Privacy Policy

Last updated: October 2026

1. Introduction

HeartLab ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how HeartLab ("the App") collects, uses, and protects your personal information.

By using HeartLab, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the App.

2. Data Controller

The data controller responsible for your personal data is:

CEPALabs SHPK
NUIS: M61327011S
Rruga Andon Zako Cajupi, Ndërtes 3, Hyrja Nr. 11
Tiranë, Albania

• Phone: +39 379 234 5841
• Email: hello@heartlab.it
• Website: heartlab.it

For any privacy-related questions or to exercise your data rights, you can reach us through any of the channels listed on our Contact page — including email, WhatsApp, Discord, and phone.

3. Information We Collect

3.1 Health Data (Special Category Data)

HeartLab asks Apple HealthKit only for permission to read your ECG recordings. It does not read other Health data and does not write anything to Apple Health. From each ECG it uses:

• ECG Recordings: Electrocardiographic data from your Apple Watch, including the average heart rate measured during the recording
• Rhythm Classification: Apple's ECG classification results

Important: ECG recordings are analyzed locally on your device. We do not upload your raw ECG recordings to our servers, unless you choose to contribute them to research with your explicit consent (see section 3.7).

3.2 Health Profile Information

If you choose to create a health profile, you may provide:

• Age and biological sex
• Height and weight
• Pre-existing medical conditions (optional)
• Current medications (optional)
• Family medical history (optional)
• Sports activity level (optional)

Your health profile is stored on your device. Some of it (age, biological sex, conditions and medications) leaves your device only if you use the AI assistant after giving your consent (section 6.2) or if you choose to include it in a research contribution (section 3.7).

3.3 Account Information

If you create an account, we collect:

• Email address
• Authentication credentials (securely hashed)
• Sign in with Apple identifier (if used)

If you use Sign in with Apple, we receive only your email address (or Apple's private relay address), not your name.

3.4 Usage Data

We may collect anonymized usage data to improve the App, including:

• App feature usage patterns
• Crash reports and error logs
• Device type and iOS version
• Advertising identifier (IDFA), only if you allow tracking when the App asks
• Your optional answer to “How did you find us?”

3.5 Apple HealthKit Data - Important Disclosures

In compliance with Apple's HealthKit requirements, we explicitly state that:

• (a) NO ADVERTISING: Your HealthKit data (ECG recordings, heart rate, rhythm classifications) is NEVER used for advertising or marketing purposes.
• (b) NO SELLING: We do NOT sell, license, or otherwise disclose your HealthKit data to any third party, including advertising platforms, data brokers, or information resellers.
• (c) NO THIRD-PARTY SHARING: Your HealthKit data is NOT shared with third parties except:
  • When you use the AI assistant after giving your consent (summarized values derived from your ECGs, never the raw recordings, are sent to OpenAI only to answer you)
  • When required by law
• (d) HEALTH PURPOSES ONLY: HealthKit data is used exclusively to provide health and fitness features within the App, including ECG analysis, heart rate variability calculations, and trend monitoring, and, only if you choose to contribute your recordings, to improve HeartLab's ECG analysis.
• (e) LOCAL PROCESSING: Your HealthKit data is processed on your device. We do not store your raw ECG recordings on our servers, except the recordings you choose to contribute to research with your explicit consent.
• (f) USER CONTROL: You can revoke HeartLab's access to HealthKit at any time through your iPhone's Settings > Privacy & Security > Health > HeartLab.

3.6 Wellness Journal

When you write in the journal, the text of the entry, the mood you choose and the date are saved on your device. If you are signed in to a HeartLab account, the entries are also saved to your account on our servers (Supabase), so that they can be synced and restored; entries written before you sign in are uploaded when you sign in. If you never sign in, they stay only on your device. When you delete an entry, it is also deleted from our servers. Deleting your account deletes all your journal entries.

3.7 Contributing ECGs to Research (Optional)

In the App you can choose to contribute your ECG recordings to help improve HeartLab's analysis. This is off by default: it happens only after you give a separate, explicit consent, you are signed in, and you select the recordings to send. For each recording we receive:

• The raw ECG signal (voltage values), its duration and sampling frequency
• The recording date (day only, no time)
• Apple's classification and heart rate, the signal quality and HeartLab's analysis results
• Only if you agree: your age range, biological sex, known conditions, medications, whether you are an athlete, and your Apple Watch model

Each recording gets a new random identifier and does not include your name, email or notes. We keep a link between your contribution and your account only so that you can see and delete it. You can withdraw your consent and delete your contributions from the App at any time.

4. How We Use Your Information

We use your information for the following purposes:

• ECG Analysis: To provide detailed analysis of your ECG recordings locally on your device
• AI Assistant: When you use the AI assistant, your messages and summarized values derived from your ECGs are sent to OpenAI to generate the answer (only after you give your consent, see section 6.2)
• Journal Sync: To save your journal entries to your account, if you are signed in
• Research (optional): To improve HeartLab's ECG analysis with the recordings you choose to contribute (see section 3.7)
• Personalization: To customize insights based on your health profile
• App Improvement: To fix bugs and improve app performance
• Support: To respond to your inquiries and provide customer support
• Advertising Measurement: To understand which of our ads brought you to HeartLab (see section 6.7). Health data is never used for this

5. Data Storage and Security

5.1 On-Device Storage

The majority of your data is stored locally on your device:

• ECG recordings remain in Apple HealthKit
• Analysis results are cached locally
• Your health profile is stored on-device
• Journal entries are stored on-device (and also in your account if you are signed in, see 5.2)

5.2 Cloud Storage

Limited data may be stored in our secure cloud infrastructure (Supabase):

• User account information
• Subscription status
• App preferences and settings
• Journal entries (text, mood and date), if you are signed in
• ECG recordings you choose to contribute to research (see section 3.7)

5.3 Security Measures

We implement industry-standard security measures:

• End-to-end encryption for data in transit
• Secure authentication with Apple Sign In support
• Face ID / Touch ID integration for app access
• Regular security audits

6. Third-Party Services

HeartLab uses the following third-party services:

6.1 Apple HealthKit

We access your ECG data through Apple HealthKit. Apple's privacy policy applies to data stored in HealthKit.

6.2 OpenAI (AI Assistant)

HeartLab uses OpenAI (OpenAI, L.L.C., San Francisco, CA, USA) as a third-party AI service to power the AI assistant. Before anything is sent for the first time, the App shows a consent screen that explains what will be shared. Nothing is sent to OpenAI unless you tap "Allow".

What is sent to OpenAI:

• The messages you write to the assistant
• Your age and biological sex, if you entered them in your profile
• Known medical conditions and current medications, if you entered them
• Summarized values computed by HeartLab on your device: heart rate (average, minimum, maximum), HRV and SDNN, QTc, counts of extra beats (PAC, PVC), pauses and AFib, rhythm patterns, number of ECGs, ECG classification and signal quality
• The date and time of the ECGs the question refers to (for example your last ECG or an ECG you attach) and the language of the App

What is not sent: your name, your email address and your raw ECG recordings (the waveform). Please do not write your name or other details that identify you in your messages.

Encryption and secure transmission:

Requests go from the App to our server (Supabase), which forwards them to OpenAI's API. All data is encrypted in transit using TLS 1.2+ (HTTPS). Our server does not store your chat messages.

OpenAI does not train on your data:

Per OpenAI's Enterprise Privacy policy, data sent through the API is not used to train, improve, or fine-tune OpenAI models. OpenAI may keep API data for up to 30 days to detect abuse, and then deletes it.

You can withdraw your consent at any time in the AI assistant (menu > Manage AI consent > Don't Allow). After that, no further data is sent to OpenAI.

6.3 RevenueCat (Subscriptions)

We use RevenueCat to manage subscriptions. They process payment information through Apple's App Store. We do not have access to your payment card details.

6.4 Supabase (Authentication & Storage)

User accounts, journal entries (if you are signed in) and research contributions (if you choose to make them) are stored through Supabase, which provides secure, GDPR-compliant data storage. Supabase also hosts the server that forwards AI assistant requests to OpenAI.

6.5 IP Geolocation (Website Localization)

Our website uses ipapi.co to detect your country based on your IP address for the sole purpose of displaying content in your local language. This is done under the legal basis of legitimate interest (GDPR Article 6(1)(f)) to provide a better user experience.

• Data processed: Your country code only (e.g., "IT", "DE", "ES")
• Data NOT stored: Your IP address is not stored or logged by us
• Purpose: Automatic language selection for website content
• Fallback: If you prefer, you can manually select your language using the language selector, and your preference will be saved

You can opt out of automatic language detection by selecting your preferred language manually. Your choice is stored locally in your browser and takes precedence over automatic detection.

6.6 Firebase Crashlytics (Crash Reporting)

We use Firebase Crashlytics, a service provided by Google LLC, to collect anonymous crash reports and diagnostic data. This helps us identify and fix bugs to improve app stability.

• Data collected: Crash stack traces, device model, OS version, app state at time of crash, anonymous installation identifier
• Data NOT collected: No personally identifiable information (no names, emails, or health data)
• Purpose: App stability monitoring and bug fixing
• Legal basis: Legitimate interest (GDPR Article 6(1)(f)) in providing a stable, reliable application
• Retention: Crash data is retained for 90 days by Google

For more information, see Firebase Privacy Policy.

6.7 Singular (Advertising Measurement)

We use Singular (Singular Labs, Inc., USA) to measure which of our advertising campaigns, for example on Instagram, Facebook, TikTok or Apple Search Ads, led to an installation of HeartLab. Singular may share the result of this measurement with the advertising network that showed the ad.

• Data collected: Advertising identifier (IDFA) only if you allow tracking, the app-specific device identifier (IDFV), IP address, device model, iOS version, app installs and opens, completed onboarding, subscription screen views and purchases (purchase amounts are sent by RevenueCat)
• Data NOT collected: No health data (no ECG recordings, heart rate, rhythm results or health profile) and no name or email
• Purpose: Measuring the effectiveness of our advertising
• Legal basis: Your consent (GDPR Article 6(1)(a)), requested through Apple's App Tracking Transparency prompt, for the advertising identifier; legitimate interest (Article 6(1)(f)) for aggregated measurement through Apple SKAdNetwork, which does not identify you
• Your choice: You can allow or refuse tracking at any time in Settings > Privacy & Security > Tracking. Refusing changes nothing in the App

For more information, see the Singular Privacy Policy.

6.8 Firebase Analytics (App Usage Statistics)

We use Firebase Analytics, a service provided by Google LLC, to understand how the App is used, for example at which onboarding step people stop or how often the subscription screen is opened.

• Data collected: App usage events (onboarding steps, subscription screen views, purchases), your optional answer to “How did you find us?”, an app instance identifier, device model, iOS version and approximate country
• Data NOT collected: No health data, no advertising identifier, no name or email
• Purpose: Improving the App
• Legal basis: Legitimate interest (GDPR Article 6(1)(f))
• Retention: According to our Google Analytics settings, at most 14 months

For more information, see the Firebase Privacy Policy.

7. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data
• Right to Portability: Receive your data in a portable format
• Right to Restrict Processing: Limit how we use your data
• Right to Object: Object to processing of your data
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at hello@heartlab.it.

8. Data Retention

We retain your data according to the following policies:

• Account Data: Until you delete your account
• Health Data: ECG recordings stay in Apple Health; analysis results and your health profile are stored locally until you delete the app or clear data
• Journal Entries: On your device and, if you are signed in, in your account until you delete them or delete your account
• Research Contributions: Until you delete them from the App
• Usage Analytics: Anonymized and retained for up to 24 months

You can delete your account and all associated data at any time through the app settings.

9. Children's Privacy

HeartLab is not intended for use by children under 17 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately.

10. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Services certified under recognized data protection frameworks

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by:

• Posting the new policy in the App
• Updating the "Last updated" date
• Sending an email notification for material changes

12. Data Protection Authority

If you have concerns about our data processing, you have the right to lodge a complaint with a supervisory authority.

Albanian Information and Data Protection Commissioner (IDP)
Rruga "Abdi Toptani", Nr. 5
Tirana, Albania
www.idp.al

For EU residents, you may also contact your local data protection authority.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: hello@heartlab.it
• Support: hello@heartlab.it
• Website: heartlab.it

14. Apple App Store Privacy

If you downloaded HeartLab from the Apple App Store:

• (a) Apple's Privacy Policy applies to data collected by Apple, including App Store transactions and HealthKit data stored by Apple.
• (b) We do not have access to your Apple ID, payment information, or other data managed directly by Apple.
• (c) For information about Apple's privacy practices, visit: https://www.apple.com/privacy/
• (d) This Privacy Policy governs only data collected and processed by HeartLab.