This policy explains what Somnus collects, why, who else sees it, how long it is kept, and how to get rid of it. It is written to be read, not to be survived. If anything here is unclear, write to support@siyanclinical.com and ask.
1. What Somnus is
Siyan Somnus is a sleep-wellness app for iPhone and Android, made by Siyan Clinical Corporation. It holds a sleep diary, a sleep window worked out from your own logged nights, an eight-week guided plan of behavioural sleep methods, a library of narrated sleep stories, meditations and soundscapes, and an AI sleep coach you can type to or speak with.
Somnus is a consumer wellness product. It is not a medical device, it is not a diagnostic tool, and it does not treat, cure or diagnose anything. The coach is software, not a clinician. Nothing in the app is medical advice, and nothing in it replaces a conversation with a doctor about your sleep.
2. This is not the clinic's HIPAA notice
Two different things, under one company name.
Siyan Clinical Corporation also operates a healthcare practice. That practice has its own patients, its own records and its own Notice of Privacy Practices under HIPAA. This policy is not that notice, and Somnus is not part of that practice.
Your Somnus account is not a patient chart. We are not your healthcare provider because you use Somnus. Nothing you log or say in the app is added to a clinical record, and being a Somnus member does not make you a patient of the practice. If you are a patient of the practice, the notice you were given there governs that relationship — not this page.
3. Adults only
Somnus is for people aged 18 and over. The app asks for your date of birth during setup and will not let you continue if you are under 18. This check sits on every way into the app, including sign-in with Apple and sign-in with Google.
We do not knowingly collect data from anyone under 18. If you believe a child has created an account, write to support@siyanclinical.com and we will delete it.
4. What we collect
Your account
Your email address.
Your date of birth — needed for the age check above.
If you choose to give them: your name, gender, height and weight.
If you sign in with Apple or Google, we receive the account identifier and the email address those services pass to us. We do not receive your password, and we never see it.
What you record in the app
Sleep logs — bedtime, wake time, how long it took to fall asleep, times awake, how the night felt.
Wellness check-in answers and the scores worked out from them.
Thought records you write.
Medications you choose to log.
Health conditions you tick during setup or in your profile.
Your progress through the guided plan, and the sleep window calculated for you.
Your reminder and notification settings.
Coach conversations
The messages you send the coach and the replies it sends back. These are saved as your conversation history so the coach can remember what you have already discussed.
If you speak to the coach instead of typing, the audio from your microphone while a session is open. See Talking to the coach.
Technical
Your subscription status.
If the app crashes, a crash report. It carries no identifier of any kind — see When the app crashes.
5. Apple Health and Health Connect
If you allow it, Somnus reads sleep and related data from Apple Health on iPhone or Health Connect on Android. This is optional. If you decline, or if you have no wearable, you log your nights by hand and the rest of the app works normally.
Somnus only reads. It never writes anything to Apple Health or Health Connect, and never changes or deletes anything in them. Every permission the app asks for is a read permission.
These are the exact data types the app asks to read.
Sleep
Time asleep
Time awake during the night
Deep sleep
REM sleep
Light sleep
Time in bed iPhone
Sleep sessions Android
Awake in bed Android
Out of bed Android
Sleep the device recorded but could not classify Android
Measured alongside your sleep
All of these are optional. A night imports fine with none of them, and one missing reading never stops the others.
Heart rate — the series recorded across the night
Resting heart rate
Respiratory rate
Blood oxygen
Body temperature
Heart rate variability, as SDNN iPhone
Sleeping wrist temperature iPhone
Mindful minutes iPhone
Heart rate variability, as RMSSD Android
Skin temperature, as a difference from your own baseline Android
What you did the day before
Movement and exercise timing shift sleep more reliably than most things a sleep tracker records about the night itself, so the app reads these to relate your days to your nights.
Steps
Active energy burned
Workouts
Two things worth knowing
The vitals and the sleep-stage breakdown need a device that records them. A watch, ring or phone that tracks sleep. Without one you will see the nights you type in, and no heart rate, no stages and no temperature, because there is nothing to read.
On Android, history is a second permission. Health Connect keeps data older than 30 days behind its own separate grant. If you ask Somnus to import more than the last month, it will ask Health Connect for that too. Decline it and the import still works — it just sees less.
You can withdraw this access at any time in iOS Settings (Privacy & Security → Health → Somnus) or in the Health Connect app on Android. The data Somnus already imported stays in your Somnus account until you delete it or delete your account.
6. How we use it
To work out your sleep metrics, trends and your personalised sleep window.
To run and adjust your eight-week plan.
To give the AI coach the context to answer questions about your own nights.
To screen messages for signs of crisis before they reach the coach, and to show support resources when that screen fires.
To manage your subscription and your access to paid features.
To send the reminders and notifications you have turned on.
To fix the app when it breaks.
If — and only if — you turn it on: to show your sleep data and check-ins to a wellness coach you have linked, or to contribute de-identified data to research.
We do not sell your data. We do not share it for advertising. We do not use it to build advertising profiles, and we do not use your health data to advertise anything to you.
7. Who else sees it
This is the complete list of third parties that receive data from Somnus, what each one gets, and why. Each is bound by a contract that requires it to protect the data at least as well as we do, to use it only to provide the service we have asked them for, and not to sell it or use it for their own purposes.
Amazon Web Services (AWS)
Hosts the whole service in the US West (Oregon) region, us-west-2. Amazon Cognito holds account identity. Amazon DynamoDB holds your member data. Amazon Bedrock generates the coach's written replies. AWS is our infrastructure provider: it stores and processes the data on our instruction and does not use it for its own purposes.
ElevenLabs
Speech only, and only while you are speaking to the coach. Audio from your microphone leaves your device and leaves our AWS account, and goes to ElevenLabs, which turns your speech into words and speaks the coach's reply back to you. Their account is configured not to retain session audio after a session ends and not to use anything from it to train models. If you would rather nothing was sent to a speech company, use the written coach — it is the same coach, with the same history.
RevenueCat
Manages your subscription. It receives your Somnus member identifier and the purchase information the App Store or Google Play reports — which plan, when it renews, whether a trial is running. It does not receive your sleep data, your check-ins, your thought records or your coach conversations.
Apple and Google
The App Store and Google Play take the payment and run the subscription. They tell us whether your subscription is active. We never see your card number or your billing details. What Apple or Google do with your payment data is governed by their own privacy policies, not this one.
A wellness coach you have linked — off unless you turn it on
If you switch on "Share with my coach" in Profile, a wellness coach you have linked can see your sleep data and your check-ins. This is off by default. Turning it off takes effect immediately, not at the next sync.
Research — off unless you turn it on
If you switch on "Contribute to research" in Profile, de-identified data may be used for research. It is never sold and never linked back to you. This is off by default.
Google Fonts
The app loads two typefaces from Google's font service the first time it needs them, then keeps them on your phone. That request carries your IP address to Google, as any web request does. It carries nothing about you, your account or your sleep.
There is nobody else. We may also disclose data if the law requires it — a valid subpoena, court order or similar — or to protect someone's safety; and if the business were ever sold or merged, your data would transfer with it, under this policy or a successor you would be told about.
8. The AI sleep coach
When you type to the coach, your message and a summary of your recent sleep data are sent to Amazon Bedrock, inside our own AWS account, where an Anthropic Claude model generates the reply. Under AWS's terms for Bedrock, that content is not stored by Amazon and is not used to train any model.
Before anything reaches the model, the message passes a safety screen that runs on our own servers. If that screen fires, the message is not sent onward and you are shown support resources instead. This happens whether you type or speak.
Your messages and the coach's replies are saved in your conversation history on our servers, so the coach can refer back to them.
9. Talking to the coach
Speaking works differently from typing, and it involves someone else. This is the part of Somnus that sends your data furthest, so it is worth reading closely.
While a spoken session is open, audio from your microphone is streamed to ElevenLabs. It leaves your phone and it leaves our AWS account. ElevenLabs turns your speech into words, and speaks the reply back to you in the voice you chose.
The microphone is open only while a session is open. Leaving the screen, or moving the app to the background, ends the session and closes it.
What the coach says is still decided by us, on our own servers, from the same words and the same safety screening as a typed message. The speech service carries the conversation; it does not write it.
The transcript is saved to your conversation history, in the same place your typed messages are saved.
The audio itself is not stored by us, and is not written to your phone.
If you would rather no audio left your device, type instead. The written coach has the same memory and the same abilities.
10. Subscriptions and billing
Somnus is a paid subscription. There are four plans — 30 days, 90 days, 6 months and 12 months.
When a trial or subscription ends, most of the app locks. The AI coach, the spoken coach, the eight-week plan, the full audio library and the detailed analysis all need an active subscription. You keep your sleep diary, your week's trend and a sample of the audio library. Nothing you have logged is deleted when a subscription lapses.
Subscriptions are bought and auto-renew through the App Store or Google Play, and are managed with RevenueCat. On the App Store, new subscribers get a 14-day free trial. Cancel or change a subscription in your App Store or Google Play account settings — we cannot cancel it for you, because we do not hold the billing relationship.
Cancelling a subscription does not delete your data. Deleting your account does.
11. What stays on your phone
Somnus keeps a copy of your own data on your phone so the app works without a connection.
Your sign-in tokens are kept in the iOS Keychain or the Android Keystore, not in ordinary app storage.
If you turn on the app lock, Face ID, Touch ID or your fingerprint is checked by your phone. Somnus never receives your biometrics — the phone only tells it yes or no.
Deleting the app removes the local copy. It does not delete your account on our servers. To do that, see Deleting your data.
If you export your data, the export is a plain JSON file containing your health information. Once you share it, it is outside our control. Be deliberate about where it goes.
12. When the app crashes
If the app stops working, it sends a report so we can fix it. The report says what broke and where in the code: the kind of error, the file and line, which screen you were on, your app version and your phone's operating system version.
It does not identify you. There is no account identifier, no email address and no device identifier in it, and nothing you have written is included. Error messages can quote text they could not handle, so anything quoted is stripped on your phone before the report is sent, and stripped again on our servers.
Reports go to our own endpoint in the same AWS account as everything else, and nowhere else. We do not use a crash-reporting company, which is why there is no third party to name here. Crash reports are deleted automatically after 30 days.
13. No advertising, no analytics
Somnus contains no advertising SDK and no third-party analytics SDK. Not Google Analytics, not Firebase Analytics, not Sentry, not Crashlytics, not Meta, not an attribution or ad-network kit of any kind. This is a deliberate decision, not an oversight: those tools would make another company a processor of what people tell a sleep coach at three in the morning.
There are no advertising identifiers, no cross-app tracking and no third-party cookies in the app. We do not track you across other apps or websites.
14. Where your data lives
Your account, your health information and your conversation history are stored on AWS in the United States, in the us-west-2 region (US West, Oregon). Identity is held in Amazon Cognito; everything else is in Amazon DynamoDB.
Data is encrypted in transit with HTTPS/TLS and at rest with AES-256, under an encryption key that belongs to us and is rotated. Access is limited to the people and systems that need it to run the service.
The one exception is spoken audio, which passes through ElevenLabs as described in Talking to the coach, encrypted in transit there too.
15. How long we keep it
Your account and everything in it
Kept for as long as your account exists, because the app's whole job is to compare tonight with the nights before it. Deleted when you delete your account.
Coach conversations
Kept as your history, for as long as your account exists.
Spoken audio
Not stored by us at all. The transcript is kept with your other messages.
Crash reports
30 days, then deleted automatically.
Encrypted backups
The database keeps automatic encrypted point-in-time backups. Deleted records can persist in those backups for a short while — currently up to 35 days — before they roll off, after which they are gone from there too.
Billing records
Apple, Google and RevenueCat keep their own records of your subscription under their own retention rules. We keep only your subscription status.
16. Deleting your data
In the app
Go to Profile → Privacy and security → Delete my account. You will be asked to confirm. When you do, your record is purged from our database immediately: your sleep logs, check-ins, thought records, medications, coaching progress, profile and conversations. If you had linked a coach, that link is removed too. This is permanent and cannot be undone.
From this page
If you cannot get into the app, email support@siyanclinical.com from the address on your account, with the subject "Delete my Somnus account". If you write from a different address, tell us the email address on the account so we can find it. We may need to confirm it is yours before we delete it. We will complete the deletion and confirm it to you within 30 days.
Getting a copy first
You can export everything before you delete it: Profile → Export everything. It produces a JSON file you can save or send anywhere. Deletion is permanent, so export first if you want to keep anything.
What deletion does not reach
Your subscription. Cancel it in your App Store or Google Play settings, or it will keep renewing. Deleting your account does not cancel it.
Apple Health and Health Connect. Your own data in those stores is untouched — Somnus never writes to them and deleting your Somnus account changes nothing there.
Encrypted backups, for a short while after deletion, as described above.
Records we are required to keep by law, such as a tax record of a payment.
17. Withdrawing consent
Everything optional can be switched off, and switching it off does not break the app.
Health data: revoke it in iOS Settings (Privacy & Security → Health → Somnus) or in the Health Connect app on Android. Somnus stops reading immediately.
Microphone and the spoken coach: stop using the voice screen, or revoke the microphone permission in your phone's settings. Nothing is sent to a speech company unless a spoken session is open. The written coach keeps working.
Sharing with a linked coach: turn off "Share with my coach" in Profile. It takes effect immediately.
Research: turn off "Contribute to research" in Profile.
Notifications: turn off reminders in Profile, or revoke notification permission in your phone's settings.
Everything: delete your account, as above.
Depending on where you live, you may also have the right to ask what we hold about you, to have it corrected, to have it deleted, or to receive a copy. Export and delete are both built into the app; for anything else, write to support@siyanclinical.com and we will answer within 30 days. We will not treat you worse for exercising any of these rights.
18. Safety limits
Somnus is not an emergency service and cannot summon help.
If a message suggests you may be in crisis, the app stops being a sleep coach and shows support resources, including findahelpline.com, which lists helplines by country. That screening runs on our servers, before anything reaches the AI model, whether you type or speak.
The guided plan works partly by shortening time in bed. Somnus will not do that if you have told it you have sleep apnoea, narcolepsy, a shift-work pattern, bipolar disorder or seizures. For those, shortening sleep can make things worse, so the app refuses and says the plan needs someone who knows your health history. That refusal is not a diagnosis and not medical advice.
If something is wrong with your sleep, see a doctor. An app is not a substitute for one.
19. Security
Everything in transit is encrypted with HTTPS/TLS.
Everything at rest is encrypted with AES-256, under a key we control and rotate.
If you sign in with an email and password, the password is never sent to us — the sign-in uses a challenge-response exchange that proves you know it without transmitting it.
Sign-in tokens live in your phone's secure keystore.
Access to member data is limited to what is needed to run the service.
No system is perfectly secure, and we will not pretend otherwise. If we discover a breach affecting your data, we will tell you and the relevant authorities as the law requires.
20. If you are outside the US
Somnus is operated from the United States and your data is stored there, in the us-west-2 AWS region. Using the app means your data is transferred to and processed in the United States, where privacy law may differ from where you live. ElevenLabs processes spoken audio as described above.
21. Changes to this policy
If we change how Somnus handles your data, we will update this page and change the date at the top. If a change is significant — a new third party, a new category of data, a materially different use — we will tell you in the app before it takes effect, and where consent is required we will ask for it again rather than assume it.
22. Contact
Siyan Clinical Corporation
Privacy questions, data requests and deletion requests: support@siyanclinical.com
We answer privacy and deletion requests within 30 days.