Osmo Privacy Policy

1. Introduction

Stateframe Technologies, Inc. (“Stateframe,” “we,” “us,” or “our”) operates Osmo, an emotional performance platform for athletes (“Osmo” or the “Services”).

This Privacy Policy describes how Stateframe collects, uses, discloses, retains, and protects information in connection with Osmo and describes the choices and rights that may be available to you.

Osmo may integrate with third-party products and services, including WHOOP, when you choose to connect those services to your Osmo account. Stateframe is an independent company and is not affiliated with or endorsed by WHOOP, Inc.

Osmo is designed to complement wearable performance platforms by providing an emotional-performance methodology, personalized context, and exercises informed by information you choose to make available to Osmo.

2. Eligibility

The Services are intended only for individuals who are at least 18 years of age.

By creating an Osmo account, you represent that you are at least 18 years old.

The Services are not directed to children under 18, and Stateframe does not knowingly collect personal information from individuals under 18. If we learn that an individual under 18 has provided personal information through the Services, we may take reasonable steps to delete the information and terminate the associated account, subject to applicable law.

3. Information We Collect

The information Stateframe collects depends on how you use Osmo, the features you enable, the third-party services you connect, and, where applicable, your relationship with an athletic program or institution.

A. Account and Profile Information

We may collect account and profile information, including, without limitation:

• Name
• Email address
• Account identifiers
• Authentication information
• Sport
• Team or institutional affiliation
• Time zone
• Display name
• Onboarding and account status
• Other profile information you choose to provide

B. Information Received From WHOOP

Connecting a WHOOP account to Osmo is optional.

If you choose to connect WHOOP and authorize Stateframe to access your WHOOP information, we may receive information made available through the permissions you grant, which may include:

• Heart rate variability
• Resting heart rate
• Recovery information
• Sleep duration and sleep-performance information
• Sleep-stage information
• Physiological cycle information
• Day strain
• Average heart rate associated with a physiological cycle
• Cycle timing and related metadata
• WHOOP profile information, including name and email address
• Identifiers and technical information required to associate your WHOOP account with your Osmo account
• Authorization and connection information required to maintain the integration

Stateframe does not independently measure WHOOP biometric information. That information originates from WHOOP and is made available to Stateframe pursuant to the authorization you provide.

Osmo evaluates HRV in relation to the individual athlete's own historical information and baseline. Osmo does not use cross-athlete HRV comparisons to determine an athlete's personal state or recommendation.

C. Information You Provide Directly to Osmo

We may collect information that you submit or generate through your use of Osmo, including, without limitation:

• PANAS check-in responses
• Emotional-state information
• Optional notes
• Emotional-context selections
• Journal entries
• Written or voice-based reflections
• Exercise responses
• Module and exercise completion information
• Pre-exercise and post-exercise state information
• Feedback
• Survey responses
• Perceived-usefulness responses
• Other information you voluntarily submit through the Services

Certain information is intended to remain private to the athlete, as described in Section 7 below.

D. Usage, Device, and Technical Information

When you use Osmo, we may automatically collect certain technical, operational, and usage information, including, without limitation:

• Application interactions and feature usage
• Authentication and session information
• Push-notification tokens
• Device and application information
• Error and diagnostic information
• Security and audit information
• Service performance information
• Analytics events

We seek to limit the inclusion of sensitive biometric and personal information in diagnostic, monitoring, and analytics systems.

E. Information From Institutions and Other Sources

Where Osmo is provided through an athletic department, university, team, or other organization, we may receive limited information from that organization as reasonably necessary to provision, administer, or support the Services.

Such information may include, without limitation, an athlete's name, institutional affiliation, team, sport, account eligibility, or other administrative information.

Institutional purchase of or access to Osmo does not independently authorize an institution, coach, or staff member to access an athlete's raw WHOOP biometric information.

4. Sources of Information

We may collect information:

• Directly from you
• From WHOOP and other services you affirmatively choose to connect to Osmo
• From an athletic department, university, team, or other organization through which your Osmo account is provided
• Automatically through your use of the Services
• From service providers acting on our behalf
• From other sources where permitted by applicable law and consistent with this Privacy Policy

5. How We Use Information

Stateframe may use personal information, as applicable, for purposes including:

• Creating, maintaining, authenticating, and administering Osmo accounts
• Providing, operating, maintaining, and supporting the Services
• Connecting and synchronizing third-party services that you authorize
• Generating daily briefings, readiness labels, recommendations, and other Osmo-derived information
• Personalizing exercises and emotional-performance experiences
• Evaluating information against your own historical patterns and baselines
• Displaying trends, activity, progress, and other information to you
• Recording check-ins, exercises, reflections, streaks, surveys, and other Osmo activity
• Sending service-related communications and notifications
• Responding to support requests
• Maintaining and improving the functionality, reliability, accessibility, and user experience of Osmo
• Conducting internal analytics, testing, research, and product development
• Detecting, investigating, preventing, and addressing fraud, abuse, security incidents, technical problems, and violations of our terms
• Protecting the rights, property, safety, and security of Stateframe, our users, and others
• Complying with contractual obligations and applicable law
• Establishing, exercising, or defending legal claims

Where required by applicable law, Stateframe will obtain additional consent before collecting or using sensitive information for a materially different purpose.

Stateframe does not sell, license, rent, or trade WHOOP data as a standalone product.

Stateframe's business model is based on access to Osmo's software, methodology, personalization, interpretation, and intervention layer, rather than the commercialization of raw WHOOP biometric information.

6. How We Disclose Information

Stateframe may disclose personal information in the circumstances described below.

A. Service Providers and Processors

We may disclose information to third-party service providers, contractors, processors, and other vendors that perform services for or on behalf of Stateframe.

These providers may include, without limitation, providers of:

• Cloud infrastructure and application hosting
• Database infrastructure
• Authentication and account-management services
• Data storage
• Security services
• Error monitoring and application-performance monitoring
• Push-notification infrastructure
• Communications infrastructure
• Analytics and product-performance tools
• Customer support tools
• Software development and technical infrastructure
• Professional, accounting, insurance, compliance, and legal services
• Other operational services reasonably necessary to operate, protect, support, or improve Osmo

Such providers may access information only to the extent reasonably necessary to perform services for Stateframe and subject to applicable contractual, confidentiality, security, and legal obligations.

The categories of providers Stateframe uses may change as the Services evolve.

B. Coaches and Athletic Department Personnel

Where an athlete has enabled or otherwise authorized applicable sharing functionality, Stateframe may make limited Osmo-derived information available to authorized coaches or athletic department personnel as described in Section 7.

Raw WHOOP biometric values are not provided through the Osmo coach-facing experience.

C. Legal, Compliance, and Safety Purposes

We may disclose information where we reasonably believe disclosure is necessary or appropriate to:

• Comply with applicable law, regulation, subpoena, court order, governmental request, or other legal process
• Protect or enforce our rights, agreements, or policies
• Detect, investigate, prevent, or address fraud, security incidents, abuse, or unlawful activity
• Protect the rights, property, health, or safety of Stateframe, our users, or others
• Establish, exercise, or defend legal claims

D. Corporate Transactions

We may disclose or transfer information in connection with an actual or proposed financing, merger, acquisition, consolidation, reorganization, sale of assets, investment transaction, bankruptcy, insolvency, due diligence process, or other corporate transaction involving all or part of Stateframe or its business.

Any successor that receives personal information will be required to honor the commitments in this Privacy Policy with respect to previously collected information, or provide affected users with notice and an opportunity to delete their information before materially different practices apply. Where reasonably practicable, we will notify users before personal information is transferred to a successor.

Any recipient of personal information in connection with such a transaction will be subject to applicable legal obligations relating to that information.

E. At Your Direction or With Your Consent

We may disclose information to another person or entity when you direct us to do so, affirmatively consent to the disclosure, or use a feature that reasonably requires the disclosure to provide the service you requested.

F. De-Identified and Aggregated Information

To the extent permitted by applicable law and applicable third-party platform terms, Stateframe may create and use information that has been aggregated, de-identified, or otherwise processed so that it cannot reasonably be associated with an identifiable individual.

We may use such information for purposes such as product development, research, analytics, service improvement, benchmarking of Osmo's own methodology, and business planning.

We will not attempt to re-identify information that has been treated as de-identified where applicable law prohibits such re-identification.

7. Athlete Privacy and Coach Access

Athlete Access

Athletes may access information made available to them through Osmo, including supported raw WHOOP values such as HRV, resting heart rate, recovery percentage, and sleep information.

Coach and Athletic Department Access

Osmo is designed so that coaches and athletic department personnel do not receive raw WHOOP biometric values through coach-facing Osmo features.

Subject to the athlete's applicable sharing permissions and the functionality enabled for a particular institution, coach-visible information may include Osmo-derived or Osmo-native information such as:

• Readiness labels, including “Ready to Compete,” “Building Back,” and “Recovery Priority”
• Module or exercise engagement information
• Participation information
• Streak information
• Aggregate or derived emotional-performance information
• Other expressly identified Osmo-generated progress information

Coach-facing access does not include:

• Raw HRV values
• Raw resting heart rate values
• Raw WHOOP recovery percentages
• Raw sleep values
• WHOOP authorization credentials or tokens
• Private journal entries
• Private reflection text
• Raw individual PANAS item responses

Restrictions on coach access to raw biometric information are implemented through technical access controls, including database-level access restrictions, and are not solely dependent on the application's user interface.

8. WHOOP Authorization and Consent

Stateframe does not access WHOOP information through the WHOOP integration until you choose to connect your WHOOP account and complete the applicable authorization process.

The permissions requested by Osmo determine the categories of WHOOP information that Stateframe is technically authorized to access.

You may disconnect your WHOOP account from Osmo. Following disconnection, Stateframe will cease requesting new information through that connection and will take steps to revoke or discontinue the applicable authorization credentials.

Disconnecting WHOOP does not necessarily terminate your Osmo account and may not prevent you from accessing Osmo functionality that does not require WHOOP information.

The treatment of WHOOP information previously received by Stateframe following disconnection is subject to applicable law, the permissions you have provided, Stateframe's applicable retention practices, and the terms governing Stateframe's use of the WHOOP APIs.

9. Automated Personalization and Derived Information

Osmo uses software-based rules, algorithms, and other computational methods to analyze information and generate personalized recommendations, readiness labels, summaries, trends, and other derived information.

These outputs are intended to support emotional performance, self-awareness, and athlete decision-making.

Osmo-derived information is not intended to constitute a medical diagnosis, medical treatment recommendation, or clinical assessment.

Stateframe may use information within Osmo to operate, evaluate, test, secure, and improve personalized product functionality, subject to this Privacy Policy and applicable law.

Stateframe does not sell WHOOP data or authorize third parties to commercially exploit WHOOP data as a standalone data product.

10. Data Retention

Stateframe retains personal information for periods reasonably necessary to provide and maintain the Services and fulfill the purposes described in this Privacy Policy, taking into account factors including:

• The nature and sensitivity of the information
• The duration of your relationship with Stateframe
• Whether the information is required to provide an active feature or service
• Applicable user permissions and consent
• Contractual requirements
• Security and fraud-prevention needs
• Legal, regulatory, tax, accounting, or reporting obligations
• Applicable third-party platform requirements

Retention periods may differ by category of information.

Where information is no longer reasonably necessary for an applicable purpose, Stateframe may delete, anonymize, aggregate, or otherwise de-identify it, subject to applicable law and third-party platform requirements.

11. Account Deletion and Eligibility Records

Account deletion

You may delete your Osmo account at any time from the Profile screen in the Osmo app, under the heading Account. You will be asked to confirm twice before anything is deleted.

Deletion runs immediately when you confirm. There is no waiting period, no recovery window, and no setting that marks your account as deleted while quietly keeping your information. Osmo cannot restore an account once it is deleted.

When you confirm, Osmo does the following in order:

• Sends a request to your connected WHOOP account to revoke Osmo's access, so Osmo can no longer receive anything new from it.
• Deletes the recovery and sleep records it stored from that service, and clears the heart rate variability values derived from them out of your daily briefings.
• Deletes your account record. Every table holding your information points at that record with a cascade rule, so this one step also removes your consent records, PANAS check-ins, journal entries, module progress and exercise completions, daily briefings, streak records, milestones, survey responses, emotional context sessions, product usage events, your coach permission links, and the Osmo summaries your coaches see.
• Deletes your login record.

If the revoke request to WHOOP does not succeed, deletion still proceeds and the app tells you plainly that the revocation did not go through.

Deleting your Osmo account does not independently delete information maintained by WHOOP or another third-party service. Requests concerning information maintained directly by a third-party service must be directed to that service.

Some records about the deletion itself sit outside the Osmo database. Osmo's server logs record that an account was deleted, using an internal account identifier rather than your name or email address. If a step of the deletion fails, an error report carrying that internal identifier is sent to Osmo's error monitoring provider. Deleting your account does not remove these operational records, and how long they are kept is governed by the retention settings of the infrastructure and monitoring providers Osmo uses.

Where deletion is required, Stateframe will delete or de-identify applicable information, subject to information that Stateframe is permitted or required to retain for legal, security, fraud prevention, contractual, dispute resolution, or other legitimate purposes permitted by applicable law.

Disconnecting your WHOOP account is a separate action with a different result. Disconnecting stops new data immediately and hides the biometric records Osmo already holds, and those records are deleted 30 days later. If you reconnect within 30 days, your history and your own baseline come back. Account deletion does not use that 30 day window at all. Everything happens at once.

Eligibility records

Osmo accounts are for people 18 and older.

If you tell Osmo you are under 18, your account is deleted and Osmo writes a separate record noting that the email address used is not currently eligible to register. The purpose is narrow. It stops the same address from being used to sign up again right away.

What the record contains: a keyed cryptographic fingerprint of the email address, the reason the record was created, the date it was created, and the date it expires. It does not contain your email address, your name, or any identifier linking it to a deleted account.

How the fingerprint works, in plain terms: the address is run through a one way calculation that uses a secret key held on the Osmo server. The same address always produces the same result, so Osmo can check whether an address being used at signup matches an existing record. The calculation does not run backwards, so an address cannot be read out of a record. This is not the same thing as the record being anonymous. Anyone holding the secret key who already has a specific address in hand can test whether that address matches a record.

Retention: an eligibility record is deleted automatically 365 days after it is created. Osmo also ignores expired records when checking a signup, so an expired record cannot block registration even before it is swept away.

Access: these records live in a table closed to ordinary application access. They are not visible to coaches, to athletic departments, or to other Osmo users.

Because an eligibility record carries no link to your account, deleting your account does not delete it. That is deliberate. The record has to outlive the account in order to work. If you believe a record was created in error, you can contact Osmo using the contact information in this policy.

12. Security

Stateframe maintains administrative, technical, and organizational safeguards designed to protect information against unauthorized access, acquisition, disclosure, alteration, loss, misuse, or destruction.

WHOOP authorization tokens maintained by Stateframe are encrypted at rest using AES-256-GCM.

Stateframe uses encrypted network connections to protect information in transit.

Access to production systems is restricted to authorized personnel and systems based on legitimate operational requirements.

No method of transmission or storage is completely secure. Accordingly, Stateframe cannot guarantee absolute security.

If Stateframe becomes aware of a security incident affecting personal information, Stateframe will investigate and provide notices as required by applicable law.

13. Your Choices and Privacy Rights

Depending on your location and applicable law, you may have certain rights concerning personal information about you.

These rights may include the ability to:

• Request access to personal information
• Request correction of inaccurate personal information
• Request deletion of personal information
• Request a copy of certain personal information
• Withdraw certain consent
• Disconnect a third-party integration
• Revoke certain coach-sharing permissions
• Restrict or object to certain processing where applicable
• Appeal certain privacy-request decisions where applicable

Certain rights may be subject to exceptions or limitations under applicable law.

Stateframe may take reasonable steps to verify your identity before processing a privacy request.

To exercise an applicable privacy right, contact us using the information provided in Section 18.

14. Institutional Use

Osmo may be purchased or made available by an athletic department, university, team, or other organization.

The purchase of Osmo by an institution does not transfer ownership of an athlete's WHOOP account or authorize unrestricted institutional access to the athlete's information.

Depending on the applicable deployment, Stateframe and an institution may enter into additional contractual terms concerning account administration, data protection, confidentiality, security, retention, and other matters.

Nothing in an institutional agreement is intended to permit coaches or athletic department personnel to receive raw WHOOP biometric values through Osmo contrary to the access restrictions described in this Privacy Policy.

15. Health and Performance Information

Osmo is an emotional-performance and wellness product.

Osmo is not intended to provide medical care, medical diagnosis, clinical mental-health treatment, emergency services, or a substitute for care from a qualified healthcare professional.

Biometric information, self-reported information, readiness labels, recommendations, and other Osmo outputs should be understood as performance and wellness information rather than medical diagnoses.

16. Third-Party Services

Osmo may contain integrations with or links to third-party products and services.

Third-party services operate under their own terms and privacy practices. Stateframe is not responsible for the privacy, security, or other practices of a third party with respect to information maintained independently by that third party.

Your use of WHOOP remains subject to the terms, policies, and privacy practices applicable to your relationship with WHOOP.

17. Changes to This Privacy Policy

Stateframe may modify this Privacy Policy from time to time to reflect changes in the Services, our practices, technology, legal requirements, or other circumstances.

When we modify this Privacy Policy, we will update the “Last Updated” date above.

Where required by applicable law, we will provide additional notice or obtain applicable consent before materially different practices apply to information previously collected.

18. Contact Us

For questions about this Privacy Policy, our privacy practices, or your personal information, contact:

Stateframe Technologies, Inc. Operator of Osmo
Privacy & Support: jamari@osmoperformance.com
Mailing Address: 131 Continental Dr Suite 305, Newark, DE 19713