Privacy Policy

Privacy policy for Website and Mobile Application

Last updated: October 1, 2026

Introduction

Mia Health is a software service consisting of mobile and web applications owned, operated, and developed by Mia Health AS (address: Krambugata 2, 7011 Trondheim, Norway, org. no. 918343814) (hereinafter “we,” “us,” or “Mia Health”), a Norwegian limited liability company. The Mia Health app appears as “MIA Health” on your device. We take your privacy seriously. We are committed to keeping your personal information private and secure.

This Privacy Policy describes how Mia Health, as the data controller, handles personal data that we collect or receive through your visit to our website, www.miahealth.no, and your use of the Mia Health mobile application (hereinafter “the Services”).

Mia Health is a Norwegian company, which means we are obligated to process your personal data in accordance with the Norwegian Personal Data Act of 2018 and the EU General Data Protection Regulation 2016/679 (GDPR), regardless of where you, as a user of the Services, are located in the world. If you reside outside the EEA, you may have additional or supplementary rights under national or local privacy laws. In such cases, we will inform you of these rights to the extent possible and facilitate your ability to exercise them.

It is important that you read this Privacy Policy and understand how we collect, store, and otherwise process your personal information. We encourage you to review this Privacy Policy periodically to stay informed of any updates made due to changes in the law, changes in our practices, or for other reasons. We will notify you if we make any significant changes to the Privacy Policy.

We process your personal data to provide our Services in full and to improve them.

• We store information you provide and that is collected when the mobile app is in use.
• We use this information to provide you with estimates of your physical condition and to evaluate your performance.
• We share personal data with our data processors, to the extent possible in pseudonymized or anonymized form, to improve our products, for analytical purposes, and to provide customer support to our users.
• If you choose to link your account to an organization, we may ask you to share personal data (in anonymized form) with the organization you are affiliated with for statistical purposes. In each case, we will inform you of which personal data is being shared and ask for your consent. You may withdraw this consent at any time.
• If you choose to link your account to a data processor, we may ask you to share personal data with that data processor. In each case, we will inform you of which personal data is being shared and ask for your consent. You may withdraw this consent at any time.
• We only allow our third-party service providers to use the information we share with them to the extent strictly necessary to perform the services they provide to us.
• Your activity data and calculated health risks may be included in anonymized statistics. This is used to document the effectiveness of our services.

Apart from the cases mentioned in this Privacy Policy, we will not share, publish, sell, or otherwise disclose any of your personal data to any third parties without you specifically asking us to do so. Below you will find additional information about our processing of your personal data.

What information we process, and the purposes and legal basis for processing

Account Information Upon Registration and Use of the Services

To register as a user of the Mia Health mobile app, you must provide a minimum amount of information that can identify you. This includes your name, email address, and password. The legal basis is that the processing is necessary to fulfill our agreement to provide the Services to you.

Health Data in Mia Health

Using the data you share, we will be able to calculate various parameters and insights regarding your health and activity level. For this reason, we will collect, process, and store information from our users that constitutes medical/health data, defined as special categories of personal data under the GDPR and other privacy laws, as described in more detail in this section.

When you register with Mia Health, you as a user must provide the following information:

• Date of birth, gender, height, and weight: We process this personal data to provide personalized calculations regarding your required activity level and to estimate your health risks.
• Resting heart rate and maximum heart rate: We process this information to provide an estimate of your ongoing progress in fitness, health risk, and required activity level. You can either enter this information manually or have it retrieved from one of your connected devices.

Furthermore, through Mia Health, we will process medical/health data such as calculations of maximum oxygen uptake and fitness age, which are derived from a combination of data collected from connected devices, physiological data you have provided to us, and manually recorded activities. Health information processed by us through this service may include the following:

• VO2max: Using the data you share with us, we will calculate your maximum oxygen uptake. We use this to determine your fitness age and to provide you with tips and advice regarding health and lifestyle.
• Fitness Age: This parameter is used as a reference for your physical fitness in relation to health risks.

The legal basis for processing your health information is your explicit consent to the processing. You may withdraw your consent at any time, without this affecting the lawfulness of the processing prior to the withdrawal of consent. Please note that if you do not wish to give your consent for us to process such personal data in Mia Health, this will mean that we cannot provide all the features and services that Mia Health has to offer you.

Use of activity and health data for follow-up via email. If you have given your separate consent to “personalized follow-up outside the app,” we may use your activity and health data—such as changes in your AQ, activity level, or fitness age—to determine when to send you an email with advice, motivation, or offers—for example, when you’ve been less active for a period of time, or when you’ve reached a goal. This selection is made within our own systems. We only send our email provider a neutral indicator of which email series you should receive—not the actual activity or health data itself.

The emails do not contain health metrics such as AQ, heart rate data, or fitness age, and neither the subject line nor the content describes your health status or activity level.

The legal basis is your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)). This consent is voluntary, is given separately from other consents, is not a prerequisite for using the Service, and can be withdrawn at any time in the app. If you withdraw your consent, we will stop using your health data for this purpose. If the email contains marketing content, the rules regarding marketing under “Communication” below also apply.

No sharing with advertising platforms. We never share health information, or information derived from it, with advertising platforms such as Meta or Google—not even in encrypted (hashed) or aggregated audiences or as conversion events.

Other activity in Mia Health

We process personal data about you through your general use of the Mia Health mobile app. This may include information you share in various features of the mobile app, such as in chat and the feed/section for events and contests. The legal basis is that the processing is necessary to fulfill our agreement to provide the Services to you.

Device data

Certain actions performed in the app, such as logging in and upgrading to the paid version, trigger the collection of data about your device. This includes information such as the device type and model, and the software version you are using. We use this information to improve our products and to provide better customer support to our users. The legal basis is that the processing is necessary to safeguard Mia Health’s legitimate interests for the aforementioned purposes, and that these legitimate interests are not overridden by your rights and freedoms.

Technical Information and Log Data

When you use our portal solutions, we collect information that your computer, mobile device, tablet, or web browser sends to us. This may include your IP address, device information, browser information, as well as information about which pages you visit, the time and duration of your visits, and other statistics. We do this to improve our products. The legal basis is that the processing is necessary to safeguard Mia Health’s legitimate interests for this purpose, and that those legitimate interests are not overridden by your rights and freedoms.

Analysis of how you, as an identified user, use the app (product analysis via Amplitude) takes place only if you have consented to the purpose “statistics, analysis, and improvement of the app.” You can withdraw your consent in the app at any time. We do not send health information to Amplitude.

Connected Devices

When you choose to connect a heart rate monitor or other sensor to the Service, we will collect information from these devices and associate it with your account with us. This data will be processed for the same purposes as those you manually specify in our product. Read more about the processing of this information in the section on “Health Data in Mia Health.”

HUAWEI Health

With your permission, we only read your heart rate data from HUAWEI Health via the HUAWEI Health Service Kit, as well as your HUAWEI ID OpenID to identify the connection. We do not write data to HUAWEI Health. The heart rate data is used for the purposes described under “Health Data in Mia Health” and is not transferred outside the EU/EEA.

You can disconnect at any time in the app (You › User Account Settings › Manage Heart Rate Monitors › HUAWEI Health) or in the HUAWEI Health app (Me › Privacy Management › Data Sharing and Authorization). After you disconnect, we will no longer read data from HUAWEI Health.

The HUAWEI Health Service Kit is not a medical device. Data collected through the service is intended for reference purposes only and should not be used for medical diagnosis.

Google Health

With your permission, we read your heart rate data from Google Health (read-only access). We use this data exclusively to calculate health metrics and provide you with health insights in Mia Health, as described under “Health Data in Mia Health.” We do not sell the data, use it for advertising, or use it to train general AI models. We share it only with our data processors when necessary to provide the services, or when required by law. The data is stored within the EU (Amazon Web Services in Frankfurt). Our use of information received from Google’s APIs complies with Google’s guidelines for user data in API services (https://developers.google.com/terms/api-services-user-data-policy), including the requirements for limited use.

You can disconnect at any time in the app (You › User Account Settings › Manage Heart Rate Monitors › Google Health) or in your Google Account settings. After you disconnect, we will no longer read data from Google Health. Data that has already been synced will be stored until it is deleted. If you wish to have this data deleted, you can send an email to privacy@miahealth.no or delete your account in the app (You › Settings › Personal Profile › Delete Your Account).

Communication

If you contact us—whether by email, phone, or through our support service on the website—we will process your personal information, such as your name, email address, phone number, subscription information, and any other information you choose to share with us. The legal basis is our legitimate interest in responding to your inquiries.

We send you messages via email, as push notifications, and within the app. These messages are divided into three types.

Service messages: Receipts, notifications regarding renewal, price changes, or the expiration of subscriptions and trial periods, failed payments, password resets, security alerts, operational messages, and notifications regarding changes to the Terms of Service and this Privacy Policy. These messages are necessary to provide the Service or to comply with legal obligations, and the legal basis is the agreement with you or a legal obligation (GDPR Art. 6(1)(b) and (c)). You cannot opt out of service notifications as long as you have an account with us. Service notifications do not contain marketing content.

Marketing and newsletters: News, tips, and advice on training and using the Service, offers, promotions, and invitations to start using the Service again. We send marketing via email and SMS only if you have consented to it, or if you are or have been a paying customer of ours and the marketing relates to similar services, cf. the Marketing Act § 15, first and third paragraphs. We send marketing as push notifications only if you have enabled the relevant notification category in the app. You can opt out at any time, free of charge, in the app (You › User Account Settings › Notifications and Consents) or via the unsubscribe link in each email.

Message Personalization: To ensure that messages are relevant, we may personalize the messages you receive based on how you use the Service—for example, whether you have completed registration, connected a heart rate monitor, started using workout programs, or have not logged in for a while—and whether you have an active subscription. This is information about your use of the app, not health information. If you have given your personal consent to personalized follow-up outside the app, we may also use activity and health data as described under “Health Data in Mia Health.” The legal basis is your consent to marketing or our legitimate interest in sending relevant messages to existing customers (GDPR Art. 6(1)(a) and (f)).

Push notifications and in-app messages regarding your own fitness and health progress—such as changes in your AQ or fitness age—are part of the personalized insights you have consented to and are sent only if you have enabled the relevant notification category. You can turn off each category within the app.

Emails and notifications are sent via our data processor Customer.io; see the list of data processors below.

You may object at any time to our use of your personal data for direct marketing purposes, without providing a reason. We will then cease such use, cf. GDPR Article 21(2) and (3).

Cookies

Cookies are small pieces of data that may include a unique identifier and can be stored on your device. Some of these cookies are persistent, meaning they will remain stored on your electronic device for a limited period after you leave our website. Session cookies are deleted as soon as you leave the website.

We use cookies to collect information and control access to our services. We use necessary and functional cookies for these purposes. If you consent via our consent solution (the cookie banner), we also use cookies and similar technologies for analytics and marketing, including Meta Pixel, Google Analytics, and Google Ads. These are not set until you give your consent, and you can change your selection at any time via “Manage Cookies” at the bottom of the website. You can set your device to reject our use of cookies, but please note that you may lose access to parts of our services where we use necessary or functional cookies.

The legal basis for our use of cookies that involves the processing of your personal data—such as your IP address and the time of your visit—is your explicit consent. For strictly necessary cookies, the legal basis is our legitimate interest in providing a functional website and mobile app.

Data Storage and How We Share and Disclose Personal Data

General Information on Disclosing Personal Data to Third Parties

We do not disclose your personal data to others unless you consent to the sharing or there is a legal basis for the sharing. Examples of such grounds include when it is necessary to fulfill a contract with you, when we have a legal obligation requiring us to disclose your personal data, or when it is justified based on our legitimate interests in sharing the information.

Data Processors

We use external service providers (data processors) for technical support, data storage and security, bookkeeping and accounting, sending emails and notifications, and for analysis and marketing. Data processors may have access to your personal data. In such cases, we have entered into data processing agreements to ensure information security at every stage of processing.

Our data processors may be located outside the EU/EEA. We will only transfer personal data outside the EU/EEA if there is a lawful basis for such a transfer under Chapter V of the GDPR. You can find out which legal basis is used for the transfer by contacting us. We will always choose data storage within the EU/EEA whenever possible.

We use the following data processors for data storage, data analysis, marketing, payment, webinars, and live chat solutions:

• HubSpot is used for customer service and support for our customers and users.
  https://legal.hubspot.com/privacy-policy
• Amazon Web Services is used as a cloud solution for our services.
  https://aws.amazon.com/privacy/
• Google Analytics is used for statistical analysis of traffic on our services
  https://policies.google.com/privacy
• Firebase is used for the distribution of our mobile applications and associated technical and usage analysis.
  https://firebase.google.com/support/privacy/
• Apple App Store for downloading the app and paying for subscriptions
  https://www.apple.com/legal/privacy/data/en/app-store/
• Google Play Store for downloading the app and paying for subscriptions
  https://policies.google.com/privacy?hl=en-US
• Stripe as a payment solution on our website, outside the app.
  https://stripe.com/privacy
• Meta Pixel is used, with explicit consent, for marketing and analytics purposes.
  https://www.facebook.com/privacy/policy
• Amplitude for analyzing user activity within the app.
  https://amplitude.com/privacy
• Branch for tracking and analyzing how users navigate from external links.
  https://branch.io/policies/privacy-policy/
• Microsoft Teams for webinars
  https://privacy.microsoft.com/en-gb/privacystatement#mainenterpriseservicesmodule
• Customer.io is used to send emails, push notifications, and other messages to our users, including both service notifications and—where we have a legal basis to do so—marketing communications. Data is stored in the EU. https://customer.io/legal/privacy-policy
• Google Ads and Google Tag Manager are used, with your consent, to measure marketing and conversions on the website. https://policies.google.com/privacy
• Apple Search Ads is used to measure the effectiveness of ads in the App Store. https://www.apple.com/legal/privacy/
• Meta SDK (app events) is used, with your consent and—on iOS—your permission for tracking (App Tracking Transparency), to measure in-app marketing. https://www.facebook.com/privacy/policy
• Supabase is used as an internal database for analysis and reporting. https://supabase.com/privacy

Affiliation with a Company or Organization

If you are invited by a company or organization to participate in their campaign with Mia Health, you will be asked to share your personal data. We will then inform you about what data is shared and how it is used, and you will need to give your consent before the data is shared. You can stop sharing data at any time in the sharing center within the mobile app. We recommend that you contact the company or organization directly for more information about how they process your personal data.

Connection to a healthcare provider

If you are invited by a healthcare provider, trainer, or other individual who provides personalized follow-up to participate in their follow-up service with Mia Health, you will be asked to share your personal data. We will then inform you about what information is shared and how it is used, and you will need to give your consent before your personal data is shared. You can stop sharing your personal data at any time through the sharing center in the mobile app. We recommend that you contact the data processor directly for more information about their processing of your personal data.

Participation in a research project

If you are invited by a research project to participate in their studies administered via the Mia Health platform, you will be asked to share your personal data. We will then inform you about which personal data is being shared, and you will need to give your consent before any personal data is shared. Depending on the specific study, you may also need to sign separate agreements directly with the research institution. To stop sharing your personal data via Mia Health, you can opt out at any time in the sharing center within the mobile app. We recommend that you contact the research institution directly for more information about how they process your personal data.

Retention and Storage (Deletion) of Personal Data

We will not retain your personal data longer than is necessary to fulfill the purpose of the processing and our legal obligations. For example, personal data that we process based on your consent will be deleted if you withdraw your consent. Personal data we process to fulfill a contract with you will be deleted once the contract has been fulfilled and all obligations arising from the contractual relationship have been met, such as legal obligations related to accounting, follow-up of the customer relationship regarding complaints, etc. Information processed due to a legal obligation will be deleted as soon as we are no longer required to retain it. Health data, including data from connected devices, is stored for as long as your account exists and is deleted when you delete your account.

Security of Processing

All processing of personal data is secured with the required technical and organizational measures. We handle information confidentially and ensure that it is accurate, accessible, and handled in accordance with the sensitivity of the data. We conduct the necessary risk assessments for the processing of personal data and restrict access to personal data to those employees or third parties who are required to process the data on our behalf. These parties are subject to a duty of confidentiality. Your data is stored with Amazon Web Services in Frankfurt, Germany (EU), and is encrypted both in transit and at rest.

Your Rights and Inquiries

You have the following rights regarding the personal data we process about you:

• Access: You have the right to information about what personal data we have stored about you, and the right to access this personal data.
• Correction and deletion: The information we have about you must be accurate and up-to-date. If you discover an error, we encourage you to contact us so that the information can be corrected. You can also contact us if you wish to have information deleted.
• Restriction of processing: You have a general right to ask us to stop processing your personal data, for example, if you believe that we are processing your personal data unlawfully and you do not want us to delete the personal data in accordance with our procedures until the matter has been clarified.
• Data Portability: For information that you have provided to us and that is necessary to fulfill a contract with us, and which is processed automatically (i.e., not manually by us), you may request that your personal data be provided to you or transferred to another provider in a structured, commonly used, and machine-readable format (data portability).
• Right to Object: You have the right to object to our processing of your personal data if this is justified by specific circumstances on your part.
• Right to File a Complaint: If you disagree with how we process your personal data, you have the right to file a complaint with a supervisory authority. In Norway, this is the Norwegian Data Protection Authority. However, you should contact us first so that we can clarify any uncertainties.
• Processing Based on Consent: If we process personal data based on your consent, you may withdraw your consent at any time. The easiest way to do this is to use the method specified when you gave your consent or by contacting us.

If you have any questions or concerns regarding the processing of your personal data, or if you wish to exercise one or more of your data protection rights, please contact our Data Protection Officer. Please note that we may ask you to verify your identity before responding to such requests: privacy@miahealth.no. For requests regarding access, correction, deletion, and restriction of the processing of your personal data, please contact privacy@miahealth.no.

You can delete your account and all your personal data in the app (You › Settings › Personal Profile › Delete Your User Account). To receive an export of your personal data, contact privacy@miahealth.no.

Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other reasons. We will notify you of material changes to the Privacy Policy by publishing the updated Privacy Policy on our website and/or through other communication channels. If the changes affect how we process your personal information, the app will ask you to accept the updated Privacy Policy before you continue using the services.

We are obligated to ensure that you can exercise your rights free of charge and within 30 days. If it takes longer than this, you will be notified.