Last updated 20 September 2026
Your health data is read on your own computer and is never sent anywhere. This page explains the small amount of data that does exist, and who holds it.
SleepLab is run by an individual based in Italy, who is the data controller for the purposes of the GDPR (Regulation (EU) 2016/679). Our full identity and postal address are given on request, by writing to the address below.
Contact: ciao@getsleeplab.com
SleepLab is a single web page. When you drop your Apple Health export.zip onto it, your browser opens the file on your own disk and does the whole calculation there. The export, and everything computed from it, stays on your machine. It is not uploaded, not transmitted, and there is no server that could receive it.
You can check this yourself: load the app, turn off your Wi-Fi, then drop your export. It still works.
The app keeps your processed figures in your browser's local storage, so that the page still has them the next time you open it. That storage sits on your device, belongs to you, and is not readable by us or by anyone else. The app has a button that erases it, and clearing your browser's site data does the same thing.
Nothing directly. There are no analytics, no tracking pixels, no advertising, no social widgets, and no cookies. Fonts and scripts are served from this site rather than fetched from a third party, so loading a page here does not hand your IP address to anyone else.
The site is hosted on Cloudflare, which acts as our processor and, like any web host, records technical request logs (IP address, time, page requested, user agent) to serve the pages and to stop abuse. We do not use those logs to build any profile of you.
| Who | What they get | Why |
|---|---|---|
| Cloudflare | Technical request logs, including your IP address | Hosting and security. Legitimate interest, Art. 6(1)(f) |
| Lemon Squeezy | Your name, email and billing details, only if you buy | Selling, invoicing and paying VAT. Contract, Art. 6(1)(b) |
The purchase is handled by Lemon Squeezy, which acts as the Merchant of Record: they take the payment, handle VAT, and are the seller on your receipt. They collect your name, email address, billing country and payment details directly, under their own privacy policy, and we never see your card number.
From them we receive your name, your email address and your order details, which we use to send you the product and your licence key, to answer you if you write, and to keep the accounting records Italian law requires us to keep. Invoicing records are kept for ten years, as required by Art. 2220 of the Italian Civil Code. We do not send marketing emails.
Only at that click is Lemon Squeezy's checkout script fetched, which is also the first moment your IP address reaches them. An ordinary visit to this site contacts nobody. From there the payment is theirs to handle, under their own privacy policy, and we never see your card details.
SleepLab can pack a summary of your figures into a text brief for you to paste into Claude, Anthropic's assistant. This is optional, and nothing happens until you copy that text and paste it somewhere yourself. If you do, the summary leaves your device at that moment and is handled by Anthropic under their terms; it contains sleep and training figures, dates and tracker names, and no name or email. Every number in SleepLab is computed by the page itself, with no AI involved. Skipping this feature costs you nothing.
Under the GDPR you can ask us for access to your data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interest. Write to ciao@getsleeplab.com and we will answer within one month.
In practice the only data we hold about you is your order record, and only if you bought something. Your health data is not ours to give you: it is already on your machine and nowhere else.
If you think we have handled your data badly you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, or to the authority in your own EU country.
Cloudflare and Lemon Squeezy are US-based companies and may process data outside the EU under the European Commission's Standard Contractual Clauses. We do no profiling and take no automated decisions about you. SleepLab is not intended for anyone under 16.
If this policy changes, the date at the top changes with it. Material changes will be mentioned on the home page.