GPC and Do Not Track turn off advertising tracking on that browser
Eight Sleep says its website honors both Global Privacy Control and Do Not Track as requests to opt out of sale or sharing of personal information and targeted advertising. It turns off tracking for those purposes from the first page loaded without further action. Preferences apply to the enabled browser and device; enable them on each one or use the website footer’s “Your Privacy Choices” link.
Supporting quotations
Opt-out preference signals. Our website honors the Global Privacy Control ("GPC") and "Do Not Track" browser signals as requests to opt out of the sale or sharing of personal information and of targeted advertising. When your browser sends either signal, we turn off the cookies and Tracking Technologies used for those purposes on that browser from the first page you load, without requiring any further action from you. The signal applies to the browser and device on which it is enabled, so you will need to enable it on each browser and device you use, or use the "Your Privacy Choices" link in the footer of every page of our website to set your preference directly.
Deidentified data may be used and shared for lawful purposes
Eight Sleep may deidentify or anonymize information, or collect already deidentified information, so it cannot reasonably be used to infer information about or be linked to you. It may use it to improve Services and understand users, share it with third parties, and use it for other purposes consistent with applicable law. This does not include pseudonymized health and sleep data, which retains indirect identifiers.
Supporting quotations
Finally, we may deidentify or anonymize your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you (or we may collect information that has already been deidentified/anonymized), and we may use such deidentified/anonymized information to improve our Services and better understand our users, share such deidentified/anonymized information with third parties, and for any other purpose in accordance with applicable law. Where you separately consent, we may also use your health and sleep data in pseudonymized form (with direct identifiers such as your name and contact information removed, but associated with demographic information and general location) to improve our health models and develop new features. Pseudonymized data retains certain indirect identifiers and is not considered deidentified information under this section.
Sharing & Disclosure · User right or choice
Linking Pod accounts makes sleep and health data visible to both users
A person sharing a Pod can invite another user to link accounts so each controls their own side and tracks their sleep. Both users can then see each other’s sleep score, stages, duration and consistency; heart rate, heart-rate variability and respiratory rate; temperature preferences and adjustments; and leaderboard or comparative sleep performance. Sending or accepting the invitation consents to mutual sharing, separately from consent to Eight Sleep’s own collection and use. You can revoke linked access in app settings.
Supporting quotations
If you share your Pod with another person, you may invite them to link their Eight Sleep account to your Pod so that each user can independently control their side of the bed and track their own sleep data. When accounts are linked, both users will be able to view each other's sleep and health data within the App, including:
Sleep metrics, such as sleep score, sleep stages, time asleep, and sleep consistency;
Biometric data, such as heart rate, heart rate variability, and respiratory rate;
Temperature preferences and adjustments; and
Leaderboard and comparative features, such as the Sleep Fitness leaderboard, which displays linked users' sleep performance data.
By sending or accepting a partner invitation, you consent to this mutual sharing of sleep and health data with the linked user. This consent is separate from, and in addition to, your consent to Eight Sleep's collection and use of your data as described elsewhere in this Privacy Notice.
Linked account users: If you link your account with another Eight Sleep user as described in Section 2 above, we will disclose your sleep and health data (including sleep metrics, biometric data, temperature preferences, and leaderboard performance) to that linked user through the App. This disclosure is made at your direction when you send or accept a partner invitation. You may revoke this disclosure at any time by unlinking the account through the App settings.
Sharing & Disclosure · User right or choice
Unlinking ends access to both new and previously recorded linked data
You can unlink your account at any time in app settings. Eight Sleep says the other user will no longer be able to view any of your sleep and health data, including data recorded while the accounts were linked. This describes access within the app, not deletion of copies someone may already have made.
Supporting quotations
You may unlink your account at any time through the App settings (see our Help Center for instructions). Unlinking will revoke the other user's ongoing access to your sleep and health data going forward. Once unlinked, the other user will no longer be able to view any of your sleep and health data, including data recorded during the linked period.
Corporate-group disclosure supports service delivery
Subject to this notice, Eight Sleep may disclose information to affiliates or others in its corporate group for its legitimate interests in efficiently providing Services.
Supporting quotations
We may disclose your information for legitimate purposes subject to this Privacy Notice, including the following categories of third parties:
Our affiliates or others within our corporate group, as a matter of our legitimate interests to efficiently provide the Services.
Sharing & Disclosure · Company practice
Service providers may receive health metrics for personalized communications
Eight Sleep may disclose information to vendors supporting administration, storage, security, customer relationships, marketing communications, personalized emails, analytics and payment functions. Email personalization may include sleep scores, heart rate and heart-rate variability to deliver personalized reports and communications. It cites legitimate interests in reliable and safe service operation and consent where applicable. This is distinct from disclosure for third parties’ own direct marketing, which requires affirmative opt-in.
Supporting quotations
Vendors or other service providers who help us provide the Services, including for system administration, cloud storage, security, customer relationship management, marketing communications and email personalization (which may include health and wellness metrics such as sleep scores, heart rate, and heart rate variability to deliver personalized reports and communications to you), web analytics, payment networks, and payment processing, in our legitimate interests to ensure the reliable and safe operation of the Services and, where applicable, with your consent.
We do not disclose your personal information to third parties for the third parties' direct marketing purposes, unless you have affirmatively opted in to such sharing.
Sharing & Disclosure · Company practice
Your requested integrations can disclose information to third parties
Eight Sleep may disclose information to third parties you request or direct, including through social widgets or integrations such as Apple Health, Google Health Connect and HealthEx, with consent or to perform its contract with you.
Supporting quotations
Third parties to whom you request or direct us to disclose information, such as through your use of social media widgets or connecting with third party applications or integrations such as Apple Health, Google Health Connect, and HealthEx with your consent or to perform our contract with you.
Sharing & Disclosure · Company practice
Professional advisers may receive information for rights and compliance work
Auditors, law firms and accountants may receive information for Eight Sleep’s legitimate interests in assessing, protecting, enforcing and defending rights and meeting legal or regulatory obligations.
Supporting quotations
Professional advisors, such as auditors, law firms, or accounting firms, as a matter of our legitimate interests to assess, protect, enforce and defend our rights and to comply with our legal and regulatory obligations.
Sharing & Disclosure · Company practice
Business transactions may involve disclosure before a deal closes
Eight Sleep may disclose information to third parties in connection with, or in anticipation of, an asset sale, merger, bankruptcy or other business transaction, for its legitimate interests in running a successful and efficient business.
Supporting quotations
Third parties in connection with or in anticipation of an asset sale, merger, bankruptcy, or other business transaction, as a matter of our legitimate interests to run a successful and efficient business.
Sharing & Disclosure · Company practice
Legal compliance, enforcement and safety can prompt disclosure
Eight Sleep may disclose information as needed to comply with law and legal obligations, or for legitimate interests in cooperating with law enforcement, judicial orders and regulatory inquiries, enforcing terms, and protecting the safety and security of its business, employees and users. This is not stated as limited only to court-ordered disclosure.
Supporting quotations
We may also disclose your information as needed to comply with applicable law or any obligations thereunder or in our legitimate interests to cooperate with law enforcement, judicial orders, and regulatory inquiries, to enforce any applicable terms of service, and to ensure the safety and security of our business, employees, and users.
Sharing & Disclosure · Company commitment
Third parties’ own direct marketing requires affirmative opt-in
Eight Sleep says it does not disclose personal information for third parties’ direct marketing unless you affirmatively opt in. This promise concerns that purpose; the notice separately permits tracking for interest-based advertising and says its website honors GPC and Do Not Track to turn off sale, sharing and targeted-advertising tracking on the enabled browser.
Supporting quotations
We do not disclose your personal information to third parties for the third parties' direct marketing purposes, unless you have affirmatively opted in to such sharing.
We and third parties may also use cookies, pixels, or other tracking technologies ("Tracking Technologies") on the Website and your App to automatically collect certain information about your interactions with the Services. This information is collected and used either with your consent (where consent is required by applicable law) to personalize the Services for you, and to target, deliver and measure interest-based advertising, or because it is in our legitimate interests to tailor your experience with the Services, provide you with offers or promotions, run analytics, better understand user interactions with the Services. Such information includes:
Opt-out preference signals. Our website honors the Global Privacy Control ("GPC") and "Do Not Track" browser signals as requests to opt out of the sale or sharing of personal information and of targeted advertising. When your browser sends either signal, we turn off the cookies and Tracking Technologies used for those purposes on that browser from the first page you load, without requiring any further action from you. The signal applies to the browser and device on which it is enabled, so you will need to enable it on each browser and device you use, or use the "Your Privacy Choices" link in the footer of every page of our website to set your preference directly.
Cross-references
contrast (model-proposed): The US supplement reports sales and sharing for ads and analytics — contrast: The notice requires affirmative opt-in for third parties’ own direct marketing but separately reports sales and sharing for marketing, advertising and analytics. Those statements concern different purposes and legal labels; neither is a blanket no-sharing promise.
Sharing & Disclosure · Company practice
Social interactions can expose information to platforms and the public
Social Features, such as liking or sharing Eight Sleep content on third-party platforms, may let those third parties collect or use information. What you post or make accessible may be publicly displayed, and both Eight Sleep and the third party may access information about you and your use of both services. Public or semi-public posts may be visible to others without limits on their use.
Supporting quotations
Certain features of the Services allow you to initiate interactions between the Services and third-party services or platforms, such as social networks ("Social Features"). Social Features may include features that allow you to access our pages on third-party platforms, and from there to "like" or "share" our content. Use of Social Features may allow a third party to collect and/or use your information. If you use Social Features, information you post or make accessible may be publicly displayed by the third-party service. Both we and the third party may have access to information about you and your use of both the Services and the third-party service. For more information, see the section below, Third-Party Websites and Links.
We may provide links to third-party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.
Sharing & Disclosure · Company practice
Information may be processed abroad under specified transfer safeguards
Information may be stored or processed outside your home country. For personal information subject to European or UK privacy law and transferred outside the EEA or UK, such as to the US, Eight Sleep says it uses relevant EU standard contractual clauses—module one for controller-to-controller or module two for controller-to-processor transfers—and/or the relevant UK addendum, unless the destination has an applicable adequacy determination. Section 11 contacts, including privacy@eightsleep.com, can provide more information.
Supporting quotations
The information we collect from you may be stored and processed in countries outside the country in which you live. We transfer personal information, subject to European and UK privacy laws (e.g., the GDPR), to countries outside the EEA and/or UK, such as the United States, subject to the European Commission's standard contractual clauses for the transfer of personal data to third countries; specifically, module one (controller to controller transfer) and/or module two (controller to processor transfer), as relevant, or the UK Information Commissioner's international data transfer addendum to the EU standard contractual clauses, as relevant, unless the data transfer is to a country that has been determined by the European Commission and/or the relevant UK authorities, as applicable, to provide an adequate level of protection for individuals' rights and freedoms for their personal data. Please contact us using the details set out in Section 11 should you like further information on this.
Should you have any questions about our privacy practices or this Privacy Notice, please contact us at privacy@eightsleep.com. If you are a resident of the EU, UK, or Switzerland, you may contact our local representative, through the details set out below.
Sharing & Disclosure · User right or choice
Privacy Choices and GPC provide sale, sharing and ad opt-outs
Depending on location, circumstances and applicable legal limits, you may direct Eight Sleep not to sell or share personal information as defined by law or process it for targeted advertising. To exercise this, use “Your Privacy Choices” in any website page footer and switch off “Sale of Personal Data,” or enable GPC, which the company says it honors automatically.
Supporting quotations
Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and these rights may be limited by law.
Right to Opt Out of Sale, Sharing, or Targeted Advertising: You may have a right to direct us not to "sell" or "share" your personal information (as those terms are defined in applicable laws) or process your personal information for targeted advertising. To exercise this right, click the "Your Privacy Choices" link in the footer of any page of our website and switch off the toggle next to "Sale of Personal Data" in the preferences panel that opens, or enable the Global Privacy Control signal in your browser, which we honor automatically. For information on how we process opt-out preference signals, see Opt-out preference signals under Information Collected Automatically above.
The US table lists recipients of identifiers and customer-record information
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table lists identifiers such as name, email and IP address as collected and disclosed to vendors, service providers and login-integration partners, and at your direction to third-party apps or integrations. Customer-record information such as name, address and phone number is listed with vendors and service providers.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Identifiers such as name, e-mail address and IP address Vendors and service providers, login integration partners, at your direction to third party applications or integrations
Personal information categories listed in the California Customer Records statute such as name, address and telephone number Vendors and service providers
Sharing & Disclosure · Company practice
The US table lists marketing partners for commercial and activity data
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table lists commercial information such as purchase history with vendors, service providers and marketing partners. Network activity, such as interaction with Services, additionally lists login-integration partners. These are the table’s business-purpose disclosures.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Commercial information such as purchase history Vendors and service providers, marketing partners
Internet or other similar network activity such as information regarding your interaction with the Services Vendors and service providers, marketing partners, login integration partners
Sharing & Disclosure · Company practice
Account access credentials are marked sensitive in the US table
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table lists account login information as sensitive information collected and disclosed for business purposes to vendors, service providers and login-integration partners.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Account access credentials* such as account log-in information for the Services Vendors and service providers, login integration partners
Sharing & Disclosure · Company practice
The US table lists recipients for protected-characteristic information
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table lists characteristics such as sex, including gender and pregnancy, and age as collected and disclosed for business purposes to vendors and service providers and, at your direction, third-party apps or integrations.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Characteristics of protected classifications under California or federal law such as sex (including gender and pregnancy) and age Vendors and service providers, at your direction to third party applications or integrations
Sharing & Disclosure · Company practice
The US health row lists communication providers and linked users
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table marks health information sensitive and mentions third-party health-record connectivity platforms such as HealthEx at your direction. Its recipient column lists vendors and service providers for personalized communications, such as sleep reports, and linked users at your direction. The partner-sharing rule specifies sleep and health metrics, biometrics, temperature preferences and leaderboard performance, disclosed when you send or accept an invitation; you can revoke that access by unlinking. The table alone does not say all clinical records are shared with a partner.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Personal information concerning an individual's health*, third-party health record connectivity platforms (e.g., HealthEx) at your direction Vendors and service providers (for personalized communications such as period sleep reports), linked account users, at your direction
Linked account users: If you link your account with another Eight Sleep user as described in Section 2 above, we will disclose your sleep and health data (including sleep metrics, biometric data, temperature preferences, and leaderboard performance) to that linked user through the App. This disclosure is made at your direction when you send or accept a partner invitation. You may revoke this disclosure at any time by unlinking the account through the App settings.
Sharing & Disclosure · Company practice
The US supplement reports sales and sharing for ads and analytics
For California residents and residents of other US states with similar privacy laws requiring these disclosures, Eight Sleep says it sells and shares certain personal information and did so during the preceding 12 months for marketing, advertising and analytics. The table lists identifiers such as name, email and IP address with tracking technologies and advertising partners. It also lists purchase-history information and website/network activity, but does not name recipient categories in those two rows. It says it has no actual knowledge of selling or sharing information of people under 16. Applicable opt-outs are available through the website’s Privacy Choices control or GPC; the website also honors Do Not Track on the enabled browser.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
We do not have actual knowledge that we "sell" or "share" (as those terms are defined under applicable law) personal information of individuals under 16 years of age. However, we do sell and share certain categories of personal information and, in the preceding 12 months, we have sold and shared the following categories of personal information about individuals for marketing, advertising, and analytics purposes:
Category of Information Categories of Recipients
Identifiers such as name, e-mail address and IP address Tracking technologies and advertising partners
Commercial information such as purchase history
Internet or other similar network activity such as information regarding your interaction with the Website
Right to Opt Out of Sale, Sharing, or Targeted Advertising: You may have a right to direct us not to "sell" or "share" your personal information (as those terms are defined in applicable laws) or process your personal information for targeted advertising. To exercise this right, click the "Your Privacy Choices" link in the footer of any page of our website and switch off the toggle next to "Sale of Personal Data" in the preferences panel that opens, or enable the Global Privacy Control signal in your browser, which we honor automatically. For information on how we process opt-out preference signals, see Opt-out preference signals under Information Collected Automatically above.
Opt-out preference signals. Our website honors the Global Privacy Control ("GPC") and "Do Not Track" browser signals as requests to opt out of the sale or sharing of personal information and of targeted advertising. When your browser sends either signal, we turn off the cookies and Tracking Technologies used for those purposes on that browser from the first page you load, without requiring any further action from you. The signal applies to the browser and device on which it is enabled, so you will need to enable it on each browser and device you use, or use the "Your Privacy Choices" link in the footer of every page of our website to set your preference directly.
Not stated here
Recipient categories are not supplied in the commercial-information and network-activity rows; the identifiers row cannot establish their recipients.