SSI mHealth: privacy policy

1. Who we are

The app is made and run by Self Science Institute ApS, a company registered in Denmark (CVR 43627287), Eremitageparken 213, 2D, 2800 Kongens Lyngby, Denmark. We run the app and the server it sends data to.

We are the data controller for the personal data described here.

You use the app as part of a program set up by a practitioner or centre (for example a clinic, a therapist or a wellbeing provider). In this policy, "your centre" means the practitioner or centre that runs your program. Your centre decides which tasks, measurements and sensors your program includes, and it sees the data you send.

Privacy contact: data-protection@selfscience.tech

2. The short version

• Your account is created by your centre. There is no public sign-up in the app.
• What the app collects depends on your program: questionnaires, short tasks, voice recordings, photos or videos, data from Bluetooth sensors you wear, Apple Health or Health Connect data, and, only if your program includes it, your location.
• Apple Health and Health Connect: the app only reads, and only the types you allow. It never writes to them.
• Your data goes to our server in the EU. You and your centre can see it. Other people in your program can see your name and part of your e-mail address in Find Comrades.
• Location is used only if your program includes it, and only while the app is open. If your program includes weather or air quality, your location is sent to OpenWeatherMap and WAQI to look them up.
• The app has no ads, no tracking and no analytics tools. We do not sell your data.
• You can delete your account in the app (Profile, then Delete account) or ask us by e-mail.
• The app is not a medical device.

3. What the app does

SSI mHealth is the companion app for a program you follow with your centre. In the app you can connect wearable sensors over Bluetooth and see their signals, complete the tasks your program gives you (questionnaires, short tasks, practices, voice notes, photos or videos), log moments such as stress, exercise, food, medication or pain, follow practices such as breathing exercises, and see your progress.

The app sends what you record to our server, where you and your centre can see it.

4. What data we process, and why

Below, "legal basis" is the rule in the EU General Data Protection Regulation (GDPR) that allows us to process the data.

4.1 Your account and signing in

What: your centre creates your account. The account can hold:

• first name and last name
• e-mail address
• phone number
• gender
• date of birth
• height and weight
• your password, if your account has one (the server stores it only in a protected, hashed form)
• which centre or centres you belong to, and which programs you follow

In the app you can change your first name, last name, phone number and password. To change your e-mail address, use Account Support.

Signing in: you enter your e-mail address. For most accounts we then send a one-time code to that address. Some accounts sign in with a password and a code from an authenticator app instead; for those, the app shows the authenticator setup the first time.

Why: to give you an account, to show you your program, and to know which data is yours.

Legal basis: performance of a contract with you (GDPR Article 6(1)(b)). Height and weight may be health data; for those, your explicit consent (Article 9(2)(a)).

4.2 Program tasks

What: the answers and recordings you make in the tasks your program gives you:

• answers to questionnaires and check-ins
• results of short tasks that test, for example, attention or memory
• voice recordings (audio), when a task asks for one; the app uses the microphone only during that task
• photos and videos, when a task asks for one; the app uses the camera only during that task
• practices you do (for example breathing exercises): when you started and finished and, for some practices, a few questions before you start, such as whether you have had caffeine and your posture
• moments you log (stress, exercise, food, medication, pain or your own event types), with the time
• when each task was done

After some practices done with a sensor, our server analyses the sensor data from that practice and sends you a report by e-mail.

Why: to run your program, to show you your progress, and so that your centre can follow your program.

Legal basis: your explicit consent, given when you sign the consent form for your program (GDPR Articles 6(1)(a) and 9(2)(a)), because these answers and recordings can reveal information about your health.

4.3 Bluetooth sensors

What: if your program uses a wearable sensor, the app connects to it over Bluetooth and records its signals. The app supports Polar sensors (such as the H10 chest strap and the Verity Sense armband), Movesense sensors and Muse headbands. Depending on the sensor and your program, the recording can include:

• heart rate and the time between heartbeats
• ECG (the heart's electrical signal)
• PPG (the optical pulse signal)
• EEG (brain activity, Muse headbands) and, on Muse S Athena headbands, fNIRS (an optical signal from the forehead)
• movement: accelerometer, gyroscope and magnetometer
• skin temperature (Movesense)
• the sensor's name, type, battery level and connection state

Each recording is uploaded to our server in files. Each file also contains your user ID, your gender, your age (calculated from your date of birth), your height and weight, the name of your program and centre, and the sensor type, so that the signals can be interpreted correctly.

A recording continues while the screen is locked, as long as the app is running. That is the only thing the app does in the background.

Why: to show you your signals, to record them for your program, and to calculate the results and reports your program includes.

Legal basis: your explicit consent (GDPR Articles 6(1)(a) and 9(2)(a)). These signals are health data.

4.4 Apple Health and Health Connect

What: if your program includes a health task, the app asks for permission to read data from Apple Health (on iPhone and iPad) or Health Connect (on Android). It asks for read access only, to some or all of these types:

• weight
• height
• heart rate
• resting heart rate
• blood pressure (systolic and diastolic)
• body temperature
• body fat percentage
• body mass index (BMI, Apple Health only)
• steps
• sleep

You choose which types to allow, in the system's own permission screen, and you can change this at any time in the Health app (iPhone and iPad) or in Health Connect (Android).

In a health task, the app reads the most recent value of each allowed type from the past 12 months, shows them to you, and sends them to our server when you tap Save. A program can also be set up to read these types at set times while the app is running.

The app never writes to Apple Health or Health Connect. Data from Apple Health or Health Connect is not used for advertising or marketing, is not sold, and is not shared with anyone other than you and your centre, except the service providers who store it for us (section 6).

Why: so that you and your centre can follow these measures as part of your program.

Legal basis: your explicit consent (GDPR Articles 6(1)(a) and 9(2)(a)).

4.5 Phone sensors, location and weather

What: a program can include measurements from the phone itself. Only the ones your program includes are collected, and only while the app is running:

• movement and activity: steps, accelerometer and gyroscope, and the type of activity (for example walking)
• phone status: device model and operating system, battery level, free memory, screen on or off, time zone and ambient light
• location: your position (latitude and longitude, with its accuracy and time), and places derived from it
• weather and air quality at your location

Location: the app asks for location permission only if your program includes a location, weather or air-quality measurement. It uses location only while the app is open. It does not collect your location in the background. On Android 11 and older, the system also requires location permission to search for Bluetooth sensors; the app does not record your position for that.

Weather and air quality: to look these up, the app sends your coordinates to OpenWeatherMap (weather) and the World Air Quality Index project, WAQI (air quality). They receive your coordinates and your phone's IP address. The weather and air-quality values are then stored with your program data.

Why: to give context to your sensor data and your answers, when your program asks for it.

Legal basis: your explicit consent (GDPR Articles 6(1)(a) and 9(2)(a)), and the permission you give in the system prompt.

4.6 Consent forms

What: before your program starts, the app shows you a consent form, which you sign with your finger. We store your signature (as an image), your name, the date, which form you signed and which program it is for. The app also records your acceptance of the account terms.

The consent form explains what your program involves and how the data is handled. The standard form currently in the app, "SSI mHealth: Consent to Data Processing", asks for your explicit consent to Self Science Institute ApS processing your personal data, including health data, to run the program you joined with your practitioner or centre, as described in the form and in this policy. Your centre may use its own form. Read the form before you sign: we use your data only for the purposes in this policy and in the form you signed. You can see the forms you have signed in the app, under Profile.

Why: we must be able to show that you gave consent, when, and to what.

Legal basis: our legal obligation to be able to demonstrate consent (GDPR Articles 6(1)(c) and 7(1)).

4.7 Find Comrades

What: the Find Comrades screen lists the other people who follow the same program as you. For each of them, the app receives their first name, last name and e-mail address, and shows their name and the part of their e-mail address before the @. In the same way, people in your program can see your first name, last name and the part of your e-mail address before the @. There is currently no setting in the app to hide yourself from this list. If you do not want to appear in it, write to us (section 8).

Why: so that people who follow the same program can find each other.

Legal basis: our legitimate interest in letting people in the same program find each other (GDPR Article 6(1)(f)). You can object at any time (section 8).

4.8 Support and feedback

What: if you send a message through Account Support, the app sends your message, your user ID and your e-mail address. If you send feedback, the app sends your message, your user ID and any photos or screenshots you attach.

Why: to answer you and to fix problems.

Legal basis: performance of a contract (GDPR Article 6(1)(b)), and our legal obligation to handle requests about your data (Article 6(1)(c)).

4.9 Account deletion requests

If you ask to delete your account in the app, the app sends a request with your user ID, your e-mail address and the source ("mhealth"). Our server then immediately blocks the account and erases its personal details, and we delete the data linked to your account (section 7). We keep the request, including your e-mail address, only to confirm the deletion to you and as a record that it was done. See section 8.

Legal basis: our legal obligation to handle requests about your data and to be able to show that we did (GDPR Article 6(1)(c)).

4.10 Technical data

Like any server, our server receives your phone's IP address and the time of each request. These request logs are kept for 30 days.

The app may download a missing display font from Google Fonts; Google then receives your phone's IP address. The fonts the app uses are included in the app, so this normally does not happen.

Legal basis: our legitimate interest in running a secure service (GDPR Article 6(1)(f)).

We do not use analytics, crash reporting, advertising or tracking tools in this app.

5. Data on your phone

Some data is kept on your phone:

• Your sign-in session (access tokens), your user ID, and your name and e-mail address, so you stay signed in. Signing out removes the sign-in session.
• Sensor recordings and task answers that have not been uploaded yet, for example when you have no connection. They are uploaded when the connection is back.
• Settings, for example your language and notification choices.
• The switches on the Data & Privacy screen and the data access levels in Settings are saved only on your phone. They do not currently change what is collected or who can see it; that is set by your program, as described in this policy. The "Request Data Deletion" button on those screens does not send a request yet; to delete your account, use Delete account in Profile instead (section 8).

6. Who receives your data

We do not sell your data. We do not share it with advertisers.

• Your centre: the practitioners and staff of the centre that runs your program can see your account details and the data you send in that program.
• Other people in your program: your name and the first part of your e-mail address, in Find Comrades (section 4.7).
• Self Science Institute staff, when needed to run the service, to give support, or to handle your requests.
• Our service providers (processors), who store or send data for us under a data processing agreement:
• Server, database and analysis (api.selfscience.tech): Google Cloud (Google Cloud EMEA Limited, Ireland), on servers in the Netherlands.
• File storage: depending on your centre's setting, recordings are stored on our server or in Google Cloud Storage (Google Cloud EMEA Limited, Ireland), in the EU.
• Sending e-mails (sign-in codes and reports): Simply.com (Denmark).
• OpenWeatherMap and WAQI receive your coordinates, only if your program includes weather or air quality (section 4.5).
• Authorities, if the law requires it.

Outside the EU: OpenWeatherMap and WAQI may process your coordinates outside the EU. All other data is stored in the EU. The app does not sign you in by text message, so no text-message provider receives your phone number.

7. How long we keep data

Deleted data can remain in backups for up to 30 days, until they are overwritten.

If the law requires us to keep something longer, we keep only that, and only for as long as required.

8. Your rights

Under the GDPR you have the right to:

• see the data we hold about you (access)
• have wrong data corrected
• have your data deleted
• restrict or object to how we use it
• get your data in a portable format
• withdraw your consent at any time. This does not affect what was done before you withdrew.

To use any of these rights, write to data-protection@selfscience.tech from the e-mail address linked to your account. We answer within one month.

How to delete your account: in the app, open Profile, tap "Delete account" and then "Delete my account", or write to data-protection@selfscience.tech. In the app, your account is deleted immediately, in every Self Science app: it can no longer sign in and its personal details are erased. If the app says that your account cannot be deleted from the app, use Account Support and our team will delete it for you. The data linked to your account is deleted within 30 days, and we confirm by e-mail. Signed consent forms and the record of your request are kept as described in section 7. Step-by-step instructions: https://www.selfscience.tech/en/mhealth/delete-account/

How to stop sharing Apple Health or Health Connect data: turn off the app's access in the Health app (iPhone and iPad) or in Health Connect (Android). Data already sent stays until you ask us to delete it.

How to stop location: turn off location for SSI mHealth in your phone's settings.

You also have the right to complain to the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk, or to the authority in the EU country where you live.

9. Security

• The app talks to our server only over encrypted connections (HTTPS).
• Your sign-in session is kept in the phone's secure storage (the Keychain on iPhone and iPad, encrypted storage on Android).
• Each request from the app is made with your own sign-in, so the server can tell which account it comes from.

10. Children

The app is for adults aged 18 and over. If you think a child has given us data, write to data-protection@selfscience.tech and we will delete it.

11. Not a medical device

SSI mHealth is not a medical device. It does not diagnose, treat, prevent or monitor any disease or condition. Do not use it to make health decisions. If you are worried about your health, talk to a doctor. In an emergency, call your local emergency number.

12. Changes to this policy

If we change this policy, we will update the date at the top and the text in the app. If a change affects how we use data you have already given us, we will tell you in the app or by e-mail before it takes effect.

13. Contact

Self Science Institute ApS, Eremitageparken 213, 2D, 2800 Kongens Lyngby, Denmark

Privacy: data-protection@selfscience.tech

Support: helloworld@selfscience.tech