The notice covers the website, app, devices and other interactions
This August 25, 2026 notice describes how Eight Sleep, Inc. collects, uses and discloses information when you use its website, app, Pod, other devices or other services, tools and features, or otherwise interact with it. Here, “you” means the user of those Services.
Supporting quotations
Last Updated: August 25, 2026
This Privacy Notice describes how Eight Sleep, Inc. ("Eight Sleep", "we", "us", "our") collects, uses and discloses information about you when you use our website (https://www.eightsleep.com/) (the "Website"), mobile application (the "App"), the Pod, another Eight Sleep device, or any other services, tools and features offered by us, or when you otherwise interact with us (collectively, the "Services"). For the purposes of this Privacy Notice, "you" and "your" means you as the user of the Services.
Legal Rights & Agreement Rules · Context
Eight Sleep is the data controller
Eight Sleep identifies itself as the data controller. Prighter Group represents it in the EEA, UK and Switzerland; residents there can use the linked Prighter portal to make a request. Section 11 provides representative contact details.
Supporting quotations
For purposes of data protection laws, we are the data controller. Our representative in the European Economic Area, UK and Switzerland is the Prighter Group, whose contact details are set out in Section 11 below. If you are an EEA, UK or Swiss resident, you may also make a request here.
Legal Rights & Agreement Rules · Context
Using the Services signifies agreement to the notice
The notice says using any Services means agreeing to the collection, use and disclosure it describes. It asks people who do not understand or agree to it not to use or access the Services.
Supporting quotations
Please read this Privacy Notice carefully. By using any of the Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Notice. If you do not understand or agree to this Privacy Notice, please do not use or access the Services.
Legal Rights & Agreement Rules · Company commitment
Material use or disclosure changes trigger reasonable notification efforts
Eight Sleep may change the notice and update its date. For material changes to how it uses or discloses collected information, it promises reasonable notification efforts, such as email or a notice on the Services, plus steps required by law. It asks users who disagree with updates to stop using or accessing the Services.
Supporting quotations
We may modify this Privacy Notice from time to time, in which case we will update the "Last Updated" date at the top of this Privacy Notice. If we make material changes to how we use or disclose information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on the Services or by other means consistent with applicable law) and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Notice, please do not continue using or accessing the Services.
Use & Processing · Company practice
Collected information supports services, research and business protection
In addition to the specific uses listed in the notice, Eight Sleep may use information to provide and improve its Services, conduct research and development, and maintain its business relationship. It cites legitimate interests including service security, support, legal compliance, enforcing terms and protecting its own and others’ rights. Specific consent requirements and purpose restrictions elsewhere still apply.
Supporting quotations
When you use or access the Services, we collect certain categories of information about you from a variety of sources. In addition to the specific uses discussed below, we may use this information to provide and improve the Services, to conduct research and development and to maintain our business relationship, in our legitimate interests, including to enhance the safety and security of our Services, providing customer support, complying with applicable legal obligations, enforcing any applicable terms of service, and protecting our rights and the rights of our employees, users or other individuals.
Data Access & Collection · Restriction or exception
Declining required information can prevent use of features
Creating an account, setting up devices or enabling their functions may require information directly from you. You can decline, but this may prevent use of the Services or particular features.
Supporting quotations
Some features of the Services, such as creating an account, setting up your device(s), and enabling functionality of your device(s), may require you to directly provide certain information, including information about yourself. You may elect not to provide this information, but as this information is required to enable us to provide you with the Services, choosing not to provide this information may prevent you from using, or accessing features of, the Services.
Information that you directly submit through our Services includes:
Data Access & Collection · Company practice
Contact information supports accounts and communications
Eight Sleep collects details such as name, address, phone and email to create and maintain accounts and deliver Services under its contract, and for its legitimate interest in communicating with you. Promotional communications require consent where required.
Supporting quotations
Basic contact details, such as name, address, phone number, and email. We use this information to create and maintain your account and provide the Services, as required to perform our contract with you, and because it is in our legitimate interest to communicate with you (including, with your consent where required, to tell you about certain promotions, products or services that may be of interest to you). Where you provide the same email address at checkout and during app account creation, we may associate your purchase record with your app account for purposes of service delivery, account setup, and personalization of the Services.
Linking & Identification · Company practice
A matching email can connect your purchase to your app account
If you use the same email at checkout and app registration, Eight Sleep may associate the purchase record with the app account for service delivery, account setup and personalization.
Supporting quotations
Basic contact details, such as name, address, phone number, and email. We use this information to create and maintain your account and provide the Services, as required to perform our contract with you, and because it is in our legitimate interest to communicate with you (including, with your consent where required, to tell you about certain promotions, products or services that may be of interest to you). Where you provide the same email address at checkout and during app account creation, we may associate your purchase record with your app account for purposes of service delivery, account setup, and personalization of the Services.
Security & Safeguards · Procedure
You must safeguard your account credentials
Eight Sleep uses account credentials to provide Services under its contract and to maintain and secure accounts in its legitimate interests. Registered users are responsible for keeping credentials safe; it recommends not sharing access details and asks you to contact it immediately if you suspect compromise.
Supporting quotations
Account information, such as username and password. We use this information to provide the Services, as required to perform our contract with you, and because it is in our legitimate interest to maintain and secure your account with us. If you choose to register an account, you are responsible for keeping your account credentials safe. We recommend you do not share your access details with anyone else. If you believe your account has been compromised, please contact us immediately.
Charges & Financial Obligations · Company practice
A third-party processor collects payment details
Eight Sleep collects payment and transaction information, including card details, billing address and purchase information, using a third-party payment processor. It uses this to process payment and provide the Services under its contract with you.
Supporting quotations
Payment and transaction information, such as credit card information and billing address, which we collect using a third-party payment processor, and information about your purchases. We use this information to process your payment and provide the Services, as required to perform our contract with you.
Data Access & Collection · Company practice
Health information can include app entries and authorized clinical records
Eight Sleep collects health and wellness information you choose to provide in the app and clinical records you authorize it to obtain through platforms such as HealthEx. It uses health information with consent to the extent required by applicable privacy law. For clinical records, it specifically says access is with consent for personalized health insights and a Biological Age score; pseudonymized use for health-model and feature development needs separate consent. US residents are directed to a separate Consumer Health Data Privacy Policy, whose additional terms are not supplied here.
Supporting quotations
Health and wellness information, such as information you choose to provide about your health and wellness when setting up your account in the App, and clinical health data you authorize us to access from your healthcare providers through third-party health record platforms such as HealthEx (as described below under "Information Collected From Other Sources"). We use this information with your consent, to the extent consent is required by applicable privacy law. If you reside in the US, please refer to the Eight Sleep Consumer Health Data Privacy Policy for more information.
Information we receive from third-party health record connectivity platforms, such as HealthEx, including laboratory and diagnostic test results, vital signs, medications, and allergies from your healthcare providers. We access this information with your consent to provide personalized health insights and your Biological Age score within the App. With your separate consent, we may also use this data in pseudonymized form (with your name and contact information removed) to improve our health models and develop new features.
Not stated here
The linked Consumer Health Data Privacy Policy text is not supplied here; this card cannot describe its additional rules.
Use & Processing · Company practice
AI tools use your inputs to generate outputs
Information you enter into Eight Sleep’s AI-powered tools is used to generate new information or content, including personalized insights, customer support and other Services. Eight Sleep says it does not use personal data to train large language models or third-party generative AI systems. Separately consented pseudonymized health and sleep data may improve its health models and new features; that data retains indirect identifiers and is not deidentified.
Supporting quotations
Any information you choose to input into our AI-powered tools ("Input"), which we use to generate and output new information or content ("Output") as a part of the Services, including to personalize insights, assist in our provision of customer support and otherwise provide the Services. We do not use your personal data to train large language models or third-party generative AI systems.
Finally, we may deidentify or anonymize your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you (or we may collect information that has already been deidentified/anonymized), and we may use such deidentified/anonymized information to improve our Services and better understand our users, share such deidentified/anonymized information with third parties, and for any other purpose in accordance with applicable law. Where you separately consent, we may also use your health and sleep data in pseudonymized form (with direct identifiers such as your name and contact information removed, but associated with demographic information and general location) to improve our health models and develop new features. Pseudonymized data retains certain indirect identifiers and is not considered deidentified information under this section.
Inference & Profiling · User right or choice
Autopilot can adjust device settings using sleep and biometric data
Automated processing, including Autopilot and AI features, analyzes sleep and biometric data and adjusts Pod temperature, firmness and other settings to personalize and improve the Services. Eight Sleep says these decisions have no legal or similarly significant effects. You can adjust or disable automated features in app settings at any time. Where law requires, you can seek information about the logic, contest profiling results and request human review.
Supporting quotations
Automated Decision-Making and Profiling. We use automated processing, including through our Autopilot and AI-powered features, to analyze your sleep and biometric data and make automated adjustments to your Pod's temperature, firmness, and other settings. These automated decisions are made to personalize and improve the Services for you and do not produce legal or similarly significant effects. You may adjust or disable automated features at any time through the App settings. Where required by applicable law, you have the right to request information about the logic involved in automated decision-making, to contest the results of profiling, and to request human review of a decision.
Use & Processing · Company practice
Job application details are used to assess candidates
Eight Sleep uses resume, CV and employment-history information to process job applications and evaluate candidacy in its legitimate interests.
Supporting quotations
Applicant details, such as information included in your resume or CV and job history. We use applicant details to process your application for employment and because it is in our legitimate interest to evaluate your candidacy.
Data Access & Collection · Company practice
Messages to Eight Sleep may include other information you choose to supply
Eight Sleep uses information you choose to include in communications, such as messages through the Services, for its legitimate interest in responding to you.
Supporting quotations
Any other information you choose to include in communications with us, for example, when sending a message through the Services, because it is in our legitimate interest to be responsive to you.
Data Access & Collection · Company practice
Devices collect metrics and send recorded data to company servers
The Pod and other Eight Sleep devices automatically collect metrics to provide Services, including personalized sleep statistics, recommendations and app health statistics. The notice cites contract performance and consent to the extent privacy law requires. When a device syncs with the app, recorded data transfers to Eight Sleep’s servers. US residents are directed to a separate Consumer Health Data Privacy Policy for more information; its terms are not supplied in this notice.
Supporting quotations
If you use the Pod or other Eight Sleep device(s), the device(s) will automatically collect a variety of metrics to provide the Services, such as to personalize your sleep statistics and sleep recommendations and to provide health statistics in the App, as required to perform our contract with you and with your consent, to the extent consent is required by applicable privacy law. If you are a US resident, please refer to the Eight Sleep Consumer Health Data Privacy Policy for more information about our processing of certain data collected through the device(s). When your device syncs with your App, data recorded on your device is transferred from your device(s) to our servers.
Not stated here
The linked Consumer Health Data Privacy Policy text is not supplied here; this card cannot describe its additional rules.
Use & Processing · Company practice
Tracking supports personalization, advertising and analytics
Eight Sleep and third parties may use cookies, pixels and other tracking technologies on the website and app to collect interaction information. The notice cites consent where law requires for personalization and targeting, delivering and measuring interest-based ads, or legitimate interests for tailoring experiences, offers, analytics and understanding interactions. The website honors GPC and Do Not Track signals to disable sale, sharing and targeted-advertising tracking on that browser from the first loaded page.
Supporting quotations
We and third parties may also use cookies, pixels, or other tracking technologies ("Tracking Technologies") on the Website and your App to automatically collect certain information about your interactions with the Services. This information is collected and used either with your consent (where consent is required by applicable law) to personalize the Services for you, and to target, deliver and measure interest-based advertising, or because it is in our legitimate interests to tailor your experience with the Services, provide you with offers or promotions, run analytics, better understand user interactions with the Services. Such information includes:
Opt-out preference signals. Our website honors the Global Privacy Control ("GPC") and "Do Not Track" browser signals as requests to opt out of the sale or sharing of personal information and of targeted advertising. When your browser sends either signal, we turn off the cookies and Tracking Technologies used for those purposes on that browser from the first page you load, without requiring any further action from you. The signal applies to the browser and device on which it is enabled, so you will need to enable it on each browser and device you use, or use the "Your Privacy Choices" link in the footer of every page of our website to set your preference directly.
Data Access & Collection · Company practice
Automatic collection includes device and online identifiers
Tracking on the website and app may collect device type, operating system, unique device identifiers, IP address, cookie ID and other online identifiers for the stated personalization, advertising and analytics purposes, with consent where legally required.
Supporting quotations
We and third parties may also use cookies, pixels, or other tracking technologies ("Tracking Technologies") on the Website and your App to automatically collect certain information about your interactions with the Services. This information is collected and used either with your consent (where consent is required by applicable law) to personalize the Services for you, and to target, deliver and measure interest-based advertising, or because it is in our legitimate interests to tailor your experience with the Services, provide you with offers or promotions, run analytics, better understand user interactions with the Services. Such information includes:
Device information and online identifiers, such as device type, operating system, unique device identifier, internet protocol (IP) address, cookie ID and other online identifiers.
Data Access & Collection · Company practice
Location may be approximate or, if you choose, precise
The automatically collected information may include approximate location inferred from IP address and precise geolocation if you choose to provide it. These fall within the notice’s tracking purposes and applicable consent conditions.
Supporting quotations
We and third parties may also use cookies, pixels, or other tracking technologies ("Tracking Technologies") on the Website and your App to automatically collect certain information about your interactions with the Services. This information is collected and used either with your consent (where consent is required by applicable law) to personalize the Services for you, and to target, deliver and measure interest-based advertising, or because it is in our legitimate interests to tailor your experience with the Services, provide you with offers or promotions, run analytics, better understand user interactions with the Services. Such information includes:
Location information, such as approximate location based on IP address and, if you choose to provide it, precise geolocation.
Data Access & Collection · Company practice
Tracked activity can include purchases, scrolling and marketing interactions
Tracking information may include browser and log data, timestamps, scrolling, session statistics, clickstreams, purchase history, ad views and impressions, and interactions with marketing emails and SMS. This collection supports the stated personalization, advertising and analytics uses, with consent where law requires.
Supporting quotations
We and third parties may also use cookies, pixels, or other tracking technologies ("Tracking Technologies") on the Website and your App to automatically collect certain information about your interactions with the Services. This information is collected and used either with your consent (where consent is required by applicable law) to personalize the Services for you, and to target, deliver and measure interest-based advertising, or because it is in our legitimate interests to tailor your experience with the Services, provide you with offers or promotions, run analytics, better understand user interactions with the Services. Such information includes:
Other information regarding your interaction with the Services, such as browser type, log data, date and time stamps, scroll-to-page interactions, session statistics, clickstream data, purchase history and related information, ad views and impressions, and interactions with marketing emails and SMS messages.
Use & Processing · User right or choice
Blocking cookies may affect functionality; industry ad opt-outs also exist
Most browsers accept cookies automatically. You may be able to control, block or delete some cookies, but this may make Services, portal features or general functionality work incorrectly. The notice also links NAI, DAA and EDAA tools to opt out of interest-based collection and use by advertisers participating in those alliances; it does not promise those tools cover all advertisers.
Supporting quotations
Most browsers accept cookies automatically, but you may be able to control the way in which your devices permit the use of cookies. If you so choose, you may block or delete certain of our cookies from your browser; however, blocking or deleting cookies may cause some of the Services, including any portal features and general functionality, to work incorrectly. You may also opt-out of the collection and use of information for interest-based advertising by advertisers that are part of certain industry alliances, including through tools offered by the National Advertising Initiative, the Digital Advertising Alliance or the European Interactive Digital Advertising Alliance, by clicking the links provided.
Sharing & Disclosure · Company commitment
GPC and Do Not Track turn off advertising tracking on that browser
Eight Sleep says its website honors both Global Privacy Control and Do Not Track as requests to opt out of sale or sharing of personal information and targeted advertising. It turns off tracking for those purposes from the first page loaded without further action. Preferences apply to the enabled browser and device; enable them on each one or use the website footer’s “Your Privacy Choices” link.
Supporting quotations
Opt-out preference signals. Our website honors the Global Privacy Control ("GPC") and "Do Not Track" browser signals as requests to opt out of the sale or sharing of personal information and of targeted advertising. When your browser sends either signal, we turn off the cookies and Tracking Technologies used for those purposes on that browser from the first page you load, without requiring any further action from you. The signal applies to the browser and device on which it is enabled, so you will need to enable it on each browser and device you use, or use the "Your Privacy Choices" link in the footer of every page of our website to set your preference directly.
Further cookie information is in a separate policy
The notice directs readers to a linked Cookies Policy for more information about cookie use. That policy’s text is not included here, so this card does not describe its additional details.
Supporting quotations
For more information on how we use cookies, please see our Cookies Policy.
Not stated here
The linked Cookies Policy text is not supplied here; its additional cookie rules cannot be described.
Data Access & Collection · Company practice
Connected health apps provide information with consent
Eight Sleep may obtain information directly from third parties or through sharing you choose. It uses information from apps and accounts such as Apple Health and Google Health Connect with your consent and to perform its Services contract.
Supporting quotations
We may obtain information about you from outside sources, including information that we collect directly from third parties and information from third parties that you choose to share with us. Such information includes:
Information we receive from third-party apps and accounts, such as Apple Health and Google Health Connect, which we use with your consent and in order to perform our contract to provide the Services.
Data Access & Collection · Company practice
Authorized clinical records support health insights and a Biological Age score
With consent, Eight Sleep accesses healthcare-provider records through connectivity platforms such as HealthEx, including lab and diagnostic results, vital signs, medications and allergies. It uses these for personalized app health insights and a Biological Age score. Separate consent permits pseudonymized use to improve health models and develop features. Removing name and contact information does not make pseudonymized data deidentified: it can retain demographics, general location and other indirect identifiers.
Supporting quotations
Information we receive from third-party health record connectivity platforms, such as HealthEx, including laboratory and diagnostic test results, vital signs, medications, and allergies from your healthcare providers. We access this information with your consent to provide personalized health insights and your Biological Age score within the App. With your separate consent, we may also use this data in pseudonymized form (with your name and contact information removed) to improve our health models and develop new features.
Finally, we may deidentify or anonymize your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you (or we may collect information that has already been deidentified/anonymized), and we may use such deidentified/anonymized information to improve our Services and better understand our users, share such deidentified/anonymized information with third parties, and for any other purpose in accordance with applicable law. Where you separately consent, we may also use your health and sleep data in pseudonymized form (with direct identifiers such as your name and contact information removed, but associated with demographic information and general location) to improve our health models and develop new features. Pseudonymized data retains certain indirect identifiers and is not considered deidentified information under this section.
Data Access & Collection · Company practice
External marketing databases help customize advertising
Eight Sleep receives information from consumer marketing databases or other data enrichment companies and uses it for its legitimate interests in customizing advertising and marketing to you.
Supporting quotations
Information we receive from consumer marketing databases or other data enrichment companies, which we use in our legitimate interests to better customize advertising and marketing to you.
Linking & Identification · Company practice
Linking a social account supplies information for account maintenance
If you choose to link a social platform such as Facebook or X, Eight Sleep receives information from it and uses that information for its legitimate interests in maintaining your account and login details.
Supporting quotations
Information we receive when you choose to link any social media platforms to your account, such as Facebook or X, which we use in our legitimate interests to maintain your account and login information.
Legal Rights & Agreement Rules · Restriction or exception
Outside information follows this notice, but third-party accuracy is disclaimed
Eight Sleep says information received from outside sources will be treated under this notice. It disclaims responsibility for third-party information’s accuracy and for third parties’ policies and practices, directing readers to the Third-Party Websites and Links section.
Supporting quotations
Any information we receive from outside sources will be treated in accordance with this Privacy Notice. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party's policies or practices. For more information, see the section below, Third-Party Websites and Links.
Sharing & Disclosure · Company practice
Deidentified data may be used and shared for lawful purposes
Eight Sleep may deidentify or anonymize information, or collect already deidentified information, so it cannot reasonably be used to infer information about or be linked to you. It may use it to improve Services and understand users, share it with third parties, and use it for other purposes consistent with applicable law. This does not include pseudonymized health and sleep data, which retains indirect identifiers.
Supporting quotations
Finally, we may deidentify or anonymize your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you (or we may collect information that has already been deidentified/anonymized), and we may use such deidentified/anonymized information to improve our Services and better understand our users, share such deidentified/anonymized information with third parties, and for any other purpose in accordance with applicable law. Where you separately consent, we may also use your health and sleep data in pseudonymized form (with direct identifiers such as your name and contact information removed, but associated with demographic information and general location) to improve our health models and develop new features. Pseudonymized data retains certain indirect identifiers and is not considered deidentified information under this section.
Use & Processing · Company practice
Health-model development with pseudonymized data requires separate consent
With separate consent, Eight Sleep may use health and sleep data stripped of direct identifiers but associated with demographics and general location to improve health models and develop features. This pseudonymized data retains indirect identifiers and is expressly not deidentified under this section.
Supporting quotations
Finally, we may deidentify or anonymize your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you (or we may collect information that has already been deidentified/anonymized), and we may use such deidentified/anonymized information to improve our Services and better understand our users, share such deidentified/anonymized information with third parties, and for any other purpose in accordance with applicable law. Where you separately consent, we may also use your health and sleep data in pseudonymized form (with direct identifiers such as your name and contact information removed, but associated with demographic information and general location) to improve our health models and develop new features. Pseudonymized data retains certain indirect identifiers and is not considered deidentified information under this section.
Cross-references
qualifies (model-proposed): Deidentified data may be used and shared for lawful purposes — qualifies: The notice explicitly excludes pseudonymized health data from deidentified information because indirect identifiers remain; separate consent governs the health-model use.
contrast (model-proposed): AI tools use your inputs to generate outputs — contrast: Personal data is not used to train large language models or third-party generative AI systems, while separately consented pseudonymized health data may improve health models. The stated model types and consent conditions differ, so this is a scoped tension rather than an established contradiction.
Sharing & Disclosure · User right or choice
Linking Pod accounts makes sleep and health data visible to both users
A person sharing a Pod can invite another user to link accounts so each controls their own side and tracks their sleep. Both users can then see each other’s sleep score, stages, duration and consistency; heart rate, heart-rate variability and respiratory rate; temperature preferences and adjustments; and leaderboard or comparative sleep performance. Sending or accepting the invitation consents to mutual sharing, separately from consent to Eight Sleep’s own collection and use. You can revoke linked access in app settings.
Supporting quotations
If you share your Pod with another person, you may invite them to link their Eight Sleep account to your Pod so that each user can independently control their side of the bed and track their own sleep data. When accounts are linked, both users will be able to view each other's sleep and health data within the App, including:
Sleep metrics, such as sleep score, sleep stages, time asleep, and sleep consistency;
Biometric data, such as heart rate, heart rate variability, and respiratory rate;
Temperature preferences and adjustments; and
Leaderboard and comparative features, such as the Sleep Fitness leaderboard, which displays linked users' sleep performance data.
By sending or accepting a partner invitation, you consent to this mutual sharing of sleep and health data with the linked user. This consent is separate from, and in addition to, your consent to Eight Sleep's collection and use of your data as described elsewhere in this Privacy Notice.
Linked account users: If you link your account with another Eight Sleep user as described in Section 2 above, we will disclose your sleep and health data (including sleep metrics, biometric data, temperature preferences, and leaderboard performance) to that linked user through the App. This disclosure is made at your direction when you send or accept a partner invitation. You may revoke this disclosure at any time by unlinking the account through the App settings.
Sharing & Disclosure · User right or choice
Unlinking ends access to both new and previously recorded linked data
You can unlink your account at any time in app settings. Eight Sleep says the other user will no longer be able to view any of your sleep and health data, including data recorded while the accounts were linked. This describes access within the app, not deletion of copies someone may already have made.
Supporting quotations
You may unlink your account at any time through the App settings (see our Help Center for instructions). Unlinking will revoke the other user's ongoing access to your sleep and health data going forward. Once unlinked, the other user will no longer be able to view any of your sleep and health data, including data recorded during the linked period.
Corporate-group disclosure supports service delivery
Subject to this notice, Eight Sleep may disclose information to affiliates or others in its corporate group for its legitimate interests in efficiently providing Services.
Supporting quotations
We may disclose your information for legitimate purposes subject to this Privacy Notice, including the following categories of third parties:
Our affiliates or others within our corporate group, as a matter of our legitimate interests to efficiently provide the Services.
Sharing & Disclosure · Company practice
Service providers may receive health metrics for personalized communications
Eight Sleep may disclose information to vendors supporting administration, storage, security, customer relationships, marketing communications, personalized emails, analytics and payment functions. Email personalization may include sleep scores, heart rate and heart-rate variability to deliver personalized reports and communications. It cites legitimate interests in reliable and safe service operation and consent where applicable. This is distinct from disclosure for third parties’ own direct marketing, which requires affirmative opt-in.
Supporting quotations
Vendors or other service providers who help us provide the Services, including for system administration, cloud storage, security, customer relationship management, marketing communications and email personalization (which may include health and wellness metrics such as sleep scores, heart rate, and heart rate variability to deliver personalized reports and communications to you), web analytics, payment networks, and payment processing, in our legitimate interests to ensure the reliable and safe operation of the Services and, where applicable, with your consent.
We do not disclose your personal information to third parties for the third parties' direct marketing purposes, unless you have affirmatively opted in to such sharing.
Sharing & Disclosure · Company practice
Your requested integrations can disclose information to third parties
Eight Sleep may disclose information to third parties you request or direct, including through social widgets or integrations such as Apple Health, Google Health Connect and HealthEx, with consent or to perform its contract with you.
Supporting quotations
Third parties to whom you request or direct us to disclose information, such as through your use of social media widgets or connecting with third party applications or integrations such as Apple Health, Google Health Connect, and HealthEx with your consent or to perform our contract with you.
Sharing & Disclosure · Company practice
Professional advisers may receive information for rights and compliance work
Auditors, law firms and accountants may receive information for Eight Sleep’s legitimate interests in assessing, protecting, enforcing and defending rights and meeting legal or regulatory obligations.
Supporting quotations
Professional advisors, such as auditors, law firms, or accounting firms, as a matter of our legitimate interests to assess, protect, enforce and defend our rights and to comply with our legal and regulatory obligations.
Sharing & Disclosure · Company practice
Business transactions may involve disclosure before a deal closes
Eight Sleep may disclose information to third parties in connection with, or in anticipation of, an asset sale, merger, bankruptcy or other business transaction, for its legitimate interests in running a successful and efficient business.
Supporting quotations
Third parties in connection with or in anticipation of an asset sale, merger, bankruptcy, or other business transaction, as a matter of our legitimate interests to run a successful and efficient business.
Sharing & Disclosure · Company practice
Legal compliance, enforcement and safety can prompt disclosure
Eight Sleep may disclose information as needed to comply with law and legal obligations, or for legitimate interests in cooperating with law enforcement, judicial orders and regulatory inquiries, enforcing terms, and protecting the safety and security of its business, employees and users. This is not stated as limited only to court-ordered disclosure.
Supporting quotations
We may also disclose your information as needed to comply with applicable law or any obligations thereunder or in our legitimate interests to cooperate with law enforcement, judicial orders, and regulatory inquiries, to enforce any applicable terms of service, and to ensure the safety and security of our business, employees, and users.
Sharing & Disclosure · Company commitment
Third parties’ own direct marketing requires affirmative opt-in
Eight Sleep says it does not disclose personal information for third parties’ direct marketing unless you affirmatively opt in. This promise concerns that purpose; the notice separately permits tracking for interest-based advertising and says its website honors GPC and Do Not Track to turn off sale, sharing and targeted-advertising tracking on the enabled browser.
Supporting quotations
We do not disclose your personal information to third parties for the third parties' direct marketing purposes, unless you have affirmatively opted in to such sharing.
We and third parties may also use cookies, pixels, or other tracking technologies ("Tracking Technologies") on the Website and your App to automatically collect certain information about your interactions with the Services. This information is collected and used either with your consent (where consent is required by applicable law) to personalize the Services for you, and to target, deliver and measure interest-based advertising, or because it is in our legitimate interests to tailor your experience with the Services, provide you with offers or promotions, run analytics, better understand user interactions with the Services. Such information includes:
Opt-out preference signals. Our website honors the Global Privacy Control ("GPC") and "Do Not Track" browser signals as requests to opt out of the sale or sharing of personal information and of targeted advertising. When your browser sends either signal, we turn off the cookies and Tracking Technologies used for those purposes on that browser from the first page you load, without requiring any further action from you. The signal applies to the browser and device on which it is enabled, so you will need to enable it on each browser and device you use, or use the "Your Privacy Choices" link in the footer of every page of our website to set your preference directly.
Cross-references
contrast (model-proposed): The US supplement reports sales and sharing for ads and analytics — contrast: The notice requires affirmative opt-in for third parties’ own direct marketing but separately reports sales and sharing for marketing, advertising and analytics. Those statements concern different purposes and legal labels; neither is a blanket no-sharing promise.
Sharing & Disclosure · Company practice
Social interactions can expose information to platforms and the public
Social Features, such as liking or sharing Eight Sleep content on third-party platforms, may let those third parties collect or use information. What you post or make accessible may be publicly displayed, and both Eight Sleep and the third party may access information about you and your use of both services. Public or semi-public posts may be visible to others without limits on their use.
Supporting quotations
Certain features of the Services allow you to initiate interactions between the Services and third-party services or platforms, such as social networks ("Social Features"). Social Features may include features that allow you to access our pages on third-party platforms, and from there to "like" or "share" our content. Use of Social Features may allow a third party to collect and/or use your information. If you use Social Features, information you post or make accessible may be publicly displayed by the third-party service. Both we and the third party may have access to information about you and your use of both the Services and the third-party service. For more information, see the section below, Third-Party Websites and Links.
We may provide links to third-party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.
Legal Rights & Agreement Rules · Restriction or exception
Linked external sites have their own privacy and security practices
For linked sites or platforms outside Eight Sleep’s control and affiliation, the notice asks you to review their own terms and privacy policies. Eight Sleep disclaims responsibility for their privacy, security and information, and says a link alone does not endorse the platform’s content, owner or operator.
Supporting quotations
We may provide links to third-party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.
Data Access & Collection · Company commitment
The Services are not intended for children under 16
Eight Sleep says it does not seek or knowingly collect personal information about children under 16, knowingly sell or share their personal information, or knowingly process it for targeted ads. If it learns it unknowingly collected a child’s information, it will make commercially reasonable efforts to delete it. A parent or guardian can request deletion through Section 11’s contacts, including privacy@eightsleep.com.
Supporting quotations
Our Services are not intended for children under the age of 16, and we do not seek or knowingly collect any personal information about children under the age of 16. We do not knowingly sell or share the personal information of consumers under 16 years of age, or knowingly process such consumers' personal information for targeted advertising. If we become aware that we have unknowingly collected information about a child under 16, we will make commercially reasonable efforts to delete such information from our database. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the details set out in Section 11 to request that it be deleted.
Should you have any questions about our privacy practices or this Privacy Notice, please contact us at privacy@eightsleep.com. If you are a resident of the EU, UK, or Switzerland, you may contact our local representative, through the details set out below.
Cross-references
qualifies (model-proposed): The US supplement reports sales and sharing for ads and analytics — qualifies: The general under-16 rule says no knowing sale, sharing or targeted advertising; the US historical disclosure section similarly disclaims actual knowledge of under-16 sale or sharing.
Security & Safeguards · Restriction or exception
Reasonable protection does not guarantee secure transmission
Eight Sleep says it makes reasonable efforts to protect information but cannot guarantee perfect security. Electronic information may not be secure in transit; it recommends avoiding insecure channels for sensitive or confidential information.
Supporting quotations
Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee "perfect security." Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.
Retention & Deletion · Company practice
Retention depends on the purpose, with a separate clinical-data limit
Eight Sleep generally retains information as long as reasonably necessary for notice purposes. Its criteria include continuing Services, disputes, contractual enforcement, harm prevention, safety, security, integrity and protection of its rights, property and products. Clinical health data obtained through platforms such as HealthEx has a specific limit of up to one year and is automatically deleted when consent expires or is revoked.
Supporting quotations
We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Notice. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products.
Clinical health data accessed through third-party health record platforms such as HealthEx is retained for up to one year, corresponding to the duration of your consent authorization. When your consent expires or is revoked, Eight Sleep automatically deletes your stored clinical health data. You may also request deletion at any time by disconnecting the health record platform in the App settings or by contacting us at privacy@eightsleep.com.
Retention & Deletion · Company commitment
Clinical platform data is deleted when consent ends
Clinical health data obtained through third-party record platforms such as HealthEx is kept for up to one year, corresponding to consent authorization. Eight Sleep says it automatically deletes stored clinical health data when consent expires or is revoked. You may also request deletion at any time by disconnecting the platform in app settings or emailing privacy@eightsleep.com. This specific promise concerns clinical platform data, not all account or device data.
Supporting quotations
Clinical health data accessed through third-party health record platforms such as HealthEx is retained for up to one year, corresponding to the duration of your consent authorization. When your consent expires or is revoked, Eight Sleep automatically deletes your stored clinical health data. You may also request deletion at any time by disconnecting the health record platform in the App settings or by contacting us at privacy@eightsleep.com.
Cross-references
narrows (model-proposed): Retention depends on the purpose, with a separate clinical-data limit — narrows: Clinical health data obtained from record platforms has a specific up-to-one-year limit and automatic deletion when consent ends, unlike the general purpose-based retention rule.
Information may be processed abroad under specified transfer safeguards
Information may be stored or processed outside your home country. For personal information subject to European or UK privacy law and transferred outside the EEA or UK, such as to the US, Eight Sleep says it uses relevant EU standard contractual clauses—module one for controller-to-controller or module two for controller-to-processor transfers—and/or the relevant UK addendum, unless the destination has an applicable adequacy determination. Section 11 contacts, including privacy@eightsleep.com, can provide more information.
Supporting quotations
The information we collect from you may be stored and processed in countries outside the country in which you live. We transfer personal information, subject to European and UK privacy laws (e.g., the GDPR), to countries outside the EEA and/or UK, such as the United States, subject to the European Commission's standard contractual clauses for the transfer of personal data to third countries; specifically, module one (controller to controller transfer) and/or module two (controller to processor transfer), as relevant, or the UK Information Commissioner's international data transfer addendum to the EU standard contractual clauses, as relevant, unless the data transfer is to a country that has been determined by the European Commission and/or the relevant UK authorities, as applicable, to provide an adequate level of protection for individuals' rights and freedoms for their personal data. Please contact us using the details set out in Section 11 should you like further information on this.
Should you have any questions about our privacy practices or this Privacy Notice, please contact us at privacy@eightsleep.com. If you are a resident of the EU, UK, or Switzerland, you may contact our local representative, through the details set out below.
Account & Service Control · User right or choice
Access rights may include information about past recipients
Depending on your location, circumstances and legal limits, you may request access to held personal information and details of how it is used and shared, including with whom it is or has been shared.
Supporting quotations
Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and these rights may be limited by law.
Access / Know: You may have the right to request access to the personal information we hold about you, and to obtain details about how we use and share your information, and with whom we share or have shared it in the past.
Retention & Deletion · User right or choice
You may be able to request deletion
Depending on where you live and subject to applicable circumstances and legal limits, you may request deletion of personal information Eight Sleep holds about you.
Supporting quotations
Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and these rights may be limited by law.
Deletion / Erasure: You may have the right to request that we delete personal information we hold about you.
Account & Service Control · User right or choice
You may be able to correct inaccurate personal information
Depending on location, circumstances and legal limits, you may request correction of inaccurate personal information Eight Sleep holds about you.
Supporting quotations
Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and these rights may be limited by law.
Correction: You may have the right to request that we correct inaccurate personal information we hold about you.
Account & Service Control · User right or choice
You may be able to obtain a copy or request transfer
Depending on location, circumstances and legal limits, you may receive a copy of held personal information and request transfer to a third party.
Supporting quotations
Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and these rights may be limited by law.
Portability: You may have the right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party.
Use & Processing · User right or choice
Processing restrictions may leave storage permitted
Depending on location, circumstances and legal limits, you may require Eight Sleep to stop, suspend or restrict processing of your personal information, other than storage.
Supporting quotations
Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and these rights may be limited by law.
Restriction of Processing: You may have the right to require us to stop, suspend or restrict our processing of personal information we hold about you, other than for storage purposes.
Use & Processing · User right or choice
You may have a right to object to processing
Depending on location, circumstances and legal limits, you may object to Eight Sleep’s processing of personal information. The notice does not promise every objection must result in all processing stopping.
Supporting quotations
Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and these rights may be limited by law.
Objection: You may have the right to object to our processing of your personal information.
Use & Processing · User right or choice
Unsubscribing from marketing does not stop administrative messages
You can opt out of marketing, including SMS, through unsubscribe or opt-out instructions in the communications. Eight Sleep may still send transactional or administrative messages afterward.
Supporting quotations
Opt-Out of Marketing: You may opt out of marketing, including from SMS messages, by using the unsubscribe / opt-out instructions provided in our communications to you. If you opt out, we may still send you transactional or administrative messages.
Consent-based processing may allow withdrawal at any time
Where Eight Sleep relies on consent for processing, you may have the right to withdraw that consent at any time, subject to the notice’s location, circumstance and legal qualifications.
Supporting quotations
Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and these rights may be limited by law.
Withdrawal of Consent: Where we rely on consent to process your personal information, you may have the right to withdraw this consent at any time.
Legal Rights & Agreement Rules · User right or choice
UK complaints receive acknowledgment within 30 days
Depending on location and applicable limits, you may complain to Eight Sleep or your local data protection authority. The notice specifically says UK residents have a statutory right to complain directly to Eight Sleep: it will acknowledge within 30 days of receipt, investigate without undue delay and communicate the outcome and right to escalate to the ICO. Complaints can use Section 11’s contacts, including privacy@eightsleep.com, or another channel by which you contact the company. The 30 days is an acknowledgment deadline, not a promised final resolution deadline.
Supporting quotations
Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and these rights may be limited by law.
Right to Complain: You may have the right to complain to us and/or your local data protection authority about how we process your personal information. If you are a UK resident, you have a statutory right to submit a data protection complaint directly to us. We will acknowledge your complaint within 30 days of receipt, take appropriate steps to investigate it without undue delay, and communicate the outcome to you, including your right to escalate the matter to the UK Information Commissioner's Office (ICO). You may submit a complaint through any of the contact methods described in Section 11 below or through any other channel by which you contact us.
Should you have any questions about our privacy practices or this Privacy Notice, please contact us at privacy@eightsleep.com. If you are a resident of the EU, UK, or Switzerland, you may contact our local representative, through the details set out below.
Sharing & Disclosure · User right or choice
Privacy Choices and GPC provide sale, sharing and ad opt-outs
Depending on location, circumstances and applicable legal limits, you may direct Eight Sleep not to sell or share personal information as defined by law or process it for targeted advertising. To exercise this, use “Your Privacy Choices” in any website page footer and switch off “Sale of Personal Data,” or enable GPC, which the company says it honors automatically.
Supporting quotations
Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and these rights may be limited by law.
Right to Opt Out of Sale, Sharing, or Targeted Advertising: You may have a right to direct us not to "sell" or "share" your personal information (as those terms are defined in applicable laws) or process your personal information for targeted advertising. To exercise this right, click the "Your Privacy Choices" link in the footer of any page of our website and switch off the toggle next to "Sale of Personal Data" in the preferences panel that opens, or enable the Global Privacy Control signal in your browser, which we honor automatically. For information on how we process opt-out preference signals, see Opt-out preference signals under Information Collected Automatically above.
Privacy requests may require identity verification
Send rights requests to privacy@eightsleep.com; EEA, UK and Swiss residents can also use the linked Prighter portal. Eight Sleep says it will not discriminate for exercising these rights and may need further identity-verification information. If a request is denied, you can appeal using Section 11’s contact methods. Neither you nor your agent must pay a fee for verification of a request or appeal.
Supporting quotations
To make a request described in this Section, please email us at privacy@eightsleep.com. If you are an EEA, UK or Swiss resident, you may also make a request here. We will not discriminate against you for exercising any of these rights. Further information may be needed to verify your identity before exercising these rights. You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. If we deny your request, you may appeal our decision by contacting us through the methods described in Section 11. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal.
Account & Service Control · Procedure
An agent must show authorization to make rights requests
You may appoint an agent in writing or through a power of attorney to exercise rights on your behalf. Before accepting an agent’s request, Eight Sleep requires proof of authorization and may ask you to verify your identity directly. It does not charge you or the agent for verification of the request or appeal.
Supporting quotations
To make a request described in this Section, please email us at privacy@eightsleep.com. If you are an EEA, UK or Swiss resident, you may also make a request here. We will not discriminate against you for exercising any of these rights. Further information may be needed to verify your identity before exercising these rights. You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. If we deny your request, you may appeal our decision by contacting us through the methods described in Section 11. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal.
Cross-references
qualifies (model-proposed): Privacy requests may require identity verification — qualifies: Requests through an agent need proof of authorization and may still require the individual’s direct identity verification.
Legal Rights & Agreement Rules · Context
The US supplement applies to California and certain similar-law states
Section 10 applies to California residents and residents of other US states with privacy laws similar to the CCPA that require specific notice disclosures. In this section, personal information includes sensitive personal information. Its first table reports collection and indicated business-purpose disclosures during the preceding 12 months; an asterisk marks sensitive information.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Category of Information Categories of Recipients
Sharing & Disclosure · Company practice
The US table lists recipients of identifiers and customer-record information
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table lists identifiers such as name, email and IP address as collected and disclosed to vendors, service providers and login-integration partners, and at your direction to third-party apps or integrations. Customer-record information such as name, address and phone number is listed with vendors and service providers.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Identifiers such as name, e-mail address and IP address Vendors and service providers, login integration partners, at your direction to third party applications or integrations
Personal information categories listed in the California Customer Records statute such as name, address and telephone number Vendors and service providers
Data Access & Collection · Company practice
The US table lists professional information without naming recipients
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table lists collection of resume or job-history information. Its recipient cell supplies no category. That blank does not establish a promise never to disclose professional information.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Professional information included in an individual's resume or job history
Not stated here
The table does not identify recipients for these rows; no no-sharing promise is inferred.
Sharing & Disclosure · Company practice
The US table lists marketing partners for commercial and activity data
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table lists commercial information such as purchase history with vendors, service providers and marketing partners. Network activity, such as interaction with Services, additionally lists login-integration partners. These are the table’s business-purpose disclosures.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Commercial information such as purchase history Vendors and service providers, marketing partners
Internet or other similar network activity such as information regarding your interaction with the Services Vendors and service providers, marketing partners, login integration partners
Data Access & Collection · Company practice
The US table lists location categories without recipient categories
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table lists geolocation such as IP address and precise geolocation, marking the latter sensitive. Neither row names a recipient category. This is an unspecified recipient field, not a general prohibition on disclosure.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Geolocation data such as IP address
Precise geolocation data*
Not stated here
The table does not identify recipients for these rows; no no-sharing promise is inferred.
Sharing & Disclosure · Company practice
Account access credentials are marked sensitive in the US table
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table lists account login information as sensitive information collected and disclosed for business purposes to vendors, service providers and login-integration partners.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Account access credentials* such as account log-in information for the Services Vendors and service providers, login integration partners
Sharing & Disclosure · Company practice
The US table lists recipients for protected-characteristic information
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table lists characteristics such as sex, including gender and pregnancy, and age as collected and disclosed for business purposes to vendors and service providers and, at your direction, third-party apps or integrations.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Characteristics of protected classifications under California or federal law such as sex (including gender and pregnancy) and age Vendors and service providers, at your direction to third party applications or integrations
Sharing & Disclosure · Company practice
The US health row lists communication providers and linked users
For California residents and residents of other US states with similar privacy laws requiring these disclosures, the preceding-12-month table marks health information sensitive and mentions third-party health-record connectivity platforms such as HealthEx at your direction. Its recipient column lists vendors and service providers for personalized communications, such as sleep reports, and linked users at your direction. The partner-sharing rule specifies sleep and health metrics, biometrics, temperature preferences and leaderboard performance, disclosed when you send or accept an invitation; you can revoke that access by unlinking. The table alone does not say all clinical records are shared with a partner.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *):
Personal information concerning an individual's health*, third-party health record connectivity platforms (e.g., HealthEx) at your direction Vendors and service providers (for personalized communications such as period sleep reports), linked account users, at your direction
Linked account users: If you link your account with another Eight Sleep user as described in Section 2 above, we will disclose your sleep and health data (including sleep metrics, biometric data, temperature preferences, and leaderboard performance) to that linked user through the App. This disclosure is made at your direction when you send or accept a partner invitation. You may revoke this disclosure at any time by unlinking the account through the App settings.
Linking & Identification · Company commitment
Accounts with different emails are not linked without your direction
For California residents and residents of other US states with similar privacy laws requiring these disclosures, Eight Sleep may associate a purchase record with an app account when checkout and app registration use the same email, for service delivery, setup and personalization. It says it does not associate accounts across different email addresses without your direction.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
Internal cross-referencing: Where you use the same email address at checkout and during app account creation, we may associate your purchase record with your Eight Sleep app account for purposes of service delivery, account setup, and personalization. We do not associate accounts across different email addresses without your direction.
Cross-references
qualifies (model-proposed): A matching email can connect your purchase to your app account — qualifies: The US supplement adds that accounts across different email addresses are not associated without the user’s direction; its regional scope is retained.
Use & Processing · Restriction or exception
Sensitive-information uses are limited to CCPA purposes or consent
For California residents and residents of other US states with similar privacy laws requiring these disclosures, Eight Sleep says it uses and discloses sensitive personal information only for purposes specified in the CCPA or otherwise in line with your consent. The supplement refers back to the notice’s collection, use, disclosure and retention sections rather than supplying a separate full list of purposes and sources. General retention is based on reasonable necessity; clinical platform data has a specific up-to-one-year limit and deletion when consent expires or is revoked. The cited law’s text is not supplied here.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
The specific business or commercial purposes for which we collect and disclose your personal information and the categories of sources from which we collect your personal information are described in the sections above, Collection of Your Information, Use of Your Information, and Disclosure of Your Information. We only use and disclose sensitive personal information for purposes specified in the CCPA or otherwise in line with your consent. The criteria we use to determine how long to retain your personal information is described in the section above, Retention of Your Information.
We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Notice. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products.
Clinical health data accessed through third-party health record platforms such as HealthEx is retained for up to one year, corresponding to the duration of your consent authorization. When your consent expires or is revoked, Eight Sleep automatically deletes your stored clinical health data. You may also request deletion at any time by disconnecting the health record platform in the App settings or by contacting us at privacy@eightsleep.com.
Sharing & Disclosure · Company practice
The US supplement reports sales and sharing for ads and analytics
For California residents and residents of other US states with similar privacy laws requiring these disclosures, Eight Sleep says it sells and shares certain personal information and did so during the preceding 12 months for marketing, advertising and analytics. The table lists identifiers such as name, email and IP address with tracking technologies and advertising partners. It also lists purchase-history information and website/network activity, but does not name recipient categories in those two rows. It says it has no actual knowledge of selling or sharing information of people under 16. Applicable opt-outs are available through the website’s Privacy Choices control or GPC; the website also honors Do Not Track on the enabled browser.
Supporting quotations
This Section 10 applies to you if you are a resident of California or another U.S. state that has passed a privacy law similar to the California Consumer Privacy Act ("CCPA") and require specific privacy notice disclosures. For purposes of this section, references to "personal information" shall include "sensitive personal information," as these terms are defined under such laws.
We do not have actual knowledge that we "sell" or "share" (as those terms are defined under applicable law) personal information of individuals under 16 years of age. However, we do sell and share certain categories of personal information and, in the preceding 12 months, we have sold and shared the following categories of personal information about individuals for marketing, advertising, and analytics purposes:
Category of Information Categories of Recipients
Identifiers such as name, e-mail address and IP address Tracking technologies and advertising partners
Commercial information such as purchase history
Internet or other similar network activity such as information regarding your interaction with the Website
Right to Opt Out of Sale, Sharing, or Targeted Advertising: You may have a right to direct us not to "sell" or "share" your personal information (as those terms are defined in applicable laws) or process your personal information for targeted advertising. To exercise this right, click the "Your Privacy Choices" link in the footer of any page of our website and switch off the toggle next to "Sale of Personal Data" in the preferences panel that opens, or enable the Global Privacy Control signal in your browser, which we honor automatically. For information on how we process opt-out preference signals, see Opt-out preference signals under Information Collected Automatically above.
Opt-out preference signals. Our website honors the Global Privacy Control ("GPC") and "Do Not Track" browser signals as requests to opt out of the sale or sharing of personal information and of targeted advertising. When your browser sends either signal, we turn off the cookies and Tracking Technologies used for those purposes on that browser from the first page you load, without requiring any further action from you. The signal applies to the browser and device on which it is enabled, so you will need to enable it on each browser and device you use, or use the "Your Privacy Choices" link in the footer of every page of our website to set your preference directly.
Not stated here
Recipient categories are not supplied in the commercial-information and network-activity rows; the identifiers row cannot establish their recipients.
Legal Rights & Agreement Rules · Procedure
Privacy questions can be emailed to Eight Sleep
Contact privacy@eightsleep.com with questions about Eight Sleep’s practices or this notice. EU, UK and Swiss residents may also contact their local representative using the listed regional details.
Supporting quotations
Should you have any questions about our privacy practices or this Privacy Notice, please contact us at privacy@eightsleep.com. If you are a resident of the EU, UK, or Switzerland, you may contact our local representative, through the details set out below.
Legal Rights & Agreement Rules · Procedure
EU inquiries can go to Prighter in Vienna
For EU inquiries, the notice lists Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria.
Supporting quotations
For EU inquiries
Prighter EU Rep GmbH Schellinggasse 3/10 1010 Vienna Austria
Legal Rights & Agreement Rules · Procedure
UK inquiries can go to Prighter in London
For UK inquiries, the notice lists Prighter Ltd, 20 Mortlake High St, London, SW14 8JN, United Kingdom.
Supporting quotations
For UK inquiries
Prighter Ltd 20 Mortlake High St London, SW14 8JN United Kingdom
Legal Rights & Agreement Rules · Procedure
Swiss inquiries can go to Prighter in Luzern
For Swiss inquiries, the notice lists Prighter CH GmbH, Obergrundstrasse 17, 6002 Luzern, Switzerland.