Privacy Policy
& data rights.

Privacy Policy Canada

Navien OptiSleep

Effective Date: July 22, 2026

Navien OptiSleep ("Navien," "we," "us," or "our") is committed to protecting the privacy of individuals and safeguarding personal information in accordance with applicable Canadian privacy laws, including the federal Personal Information Protection and Electronic Documents Act ("PIPEDA"), applicable provincial private-sector privacy laws, and, where applicable, Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25.

This Privacy Policy explains how we collect, use, disclose, retain, transfer, and protect personal information in connection with our Canadian website, ecommerce store, products, mobile applications, connected product features, customer support, warranty services, marketing activities, affiliate/referral programs, reviews, analytics, advertising, and related services.

1. What Is Personal Information

“Personal information” means information about an identifiable individual. This may include, for example, your name, mailing address, email address, telephone number, payment-related information, IP address, device identifiers, order details, warranty information, customer support communications, application usage information, and information relating to your interactions with our website, products, applications, or services.

Personal information generally does not include business contact information used solely to communicate with an individual in a business or professional capacity, where that information is excluded from applicable privacy law.

2. Accountability

Navien is responsible for personal information under its control. We have designated a Privacy Officer who is accountable for our compliance with this Privacy Policy and applicable privacy laws. Contact details for the Privacy Officer are provided in Section 18 below.

We also use third-party service providers to support our website, ecommerce operations, marketing, analytics, customer support, reviews, affiliate/referral programs, consent management, and related services. Where these service providers process personal information on our behalf, we require appropriate contractual, technical, organizational, and other safeguards designed to protect the information.

3. Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information.

Contact and Account Information
We may collect your name, mailing address, billing address, shipping address, email address, telephone number, account login information, communication preferences, and similar identifiers.

Order, Payment, Shipping, and Transaction Information
We may collect products purchased, order history, billing and shipping details, payment-related information, payment status, returns, refunds, purchase confirmations, discounts, referral codes, affiliate codes, and related transaction records.

Product, Warranty, and Support Information
We may collect product model, serial number, registration information, purchase date, warranty claims, service history, troubleshooting records, replacement requests, support inquiries, and related communications.

Website, Device, and Network Information
We may collect IP address, browser type, operating system, device identifiers, cookie identifiers, pixel data, referral URLs, pages viewed, links clicked, session information, approximate location, time zone, language settings, and interactions with our website, advertisements, or digital content.

Application and Connected Product Information
If you use a Navien OptiSleep application or connected product feature, we may collect device type, operating system, application usage information, device identifiers, push notification tokens, diagnostics, product settings, feature usage, usage patterns, and information generated through optional connected product features.

Location Information
We may collect approximate location derived from IP address, postal code, time zone, or precise geolocation where required for application functionality and where enabled or permitted by you.

Optional Sleep-Related Information
If you enable optional sleep-related functionality, we may collect sleep-related settings, comfort preferences, usage patterns, automated temperature or comfort adjustments, audio-derived signals such as breathing sound data, and related product or application data. Our U.S. OptiSleep notices identify optional sleep-related functionality, precise geolocation, device/application data, audio-derived signals, and automated comfort features as part of the product's privacy disclosures.

Affiliate, Referral, and Promotion Information
We may collect referral source, affiliate code, discount code, customer ID, customer name, email address, phone number, address, order details, and related referral or affiliate tracking information. We may use affiliate marketing providers, such as Uppromote or similar providers, to operate affiliate or referral programs, track referrals, attribute orders, and manage affiliate-related communications.

Review, Survey, and Social Proof Information
We may collect customer name, email address, phone number, postal code, transaction currency, product review content, survey responses, product photos, and optional social media profile information if you choose to authenticate through social login or a similar feature. We may use review and social proof providers, such as Okendo or similar providers, to collect, display, moderate, and manage customer reviews, survey responses, product photos, and related user-generated content.

Analytics, Attribution, and Session Information
We may collect or process IP address, approximate location, device type, operating system, device ID, browser version, locale, language, activity logs, cookies, pixels, inferred information, session recordings, website interactions, shopping activity, order attribution, and conversion data. We may use analytics and attribution providers, such as Triple Whale or similar providers, to measure website performance, advertising attribution, campaign effectiveness, session behavior, ecommerce performance, and return on advertising spend.

Email, SMS, and Marketing Engagement Information
We may collect name, email address, phone number, purchase history, order data, site activity, email open activity, email click activity, browse abandonment activity, cart abandonment activity, SMS opt-in status, unsubscribe records, suppression records, and marketing consent records. We may use email and SMS marketing providers, such as Klaviyo or similar providers, to send communications, manage consent, and measure engagement.

Consent and Privacy Preference Information
We may collect cookie consent status, privacy preference selections, opt-in and opt-out actions, consent dates and times, browser and device information, anonymized or partial IP address, disabled cookie categories, privacy request submissions, and related consent logs. We may use consent-management providers, such as Consentmo or similar providers, to manage cookie banners, consent preferences, opt-out choices, and privacy request workflows.

Store Optimization and Technical Service Information
We may process merchant-side usage information, image optimization activity, SEO optimization activity, and technical logs through providers that help optimize website images, performance, and search functionality. We may use providers such as TinyIMG or similar providers for server-side image optimization, SEO support, and related technical services. Based on the information provided, TinyIMG is not intended to inject tracking scripts into the customer-facing storefront.

Inferences and Preferences
We may derive product interests, comfort preferences, usage patterns, purchase tendencies, marketing segments, advertising audiences, or other insights based on your interactions with our website, products, applications, advertisements, communications, reviews, referrals, or services.

Sensitive Personal Information
We may collect sensitive personal information where applicable, such as precise geolocation, sleep-related information, audio-derived signals, or other information that may be considered sensitive depending on the context. We collect sensitive personal information only where reasonably necessary and with consent where required by applicable law.

4. How We Collect Personal Information

We collect personal information in the following ways:

• Directly from you, such as when you place an order, create an account, register a product, request warranty support, contact customer service, submit a review, participate in a survey, subscribe to communications, participate in promotions, or provide information through our website or applications.
• Automatically when you use our website, applications, connected product features, or online services, including through cookies, pixels, tags, SDKs, local storage, analytics tools, attribution tools, advertising technologies, server logs, diagnostic tools, and similar technologies.
• From products, applications, and connected features you choose to enable, including optional sleep-related functionality, device identifiers, application settings, diagnostics, usage patterns, comfort preferences, and related feature data.
• From service providers and business partners, such as Shopify, payment processors, shipping providers, fulfillment providers, hosting providers, analytics providers, advertising partners, affiliate/referral providers, review providers, customer support vendors, application service providers, email/SMS service providers, consent-management providers, and warranty support vendors.

Where required by applicable law, we will obtain consent before collecting, using, or disclosing personal information, including sensitive personal information or information collected through optional application features.

5. Purposes for Collection and Use

We collect and use personal information for purposes that a reasonable person would consider appropriate in the circumstances, including:

• To process orders, payments, shipping, returns, exchanges, refunds, discounts, and promotional offers.
• To provide, operate, maintain, and improve our website, ecommerce store, products, applications, connected product features, and services.
• To create and manage accounts.
• To register products, administer warranties, process warranty claims, troubleshoot issues, and provide customer support.
• To provide optional application features, including sleep-related functionality, comfort settings, automated product features, and related diagnostics, where enabled by you.
• To request, collect, publish, moderate, and manage product reviews, survey responses, photos, testimonials, and related user-generated content.
• To manage affiliate, referral, influencer, promotional, and discount programs.
• To send transactional, service, warranty, safety, recall, administrative, or account-related communications.
• To send marketing or promotional communications where you have consented or where permitted by law.
• To measure website, product, application, advertising, affiliate/referral, review, survey, and marketing performance.
• To personalize user experience, product recommendations, website content, advertising, or marketing communications, where permitted by law.
• To conduct surveys, promotions, product research, testing, analysis, and product development.
• To support analytics, attribution, session analysis, ecommerce reporting, advertising measurement, and campaign optimization.
• To detect and prevent fraud, misuse, security incidents, unauthorized transactions, or other harmful activity.
• To comply with legal, tax, accounting, warranty, product safety, reporting, and regulatory obligations.
• To establish, exercise, or defend legal claims.
• To evaluate or conduct a business transaction, such as a merger, acquisition, financing, restructuring, or sale of assets.

If we intend to use personal information for a new purpose that is not identified in this Privacy Policy or otherwise permitted by law, we will identify that purpose and obtain consent where required.

6. Optional Application Features and Sensitive Information

Certain OptiSleep application or connected product features may be optional. If you choose to enable those features, we may collect and use information necessary to provide them, such as precise geolocation, device identifiers, product usage information, sleep-related settings, comfort preferences, usage patterns, diagnostics, application data, and audio-derived signals such as breathing sound data.

We use this information to provide the requested feature, improve product functionality, support automated comfort adjustments, maintain product performance, provide customer support, troubleshoot issues, and improve our products and services.

We do not use sensitive personal information collected through optional application features for targeted advertising unless we have obtained consent where required by law.

You may withdraw consent for optional features by disabling the relevant feature through application settings, where available, or by contacting us. Withdrawal of consent may limit or disable certain optional features, but it will not affect core order, warranty, customer support, legal, or account functions.

7. Cookies, Pixels, Analytics, and Similar Technologies

We use cookies, pixels, web beacons, SDKs, tags, local storage, analytics tools, attribution tools, advertising technologies, session recording tools, consent-management tools, and similar technologies to:

• Enable core website functionality.
• Maintain sessions and protect website security.
• Process carts, checkout, payment, account, and order functions.
• Remember preferences.
• Measure website, application, and advertising performance.
• Understand website, product, and application usage.
• Support affiliate and referral tracking.
• Request and manage reviews and surveys.
• Support email, SMS, and marketing automation.
• Support advertising, attribution, remarketing, and campaign measurement.
• Improve products, services, and user experience.

These technologies may be provided by service providers such as Consentmo, Triple Whale, Klaviyo, Okendo, Uppromote, Shopify, Google, Meta, or similar providers. Depending on the tool, these technologies may collect or process IP address, approximate location, device information, browser information, cookie identifiers, pixel data, pages viewed, links clicked, referring source, order attribution, product interest, session activity, inferred data, and marketing engagement information.

We use Consentmo or a similar consent-management platform to manage cookie preferences, privacy choices, opt-out requests, and consent records. Where required by applicable law, including Québec privacy law, non-essential cookies, analytics tools, advertising cookies, pixels, session recording technologies, profiling technologies, or similar tracking technologies will not be activated unless the required consent has been obtained.

We may use Triple Whale or similar analytics and attribution tools to measure website performance, advertising attribution, conversion activity, ecommerce analytics, user behavior, and campaign effectiveness. Because tools like Triple Whale may involve cookies, pixels, session recordings, inferred data, advertising attribution, or cross-context tracking, we will manage these technologies through our consent-management tools where required by applicable law.

You may manage cookie preferences through our cookie banner, consent-management tool, preference center, or browser settings. Disabling cookies may affect website functionality.

8. Marketing Communications and CASL

We may send you marketing or promotional communications where you have consented or where permitted by law. We comply with Canada's Anti-Spam Legislation ("CASL") for commercial electronic messages.

Marketing communications may include product updates, promotional offers, newsletters, abandoned-cart communications, browse abandonment communications, event information, surveys, review requests, referral program communications, affiliate-related communications, or other commercial messages.

We may use email, SMS, affiliate, referral, review, survey, and marketing automation providers, such as Klaviyo, Uppromote, Okendo, or similar providers, to send communications, manage marketing preferences, administer referral or affiliate programs, collect reviews, request survey responses, measure engagement, and improve marketing effectiveness.

These providers may process contact information, order history, discount or referral information, email open and click activity, SMS consent status, unsubscribe records, product review content, survey responses, and related engagement data.

Marketing emails will include an unsubscribe mechanism and our required contact information. You may unsubscribe from marketing communications at any time by using the unsubscribe link in the message or by contacting us. You may continue to receive transactional, warranty, safety, recall, service, legal, or administrative communications where permitted or required by law.

If we offer SMS marketing, we will obtain consent where required and will not share SMS opt-in data or SMS consent status with third parties for their unrelated marketing purposes.

9. Disclosure of Personal Information

We disclose personal information only as necessary and for legitimate business purposes, including to:

• Ecommerce, website, and application platform providers, such as Shopify or similar providers.
• Payment processors and financial institutions.
• Shipping, logistics, fulfillment, returns, and warehouse providers.
• Customer service, warranty, repair, and technical support providers.
• Hosting, cloud, IT, cybersecurity, fraud prevention, and infrastructure providers.
• Analytics, attribution, session recording, and advertising measurement providers, such as Triple Whale or similar providers, to measure website performance, conversion activity, advertising effectiveness, attribution, session behavior, and ecommerce analytics, subject to applicable consent and opt-out requirements.
• Advertising networks, marketing platforms, and social media platforms, where permitted by law and subject to your consent or privacy choices where required.
• Affiliate and referral program providers, such as Uppromote or similar providers, to administer affiliate programs, track referrals, manage discount or referral codes, attribute orders, and support affiliate communications.
• Review, survey, and social proof providers, such as Okendo or similar providers, to request, collect, display, moderate, and manage customer reviews, survey responses, product photos, and related user-generated content.
• Email, SMS, and marketing automation providers, such as Klaviyo or similar providers, to manage subscriber lists, consent records, marketing campaigns, transactional or service communications, open and click tracking, SMS opt-ins, unsubscribe records, and marketing analytics.
• Consent-management and privacy request providers, such as Consentmo or similar providers, to manage cookie banners, consent logs, opt-in and opt-out preferences, privacy request pages, and related compliance workflows.
• Store optimization, image optimization, SEO, and technical service providers, such as TinyIMG or similar providers, to optimize product images, improve site performance, support SEO functionality, and process related technical information.
• Product research, survey, testing, and product development providers.
• Professional advisors, such as legal, accounting, audit, insurance, or compliance advisors.
• Government authorities, regulators, courts, or law enforcement where required or permitted by law.
• Parties involved in a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction.

Some service providers act solely on our behalf as processors or service providers, while others may process limited information as independent controllers for their own legally permitted business purposes. Where required, we use contractual, technical, organizational, and other safeguards designed to protect personal information.

We do not sell personal information.

10. Cross-Border Transfers

Personal information may be stored, processed, or accessed outside your province or territory, including outside Québec, or outside Canada, including in the United States, Korea, European Union, United Kingdom, Australia, Singapore, Israel, or other jurisdictions where Navien, its affiliates, or service providers operate.

The privacy laws of those jurisdictions may differ from Canadian laws, and personal information may be subject to lawful access requests by courts, law enforcement, regulators, or government authorities in those jurisdictions.

Our service providers may store, process, or access personal information outside Canada, depending on the provider and service. For example, ecommerce, marketing, analytics, affiliate, review, attribution, consent-management, and technical-service vendors may process or access personal information outside Canada.

Where required by Québec law, we will assess transfers of personal information outside Québec and use contractual, technical, organizational, and other safeguards designed to provide adequate protection for the information.

11. Québec Privacy Rights and Law 25 Disclosures

If you are located in Québec, you may have additional rights under Québec privacy law, including the right to:

• Access personal information we hold about you.
• Request correction of inaccurate, incomplete, or ambiguous personal information.
• Withdraw consent, subject to legal or contractual restrictions and reasonable notice.
• Request deletion or de-indexing where applicable.
• Request information about our use, disclosure, and retention of personal information.
• Request information about the use of technologies that identify, locate, or profile you.
• Request portability of computerized personal information collected from you, where required by law and subject to applicable limitations.

Where required by Québec law, we will provide notice and obtain consent before activating technologies that identify, locate, or profile an individual. We will also use privacy-by-default settings where required for products or services offered to the public that include privacy settings.

Québec's data portability right applies to certain computerized personal information collected from the individual and came into force on September 22, 2024.

12. Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity of personal information. These safeguards may include access controls, authentication measures, encryption where appropriate, confidentiality obligations, vendor controls, retention controls, security monitoring, and employee or service provider restrictions.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. However, we take reasonable measures designed to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, disposal, loss, or theft.

13. Retention of Personal Information

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, including to provide products and services, process orders, administer warranties, provide customer support, comply with legal, accounting, product safety, tax, warranty, and regulatory obligations, resolve disputes, prevent fraud, and establish, exercise, or defend legal claims.

For example:

• Order, payment, shipping, and transaction records may be retained for the period required for accounting, tax, warranty, legal, and business recordkeeping purposes.
• Warranty and product support records may be retained for the applicable warranty period and a reasonable period thereafter for warranty administration, product safety, claims handling, and legal compliance.
• Customer service records may be retained for a reasonable period after resolution.
• Marketing consent, unsubscribe, and suppression records may be retained as needed to manage consent and comply with CASL and other legal obligations.
• Affiliate, referral, discount, attribution, review, survey, and promotional records may be retained as needed to administer the relevant program, resolve disputes, prevent fraud, and comply with legal or business requirements.
• Consent records, cookie preferences, opt-out records, and privacy request records may be retained as needed to demonstrate compliance and manage privacy choices.
• Information collected through optional application features may be retained until service termination, withdrawal of consent, or deletion request, unless a longer retention period is required or permitted by law.

Third-party service providers may retain information in accordance with their agreements with us, their technical backup cycles, and applicable legal requirements. For example, affiliate, analytics, marketing, consent-management, review, and technical-service providers may retain operational records, consent logs, attribution records, review records, marketing engagement records, or backup copies for limited periods necessary to provide their services, comply with legal obligations, maintain security, or support audit and dispute-resolution purposes.

Where a provider's retention period is controlled by us through dashboard settings or contract terms, we will configure or instruct retention in a manner consistent with our legal obligations and business needs.

When personal information is no longer required, we will securely destroy, delete, erase, anonymize, or de-identify it in accordance with our retention practices and applicable law.

14. Access, Correction, Withdrawal of Consent, and Other Rights

Subject to applicable law and limited exceptions, you may request access to personal information we hold about you and request correction of personal information that is inaccurate or incomplete.

You may also withdraw consent to our collection, use, or disclosure of personal information, subject to legal or contractual restrictions and reasonable notice. If you withdraw consent, we may no longer be able to provide certain products, services, application features, marketing communications, warranty support, customer support functions, or personalized functionality.

Depending on your province or territory, you may have additional rights, including rights relating to deletion, portability, information about disclosures, and complaint handling.

Requests must be made in writing using the contact information below. We may require verification of your identity before responding.

15. Children's Privacy

Our website, products, and services are intended for individuals who are at least the age of majority in their province or territory of residence. We do not knowingly collect personal information from minors without appropriate consent where required by law. If you believe a minor has provided personal information to us, please contact us.

16. Third-Party Websites and Services

Our website, applications, or communications may contain links to third-party websites, platforms, applications, stores, payment services, shipping services, social media platforms, or other services. We are not responsible for the privacy practices, content, or security of third-party websites or services. This Privacy Policy does not apply to third-party services. We encourage you to review their privacy policies before providing personal information.

17. Automated Processing and Optional Product Features

We may use automated processing in connection with certain optional product or application features, such as comfort adjustments based on usage patterns, product settings, or related activity. These features are designed to enhance product functionality and user comfort and are not intended to produce legal or similarly significant effects.

Where required by applicable law, we will provide additional notice or obtain consent before using automated processing that has a legal or similarly significant effect or that otherwise requires consent.

18. Contact Information and Privacy Officer

If you have questions about this Privacy Policy, wish to withdraw consent, want to request access to or correction of your personal information, or wish to submit a privacy complaint, please contact:

Navien OptiSleep – Privacy Officer
Email: optisleep@navien.com

Mailing Address:
Navien, Inc.
Attn: Privacy Officer
20 Goodyear
Irvine, CA 92618
United States

If your inquiry relates to Canadian or Québec privacy rights, please indicate that in your request so we can route it appropriately.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, products, services, or legal requirements. Any changes will be effective when the updated version is posted on our website, with the revised effective date indicated above. Where required by law, we will provide additional notice or obtain consent for material changes.

A French version of this Privacy Policy is available upon request and should be made available for Québec users where required by applicable law.