Health and Fitness Data Privacy Policy

BugendaiOhana is an employee self-service application developed by Bugendaitech Pvt. Ltd. The application may provide employee wellness, activity tracking, and BT Rewards features, subject to the functionality enabled by the organization.

To support these features, BugendaiOhana may access certain health and fitness information through Android Health Connect on supported Android devices and Apple HealthKit on supported iOS devices.

This section explains the health and fitness information the application accesses, how it is collected and used, when it may be synchronized with the organization's Human Resource Management System (HRMS), and how users can manage permissions and request deletion of their information.

This section supplements the main BugendaiOhana Privacy Policy.

Subject to the features available and the permissions granted by the user, BugendaiOhana may access the following information:

• Daily step count: The number of steps recorded for a particular day.
• Walking distance: The distance recorded for walking activities.
• Running distance: The distance recorded for running activities.
• Activity dates and timestamps: Dates or timestamps associated with activity records, where required by the application's functionality.
• Associated account information: An employee or application account identifier used to associate activity summaries with the appropriate user.

The application accesses this information through Android Health Connect or Apple HealthKit, depending on the device and supported integration.

BugendaiOhana requests access only to the data types required for the relevant features and authorized by the user.

When a user enables a relevant feature and grants the required permissions, BugendaiOhana reads the authorized health and fitness information from the applicable health platform.

The application may process this information to calculate activity summaries, display daily progress, evaluate progress toward eligible wellness or rewards goals, and support synchronization with the organization's HRMS.

The frequency and method of access depend on the application's implementation, the feature being used, and the permissions granted by the user.

The application does not intentionally access health information beyond the data types required for its disclosed functionality.

Health and fitness information may be processed for the following purposes, where supported by the application:

Health and fitness information will not be used for purposes unrelated to those disclosed in this policy or otherwise prohibited by applicable law or platform requirements.

Where required to provide the application's wellness, activity tracking, or rewards features, relevant activity summaries, associated activity dates, and employee or account identifiers may be transmitted to and stored within the organization's HRMS.

The receiving system is Bugendaitech Pvt. Ltd..

The information may also be processed by authorized hosting providers, infrastructure providers, or other service providers supporting the disclosed functionality, subject to applicable contractual, security, and privacy requirements.

The information shared and the parties receiving it will be limited to what is necessary for the relevant features.

BugendaiOhana does not sell health and fitness data, share it with advertisers or data brokers, or use it for targeted advertising, provided these statements accurately reflect the application's implementation, integrated software development kits (SDKs), and organizational practices.

Access to health and fitness information is subject to the permissions granted through Android Health Connect or Apple HealthKit, as applicable.

Users may grant or deny the requested permissions and manage or revoke access through the relevant platform's settings.

BugendaiOhana requests only the permissions necessary for its available features. Where required, the application provides a prominent disclosure explaining the data accessed, its purposes, and relevant sharing before requesting permissions.

Revoking permission prevents future access to information that the application is no longer authorized to read. However, revocation does not automatically delete information previously transmitted to or stored within the HRMS or another system.

The application handles permission denial and revocation according to its implemented access-control and synchronization procedures.

BugendaiOhana retains health and fitness information only for as long as necessary to provide the disclosed activity tracking, employee wellness, and rewards features, and to meet applicable legal and organizational record-keeping requirements.

Users may request deletion of eligible stored health and fitness information by contacting operations@bugendaitech.com.

Revoking Health Connect or Apple HealthKit permissions prevents future access to data that is no longer authorized. However, it does not automatically delete information previously synchronized with the organization's HRMS.

Deletion requests will be processed in accordance with the organization's data retention and deletion procedures and applicable legal obligations. Where information must be retained for legitimate legal or record-keeping purposes, it may be retained for the period required.

BugendaiOhana and the relevant service providers implement appropriate technical, administrative, and organizational safeguards to protect health and fitness information against unauthorized access, disclosure, alteration, loss, or misuse.

Subject to verification of the implemented controls, these safeguards may include:

• Encryption of information during transmission using HTTPS/TLS.
• Encryption of stored information and backups, where implemented.
• Role-based access controls and least-privilege access.
• Authentication and authorization controls for application services and APIs.
• Security logging and monitoring to help identify unauthorized access or suspicious activity.
• Procedures for investigating and responding to security incidents.

Access to health and fitness information is limited to authorized personnel and systems according to their operational responsibilities.

The organization maintains security measures in accordance with its applicable security policies and legal requirements.

Health and fitness information accessed through Android Health Connect or Apple HealthKit is used for the purposes described in this policy and other compatible purposes permitted by applicable law and platform requirements.

The information is not sold or used for targeted advertising. It is not shared with advertisers or data brokers, provided the application's actual data flows and third-party integrations support these commitments.

Any additional use of health and fitness information must be reviewed for applicable privacy, consent, and platform-policy requirements before implementation.

Users may contact Bugendaitech Pvt. Ltd. with questions or concerns regarding health and fitness data accessed through BugendaiOhana, including data collection, use, sharing, permission management, and requests for access to or deletion of eligible information.

Users may request deletion of eligible health and fitness information by contacting the organization through the privacy contact details provided above. Requests will be reviewed and handled in accordance with applicable laws and the organization's data retention and deletion procedures. Where information must be retained to meet legal or legitimate record-keeping obligations, applicable retention requirements will be followed.

This section applies to health and fitness information accessed through the Android Health Connect and Apple HealthKit integrations within BugendaiOhana.

Other provisions of the main BugendaiOhana Privacy Policy continue to apply where relevant, provided they remain consistent with this section and applicable legal and platform requirements.

Any material change to the data types accessed, purposes of use, sharing arrangements, or retention practices must be reviewed and reflected in the relevant privacy disclosures before the changed functionality is introduced.