Privacy Policy Datico® LIFE APP

This privacy policy applies to the mobile app Datico® LIFE APP for Android and iOS. It describes which personal data the app collects, how it is used and with whom it is shared. Our website is covered by the separate website privacy policy.

1. Provider of the app and contact

The app is provided and published by:
Datico Sport & Health GmbH
Marktler Straße 61
84489 Burghausen
Germany
Phone: +49 8677 76794-0
Email: info@datico.com

You can reach our data protection officer at datenschutz[at]kreutzpointner.de.

2. Who is responsible for your data?

The Datico® LIFE APP is part of the Datico® LIFE HUB platform. Our customers are organisations – for example hospitals, rehabilitation facilities, performance centres, Olympic training centres, federations or research institutions. Each organisation uses its own separate area in the Datico® LIFE HUB (tenant).

Your organisation is the controller within the meaning of Art. 4(7) GDPR for the measurement, health and performance data you record with the app and transfer to its tenant. It decides for which purposes this data is processed, who may access it and how long it is stored. Which organisation this is follows from your invitation or the access you use to sign in to the app. For details, please refer to your organisation's privacy notice.

Datico is the processor (Art. 28 GDPR): we operate the app and the platform on behalf of your organisation, process the data solely on its instructions and do not use it for our own purposes.

Datico is itself the controller only for narrowly limited operations: handling requests you send directly to us (e.g. support or deletion requests via our deletion page).

3. Data processed by the app

3.1 Account and sign-in data

To use the app, you sign in with a personal access – either via an invitation from your organisation or via an access you created yourself (e.g. for testing). We process your name, email address, an internal user ID, your assignment to your organisation and technical sign-in information (session tokens). Sign-in is handled by a central identity service (Keycloak), which we operate at Amazon Web Services (AWS) exclusively in data centres in Frankfurt am Main, Germany (see section 6).

3.2 Data from connected wearables

The app connects directly to wearables (e.g. sports watches, chest straps or measuring devices) via Bluetooth and transfers their readings, clearly assigned to you, to your organisation's tenant. The app currently supports Polar wearables; further manufacturers may be added. Which values are transferred depends on the wearable and on your organisation's configuration. They may include:

health and vital data, e.g. heart rate, heart rate variability (HRV), blood pressure, body weight
training and activity data, e.g. training duration, distance covered, speed, load values
sleep and recovery data
metrics and analyses calculated by the device manufacturer, e.g. sleep or recovery analyses
identifier, model and serial number of the connected wearable

Health data belongs to the special categories of personal data under Art. 9 GDPR and is protected accordingly (see section 7). The app itself does not make diagnoses or provide medical assessments.

3.3 Location data

The app does not determine the location of your smartphone and does not request location permission. Location data is only transferred if the connected wearable records it itself – for example GPS positions of a training route. Like all other readings, this data is assigned to you and transferred to your organisation's tenant.

3.4 What the app does not do

The app shows no advertising, does not sell data and does not share data with third parties for advertising or marketing purposes. It contains no analytics, tracking or crash reporting services and no push notification services (e.g. Firebase).

4. App permissions

The app only requests permissions it needs to function:

Bluetooth / nearby devices: to find and pair wearables and to receive their readings.
Background operation: so that the app can regularly sync readings from your wearables even when it is not open.
Internet access: to transfer readings to the Datico® LIFE HUB in encrypted form.

You can revoke granted permissions at any time in your smartphone's settings. Without the Bluetooth permission, the app cannot connect to wearables; without background operation, it only syncs while it is open.

5. Purposes and legal bases

The app processes your data to record readings from wearables, assign them to you, transfer them to your organisation's tenant and display results to you in the app.

Data in your organisation's tenant: the legal basis is determined by your organisation as the controller. For health data, this is usually your explicit consent (Art. 9(2)(a) GDPR) or – for example in the context of treatment – Art. 9(2)(h) GDPR in conjunction with Section 22 of the German Federal Data Protection Act (BDSG). For details, please refer to your organisation's privacy information.

Datico's own processing: we handle your requests and deletion requests to comply with legal obligations (Art. 6(1)(c) GDPR) and on the basis of our legitimate interest in reliable support (Art. 6(1)(f) GDPR).

6. Recipients and sharing

Your data is only received by:

Your organisation and the persons it authorises (e.g. therapists, coaches, researchers) – within the roles and rights your organisation defines in the Datico® LIFE HUB.
Datico Sport & Health GmbH as processor, to the extent necessary for operation, maintenance and support.
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, as a sub-processor bound by instructions for hosting the Datico® LIFE HUB and the sign-in service (Keycloak). The data is processed exclusively in data centres in Frankfurt am Main, Germany.

Wearable manufacturers: the app includes software libraries (SDKs) of wearable manufacturers, currently the Polar SDK. Communication between the app and the wearable runs exclusively locally via Bluetooth; the app does not transfer any data to the manufacturer's servers. If you also use an app or account of the manufacturer (e.g. Polar Flow), the manufacturer's own privacy policy applies.

App stores: when you download the app, Google (Google Play) or Apple (App Store) process data under their own responsibility and privacy policies. We have no influence on this.

All data is stored in data centres in Germany; the app does not transfer data to countries outside the EU/EEA. As AWS belongs to a group headquartered in the USA, access from there cannot be completely ruled out in exceptional cases. Appropriate safeguards are in place for this: Amazon Web Services, Inc. is certified under the EU-US Data Privacy Framework, and the EU Commission's standard contractual clauses apply in addition. We do not sell personal data.

7. Data security

Readings the app downloads from wearables are stored on the smartphone in an encrypted local database (see section 8).
All data is transferred between the app and the Datico® LIFE HUB in encrypted form (TLS/HTTPS).
The data is stored exclusively on servers in Frankfurt am Main, Germany.
Each organisation has its own separate tenant; access is restricted to authorised persons through roles and rights.
Access and changes are logged in the Datico® LIFE HUB (audit trail).

8. Retention

On your smartphone: readings that have not yet been transferred to the Datico® LIFE HUB remain in the encrypted local database until the transfer succeeds – for example if there is temporarily no internet connection. Readings that have already been transferred are automatically deleted from the smartphone 14 days after transfer. If you uninstall the app, the locally stored data is removed; readings not yet transferred are lost.

In the Datico® LIFE HUB: How long your data remains in the tenant is determined by your organisation. It may be subject to statutory retention obligations – for example, a hospital in Germany generally has to keep treatment records for ten years (Section 630f German Civil Code).

Data we process to handle your requests and deletion requests is only kept for as long as necessary to handle them and to document that they were handled properly.

9. Deleting your account and data

You can request deletion of your account and the associated data at any time:

In the app: “Profile → Settings → Delete account”. This menu item opens our deletion page with the deletion form.
On the web, without the app: via our page Delete data (Datico® LIFE APP and Datico® LIFE HUB)

We delete your app account and forward the deletion of your readings to your organisation, which decides on it as the controller. Data your organisation is legally required to retain is only deleted once these periods have expired. Details of the process are on the deletion page.

10. Your rights

Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

For data in the tenant, please contact your organisation. If your request reaches us directly, we forward it to your organisation without delay and support it in implementing the request.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for Datico is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Postfach 1349, 91504 Ansbach, Germany, poststelle[at]lda.bayern.de.

11. Minors

The app is not directed at children. If minors use the app through their organisation (e.g. in a youth performance centre), the organisation is responsible for obtaining the necessary consent of their parents or guardians.

12. Changes to this policy

We update this privacy policy when the app or the legal requirements change – for example when further wearables or features are added. The version published here applies.

Last updated: 22 October 2026