Huestun Privacy Policy

Your tour operator — the business you booked your tour with — is the business responsible for your personal information on its tours. It decides who is tracked and why, its coordinators and guides use the information to run your tour, and it answers for how that information is handled. The tour operators currently using Huestun are listed at https://www.huestun.ai/operators.

Huestun ("we", "us") provides the app and the service to your tour operator and handles your information on its behalf, as its entrusted service provider. We also use some of that information for purposes of our own — operating, maintaining and improving the service, including its fall detection — which are set out in section 3. The app is published by, and this policy is issued by:

Huestun Inc. (Huestun)
6211 S Highland Drive Ste 310, Holladay, UT 84121, USA
Representative: Christopher Peck
Privacy contact: developer@huestun.ai

Not every part of this section applies to every tour. The participant form described in 2.1 is used by some tour operators and not others, and the Huestun app you install from the App Store or Google Play does not contain it — on that app you type your name on the join screen and nothing else. Where this policy says "participant form", it applies only if your operator asked you to fill one in. Sections 2.2 to 2.6 apply to everyone on a tracked session.

2.1 Information you enter on the participant form (only where your operator uses the form — not in the app you install from the App Store or Google Play)

Before a tour you complete a participant form (a one-day or a multi-day version). It asks for:

• Identity and contact details: name, phone number, email address, nationality, gender, date of birth, height and weight.
• Emergency contact: the name and phone number of someone we can call for you. You must have that person's permission to give us their details.
• Health information: medical conditions, drug allergies, medications, food allergies and blood type. This is special care-required personal information under Japan's Act on the Protection of Personal Information, and we only collect it with your consent (see section 4).
• Tour information: your skiing/snowboarding experience and ability, avalanche training, fitness, equipment and rental sizes, how you heard about the tour, and free-text answers about your goals. The multi-day form also asks whether you drink alcohol.
• Your consent record: the version of the consent text you agreed to and the time you agreed.

2.2 Information collected while you are on a tracked session

When you scan the session QR code and agree to start tracking, the app collects:

• Your location, about once every one to two seconds: latitude, longitude, altitude, speed, heading, the accuracy of the fix, and the time. This continues while your phone is locked or the app is in the background, because that is what lets your coordinator see where you are for the whole session.
• How tracking stops. Tapping End tracking in the app stops your phone taking new readings. It then sends up any readings already taken that had not reached us yet, so the last minutes of your tour are not lost, and stops. If instead your coordinator ends the session, your phone stops sending immediately but carries on recording into its own storage until you end tracking in the app — so that nothing is lost if the coordinator resumes. If the session is resumed, those stored readings can then be sent. Otherwise they stay on the phone and are deleted as described in section 7.
• Battery level of your phone, if available, sent with each location fix.
• The name you give when you join. On the app you install from the App Store or Google Play you type it yourself. Where your operator uses the participant form, you instead pick your own name from the day's list. You also choose your group, on tours that have groups.
• A device identifier and access token that we issue when you join, identifying your phone for that session. They are stored in your phone's secure keychain, and the token expires — within 12 hours for an ordinary tour. The token expiring is not the same as your data being deleted: the location readings sent with it are kept for the period in section 7.
• Technical details of each request: the app's version and build number, your phone's operating system and platform, and the time. The app sends these so that we can tell which version of the app a problem came from; today our server does not read or keep them.

2.3 Motion data and alerts

• While the app is open on screen, it reads your phone's accelerometer to detect a possible fall. Those readings stay on your phone and are discarded continuously. Only if a fall is suspected does the app send an alert with about five seconds of motion readings around the event, plus your last known location and the time. A suspected fall is reported automatically; the coordinator, not the app, decides what to do about it.
• If you press the SOS button, the app sends an alert with your last known location and the time.
• Fall detection only works while the app is open in front of you. It stops the moment you switch to another app, go back to your home screen or lock your phone, and starts again when you return to it. A phone carried in a pocket is not watching for falls. Please do not rely on it: the SOS button is what you should use if you need help, and your guide is what keeps you safe.

2.4 Camera

The app uses the camera only to read the session QR code. It does not take, store or transmit any photo or video, and it does not record audio.

2.5 Information created for you

After a session, the app can show you a recap: distance, vertical descent, top speed, duration, altitude range, and a picture of your own track. The recap is computed on our server from your location data and a copy is kept on your phone so you can look at it later (see section 7).

2.6 Additional information for guides and patrollers

If you use the app as a guide or patroller, you pick your name from your organisation's staff list, and the app shows you the names and live positions of the participants in your group. Participants do not see each other's live positions or details — with the one exception described in section 5, the day's participant list, where your name is visible to others joining the same tour.

2.7 What we do not collect

No account or password. No advertising identifier. No analytics, crash-reporting or advertising software. No access to your contacts, photos, microphone, calendar or other apps. No tracking of you across other apps or websites. We do not collect location before you agree to start tracking or after you end it — see the note on how tracking stops in 2.2.

We do not use your information for advertising, we do not build profiles of you, and we do not use automated decisions that have legal or similarly significant effects on you.

• Health information and your emergency contact — where the participant form is used; see 2.1 — are collected only with your consent, which you give by ticking the consent box on that form. That consent also covers their use by your tour operator's staff for emergency care. If your tour does not use the form, we ask you no health questions and hold no medical history for you. We do still record SOS alerts and suspected falls, which describe what happened to you on the mountain rather than your medical history, but which may indicate something about your physical condition.
• Location tracking starts only when you tap I agree — start tracking on the join screen, and only after you have granted the location permission on your phone.
• You can decline either consent. Where the form is used, we cannot take you on a guided tour without the safety information on it; and in every case you cannot join a tracked session without location.
• Visitors from the European Economic Area, the United Kingdom or Switzerland. Our position is that European and UK data-protection law does not apply to tracking on a tour in Japan, and we have no representative in those places. We nevertheless give every participant the same rights, described in section 10, whatever country you live in.

• Your tour operator's staff — coordinators and guides, acting for the business responsible for your information (section 1). They see your name, group, live location, alerts and tour information to run the tour. They can view your health information and emergency contact only in an emergency involving you; every such access through the coordinator's screen is logged with who read it, when and why, and the log is reviewable.
• Emergency services, ski patrol and medical providers, if you need help. We will share your location, emergency contact and health information with them when that is necessary to protect your life or physical safety.
• Other participants do not see your location, your tour information or your health information. Guides see the names and positions of the participants in their own group only. There is one exception, and it is the largest disclosure in this policy: where your operator uses the participant form, your name appears on the day's participant list that other guests pick their own name from, so anyone holding that session's QR code can see the names on it. On the app you install from the App Store or Google Play there is no such list — you type your own name and see nobody else's.
• Service providers who host our systems and act on our instructions under contract: Amazon Web Services (servers and database, located in Japan); and Vercel Inc., a United States company, which hosts this website and the pages a QR code opens, and records the IP address, time, page requested and browser version of each visit and keeps them for 30 days, and counts visits to this website without cookies, as anonymous totals only (Vercel Web Analytics). They may not use your information for their own purposes.
• Messaging providers. If a coordinator sends your location to a designated first responder by email or SMS, that message travels through our messaging providers — Resend (email) and Twilio (SMS), both in the United States — acting on our instructions.
• Our own staff in the United States. Huestun is a United States company. Our personnel there routinely access your information in order to operate, support and maintain the service, and may download session records to computers in the United States for analysis or troubleshooting. This is normal day-to-day operation, not an exception made in an emergency. See section 6.
• Authorities, where the law requires it.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

Our primary production servers are located in Japan. If you use the app from another country, your information is transferred to and stored in Japan, whose data-protection law may differ from your own.

Huestun is a United States company, and where your information is stored is only half the answer. Huestun personnel in the United States routinely access your information in order to operate, support and maintain the service. They may also download session records to computers in the United States for analysis or troubleshooting. We assess the data-protection framework of any country where your information is handled, including the United States, and apply the security measures described in section 8.

• Organisational: the representative named in section 1 is accountable for how we handle personal information, and our staff are instructed in these rules. Our formal incident-response procedure is still being written. Until it is, anyone here who suspects a security incident escalates it to that person and to your tour operator, which as the business responsible for your information decides whether to report it to the Personal Information Protection Commission and to notify you, with our support. Where the incident concerns information we handle for our own purposes, we report it ourselves. We would rather tell you that this is unfinished than describe a process we do not yet follow.
• Personnel: staff and tour-operator personnel with access are bound by confidentiality obligations and instructed in these rules.
• Physical / hosting: data is held on servers in a professionally managed data centre (Amazon Web Services) with access limited to authorised administrators.
• Technical: all traffic between the app and our servers is encrypted (HTTPS). Health information and emergency contacts are encrypted at rest with AES-256-GCM using a key that is held only by our application servers, never by the database. Every read of health information is logged (who, when, which fields, on what basis) and the values themselves are never written to the log. Session tokens expire within 12 hours. On your phone, credentials are stored in the operating system's secure keychain / keystore.
• External environment: our personnel in the United States handle your information in the course of operating, supporting and maintaining the service, and we assess the data-protection framework of the United States and of any other country where it is handled.

Huestun is for adults. We do not knowingly track anyone under 18. The app does not ask your age and cannot check it, so this rule rests on your tour operator, which should not enrol a child in tracking, and on parents and guardians, who are responsible for the safety of their children on a tour. If we learn that a participant is under 18, we stop tracking that phone, delete what was recorded as described in section 10, and inform your tour operator. Where the participant form is used, it must be completed by an adult about themselves.

You can ask us to:

• tell you what personal information we hold about you and how we use it (disclosure);
• correct it if it is wrong, or add to it;
• stop using or delete it — including withdrawing the consent you gave for your health information;
• stop sharing it with a third party;
• explain our purposes of use.

To make a request, email developer@huestun.ai and tell us the name you used and the date of your tour, and which tour operator ran it. Because your tour operator is responsible for the information from its tours, we will ask it to confirm both that you were on that tour and that the request is really coming from you before we act. Being on the tour is not by itself proof of identity — your name and the date of your tour can be known to other people, including anyone who held that session's QR code (section 5) — so your operator verifies you against the contact details in its own booking record: it will reach you on the email address or phone number you booked with, not on whatever address the request arrived from, and may ask you about your booking in a way another guest could not answer. Only once it has reached you that way do we act. The app itself holds no account, email address or phone number for you, which is why the check runs through your operator. If that route will not work for you — somebody else booked the tour for you, you no longer have the email address or phone number it was booked with, or your operator cannot find a contact in its own record — say so when you write, and we will agree another way to establish that the records are yours before we touch them. We may ask for more information if we cannot match you to a record. We respond without undue delay, and within any deadline the law that applies to you sets. There is no fee.

If we cannot identify your record with confidence, or cannot verify that the request comes from the person that record is about, we will tell you so and will not delete or disclose anything — rather than act on a record that may belong to somebody else. Two guests on the same tour with the same name is one case this is written for; somebody asking for a record that is not theirs is the other.

A request about your information has to come from you, or from somebody with legal authority to act for you. A family relationship on its own is not that authority: we do not act on a request from a relative, a partner or a friend merely because they know your name and your tour. If you are acting for someone else under a legal authority — as their legal representative, or after a death or an accident that leaves them unable to act for themselves — tell us when you write and we will tell you what evidence of that authority we need. In every case we reach the person the records are about, or the person entitled to act for them, through the route above; an operator's confirmation on its own is never enough.

How deletion works today. We carry it out by hand. There is no delete button in the app: once the check above is done, we remove your records from our live systems ourselves, and we tell you when it is finished. That is slower than an automated process would be, and it is the honest description of what happens. Where we cannot yet promise completeness: we are still compiling a full inventory of every place a copy of your records can exist — system backups, and the session records our staff download to their own computers for troubleshooting (section 5). We delete every copy we can identify, we tell you plainly what we have deleted, and we do not put a record you have asked us to delete back into use. One thing deletion does not remove: if a guide or coordinator wrote an incident report about something that happened on your tour, that report is kept as a safety record, and it can contain your name in the account of what happened. We will tell you if one exists about you.

You can stop location tracking at any moment by tapping End tracking in the app, by turning off the app's location permission in your phone's settings, or by deleting the app. Location collected before that point is kept as described in section 7 unless you also ask us to delete it.

Deleting your profile removes your identity, contact, tour and health information and your emergency card. We keep the access log (without the health information) and any information we are legally required to retain. If you have filled in the form more than once, tell us, so that we find every copy.

Whatever country you live in, you may also ask us for a copy of your information in a portable form, object to a use of it, and complain to the data-protection authority where you live as well as to Japan's (section 12). We give these rights to every participant regardless of nationality.

We will post any changes here with a new "last updated" date. If a change affects the health information or location tracking you have consented to, we will ask for your consent again through the app before the change applies to you.

Questions, requests and complaints: developer@huestun.ai, or by post to the address in section 1. You can also complain to Japan's Personal Information Protection Commission (個人情報保護委員会, https://www.ppc.go.jp/).

This policy is governed by the laws of Japan. The Japanese version prevails if the two versions differ. Where the law of the country you live in gives you rights that cannot be set aside by agreement, nothing in this policy removes them.