Privacy Policy for myQiu/BioSign HRV

As of September 2026

1. General information

This Privacy Policy explains how BioSign GmbH processes personal data when you use myQiu.

myQiu enables the collection, storage, analysis and presentation of heart rate variability (HRV) data. Measurement data can be transmitted to myQiu from a measuring device connected via Bluetooth and processed on our server systems.

The measurement and analysis data processed in this context may allow conclusions to be drawn about a person’s health status. We therefore treat these data as health data and thus as special categories of personal data within the meaning of Art. 9(1) GDPR.

2. Controller

BioSign GmbH
Brunnenstr. 21
85570 Ottenhofen
Germany
 
Managing Director: Dr. Reinhard D. Beise
Telephone: +49 8121 923894
Email: info@biosign.de
Website: www.biosign.de
Register court: Amtsgericht München (Local Court of Munich)
Commercial register number: HRB 135220
VAT identification number: DE 213294143

3. Data Protection Officer

Dr. Markus Hofer
Data Protection Officer
BioSign GmbH
Brunnenstr. 21
85570 Ottenhofen
Germany
Email: datenschutz@biosign.de

4. What data do we process?

4.1 Account and registration data

For the setup and management of a myQiu account, the following data in particular may be processed:

·        Username and authentication data,

·        email address,

·        salutation and title, where provided,

·        first and last name or a pseudonym chosen by the user,

·        date of birth or year of birth,

·        gender, where provided,

·        height, where provided,

·        address data, where stored for the account,

·        language and time zone,

·        licence and account status.

Where technically possible and compatible with the intended use, a pseudonym may be used instead of the first and last name. Age or year of birth may be required for the calculation and interpretation of certain HRV values.

4.2 Measurement, HRV and health data

When measurements are performed and analysed, myQiu processes in particular:

·        Interbeat intervals (IBI, i.e. intervals between heartbeats),

·        for the Qiu+ measurement system, additionally the pulse waveform signal,

·        HRV parameters and analyses calculated from the measurement data,

·        time, duration and historical trends of measurements,

·        where applicable, further information associated with the measurement.

These data are treated as health data pursuant to Art. 9(1) GDPR.

4.3 Coach data and coach access permissions

For registered coaches, the account and contact data required to set up and manage the coach account are processed. Registration as a coach does not automatically provide access to a user’s measurement or health data.

myQiu also stores information about which coach a user has authorised. A user may authorise a maximum of two coaches at the same time. The authorisation may be withdrawn at any time; access by the relevant coach ends once the coach is deselected.

4.4 Technical login and application logs

Technical login and application logs are generated during login processes. These logs are used for technical security, error analysis and the detection of unauthorised access. The regular retention period is 28 days; the log data are then deleted.

4.5 Support and communication data

If you contact us, we process the contact details, information about your user account and the content of your enquiry that you provide to us, insofar as this is necessary to handle your enquiry.

5. Purposes and legal bases of processing

5.1 Provision and management of the user account

Account and registration data are processed in order to set up and manage your myQiu account and to provide you with the agreed functions. The legal basis is Art. 6(1)(b) GDPR.

5.2 Performance and analysis of HRV measurements

Measurement data are processed in order to perform the HRV measurements initiated by you, calculate HRV parameters, analyse and store the results, and display historical trends. Insofar as health data are processed, processing is based on your explicit consent pursuant to Art. 9(2)(a) GDPR. For the general processing of data required to provide the agreed myQiu functions, Art. 6(1)(b) GDPR additionally applies.

5.3 Optional sharing of data with a coach

You decide whether to grant a coach registered with myQiu access to the data intended for this purpose. Access is granted only after your active authorisation. Insofar as health data are disclosed, the disclosure is based on your explicit consent pursuant to Art. 6(1)(a) and Art. 9(2)(a) GDPR. Coach access is voluntary and is not a prerequisite for the general myQiu functions.

5.4 Technical operation and IT security

We process technical log data to ensure the secure and functional operation of myQiu, for error analysis, and to detect and prevent unauthorised access and other security incidents. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the security, stability and functionality of myQiu and in protecting the data processed.

5.5 Support and legal obligations

Depending on the subject matter of the enquiry, we process support and communication data on the basis of Art. 6(1)(b) or (f) GDPR. Where statutory retention, documentation or other obligations apply, processing is based on Art. 6(1)(c) GDPR.

6. Necessity of providing data

Certain account and authentication data are required in order to set up a myQiu account and provide the agreed services. Without the measurement data required for an HRV measurement, the corresponding measurement, calculation and analysis functions cannot be provided. Granting access to a coach is voluntary.

7. Access by coaches

A registered coach initially has no access to the health or measurement data of other users. The user decides whether and to which coach access is granted. A maximum of two coaches may be authorised at the same time. An authorisation may be withdrawn at any time.

If a coach subsequently processes data made available to them for their own advisory, coaching or other professional purposes and independently determines the purposes and means of this further processing, the coach is independently responsible under data protection law for this further processing.

8. Hosting, backups and processing by processors

For the operation of the server and backup infrastructure of myQiu, we use IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, as a processor pursuant to Art. 28 GDPR. A data processing agreement has been concluded with IONOS.

The production server infrastructure of myQiu is operated in Germany. IONOS Cloud Backup is used for data backups. Europe is configured as the target region for the backups.

The current backup configuration provides for full and differential backups, a maximum retention period of three weeks and AES-256 encryption. Recoverability is verified by restore tests.

According to the currently documented status, the sub-processors particularly relevant to the server and backup services used are Arsys Internet S.L.U. in Spain and Acronis Germany GmbH in Germany.

Under the applicable agreement, processing by IONOS generally takes place within the European Union or the European Economic Area, unless a transfer to a third country is required for an individual service. Any such transfer may take place only in compliance with the requirements of Articles 44 et seq. GDPR.

9. Bluetooth and location permission under Android

myQiu uses Bluetooth exclusively to communicate with compatible measuring devices. On certain Android versions, the operating system may require a permission for searching for Bluetooth devices that is designated as a location permission.

myQiu does not read location data on the basis of this permission. In particular, no GPS or other location coordinates are collected or stored, no location information is derived from Bluetooth data, and no location data are transmitted to the myQiu server.

10. Processing on the smartphone

Health and measurement data are not stored permanently on the smartphone. Local processing takes place only to the extent necessary for the relevant measurement and transmission to the myQiu server system.

11. Pseudonymisation and data separation

Health and measurement data are stored separately from directly identifying account data. IBI data, the pulse waveform signal recorded by Qiu+, and HRV parameters calculated from them are stored under an internal pseudonymous identifier. Assignment to the user account is performed via a separate technical link.

Because assignment remains possible, these are pseudonymised rather than anonymised data. The data remain personal data and continue to be subject to the GDPR. Directly identifying account data are stored in encrypted form.

12. Data security

We implement appropriate technical and organisational measures to protect personal data. These include, in particular, HTTPS/TLS for communication between the application and server, separate and pseudonymised storage of health data, encrypted storage of directly identifying account data, restricted administrative access rights, firewall and update procedures, and encrypted and tested backups.

13. Retention periods and deletion

13.1 User account and health data

Health and measurement data are stored for the duration of the user account insofar as this is required for myQiu’s historical measurement and analysis functions. When the user account is deleted, account data, assignment keys and the associated health and measurement data are deleted from the production systems, unless statutory retention obligations prevent deletion.

13.2 Coach access permissions

A coach’s access permission ends when the user deselects the coach and no later than when the user account is deleted.

13.3 Login and application logs

Login and application logs are stored for 28 days and then deleted.

13.4 Backups

Backups are retained for no more than three weeks and are then removed as part of the backup rotation. Data that have previously been deleted from the production system but are still contained in backups are not used for regular production purposes. Following a restore, deletions carried out in the meantime are implemented again.

14. Withdrawal of consent

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. This applies in particular to the processing of health data and to voluntary sharing with a coach. Coach access can be ended by deselecting the relevant coach. For other data protection matters, you can contact datenschutz@biosign.de.

The lawfulness of processing carried out before withdrawal remains unaffected. Where the processing of certain health data is technically necessary to provide a requested HRV measurement or analysis function, withdrawal may mean that the relevant function can no longer be used afterwards.

15. Newsletter

If you subscribe to a BioSign GmbH newsletter, we process your email address for the purpose of sending the newsletter. The newsletter is managed by BioSign GmbH itself; according to the current status, no separate external newsletter service provider is used.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, in particular by using the unsubscribe option provided in the newsletter or by contacting us. After you unsubscribe, your email address will be removed from the newsletter distribution list unless there is another legal basis for further storage.

16. No use for advertising or AI training

Under the current processing concept, the health and measurement data stored in myQiu are not used for personalised advertising, for training AI or other models, or for other unrelated purposes.

17. Automated HRV analyses

myQiu automatically calculates HRV parameters from the measurement data collected and provides derived analyses and visualisations. These calculations are part of the analysis functions offered. Under the current processing concept, no solely automated decision within the meaning of Art. 22 GDPR is made that produces legal effects concerning a user or similarly significantly affects a user.

18. Rights of data subjects

Subject to the applicable legal requirements, you have the following rights in particular:

·        Access pursuant to Art. 15 GDPR,

·        rectification pursuant to Art. 16 GDPR,

·        erasure pursuant to Art. 17 GDPR,

·        restriction of processing pursuant to Art. 18 GDPR,

·        data portability pursuant to Art. 20 GDPR,

·        objection pursuant to Art. 21 GDPR,

·        withdrawal of consent with effect for the future.

To exercise your data protection rights, you can contact our Data Protection Officer at datenschutz@biosign.de.

19. Right to object

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right, pursuant to Art. 21 GDPR, to object at any time on grounds relating to your particular situation. Following a justified objection, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

20. Right to lodge a complaint with a supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Bavarian State Office for Data Protection Supervision
Promenade 18
91522 Ansbach
Germany
Telephone: +49 981 180093-0
Email: poststelle@lda.bayern.de
Website: www.lda.bayern.de

You may also lodge a complaint with another data protection supervisory authority that has jurisdiction under the GDPR.

21. Changes to this Privacy Policy

We review this Privacy Policy regularly and amend it if the functions of myQiu, data processing activities, technical systems, service providers used or legal requirements change. The most recently published version applies.