Vagal Sense

1. Where data is stored

All data is stored only in the internal memory of the device where the app is installed.

There is no server, remote database, synchronization, or automatic cloud backup. If you install the app on two devices, each device will have its own data, with no connection between them.

Important consequence: if the app is uninstalled, or if the device is lost, formatted, or replaced, the data is permanently lost — we do not have any copy that can be recovered. For this reason, the app provides backup export.

2. What information the app handles

2.1 About the assessed person

Recorded by you, the professional, during use:

• Name
• Date of birth
• Biological sex
• Questionnaire answers about sleep, stress, pain, digestive symptoms, history, physical activity, and circadian rhythm
• Heart rate and heart rate variability (HRV) measurements
• Subjective perception reported during practices
• Session history and generated summaries

Some of this information is sensitive personal data related to health under applicable data protection laws, including Brazil’s LGPD.

2.2 About you, the professional

• Name, profession, specialty, and professional registration number (all optional)
• Logo image, if you choose one (optional)

These data are used only to compose the header of PDF summaries that you generate yourself.

2.3 Technical data

• Device language: read once at launch only to define the interface language. It is not stored or transmitted.
• Usage preferences: theme, selected language, breathing guide settings, and app lock settings.

We do not collect advertising identifiers, location, contacts, usage data, crash reports, or any telemetry.

3. Who is responsible for the data

This is an important distinction.

You, the professional, are the controller of the data of the people you assess. You decide whether to record it, you keep it, and you are responsible for it before those people and before the data protection authority.

AK BioSystems is neither controller nor processor of these data because they never reach us. We have no technical access to any information recorded in the app, and there is no way for us to obtain it.

You are responsible for:

• Obtaining appropriate consent from the assessed person before recording their data, or from their legal guardian when the person is a child or adolescent;
• Protecting access to the device;
• Responding to requests from the assessed person regarding their rights.

The acceptance of the terms that you provided when first opening the app does not replace the consent of the assessed person.

4. Device permissions and why they are needed

The Polar H10 sensor is a consumer sports device. The connection is local, via Bluetooth, between the sensor and the device — no data passes through us or through Polar via this app.

Biometric verification is performed entirely by the device operating system. The app only receives an “authorized” or “not authorized” response; it never has access to your fingerprint or face.

5. What the app does not do

• It does not create a user account or require registration
• It does not send data to our servers or to third-party servers
• It does not use analytics, metrics, or usage-monitoring services
• It does not display advertising or share data with advertisers
• It does not track you inside or outside the app
• It does not sell, rent, or transfer data to anyone
• It does not make medical diagnoses or replace professional assessment

6. Backups and files generated by you

The app allows you to:

• Export a complete backup or a backup for a specific profile. The file is encrypted with a password that you define, using AES-256.
• Generate PDF summaries of assessments.

These files become your responsibility from the moment they are created. If you send them by email, save them in your personal cloud storage, or share them through messaging apps, they become subject to the policies of those services, over which we have no control.

Keep your backup password safe. Without it, the file cannot be imported, and we cannot recover it.

7. Your rights and how to exercise them

Data protection laws grant data subjects rights such as access, correction, portability, and deletion. Because the data are only on your device, these rights are exercised directly in the app, without depending on us:

All deletions are definitive and immediate. Because there is no cloud copy, they cannot be undone. Export a backup first if you want to preserve the history.

Uninstalling the app also removes all data from the device.

If the assessed person contacts you to exercise any of these rights, you are the one who responds — we cannot intervene because we do not have access to the data.

8. Retention

Data remains on the device for as long as you decide. There is no automatic expiration, and there is no retention by us because nothing reaches us.

9. Children and adolescents

The app is intended for professionals. When the assessed person is a child or adolescent, authorization must be obtained from the legal guardian, according to applicable law.

10. Security

• Data stays in the app’s internal storage, isolated from other apps by the operating system.
• The app offers PIN and biometric lock, which we recommend enabling.
• Backup files are encrypted with AES-256 and a password defined by you.

No system is completely secure. Physical protection of the device — screen lock, password, and not leaving it unattended — is an essential part of data security.

11. Changes to this policy

If the app’s operation changes in a way that affects privacy — for example, if we ever offer cloud synchronization — this policy will be updated and the change will be communicated inside the app before it takes effect.

The date at the top indicates the latest revision.

12. Contact

Questions about this policy or about privacy in Vagal Sense: contact.akbiosystems@gmail.com.

For requests related to the data of an assessed person, please contact the professional who performed the assessment: that professional holds and controls those data.