Privacy Policy

Data Collection and Processing

How We Collect Personal Data and Legal Basis

• User Input: Information you directly provide during account creation, profile completion, fitness logging, or when contacting support.
• Automated Tools: Data automatically collected using cookies, Software Development Kits (“SDKs”), analytics, and logging tools.
• Third-Party Services: We may receive Personal Data from third-party tools or services (e.g., cloud storage, analytics platforms). Such Personal Data is collected in line with the applicable Data Protection Laws.

Legal Bases for Processing

• Your explicit consent.
• Fulfillment of a contract with you (e.g., account setup).
• Compliance with legal obligations.
• Our legitimate interest in maintaining and improving App functionality (where allowed by law).

Purposes of Processing

• To deliver and manage the core functionalities of the App, including blood pressure (BP) and blood glucose (BG) logging, visual analytics, and report generation.
• To personalize your experience by analyzing individual health data and identifying relevant trends.
• To send you important service communications and, where applicable, promotional content with your consent.
• To evaluate and enhance the App’s performance, features, and overall user satisfaction.
• To detect, prevent, and address misuse, fraud, or technical issues.
• To fulfill our legal and contractual responsibilities.
• To comply with the ATT Framework for cross-app tracking, based on your explicit opt-in consent.

No Collection of Certain Sensitive Data

• Contact lists
• Biometric identifiers (beyond voluntary health data input)
• Financial account information

Marketing Communications

Sharing Your Data

1. User-Initiated Sharing
   
   You may choose to export and share your data, such as health readings, with your selected healthcare providers. This process is entirely user-directed and remains under your control.
2. Service Providers
   
   We may share your data with trusted third-party service providers who support the operation, maintenance, and improvement of our App. These providers are contractually bound to handle data in compliance with applicable Data Protection Laws and to use it solely for authorized purposes. Categories include:
   • Cloud hosting and storage services
   • Analytics and performance monitoring tools
   • Customer support and helpdesk platforms
   • Payment processors (where applicable)
   • Communication and email delivery systems
   • IT security and fraud prevention partners
3. Legal Compliance
   
   We may disclose data to comply with applicable laws, regulations, or valid legal processes. Where legally permissible and practical, we will notify you of such requests and may challenge those that are overly broad or lack proper authority.
4. Protection of Rights and Safety
   
   We may share information when necessary to protect the rights, safety, or property of users, our company, or others.
5. With Your Consent
   
   We may share your information with third parties if you have provided explicit, informed consent.

Marketing Communications

Sharing Your Data

Specific Data Sharing Integrations

How Long We Store Data

• It is required by applicable law (e.g., for tax, accounting, or legal compliance purposes).
• It is needed to resolve disputes or enforce our agreements.
• It is subject to mandatory retention periods.
• You have provided consent for longer retention (e.g., for research or support purposes).

Security Measures

• Encryption of data in transit and at rest;
• Access controls and role-based permissions to limit access to Personal Data;
• Regular security audits, vulnerability assessments, and monitoring of our systems;
• Secure development practices and regular updates to address security vulnerabilities;
• Incident response procedures to manage and mitigate data breaches promptly.

Cross-Border Data Transfers

• We ensure that such transfers comply with applicable data protection laws, including the UK GDPR and EU GDPR.
• Transfers are made to countries deemed to provide an adequate level of data protection by the UK Government or the European Commission; or
• We implement appropriate safeguards, such as the International Data Transfer Agreement, the Addendum to the EU Standard Contractual Clauses, or other legally approved mechanisms.

Your Rights

• Right of Access: You have the right to request access to the personal data we hold about you and to obtain a copy of such data.
• Right to Rectification: You may request the correction of inaccurate or incomplete personal data.
• Right to Erasure (Right to be Forgotten): In certain circumstances, you may request that we delete your personal data, subject to legal or contractual obligations.
• Right to Restrict Processing: You may request us to restrict the processing of your personal data in specific situations.
• Right to Data Portability: Where legally applicable, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to have it transmitted to another controller.
• Right to Object: You have the right to object to the processing of your data for direct marketing, profiling, or where we are relying on legitimate interests as a legal basis.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications or tracking personalized experiences), you may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to Opt-Out of Sale or Sharing (for California residents): You may request that we do not “sell” or “share” your personal information as defined under the CCPA/CPRA.
• Right to Limit Use of Sensitive Personal Information (California residents): Where applicable, you may request us to limit our use of your sensitive personal information to that necessary for providing the services.
• HIPAA Privacy Rights (if applicable): If we process protected health information, you have specific rights under HIPAA, including the right to receive a Notice of Privacy Practices, request amendments to your health records, and obtain an accounting of disclosures.
• ATT Framework Rights: Where tracking is involved (e.g., use of device identifiers across apps), we will seek your opt-in consent in accordance with ATT Framework. You can manage or revoke this consent via your device settings.

Children’s Privacy

Complaints and Contact Us

• EEA: Contact your national supervisory authority via the EDPB website.
• UK: Information Commissioner’s Office (ICO) – www.ico.org.uk.
• California: You may also contact the California Privacy Protection Agency via www.cppa.ca.gov.
• HIPAA (if applicable): If you believe your rights under HIPAA have been violated, you may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at www.hhs.gov/ocr.

Changes to This Privacy Policy