App privacy policy

1. Controller and scope

Email: support@dajukema.com

This notice describes Private Heart's privacy concept and related activities at Dajukema. The app is in development. Describing its local concept does not certify a complete technical audit of a later released build. Access to this page is covered by the website privacy notice.

2. Measurements and voluntary context

After camera permission, Private Heart uses the iPhone's rear camera and flash to capture an optical pulse signal (PPG) for estimating heart rate and heart rate variability. The inspected source creates no photo or video files and contains no microphone or Apple Health integration.

The following local data is intended for measurement history, personal trends and comparison ranges:

• Heart rate, HRV as RMSSD and SDNN, pulse intervals, measurement times, duration and technical signal quality;
• an experimental breathing-rate estimate where available;
• voluntary daily entries about exercise, stress, exhaustion and feeling unwell;
• custom tracker names, levels and daily values;
• bleeding intensity where the cycle log is enabled;
• derived personal analyses and settings.

Context entries, trackers and the cycle log are voluntary. Camera access is needed for new camera measurements and can be revoked in iOS settings.

3. Local processing and the meaning of data collection

The concept provides for processing and storage on your iPhone: no Dajukema user accounts, no Dajukema cloud database and no direct transmission of HRV or heart-rate readings to Dajukema. The inspected code uses local storage with cloud synchronisation disabled. No Dajukema upload of health or context data, or analytics or advertising SDK, was found in it.

Under Apple's App Privacy guidance, data processed only on the device and not sent to servers is not considered collected for those App Store disclosures. This distinction concerns App Store labelling and is not a general exemption from the GDPR. Separate Apple services, exports you choose and support are described below.

4. Apple, the App Store and support purchases

Apple processes account, device and purchase information in its own responsibility for App Store downloads and optional support purchases. The relevant entity, recipients, retention arrangements and international transfers depend on the Apple service. See Apple's App Store privacy notice.

The support feature uses StoreKit. In the inspected code, products are loaded when that section is opened; purchases require your action. Product and transaction identifiers and purchase/verification status are processed in the app, with unfinished transactions also checked at startup. HRV and heart-rate readings are not passed as purchase parameters; there is no Dajukema receipt-validation server in the code. Where Dajukema is responsible for fulfilling the requested purchase, Art. 6(1)(b) GDPR applies.

Information provided by Apple

• Download and sales statistics: Available App Store statistics and financial information are used to administer and, where relevant, account for the app.
• Aggregated usage analytics: Where Apple makes these available under the relevant sharing settings, they serve app improvement.
• Diagnostic and crash reports: Where available, these are used for troubleshooting and improvement. Availability and scope depend on Apple and the relevant settings.

Dajukema uses this information only for administration, improvement, troubleshooting and, where relevant, accounting. No personal user profiles are created from it. Report availability may vary; neither identification of individual users nor blanket anonymity of all reports is asserted.

Where personal information is involved, administration and troubleshooting are based on Art. 6(1)(f) GDPR and the legitimate interest in operating and improving the app; necessary contractual processing uses Art. 6(1)(b), and statutory retention Art. 6(1)(c). Dajukema deletes its report copies once their purpose ends. No fixed periods are promised for Apple's own storage.

5. Advertising and tracking

The concept provides for no advertising and no personal usage profiles. The inspected code includes no Dajukema analytics or crash-reporting SDKs. Its privacy manifest declares no tracking or developer-collected data. The separate Apple services in section 4 are unaffected.

6. File exports and device backups

Only when you choose does the app create a CSV export or complete JSON backup. These files may contain sensitive data and are not encrypted by the app. In the iOS file dialog you select a location, potentially including a configured cloud provider. Data can then leave the device and that provider's terms apply. JSON backups can be imported again.

Depending on your iOS settings, app data may be included in device or iCloud backups. A local app concept therefore does not mean every copy you or the operating system create stays exclusively on the iPhone.

7. Retention and deletion

Local history and voluntary entries remain stored for your analyses. Archived trackers and a disabled cycle log retain previous entries. The inspected code keeps the complete signal trace temporarily in memory only.

Deleting the app can remove its local data; offloading the app retains it. Export files and existing device backups must be deleted separately where needed. Dajukema cannot set its own deletion periods for Apple's provider-side backups or internal procedures. Dajukema's support records follow the 90-day rule and statutory exceptions in the website privacy notice.

8. Voluntary support enquiries

If you voluntarily contact Dajukema, it receives the contact details and contents you send. Processing by Netlify Forms and its spam filter, email processing by IONOS, purposes, legal bases and deletion are described in the website notice. Automatic uploading of readings for support is not intended.

Dajukema does not generally request medical records, health data or personal HRV histories for support. A problem description and, where useful, anonymised screenshots are usually sufficient. The contact form has no file upload; screenshots can be sent by email if needed.

Unsolicited sensitive data is not unnecessarily processed, copied, shared or permanently stored, and is deleted when not needed. Any exceptionally necessary further processing of special categories of data is assessed separately beforehand, including Art. 9 GDPR and a secure procedure. No general health-data consent is collected as a precaution.

9. Automated decisions

Personal trend displays are not solely automated decisions with legal or similarly significant effects under Art. 22 GDPR.

Your rights

Where the statutory conditions are met, you have rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Consent can be withdrawn with effect for the future (Art. 7(3)); earlier processing remains lawful. Contact support@dajukema.com to exercise these rights.

Right to object under Art. 21 GDPR

Where processing is based on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. Dajukema will then stop processing the data concerned unless compelling legitimate grounds override your interests, rights and freedoms, or the processing is necessary for establishing, exercising or defending legal claims.

You may complain to a supervisory authority, particularly in the EU member state of your habitual residence, place of work or the alleged infringement (Art. 77 GDPR). For Dajukema's location, you can contact the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate: Postfach 30 40, 55020 Mainz, Germany. Official contact information.

Last updated: 7 November 2026