Privacy Policy
This Privacy Policy is issued by ENC data Services Co. Ltd., Ltd. (hereinafter referred to as "we" or "us") and applies to the smart health ring, Ubling App (if applicable), cloud platform, AI health assistant, and related services that we operate. The legal entity name shall be subject to the applicable business registration.We take your privacy seriously and this Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Product.
1. Scope and Basic Principles
1.1 We process personal information in accordance with the principles of lawfulness, fairness, necessity, transparency, and data minimization. We will not deny you access to basic features of the Product if you refuse to provide personal information that is not necessary for the basic functionality.
1.2 This Privacy Policy applies to the U.S. version of the Product. If non-U.S. versions involve cross-border processing, separate applicable rules will be provided.
1.3 This Privacy Policy does not apply to products or services independently provided by third parties. However, we will disclose the identity of third parties, processing purposes, and categories of information, and fulfill necessary security management obligations as required by law. We are not responsible for the policies and practices of any third parties, and we do not control, operate, or endorse any information, products, or services that may be offered by third parties or accessible on or through the Services. For clarity, we are responsible for the data protection practices of our data processors in accordance with the data protection laws applicable to the jurisdiction in which you reside.
2. Who We Are and How to Contact Us
We will generally respond to your personal information rights requests, complaints, or reports within 15 business days, or as otherwise required by applicable law. Under CCPA/CPRA, we are required to respond to verifiable consumer requests within 45 days.
| Item | Content |
|---|---|
| Data Controller / Business | ENC data Services Co. Ltd. |
| Registered Address | 13971 Norton Ave, Chino, CA 91710, USA |
| Privacy Officer / Email | ubling@enn.cn |
| Customer Service Hours | 9:00 AM - 8:00 PM (Local Time) |
| In-App Rights Entry | Me > Settings (edit nickname, avatar, profile; sign out). Account closure, data export and other rights requests: currently by e-mail to the privacy e-mail below. |
| Do Not Sell or Share My Personal Information |
3. Personal Information We Collect and Use
The following list should be consistent with the actual product, code, SDKs, permission requests, and backend fields. Information not actually collected shall not be listed in this Policy. Newly added collection items will be updated with prior notice and consent obtained as required by law.
We collect the following categories of personal information:
| Scenario | Information Category | Purpose | Necessary? / Trigger | |
|---|---|---|---|---|
| Account & Identity | Mobile phone number or e-mail address (login identifier; e-mail login is provided in the international version, phone number login in the Mainland China version), verification code, account ID, nickname (optional), avatar (optional), login password (only if you choose to set or reset one), time zone setting | Registration, login, account security, customer service; displaying your nickname, avatar and phone number to members of a family group you join | Essential for basic account function; nickname/avatar/password optional | |
| Device Pairing & Operation | Bluetooth/nearby-device permission, ring serial number, Bluetooth MAC address and broadcast name, device model, firmware version, battery level, wear status, binding relationship; for the companion robot: robot serial number, MAC address, activation signature, and the Wi-Fi network name (SSID) and password you enter for provisioning (sent to the robot over Bluetooth only; not stored by the App and not uploaded to our servers); the family/room grouping you configure for device sharing | Pairing, data sync, firmware upgrade, fault diagnosis, device sharing within a family group | Essential for device connection; Wi-Fi provisioning and family sharing only when you use those features | |
| Basic Body Information | Date of birth (age is derived from it), gender, height, weight | Calculate health and exercise metrics (e.g. stride, distance, calories; these values are also written to the ring for on-device calculation), improve algorithm adaptability | Needed for some metric calculations; refusal may affect accuracy | |
| Health & Physiological Data (Sensitive) | Ring readings: heart rate, heart rate variability (HRV), blood oxygen (SpO2), sleep (duration, stages, score, efficiency, chronotype), stress, physical energy, steps, distance, calories, wear status, ring battery. Women's health data you enter manually: cycle and period length, period dates, flow level, pain level, mood, symptoms, basal body temperature, weight, notes. Meditation/relaxation listening records (start and end time, duration, completion). | Health trend display, alerts, personalized analysis, AI health Q&A (your recent readings are attached to your AI conversation as context), relaxation content statistics | Processed only after enabling corresponding features and obtaining explicit consent | |
| Location & Trajectory (Sensitive) | Precise location (GPS/GNSS) during outdoor exercise: latitude/longitude, altitude, speed, accuracy and the resulting exercise trajectory. On some Android versions the system also requires location permission to scan for Bluetooth devices. | Outdoor exercise trajectory, map display, distance/pace calculation | Collected only when you start an outdoor exercise. Exercise records and trajectories are currently stored only on your device and are not uploaded to our servers. | |
| Camera / Photos / Microphone | Avatar photo you take or select; photos or files you attach in the AI chat (only the file name is sent as text; the file itself is not uploaded); photos taken with the ring's remote shutter (saved to your device only); voice messages you record for the AI assistant (the audio is uploaded for speech recognition and stored with your chat history); voiceprint enrollment recordings captured by the companion robot's microphone and relayed through the App to our servers (biometric information) | Avatar, AI conversation, remote photo capture, voiceprint-based owner recognition on the companion robot | Processed only when you actively use the feature; voiceprint enrollment requires your separate explicit consent | |
| Device & Network Information | Operating system type (iOS/Android), an App-generated random installation identifier, push notification registration ID, IP address and network type, the name of the Wi-Fi network you are connected to (read only during robot provisioning), error diagnostic logs (error type, message, stack trace, request path, session ID). We do not collect advertising identifiers (IDFA/OAID/IDFV) or hardware identifiers such as IMEI. | Push notifications, compatibility, network and security, troubleshooting | Required for security and operation; not used for advertising |
AI Interaction Data (Potentially Sensitive): Text you type; voice messages you record (uploaded for server-side speech recognition); chat history; health Q&A (your recent ring readings such as heart rate, blood oxygen, HRV, stress, steps, sleep and ring battery are attached to your messages to provide context); model output (text and synthesized speech); companion robot settings such as the selected personality and reminders/tasks you create — Used to provide AI Q&A/companionship, risk identification and content safety — Triggered by feature; sensitive interactions and training uses require separate consent — You can clear your chat history in the App at any time; server-side retention: 180 days.
Customer Service & Rights Requests: Contact information (the e-mail address or phone number you use to contact us), communication records, identity verification materials, complaint evidence — Used to process inquiries, complaints, appeals, and personal information requests — Required for service fulfillment and legal obligations — Retained for 3 years after matter closure. The App does not currently provide an in-app feedback form; requests are handled through the contact channels listed in Section 15.
4. Processing of Sensitive Personal Information
4.1 Under CCPA/CPRA, Sensitive Personal Information includes: health and medical data, biometric information, precise geolocation, and personal information of minors under 13 (under COPPA), as well as interaction data that may reflect private emotional or psychological states. The leakage or unlawful use of such information may result in harm to personal dignity or safety.
4.2 Before enabling the corresponding features, we will explain the necessity, categories, purposes, methods, retention period, and impact on your rights, and obtain your explicit consent through separate pop-ups, checkboxes, or other methods. You may disable features or withdraw authorization at any time.
4.3 We will not use sensitive Health Data or AI interaction data constituting Sensitive Personal Information for model training unless we provide a clear explanation and obtain your explicit consent. Training authorization will not be bundled with basic features.
5. Device Permissions
System permission names and invocation methods may vary by operating system and version. We will not proactively or frequently request permissions in irrelevant scenarios. Under CCPA/CPRA, you have the right to limit the use of Sensitive Personal Information to the purposes for which it was collected.
| Permission | Purpose | Corresponding Feature | Control Method |
|---|---|---|---|
| Bluetooth/Nearby Devices | Connect the ring, sync data, firmware upgrade; robot Wi-Fi provisioning and voiceprint enrollment | Pairing & sync / Robot provisioning | Can be disabled; device cannot connect when disabled |
| Location | Outdoor exercise trajectory and map; on some Android versions also required by the system to scan for Bluetooth devices | Exercise / Map / Bluetooth scan | Requested only when you start an outdoor exercise or scan for devices; "While Using" only; if denied, exercise is recorded without a GPS route |
| Camera/Photos | Take or select an avatar, attach images in the AI chat, take photos with the ring's remote shutter | Avatar / AI chat / Remote shutter | Called only on active user action |
| Microphone | Record voice messages for the AI assistant | AI voice chat | Called only while you press and hold to record |
| Notifications (push) | Receive device, health, family and system notifications | Message center / push | Optional; can be disabled in system settings |
| Wi-Fi / network state (Android) | Read the name of the Wi-Fi network you are connected to, to pre-fill robot provisioning | Robot provisioning | Read only during provisioning; the Wi-Fi password you enter is sent to the robot over Bluetooth only |
6. AI, Algorithmic Recommendations, and Anthropomorphic Interaction
6.1 AI Services may use your basic body information, authorized Health Data, and interaction inputs to generate personalized analysis. We will indicate the AI nature in the interface and add explicit or implicit labels to AI-generated content as required by law.
6.2 AI output may contain errors, biases, or content not suitable for individual circumstances. AI health suggestions are for general health management reference only and do not constitute medical diagnosis or treatment advice.
6.3 If we process your input through third-party large models or APIs, we will list the recipient name, processing purpose, information categories, processing methods, retention arrangements, and privacy policy in the Third-Party Information Sharing List. We will obtain your explicit consent before providing Sensitive Personal Information to third parties, and contractually restrict their use beyond the specified purpose and model training.
6.4 You may opt out of personalized recommendations and choose content not based on personal characteristics. You have the right to request an explanation of and opt out of decisions made solely by automated processing that significantly affects your rights, as provided by CCPA/CPRA.
6.5 We do not currently collect guardian or emergency contact information. Where we identify a clear and extreme risk to life or health in an AI interaction, we may contact emergency services based on applicable law or the urgent need to protect life and health.
6.6 Anthropomorphic interaction history supports copying and deletion. Except as required by law or with your explicit consent, such data will not be provided to third parties. After two hours of continuous use, a duration reminder will be issued. Users can exit at any time.
7. Commissioned Processing, Sharing, Transfer, and Public Disclosure
7.1 Commissioned Processing (Service Providers): We may commission cloud hosting and object storage, SMS verification code delivery, push notification, map, and customer service providers to process personal information. We will enter into contracts specifying processing purposes, methods, categories, retention periods, and security obligations, and supervise their performance, in accordance with CCPA/CPRA service provider requirements.
7.2 Sharing/Disclosure to Third Parties: Except with your consent or as required by law, we will not share your personal information with other parties. When sharing is necessary, we will inform you of the recipient's name and contact information, processing purpose, methods, and information categories. For Sensitive Personal Information, we will obtain your explicit consent.
We may share your personal information with:
Service providers, such as cloud hosting and object storage, SMS, push notification and map providers, security and fraud prevention consultants, [a third-party Large Language Model ("LLM") partner that powers our AI assistant —qwen.ai], and staff augmentation and contract personnel, that provide services to us or on our behalf;
Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services they render to us;
Authorities and others, including law enforcement, government authorities, and private parties we believe in good faith to be necessary or appropriate to comply with the law or legal process;
Business transferees, such as acquirers and other relevant participants in business transactions (or diligence or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale, or other disposition of all or any portion of the business or assets of, or equity interests in, ENC or our affiliates (including, in connection with a bankruptcy or similar proceedings);
Distributors and retailers of our Services or other ENC products; and
Affiliates of ENC.
7.3 Transfer: In the event of a merger, acquisition, reorganization, asset transfer, dissolution, or bankruptcy that requires the transfer of personal information, we will inform you of the recipient's name and contact information and require the recipient to continue to be bound by this Policy. If the recipient changes the original processing purpose or method, we will obtain your consent anew.
7.4 Public Disclosure: We generally do not publicly disclose personal information. Where disclosure is necessary, we will explain the purpose and information categories and obtain your explicit consent, except as otherwise required by law.
7.5 We does not sell or rent your personal information, and only shares your personal data with certain trusted service providers and partners so that we can provide and improve our services, to provide partner services and other offerings, and to operate our business. Whenever we share data with third-party service providers, we require that they use your information only for the purposes we've authorized, and for the limited reasons explained in this Policy. We also require these service providers to protect your personal information to at least the same standards that we do.
7.6 Records of commissioned processing and sharing of personal information will be retained for at least three years, or as required by applicable law.
8. Third-Party SDKs and Third-Party Services
| Third Party | Purpose | Information Possibly Processed | Trigger Condition |
|---|---|---|---|
| AutoNavi / Amap (高德地图) Map SDK | Map display of the exercise trajectory | Device and network information and App identifier needed to load map tiles; the trajectory displayed on the map (per Amap's privacy policy) | User opens the exercise map |
| Aurora Mobile / JPush (极光推送) | Push notifications | Push registration ID, device and App information, network information; on Android the SDK declares additional system permissions per its privacy policy | App installed; notifications enabled |
| Google Play Services Location (Android only) | GPS positioning during outdoor exercise | Precise location | User starts an outdoor exercise |
| Ring manufacturer firmware SDK [vendor name to be filled] (CRPSmartRing / MYRing SDK) | Ring Bluetooth connection and firmware update check | Ring MAC address, firmware version and model (sent to the manufacturer's update server when checking for firmware updates) | Ring connected; firmware update check |
9. Data Storage and Cross-Border Transfer
9.1 Personal information collected from users in the United States is stored on servers located in the United States to the extent practicable.
9.2 If cross-border transfer of personal information is necessary, we will conduct a privacy impact assessment, inform you of the recipient's name and contact information, processing purpose, methods, information categories, and how you may exercise your rights. We will obtain your explicit consent and ensure the transfer complies with applicable U.S. laws and international data transfer frameworks.
9.3 We will not transfer personal information across borders solely on the basis that "use of the Service constitutes consent to cross-border transfer," without completing the above notification and consent requirements.
10. Data Retention Period
10.1 We retain personal information as long as reasonably necessary for the purposes described in this Privacy Policy, while we have a business need to do so, or as required by law (e.g., for tax, legal, accounting, or other purposes), whichever is longer. Upon expiration of the retention period or achievement of the processing purpose, we will delete or anonymize the data.
10.2 Where retention is required by law, or where deletion or anonymization is temporarily infeasible for technical reasons, we will cease all processing other than storage and necessary security protection.
10.3 After account closure, production system data will be deleted or anonymized within 15 business days, and backup data will be deleted through overwrite cycles within 90 days.
11. How We Protect Personal Information
11.1 We have established data classification and grading, access approval, least-privilege, encrypted transmission and storage, backup recovery, log auditing, vulnerability management, vendor management, and employee training systems and technical measures.
11.2 We conduct regular security risk assessments, privacy impact assessments, and periodic privacy compliance audits as required by applicable law.
11.3 In the event of actual or potential leakage, tampering, loss, or other security incidents, we will immediately activate the emergency response plan, take remedial measures, and notify affected individuals and relevant authorities as required by applicable law. Notifications will include the incident type, potential harm, measures taken, personal protection recommendations, and contact information.
12. SPECIFIC PRIVACY NOTICE
12.1 If you are a resident of California, Colorado, Connecticut, Delaware (as of January 1, 2025), Iowa (as of January 1, 2025), Maryland (as of October 1, 2025), Minnesota (as of July 31, 2025), Montana, Nebraska (as of January 1, 2025), New Hampshire (as of January 1, 2025), New Jersey (as of January 15, 2025), Oregon, Tennessee (as of July 1, 2025), Texas, Utah, and Virginia, the law in your state may provide you with the following rights:
Right to Know/Access: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting, and the categories of third parties to whom we have disclosed the information.
Right to Delete: You may request deletion of personal information we have collected from you, subject to applicable legal exceptions.
Right to Correct: You may request correction of inaccurate personal information.
Right to Opt-Out of Sale or Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information. We do not sell personal information. To the extent any processing constitutes "sharing" under CCPA/CPRA, you may exercise your opt-out right through the email.
Right to Limit Use of Sensitive Personal Information: You have the right to limit the use of your Sensitive Personal Information to the purposes for which it was collected or as otherwise permitted by law.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect processing conducted prior to withdrawal based on valid consent.
Right to Data Portability: You may request a portable, machine-readable copy of the personal information you provided to us.
Right to Automated Decision-Making: You may request an explanation of and opt out of decisions made solely by automated processing that significantly affect your rights.
Right to Appeal: You may be permitted to appeal our decision, if we deny your request.
In addition, and as set forth below, California law requires us to identify, for the 12-month period prior to the date of this Privacy Policy, what information we may have “sold” or “shared” about you. For the 12-month period prior to the date of this Privacy Policy, we has not sold any Personal Data. We do not sell Personal Data. For the 12-month period prior to the date of this Privacy Policy, we has only shared Personal Data as described above.
Exercising Your Rights. To exercise these rights, you can submit requests as follows:
To request access to, correction of, or deletion of Personal Information collected via your use of the Products, please email us at ubling@enn.cn; or in the ubling app, go to 'Me' > 'Help & Feedback' to submit your feedback and contact us.
To protect your account and information security, we may verify your identity. Where we ask for additional Personal Information to verify your identity, we will only use it to verify your identity or your authority to make the request on behalf of another consumer.For requests that are manifestly unfounded, excessive, or potentially harmful to others' rights, we will explain the processing method as required by law and will not set unreasonable conditions or charge unreasonable fees.
Please note that we are only required to honor requests to know twice in a 12-month period.
13. Children's Privacy
13.1 If you are under the age to consent to data sharing, as applicable based on your jurisdiction, please do not attempt to register for the Products/Services or send any personal information about yourself to us. If we learn that we have collected personal information from a child under the age to consent to data sharing, as applicable based on jurisdiction, we will delete that information as quickly as possible.
13.2 We does not collect Personal Information of children. If you are under the age of 18, please do not attempt to register for the Products/Services or send any Personal Information about yourself to us. If we learn that we have collected Personal Information from an unauthorized minor, we will promptly delete that information from our platform. If you believe that an unauthorized minor may have provided us with Personal Data, please contact us at ubling@enn.cn.
13.2 If anthropomorphic interaction services are provided, we will implement minor mode, usage time limits, reality reminders, content filtering, parental safety alerts, and appeal channels. We will not provide virtual relatives, virtual companions, or other virtual intimate relationship services to minors.
14. Policy Updates
14.1 We may update this Policy due to changes in law, features, or processing activities. Material changes will be prominently notified through pop-ups, push notifications, or in-app messages, with a reasonable review period.
14.2 If new categories of personal information are added, processing purposes or methods are changed, sharing scope is expanded, or new Sensitive Personal Information processing is involved, we will provide renewed notice and obtain your consent or explicit consent as required by law.
15. Contact and Complaints
Privacy Email: ubling@enn.cn
Customer Service: +1 562-387-7764
Mailing Address: 13971 Norton Ave, Chino, CA 91710, USA
You may also file complaints with the Federal Trade Commission (FTC), your state Attorney General, or other relevant regulatory authorities.
Shine the Light Notice (California Civil Code § 1798.83)
California Shine the Light. This Privacy Policy describes how we may share your Personal Data for marketing purposes. If you are a California resident, the Shine the Light law permits you to request and obtain from us once per calendar year information about any of your Personal Information shared with third parties for their own direct marketing purposes, including the categories of information and the names and addresses of those businesses with which we have shared such information. To request this information and for any other questions about our privacy practices and compliance with California law, please contact us through the contact form on our website.
California Right to Limit Use and Disclosure of Sensitive Personal Information.If you are a California resident, you have the right to limit our use and disclosure of your sensitive personal information to those uses that are necessary to provide the Services or goods you request, or as otherwise permitted by law.Sensitive personal information may include consumer health data, biometric information, precise geolocation, and other information defined as sensitive under California law.
The information processed by this Product, including heart rate, blood oxygen, sleep, stress, women's health, precise location, and anthropomorphic interaction content, may constitute Sensitive Personal Information under CCPA/CPRA. We process such information only when there is a specific purpose and sufficient necessity, and we obtain your explicit consent through pop-ups, checkboxes, or other methods. Your refusal or withdrawal of authorization for non-essential features does not affect your use of other features that do not depend on such information.
If you are a California resident, you may request information about our disclosure of your personal information to third parties for their direct marketing purposes during the preceding calendar year. To make such a request, please contact us at ubling@enn.cn.