Scope. This Canada and Québec Privacy Notice forms part of the Hues Within Privacy Policy and applies when Hues Within handles personal information about people in Canada. If the documents differ, this notice applies to the extent required by applicable Canadian or Québec law. Nothing in either document limits a privacy or consumer right that cannot legally be waived.
1. Privacy accountability
Hues Within is operated by Cynthia Salinas Treviño. Cynthia is the individual accountable for Hues Within’s privacy program and serves as its Privacy Lead, including responsibility for privacy requests and complaints, privacy-impact reviews, service-provider oversight, retention and destruction, and incident response. Contact: hello@hueswithinapp.com. Legal domicile: Manuel Alanis 6, Col. Lomas del Hipico, 64989 Monterrey, Nuevo León, Mexico.
2. What Hues Within handles and why
The general Privacy Policy explains the information Hues Within handles, where it is stored, its sources, the purposes for which it is used, and the providers involved. In summary, this may include account and profile information; daily check-ins; mood, emotional-wellbeing, symptom, sleep, movement, activity, medication, menstrual-cycle, note, and custom-answer information; descriptive patterns and user-requested files; purchase entitlements; technical and security records; and support or privacy correspondence.
Hues Within limits collection, use, and disclosure to purposes a reasonable person would consider appropriate, seeks consent where required, and handles information without consent only where applicable law specifically permits. It does not sell personal or health information, use it for advertising, share it with data brokers, provide it to insurers or employers, or use private records to train an artificial-intelligence model.
3. Sensitive information and meaningful consent
Mood, mental-health, medication, symptom, menstrual-cycle, free-text, and gender-identity information is sensitive. Hues Within requests express consent separately from agreement to the Terms. The consent identifies the sensitive categories and purposes, including device storage and display, descriptive insights, user-requested reports or share images, and signed-in backup and restoration. Hues Within does not treat acceptance of the Terms or merely opening the app as sensitive-information consent.
You may decline optional questions and features. You may withdraw consent for future processing through the consent control in the app’s Settings or by contacting the Privacy Lead. Withdrawal does not make earlier lawful processing unlawful, but core tracking features may no longer be available. Separate deletion controls remain available.
4. Descriptive insights and Québec profiling
Hues Within analyzes records you choose to enter to create descriptive patterns, comparisons, and summaries. This may constitute profiling under Québec law. It is not used to decide eligibility, healthcare, employment, insurance, credit, or access to services. The feature does not operate unless you first take the affirmative step of consenting to the disclosed sensitive-data purpose. You may later withdraw that consent and reach the deletion controls.
5. Service providers and processing outside Canada or Québec
Hues Within is operated from Mexico, so Canadian information may be accessed and handled in Mexico. Supabase supports authentication, signed-in backup, entitlements, purchase-restoration records, the restricted Apple-revocation retry queue, database security, and server functions. Apple handles the Apple sign-in and App Store functions you choose. Google Workspace provides the support and privacy-request mailbox and processes messages, participants, attachments, and related delivery and security metadata. Public-site hosting infrastructure may process limited website request and security logs. These providers may process information in countries where they operate, where it may be subject to local law and lawful access by courts, law-enforcement agencies, or national-security authorities.
Hues Within remains accountable for personal information under its control and uses contractual, organizational, and technical safeguards appropriate to its sensitivity. Before information governed by Québec law is communicated or entrusted outside Québec, Hues Within will complete the assessment and written arrangement required by applicable Québec law.
6. Retention and destruction
Hues Within keeps information only for the period needed for the disclosed purpose, an active account, security and fraud prevention, a legal or complaint hold, or another requirement permitted by law. Successful deletion removes the authentication account, active Plus entitlement, and ordinary Hues Within account records from active cloud systems; limited copies may remain temporarily in provider backups or be blocked against ordinary use until the applicable period ends. A minimal, server-only App Store purchase ledger remains without the deleted Hues Within account identifier so the same Apple purchase can be restored and duplicate or conflicting claims can be prevented; a separate notification replay log prevents the same App Store notification from being applied twice. A failed Apple sign-in revocation credential remains in a restricted, manually processed retry queue until revocation succeeds or the first later retry run after it reaches 14 days. Device-only information remains under your device controls. The Data deletion page explains operational steps and the exact fields retained.
7. Canadian and Québec rights
Depending on the law that applies, you may ask Hues Within to confirm whether it holds personal information about you; explain its use and disclosure; provide access; correct inaccurate or incomplete information; withdraw consent; challenge compliance; and delete information through available controls or where continued retention is no longer authorized or necessary.
Québec residents may also request eligible computerized information collected from them, excluding information created or inferred by Hues Within, in a structured and commonly used technological format unless doing so raises serious practical difficulties.
8. How to make a request or complaint
Send a written request to hello@hueswithinapp.com with the subject “Canada privacy request.” Identify the right you wish to exercise, your account email if applicable, your province or territory, the request’s scope, and your preferred response format. Do not send journal entries, medication information, passwords, or unnecessary identity documents. Hues Within may verify identity through the signed-in account, account email, a one-time code, or another proportionate method.
Hues Within responds in writing as soon as reasonably possible and ordinarily no later than 30 days. For a request governed by PIPEDA outside Québec, the period may be extended where the law permits, with notice explaining the reason, new deadline, and complaint right. Québec access and correction requests will be answered no later than 30 days. Ordinary electronic requests are free. If a permitted reproduction or transmission charge could apply, Hues Within will disclose the estimated amount in advance. A refusal will explain the reason and available recourse.
9. Privacy governance and incidents
Before handling Canadian personal information at launch, Hues Within will document privacy responsibilities, consent and document versions, provider review, privacy-impact reviews for systems and material changes, cross-border assessment, access controls, retention and destruction, requests and complaints, and incident handling. Access will be limited to what is needed to operate and protect the service.
If a suspected incident occurs, Hues Within will assess it under each applicable law, keep the required record, take reasonable steps to reduce harm, and notify affected people and the Office of the Privacy Commissioner of Canada and/or the Commission d’accès à l’information du Québec when the applicable legal threshold is met.
10. Escalating a concern
Please contact the Privacy Lead first so Hues Within can investigate and respond. If you remain dissatisfied, you may contact the Office of the Privacy Commissioner of Canada. Québec residents may also contact the Commission d’accès à l’information du Québec. Depending on the subject and cross-border handling, more than one law or regulator may be relevant.
11. Changes
Changes will be posted at this URL with a new version or date. Hues Within will provide additional notice and seek renewed consent before a material new use when applicable law requires it.