera, and other features. If you wish to change our access or permissions, you may do so in your device's settings."

Hume requests access to bluetooth, sensors, reminders, camera, and unspecified 'other features' on mobile devices. While some sensor access may relate to a health tracking device, the broad and vague scope ('other features') goes beyond what's clearly justified.

"Geolocation Information. We may request access or permission to track location-based information from your mobile device, either continuously or while you are using our mobile application(s), to provide certain location-based services. If you wish to change our access or permissions, you may do so in your device's settings."

Hume explicitly states they may track location 'continuously' — not just while the app is in use — which constitutes background location tracking. They also collect precise geolocation data and device location as confirmed in their CCPA disclosure.

"The categories of third parties we may share personal information with are as follows: Data Analytics Services, Ad Networks, Sales & Marketing Tools, Retargeting Platforms, Affiliate Marketing Programs, Performance Monitoring Tools, Cloud Computing Services... When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email or home address."

Hume shares personal information with a wide range of third parties including ad networks and retargeting platforms, and allows online data partners to associate user activity with email and home addresses for marketing purposes.

"When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email or home address. We (or service providers on our behalf) may then send communications and marketing to these email or home addresses."

Hume allows data partners to link browsing activity to users' email and home addresses, enabling cross-context tracking and profiling across services, which is then used for targeted marketing communications.

"We may update this privacy notice from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification."

Changes take effect immediately upon posting, and notification for material changes is discretionary ('may notify'). Continued use constitutes acceptance with no mechanism for users to reject changes before they take effect.

"Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements."

Even after account termination, Hume retains unspecified data for broad purposes like 'troubleshoot problems' and 'assist with any investigations,' with no clear timeline for when this retained data would be deleted.

"Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements."

Account deletion does not guarantee full data removal. Hume reserves broad rights to keep data after deletion for vaguely defined purposes, and the CCPA section notes data 'may not be completely or comprehensively removed from all our systems (e.g., backups, etc.).'