Privacy Policy

Effective date: October 4, 2026
Last updated: October 4, 2026

XiMiO Health, Inc., doing business as Relay Response ("Relay Response," "we," "us," or "our"), provides CPR and AED readiness training through our website at relayresponse.com, our mobile and smartwatch apps, and our trainer, community, and healthcare dashboards (together, the "Services"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. We collect only what we need to deliver training, measure skills, and improve the Services. We do not sell your personal information.

If you have questions, contact us at contact@relayresponse.com.

Important Note About Our Services

Relay Response apps are intended for training use only and have not been cleared or approved by the U.S. Food and Drug Administration (FDA). The Services are designed to help you learn and practice CPR. They are not intended to diagnose, treat, or monitor any medical condition, and they should never be used in place of calling emergency services. In an emergency, call 911.

Information We Collect

Information We Collect Regarding Cardiac Arrest Victims

We do not receive, collect, or retain any individually identifiable health information regarding cardiac arrest victims. The identity of the individual is unknown to us.

No personally identifiable information such as name, birth date, or Social Security Number is ever reported to or known by us.

Information We Collect From Users

For a better experience, while using our services, we may require you to provide us with certain personally identifiable information, including your full name and email address. Your name and email address are required to issue a certification card.

The information that we request will be retained by us and used as described in this Privacy Policy.

When you create an account with us, you must provide an email address, which serves as your login. If you sign in with Apple, Apple may provide us with a private relay email address instead of your personal email address unless you choose to share it. Your name and email address are visible to our internal administrators.

The app does use third party services that may collect information used to identify you. Below are links to the third party service providers used by the app:

• Google Play Services – Privacy Policy
• Firebase Crashlytics

Training and performance data

When you practice with the app, we use your phone's or smartwatch's built in motion sensors (such as the accelerometer) to measure your chest compressions. We collect:

• Compression rate, depth, and related performance measurements
• Training module progress, quiz results, skills check results, and readiness scores
• Practice history, challenge and leaderboard participation, and completion records

This data describes how you perform CPR on a practice surface. It is not a measurement of your own health. We do not collect heart rate or other smartwatch health data, location data, health records, or other medical information about you, and we do not ask for your age or date of birth.

Log Data

When our services notice an error event, we may collect data and information (through third party products) about your device called "Log Data" to help resolve the technical issues. This "Log Data" may include information such as your device Internet Protocol ("IP") address, device name, operating system version, the configuration of the app when utilizing our service, the time and date of your use of the service, and other statistics.

Service Providers

We may employ third-party companies and individuals due to the following reasons: to facilitate our services, to provide the services on our behalf, to perform service-related services, or to assist us in analyzing how our services are used. These third parties may have access to your personal information to perform the tasks assigned to them on our behalf. However, they are obligated not to disclose or use the information for any other purpose.

Marketing Communications

With your consent, or as otherwise permitted by law, we may send you updates about Relay Response. You can opt out of marketing messages at any time. We do not sell your personal information.

Links to Other Sites

Our services may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by us. Therefore, we strongly advise you to review the Privacy Policy of these websites. We have no control over and assume no responsibility for the content, Privacy Policies, or practices of any third-party sites or services.

Children's Privacy

Our services are not intended to be used by children under 13 years of age ("child"). We do not knowingly collect personally identifiable information from children under the age of 13.

If you are a child under the age of 13, do not use our services or provide any information about yourself to us. That includes your name, address, telephone number, email address, or any screen name or user name.

If we learn that a child has provided us with personal information, we will immediately delete this from our servers. If you are a parent or guardian or believe we might have any information from or about a child, please contact us so that we can perform the necessary actions.

How We Use Information

• To provide the Services, including training modules, real time compression feedback, skills checks, and certification cards
• To create and manage your account and subscription
• To give organizations, trainers, sponsors, and credentialing partners the information described under How We Share Information
• To measure and report training outcomes, such as changes in confidence and skill, generally in aggregated or de-identified form
• To improve our curriculum, feedback accuracy, and product features
• To send you service messages, practice reminders, and, where permitted, updates about Relay Response. You can opt out of marketing messages at any time.
• To respond to questions and support requests
• To keep the Services secure, prevent fraud, and verify the authenticity of certification cards
• To comply with legal obligations and enforce our Terms of Service

We retain the data we collect for the purposes of analysis, reporting, technology development, and quality control. From time to time, we may share aggregated reports and analysis of this information with qualified partners, agencies, or other third parties. These reports will never include any personally identifiable information.

How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as described below.

• Your organization or trainer: if you participate through an employer, school, trainer, sponsor, or other organization, we share your name, enrollment, progress, completion status, skills results, and readiness scores with that organization's administrators or your trainer so they can manage and report on training.
• Sponsors: if you participate in a community training program supported by a sponsor, that sponsor may have access to your name and email address. Sponsors receive community impact reports only in aggregated or de-identified form.
• Credentialing partners: if you earn a co-branded credential, such as a card issued in partnership with the Heart Rhythm Society, we share the information needed to issue and verify that credential, including your name, email address, completion date, and credential ID.
• Service providers: companies that help us operate the Services, such as cloud hosting, app and website development, analytics, subscription management, customer support, and email delivery. They may use your information only to provide services to us.
• Research and outcomes reporting: we may publish or share aggregated or de-identified results, such as the percentage of participants whose confidence improved after training. These results do not identify you. If we ever want to use identifiable information for a research study, we will ask for your consent first.
• Legal and safety: when required by law, or when we believe disclosure is needed to protect the rights, safety, or property of Relay Response, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.
• With your consent: in any other case where you ask us to or agree that we may.

How Long We Keep Information

We keep your information for as long as your account is active and as needed to provide the Services. Certification records are kept for 3 years so that certification cards can be verified. When information is no longer needed, we delete it or de-identify it. You can ask us to delete your account at any time (see Your Choices and Rights).

Cookies, Analytics, and Advertising

Our website uses cookies and similar technologies to operate the site, understand how visitors use it, and improve it. These include:

• Essential cookies needed for the site to work
• Analytics such as Google Analytics, which helps us understand how visitors find and use our website
• Website feedback tools such as BugHerd, used by our team and partners to report website updates
• Advertising: we do not currently use advertising or retargeting cookies, pixels, or tags. If we add them, we will update this Privacy Policy before they are used.

You can control cookies through your browser settings.

How We Protect Information

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls, and limiting access to people who need it to operate the Services. No system is completely secure, so we cannot promise that information will never be accessed without authorization. If a data breach affects your personal information, we will notify you as required by law.

Your Choices and Rights

• Account information: you can view the name and email address we have on file in the app's Settings menu, and you can update your name in the app. Your email address is your login; to change it, contact us at contact@relayresponse.com.
• Delete your account: you can delete your account in the app or by emailing contact@relayresponse.com. If your account was created by an organization, we may need to coordinate with that organization.
• Marketing messages: use the unsubscribe link in any marketing email, or turn off notifications in your device settings.
• Device permissions: you can turn off motion sensor or notification access in your device settings, although some training features will not work without them.

Additional rights for residents of certain U.S. states

Depending on where you live, including California, Colorado, Connecticut, Virginia, Texas, and other states with consumer privacy laws, you may have the right to:

• Know what personal information we collect, use, and disclose
• Access a copy of your personal information
• Correct inaccurate personal information
• Delete your personal information
• Opt out of the sale of personal information, targeted advertising, or profiling (we do not sell personal information)
• Not be discriminated against for exercising these rights

To make a request, email contact@relayresponse.com. We will verify your identity before responding. You may use an authorized agent where permitted by law. If we deny your request, you may appeal by replying to our decision.

Healthcare Organizations

If a hospital, health system, or other healthcare organization uses the Relay Response healthcare dashboard to train its staff, we process staff training information on that organization's behalf under our agreement with them. This information relates to staff training and skills, not patients. We do not receive or process patient information, and healthcare organizations should not enter patient information into the Services.

International Users

The Services are operated in the United States and intended for users in the United States. If you use the Services from outside the United States, your information will be transferred to and processed in the United States.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above, and if the changes are significant, we will notify you in the app or by email before they take effect.

California Privacy Rights

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

If you are under 18 years of age, reside in California, and have a registered account with our services, you have the right to request removal of unwanted data that you publicly post on our services. To request removal of such data, please contact us using the contact information provided below, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on our services, but please be aware that the data may not be completely or comprehensively removed from our systems.

Contact Us