Last updated 10 September 2026

Privacy Policy

A private connection for Elvira Meyer Nielsen to access her own Oura Ring data. This application is not open for public registration.

Operator and contact

The application is operated by Elvira Meyer Nielsen. Contact em@elvirameyer.com with privacy questions or requests concerning the application.

What the application accesses

After the owner authorizes the application through Oura, it can request the categories approved on Oura's consent screen. These may include sleep, activity, readiness, heart rate, workouts, tags, sessions, blood oxygen, stress, heart-health measurements and ring configuration. Email and personal profile information are not requested by default. Some of this information is sensitive health data.

The application receives an authorization code, access and refresh tokens, granted permissions and token expiry information. Oura handles the account login; this application does not receive the Oura account password. The website's infrastructure may also process IP addresses, request times, requested paths, browser information and security events to deliver and protect the service.

Purpose and authorization

The sole purpose is to provide the owner with private, on-demand access to her own data for personal review. Access begins only after authorization on Oura's consent screen, and requests are restricted to the approved permissions. The service does not diagnose conditions or make medical decisions.

Storage and retention

Access and refresh tokens are encrypted in server-side storage and retained while the connection is active. Health-data responses are processed in memory and returned to the authenticated owner or an owner-authorized client. The backend does not maintain a historical health-data database, deliberately log health-data response bodies, or instruct browsers to cache responses.

A temporary, essential login cookie binds the Oura authorization response to the browser that started it. It expires after ten minutes or is cleared when the callback is handled. There are no advertising cookies, analytics scripts or tracking pixels in this application.

Operational logs and infrastructure backups, if maintained by the hosting provider, are subject to that provider's retention practices. These are separate from the application's token store. The application does not deliberately log authorization codes, tokens or health-data bodies. Encrypted connection records removed from the live database may remain in provider-managed recovery backups until those backups expire. Revoking the app in Oura also prevents later use of its authorization.

Recipients and third-party services

Oura supplies the authorized data and manages its own account and consent systems under Oura's Privacy Policy. The application is hosted through OpenAI Sites on Cloudflare infrastructure. These providers process requests and encrypted connection storage to operate the service. Their infrastructure may process information outside your country; their applicable privacy and data-processing terms govern that infrastructure. The backend does not sell data, use it for advertising or automatically send it to an AI service.

If the owner separately instructs an assistant or other client to retrieve data, that recipient will receive the requested information. Its own terms, privacy controls, retention and processing locations also apply. No such integration is enabled merely by connecting Oura. The operator must assess the recipient and obtain any required consent before enabling it. The application does not use Oura data to train or fine-tune AI models.

Disconnecting and deleting

The owner can stop access by removing this application in Oura's connected-app settings. The backend also provides an authenticated disconnect action that deletes its saved tokens and cancels pending connection attempts. Disconnecting here does not delete information held by Oura.

For a deletion request or help disconnecting, email the operator above. The operator will stop further processing and remove personal data from the live application within 72 hours of a verified request. Provider-managed backup limitations are described above. If data has separately been exported or shared with an authorized recipient, deletion there must also be requested; revoking this connection cannot remove independent copies automatically.

Privacy requests and changes

Contact the operator to request access, correction, deletion, restriction or withdrawal of authorization and, where applicable, portability or to raise an objection. Correct source measurements and profile information through Oura. Where data protection law applies, you may also complain to the relevant supervisory authority, including Datatilsynet in Denmark.

This policy describes a single-owner personal application. Before accepting other users, adding persistent health-data storage or enabling automatic third-party sharing, the operator will update the service and this policy and obtain any required consent. The date above identifies the latest version.