Scope. This integral privacy notice applies to people in Mexico and forms part of the Hues Within Privacy Policy. The general policy describes the product’s current data flows in more detail. If the documents differ, this notice applies to the extent required by Mexican law.
1. Controller and Privacy Lead
Cynthia Salinas Treviño, an individual operating Hues Within, is the data controller. Her legal domicile is Manuel Alanis 6, Col. Lomas del Hipico, 64989 Monterrey, Nuevo León, Mexico. Cynthia is also the Privacy Lead and designated personal-data contact responsible for ARCO requests, consent-withdrawal requests, and requests to limit use or disclosure. Email: hello@hueswithinapp.com.
2. Personal data handled
Hues Within may handle the following information when you choose to provide or generate it:
- account, authentication, session, age-eligibility, consent, Terms-acceptance, entitlement, and transaction identifiers;
- display name, age, country, gender identity, settings, reminders, and support correspondence;
- daily check-ins, notes, custom answers, symptoms, emotions, sleep, movement, activities, functioning, and timestamps;
- medication names, doses, schedules, history, changes, and reported use;
- menstrual-cycle records, settings, and calendar estimates;
- descriptive patterns, comparisons, reports, spreadsheets, chart images, and calendar images; and
- limited device, browser, IP-address, request, security, error, and support information.
Mental-health, medication, symptom, menstrual-cycle, gender-identity, free-text, and related records may be sensitive personal data. Hues Within does not request official identity documents unless they are proportionate and necessary for a particular rights request.
3. Sensitive-data purposes requiring express consent
Hues Within requests separate, affirmative consent before using sensitive information you choose to enter for these purposes:
- storing and displaying records on your device;
- creating descriptive patterns, comparisons, and context without diagnosing, predicting, or determining cause;
- creating reports or share images only when you request them; and
- when you sign in, privately backing up, synchronizing, restoring, and reconciling deletion of completed check-ins and the basic profile fields described in the general Privacy Policy.
Consent to these purposes is separate from agreement to the Terms. You may skip optional questions and leave optional features unused. Hues Within has no secondary marketing, advertising, commercial-prospecting, or unrelated profiling purpose.
4. Operational purposes
Account, sign-in, session, eligibility, acceptance, purchase, entitlement, technical, security, and support information may be used to authenticate you; operate guest or account access; document choices; provide and restore Plus; secure and troubleshoot the service; answer support and rights requests; prevent abuse; and meet legal obligations. These purposes do not authorize unrelated use of health information.
5. Sources, storage, and generated information
Information comes from you; from Hues Within’s operation on your device; from patterns and files Hues Within creates at your request; from Apple when you choose Apple sign-in or an App Store purchase; from Supabase service events for signed-in functions; and from messages you send. Guest check-ins stay on the device. For signed-in users, completed check-ins and basic profile details are also backed up privately through Supabase as described in the general policy.
6. Processors, disclosures, and transfers
Supabase provides authentication, private signed-in backup, database security, Plus-entitlement and purchase-restoration records, the restricted Apple-revocation retry queue, and server functions. Google Workspace provides the support and privacy-request mailbox and processes messages, participants, attachments, and related delivery and security metadata. Website hosting infrastructure delivers the public site and may process limited request and security logs. These providers are required to handle information only for the service functions assigned to them, subject to their applicable agreements and legal obligations.
Apple independently handles App Store billing and purchase administration and handles Apple sign-in when selected. Hues Within may disclose only the information reasonably necessary to authorities or professional advisers when lawfully required, to protect rights and safety, or to investigate an incident. A file or image is disclosed to a recipient only when you choose to save or share it.
Hues Within does not sell personal or health information and does not disclose it to data brokers, advertisers, employers, or insurers. If a future transfer requires separate consent under Mexican law, Hues Within will provide the required information and obtain consent before making that transfer, unless a legal exception applies.
7. Retention, blocking, and deletion
Device-local records remain until you delete an available record, use the applicable erasure control, successfully delete your account, or remove the app and its data. Signed-in check-in and basic-profile backups remain while the account is active. Successful account deletion removes the authentication account, active Plus entitlement, and ordinary Hues Within account records from active cloud systems. A minimal, server-only App Store purchase ledger remains without the deleted Hues Within account identifier so the same Apple purchase can be restored and duplicate or conflicting claims can be prevented; a separate notification replay log prevents the same App Store notification from being applied twice. If Apple sign-in revocation initially fails, its credential remains in a restricted, manually processed retry queue until revocation succeeds or the first later retry run after it reaches 14 days. Information that must temporarily remain in provider backups or for security, legal compliance, fraud prevention, or dispute resolution is blocked from ordinary use and deleted when the applicable retention or limitation period ends. Apple may retain its independent purchase records under its own terms. See Data deletion for operational steps and the exact fields retained.
8. ARCO rights
ARCO means access to your personal data; rectification of inaccurate or incomplete data; cancellation when deletion or blocking is appropriate; and opposition to a particular use. You may also ask to withdraw consent or limit use or disclosure.
Email hello@hueswithinapp.com with the subject “ARCO privacy request.” Include your name; a method for receiving notices; the account email, if any; the right or action requested; a clear description of the affected data; and any information that helps locate it. For rectification, identify the correction and include appropriate supporting information. For access, state your preferred electronic format. If a representative acts for you, Hues Within will request proportionate proof of both identities and authority.
Hues Within will first try to verify identity through the signed-in account, account email, one-time code, or another proportionate method. Do not send journal entries, medication details, passwords, or unnecessary identity documents. Hues Within will acknowledge the request date and may ask for missing information. It will answer even if it holds no responsive data.
Hues Within will communicate its determination within 20 days after receiving a complete request. If granted, it will implement the decision within the following 15 days. When justified and legally permitted, either period may be extended once for an equal period, with a timely explanation. Exercise is free except for reproduction or delivery costs permitted by law. A denial will be reasoned and communicated through the applicable channel.
9. Withdrawing consent or limiting use
You may withdraw consent for future sensitive-data processing through the consent control in the app’s Settings or by emailing the Privacy Lead. Withdrawal is free and will be authenticated proportionately. It does not make earlier lawful processing unlawful and is not automatically a deletion request. Because sensitive records power Hues Within’s core tracking features, those features may become unavailable after withdrawal. Separate device-erasure, account-deletion, and ARCO cancellation options remain available.
10. Security and incidents
Hues Within uses measures appropriate to the sensitivity of the information, including encrypted network transport, restricted database access, row-level security, and device-secured authentication storage. If Hues Within confirms a security incident that significantly affects patrimonial or moral rights, it will notify affected people without delay as Mexican law requires, describing the incident, affected information, protective recommendations, corrective actions, and a contact channel.
11. Changes to this notice
Changes will appear at this canonical URL with a new version or date. Material changes may also be communicated through an in-app notice, account email, or comparable direct channel before they take effect. New sensitive categories, consent-required purposes, or consent-required transfers will be presented for any renewed consent required by law.
12. Questions and recourse
Contact the Privacy Lead at hello@hueswithinapp.com. If Hues Within does not respond within the applicable period, or if you disagree with the response, you may seek the data-protection remedy available through Mexico’s Secretaría Anticorrupción y Buen Gobierno. The applicable filing period is generally 15 days after Hues Within communicates its response, or after its response period expires when no response is received.