Privacy Policy
Your sleep data, prescription, and personal information deserve the same care we put into your therapy. Here's exactly what we collect, why, and how we keep it safe.
Encrypted End-to-End
256-bit TLS in transit and AES-256 at rest, on HIPAA-eligible infrastructure.
No Data Selling — Ever
We will never sell, rent, or trade your personal or health information.
You Own Your Data
Access, export, correct, or delete your information at any time.
Plain-English Policy
No dark patterns, no legalese tricks — just clear answers to clear questions.
Introduction
Harmony CPAP (“Harmony,” “we,” “us,” or “our”) is committed to protecting the privacy of every person who uses our website, mobile app, or services. We are a licensed durable medical equipment (DME) supplier and a HIPAA-covered entity, which means we operate under some of the strictest data-protection requirements in the country.
This Privacy Policy explains what information we collect, how we use and safeguard it, and the choices you have. It applies to harmonyhcs.com, the Harmony mobile app, and any related services (collectively, the “Services”). By using the Services, you agree to the practices described here.
Information We Collect
Information You Provide
When you create an account, place an order, or contact us, you may give us:
- Name, email, phone, billing & shipping address
- Date of birth (required for insurance and prescription verification)
- Payment information (processed by PCI-DSS-compliant providers — we never store full card numbers)
- Insurance member ID, group number, and policy details
- CPAP prescription, sleep study results, and physician contact information
Health & Therapy Information
If you opt in to therapy tracking or our coaching program, we may also collect:
- Nightly CPAP usage hours, leak rates, and AHI scores
- Mask fit, comfort, and pressure preferences
- Self-reported sleep quality and therapy notes
Information Collected Automatically
When you use the Services, we automatically receive:
- Device type, operating system, browser, and language
- IP address and approximate geolocation (city-level)
- Pages visited, time spent, referring URL, and clickstream
- Cookie identifiers (see Cookies & Tracking below)
Information From Third Parties
We may receive information from your physician's office (prescriptions and sleep studies), your insurance carrier (eligibility, prior authorization, claim status), or services you connect — such as ResMed myAir or Philips DreamMapper — if you authorize the link.
How We Use Your Data
We only use your information for purposes you'd reasonably expect from a healthcare-focused company. Specifically:
We never use your health data for advertising. Marketing audiences are built only from non-health information like product interests and purchase categories.
HIPAA & Protected Health Information
Information that combines your identity with your health status — prescriptions, sleep studies, therapy data, insurance claims — is Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
As a HIPAA-covered entity, we maintain administrative, physical, and technical safeguards to protect PHI. All Harmony employees complete annual HIPAA training, and access to PHI is restricted on a least-privilege basis. We sign Business Associate Agreements (BAAs) with every vendor that touches PHI.
For a full description of how we may use and disclose your PHI, please review our ask us for our Notice of Privacy Practices, which is provided to every patient at the start of service.
Data Security
We use industry-leading safeguards to protect your information from unauthorized access, alteration, disclosure, or destruction.
No system is 100% secure, but we treat your data as if it were our own family's. If a breach ever affects you, we will notify you in accordance with HIPAA and applicable state laws.
Your Rights & Choices
Access
Request a copy of the personal information we hold about you.
Correction
Update or fix inaccurate information at any time.
Deletion
Request that we delete your data, subject to legal retention rules for medical records.
Portability
Export your data in a machine-readable format (JSON or CSV).
Opt-Out
Unsubscribe from marketing emails, SMS, or targeted advertising.
Non-Discrimination
Exercise any right above without losing access to our Services.
Email privacy@harmonyhcs.com or use the data-request form in your account settings. We respond within 45 days (and may extend once by another 45 days when reasonably necessary, with notice).
State Privacy Rights
Depending on where you live, you may have additional rights under state privacy laws including the California Consumer Privacy Act (CCPA/CPRA), Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and others. These typically include the rights to know, delete, correct, and opt out of the sale or sharing of personal information.
California residents can submit a “Do Not Sell or Share My Personal Information” request at any time. We do not sell personal information for money and do not share it for cross-context behavioral advertising involving health data.
You may also designate an authorized agent to make a request on your behalf. We will require reasonable verification before disclosing information.
Data Retention
We keep your information only as long as needed to provide the Services and meet our legal and regulatory obligations.
Children's Privacy
Our Services are intended for adults 18 and older. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected information from a child under 13, we will delete it promptly. Parents or guardians who believe their child has provided us with information can contact privacy@harmonyhcs.com.
Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or the law. When we make a material change, we'll update the “Effective Date” above and notify registered users by email at least 30 days before the change takes effect.
Earlier versions of this policy are available on request. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.
Contact Us
Have a question about this policy, or want to exercise a privacy right? Reach our Privacy Office anytime:
34 E Huntington Dr
Arcadia, CA 91006
Manage your privacy preferences anytime.
Update communication preferences, download your data, or close your account directly from your dashboard — no support ticket required.