At Xeep, your physiological data belongs to you. This Privacy Policy explains how XEEP PLT (LLP Registration No. 202504002688) collects, uses, shares, and protects personal information on xeep.io, the iOS and Android apps, and the Xeep Device, under Malaysia’s Personal Data Protection Act 2010 (PDPA). If you do not agree, do not use Xeep.
Data in transit uses TLS 1.3; data at rest uses AES-256. The Data Usage Agreement is part of this policy: creating an account also accepts AI processing and the de identified copy described in §5. Licensing that copy to research partners happens only if you turn on Research sharing.
1. Introduction
Xeep is committed to PDPA compliance. Using the Services means you agree to this Policy.
2. Information We Collect
You provide: name, email, phone, date of birth, optional IC number, encrypted password, optional photo, gender, height/weight; payment details processed by HitPay (card data not stored by Xeep), billing address, subscription history; support messages, surveys, feedback.
Device and app (nine streams): heart rate (~288/day, 5-min), SpO2 (~144/day, 10-min), algorithmic blood pressure (60–85% confidence, not medical-grade), sleep, activity, stress, HRV, XQ scores, wellness checks; plus usage, navigation, notifications, dashboard prefs, cycle tracking, meals, symptom notes.
Technical: device serial and mobile IDs, masked IP, OS/browser, network, state/region from IP, timezone, language, app version, crash logs. Cookies: see Cookie Policy.
3. How We Use Your Information
Under PDPA we use data to: calculate XQ; provide AI insights; show real-time and historical metrics; train anonymized models and improve the product (including user-generated meal suggestions); detect bugs; keep a de identified copy of your health measurements when you delete your account, so we can improve Xeep, and license that copy to research partners only when Research sharing is on, as §4 describes; identifiable data is never sold; communicate support and service notices; send marketing only with consent (opt out anytime); prevent fraud; comply with law; run payments and records; support a sale of the business with continued protections.
Keeping a de identified copy of your health measurements to improve Xeep is part of the service. Licensing that copy to research partners is optional and stays off unless you turn on Research sharing. You keep your PDPA rights over identifiable data.
4. Data Sharing and Disclosure
We never sell identifiable personal information; never share name/email/IC for marketing; never give identifiable wellness data to insurers for underwriting or employers for hiring; never share identifiable data with researchers or commercial partners.
Processors: Firebase/Google Cloud (encrypted storage, auth; may be outside Malaysia); HitPay (Singapore, PCI-DSS Level 1; email, plan, amount; cards stay with HitPay); ReCaptcha (browser/interaction). Vendors are contractually limited to the stated purpose, security, and PDPA-equivalent rules.
De identified copies kept after account deletion (see §5) may be licensed to universities, healthcare providers, Ministry of Health type agencies, and pharmaceutical companies for research, not for diagnosis or for decisions about any person. We license a copy only if Research sharing was on when the account was deleted, and that account had accepted version 1.4 of this Policy, together with the Terms of Service and the Data Usage Agreement. Research sharing is in the profile screen, under Research sharing. The control is “Share my de-identified data with research partners”. It is off unless you turn it on. You can turn it on or off at any time. The choice saved when you delete the account is the one that applies. Copies from accounts that accepted only an earlier version, or that did not have Research sharing on, are never licensed outside Xeep; we use them only to improve Xeep. Partners must agree in writing not to try to identify anyone.
5. Data Retention
Active accounts: we keep your personal and wellness data while your account is open, so we can show your history and calculate XQ. Technical logs and audit logs are kept for about 1 year while your account is open.
When you delete your account: deletion takes effect straight away and cannot be undone. There is no cooling off period, so export any data you want to keep first (Settings → Privacy → Request My Data).
Billing: before we delete anything, we cancel any recurring billing with our payment provider, HitPay, so no further charges are made. Payments already made are not refunded.
What we delete: your account and sign in details; your profile, contact details, and date of birth; your wellness and health records, cycle settings, personal baselines, and sync records; uploaded lab reports and images; AI insights; your device links and notification tokens; your consent records and signed agreement record; your audit log, which holds your IP address; beta programme records; and any Partner Link between you and another user.
What we keep, de identified: a copy of your health measurements, such as heart rate, SpO2, blood pressure, sleep, activity, HRV, stress, estimated temperature (derived from band sensors, not measured), XQ scores, cycle data, wellness checks, weight, nutrition, sport sessions, and structured lab values, together with the time between readings. Where your profile has them, we also keep your 10 year age band and sex. The copy also records which versions of this Policy, the Terms of Service, and the Data Usage Agreement you accepted, and when, with that time shifted in the same way as the measurements. It does not record your email, name, account ID, or IP address. We use this copy to improve Xeep, including research that develops our algorithms, and we license it to research partners only as §4 describes.
How the copy is protected: before we keep it, we remove your name, email, phone number, IC number, date of birth, account ID, device IDs, tokens, emergency contacts, addresses, GPS routes and locations, lab report files, and AI insight text. We give the copy a new random ID that is not linked to your account, and we shift all its dates by a random amount that we do not store. These steps mean the copy cannot reasonably be matched back to you. No user or app can read the copy.
What else remains: payment records, which our payment provider HitPay holds, kept for 7 years as tax law requires; records needed for a legal dispute, kept until it is resolved plus 7 years; and aggregate statistics and research datasets made before you deleted your account, which do not identify you.
Backups: copies of deleted data held in our backups are removed when those backups expire.
6. Your Rights Under Malaysia PDPA
Access: copy of personal and nine-stream history, use purposes, categories of anonymized recipients, access logs, consent history. [email protected] subject Data Access Request, or Settings → Privacy → Request My Data. Target 14 days (PDPA allows 21). CSV/JSON/PDF. First request per year free; later may be RM20.
Correction: account fields and manual logs in Settings or [email protected] (7 days). Sensor data, historical XQ, and anonymized sets cannot be rewritten as “errors.”
Deletion: Settings → Account → Delete, or [email protected]; password, email link, type DELETE. Deletion is immediate and cannot be undone. §5 explains what we delete and the de identified copy and billing records we keep.
You may withdraw marketing and non-essential-feature consent. You can turn Research sharing on or off at any time before you delete the account. While it is off, we do not license the de identified copy to research partners. We still keep that copy to improve Xeep. Copies already licensed are not recalled.
7. Data Security
Encryption in transit and at rest; bcrypt passwords; RBAC; MFA for production admin; all production DB access logged; App Check/ReCaptcha; API rate limits; IP allowlists; 24/7 monitoring; quarterly audits; staff PDPA training; least privilege; vendor DPAs; Google data-centre physical controls; signed firmware; secure pairing; remote wipe. Breach aim: contain within 2 hours and notify users as required by law.
8. International Data Transfers
Firebase may store data in Singapore, Japan, the US, or other Google regions. HitPay processes payments in Singapore. Transfers use adequacy, Standard Contractual Clauses, encryption, and your consent by using the Services. Future regions (e.g. GDPR/CCPA) get 30 days’ notice of material changes.
9. Cookies and Tracking
Essential (auth, security, session), analytics (with consent), preferences (theme, language, layout). Manage via first-visit banner, Settings → Privacy → Cookie Preferences, or browser settings. Full detail: Cookie Policy.
10. Children's Privacy
18+ only. We do not knowingly collect from under-18s. Parents: [email protected]; we delete within 30 days. Date of birth is required; under-18 registrations are rejected.
11. Third-Party Links
Research, education, and HitPay checkout links are not Xeep-operated. Their privacy practices are theirs. Read those policies before leaving Xeep.
12. Changes
Material: email 30 days ahead, site/app banner, acknowledgment on next login. Non-material: Last Updated date and newsletter. History: xeep.io/privacy and xeep.io/privacy/history. If you disagree, delete within 30 days of notice.
13. Contact and DPO
XEEP PLT, 202504002688, B-01-09 Savanna Lifestyle Retail, Jalan BBL2, Dengkil, Selangor.
General [email protected] · xeep.io/support.
DPO [email protected] (7–14 days); complaints same inbox, 48-hour ack.
Access: DPO · Correction: [email protected] · Delete: Settings or DPO.
Security: [email protected] (24/7).
PDP Commissioner: Level 6, Menara MCMC, Jalan Impact, Cyber 6, 63000 Cyberjaya · [email protected] · +603-8911 7000 · pdp.gov.my.
14. Consent and Acknowledgment
Creating an account means you have read this Policy; consent to described collection/use/sharing; understand that research licensing happens only if you turn on Research sharing; agree to international transfers; know PDPA rights; know BP/device are not medical-grade; understand that when you delete your account we keep a de identified copy of your health measurements to improve Xeep, as §5 describes, and that this copy may be licensed to research partners only when Research sharing is on, as §4 describes; can withdraw marketing consent and turn Research sharing off at any time, but cannot recall de identified data already licensed.
15. Transparency Commitment
Annual transparency report each February at xeep.io/transparency-report (users, datasets, recipient categories, aggregate licensing revenue, law-enforcement requests, complaints, incidents). In-app Settings → Privacy → Data Transparency. Quarterly Data Governance Committee; annual external privacy audit summary; elected user representative.
16. Additional Resources
Cookie Policy · Terms of Service · Terms of Sale · Wellness Disclaimer · Partner Data Sharing.
17. Partner Link
Optional, off by default, 18+, in-app consent. We process link status, share level, a phase summary (name, optional energy/timing/tip), and consent record. We do not share raw cycle, symptoms, flow, notes, or other health subcollections. Change share level or unlink anytime (Settings → Partner Link). Details: Partner Data Sharing Addendum. Wellness reference only, not medical advice.
Governed by the laws of Malaysia.