Privacy Policy

Diese Seite auf Deutsch: Datenschutzerklärung

Last updated: 6 September 2026

This Privacy Policy describes how BPal (“the App”) handles your information. Blood pressure readings are health data, and the App is built so that they stay on your device.

In short: your readings never reach us. We hold no copy of your health data, we operate no server that stores it, and no health data is ever used for advertising. What we do receive is limited usage and crash information that does not identify you by name, described in Sections 8 and 9. This website sets no cookies and makes no third-party requests (Section 16).

1. Who Is Responsible for Your Data

The controller for the processing described in this policy, within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR), is:

Muhammet Emre Yılmaz, trading as LuvleeLab
Hildesheimer Str. 120
30173 Hannover
Germany
support@getbpal.app

Full provider details are in our Impressum. We are established in Germany, within the European Union, so the GDPR applies to us directly and no Article 27 representative is required. We are not required to appoint a Data Protection Officer under Article 37 GDPR; privacy enquiries go to the address above.

2. Information We Collect

The App does not require you to create an account or provide your name or email address. The following categories of data are processed:

Blood pressure readings – The systolic value, diastolic value, pulse, timestamp, measurement context (morning, evening, before medication, after medication, after exercise, other), tags (seated, standing, lying, left arm, right arm, stressed, caffeine, medication) and any note you write. Entered manually, imported from a Bluetooth monitor (see Section 6), or read from Apple Health. Stored on your device.
Weight entries – Weight value, unit and timestamp, entered by you or read from Apple Health. Stored on your device.
Health profile – Optional onboarding answers such as age, whether you have been diagnosed with hypertension, how often you measure, whether you take blood pressure medication, and your goals. Used to personalise the experience and to apply age-appropriate privacy settings. Stored on your device.
Classification standard and units – Whether you use AHA/ACC 2025 or ESH 2023 categories, and your preferred weight unit. Stored on your device.
Reminders – Scheduled notification times you configure, the type of each reminder (blood pressure, medication or weight) and, for a medication reminder, the name you give it. Stored on your device; notification delivery is handled entirely on-device by iOS.
Paired devices – The identifier and name of any Bluetooth blood pressure monitor you pair, and which user slot on that device is yours. Stored on your device. Bluetooth pairing is not enabled in the current version — see Section 6.
App settings – Language preference, colour scheme, text size and accessibility options. Stored on your device.

We do not collect your name, email address, precise location, or any other directly identifying information. If you write to our support address, we receive whatever you choose to include in that message.

3. Health Data Storage

All blood pressure readings, weight entries, reminders and health profile data are stored entirely on your device using Apple’s SwiftData framework. There is no automatic cloud synchronisation of your health data to us. Your data never leaves your device except through Apple Health, if you grant permission (Section 5), or through a backup or report export that you initiate yourself.

This local-only approach means your health information stays under your direct control. We cannot access it, and it is not transmitted to our servers or to any third-party cloud storage service.

To move your data to another device you can export a JSON backup from Settings and restore it on the new device. Backup files and exported reports contain your health data — store and share them carefully.

4. Legal Bases, and Whether Providing Data Is Required

Blood pressure readings and the other health information listed in Section 2 are special categories of personal data under Article 9 GDPR and receive the higher level of protection that entails.

We design and determine the local processing that the App performs on your device, so we treat ourselves as the controller for it. But we do not receive that data and cannot access it remotely. The table below sets out the legal basis for each processing operation.

Purpose	Data	Legal basis
Recording and displaying your readings in the App	Health data, on your device only	Art. 6(1)(b) — performance of the agreement with you, together with Art. 9(2)(a) — your explicit consent, which the App asks for separately before health data is first processed
Exchanging data with Apple Health	Blood pressure, heart rate, weight	Art. 6(1)(a) and Art. 9(2)(a) — your explicit consent. The iOS Health permission prompt is the technical authorisation that accompanies it, and you can revoke it at any time
Importing from a Bluetooth monitor	Readings stored on the monitor	Art. 6(1)(a) and Art. 9(2)(a) — your explicit consent, which you can withdraw by unpairing the device
Providing and verifying Premium	Pseudonymous user identifier, Apple purchase receipt	Art. 6(1)(b) — performance of the agreement
Usage analytics	Pseudonymous app events, no health fields	Art. 6(1)(f) — legitimate interests. You may object at any time (Section 14)
Crash and error reporting	Device model, OS and app version, event names	Art. 6(1)(f) — legitimate interests in a stable and secure App
Non-personalised advertising	Ad request without advertising identifier	Art. 6(1)(f) — legitimate interests in funding a free App
Personalised advertising	Advertising identifier (IDFA)	Art. 6(1)(a) — your consent, given through App Tracking Transparency and, in the EEA and UK, through the Google consent form. Never given by default
Answering your support email	Your email address and message	Art. 6(1)(b) and Art. 6(1)(f) — responding to your enquiry
Meeting legal obligations	As required	Art. 6(1)(c)

Our legitimate interests, and how we balanced them. Where we rely on Article 6(1)(f), our interest is in understanding which features are actually used, fixing crashes, and funding a free App. We weighed that against your interests as follows: the data carries no health information (health fields are removed before transmission, see Section 8), it is not used to build a profile of you or to make any decision about you, it is not combined with data from other sources, it is not sold, it is stored in the EU, and it is deleted on the schedule in Section 10. You can object at any time and we will act on that objection. On that basis we consider that our interests are not overridden by your rights — but if you disagree in your particular situation, tell us and we will stop.

Withdrawing consent. Where processing rests on your consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it, and the App continues to work — for example, manual entry still works if you revoke Apple Health access.

Is providing data required? None of it is required by law, and only one item is required by contract:

Data	Required?	If you do not provide it
Readings, weight, reminders, health profile	Optional	The App still works; the corresponding logging, chart or report feature simply has nothing to show
Apple Health permission	Optional	No exchange with Apple Health. Manual entry and all other features continue to work
Bluetooth permission	Optional	No monitor import. You can still enter readings manually
Purchase receipt	Required for Premium	We cannot verify or restore a Premium subscription. The free features are unaffected
Analytics and crash data	Optional — you may object	No effect on any feature
Advertising consent (ATT)	Optional	You see non-personalised ads instead of personalised ones. No feature is withheld
Your email, if you contact support	Optional	We have no way to reply to you

5. Apple Health (HealthKit)

With your permission, the App exchanges data with the Apple Health app:

Blood pressure – read and written. A reading saved in BPal can be written to Health as a systolic sample, a diastolic sample and a blood pressure correlation, so other health apps and your Apple Watch can use it.
Heart rate – read and written, paired with the corresponding blood pressure reading.
Weight (body mass) – read only. The App never writes weight to Apple Health.

Where the App uses Apple Health to keep your own devices in sync, that data flows through Apple’s Health store under your iCloud settings, not through any server of ours.

Data obtained through HealthKit is never used for advertising, never shared with third parties, and never transmitted to our servers or to our analytics or crash-reporting providers. You can grant or revoke each permission at any time in iOS Settings › Health › Data Access & Devices, and the App continues to work with manual entry if you do.

6. Bluetooth Blood Pressure Monitors

Not enabled in the current App Store version. The App as currently released does not connect to a blood pressure monitor and does not import measurements from one. No Bluetooth permission is requested and no monitor data is processed. This section describes how the feature works from the update in which it is released, so you can see in advance what it will do.

If you pair a Bluetooth monitor, the App communicates directly with that device over Bluetooth Low Energy to import the readings it has stored. It supports monitors implementing the standard Bluetooth Blood Pressure Profile and several Omron models using their own protocol.

This connection is local to your phone and the cuff. No reading is sent to us or to the monitor’s manufacturer by the App. The App requests Bluetooth permission for this purpose only, and uses a background mode solely to complete an import that is already in progress. You can revoke Bluetooth access at any time in iOS Settings › Privacy & Security › Bluetooth.

7. Advertising & App Tracking Transparency

The App displays interstitial advertisements powered by Google AdMob for users who have not subscribed to Premium. Non-personalised ads are shown by default. The App asks for your permission using Apple’s App Tracking Transparency (ATT) framework before any personalised advertising.

Default (no ATT permission): only non-personalised ads are shown. Your device’s advertising identifier is not used for targeting.
If you grant ATT permission: Google AdMob may use your device’s advertising identifier (IDFA) to show personalised ads and measure ad performance.

No health data is ever used for ad targeting, regardless of your ATT choice. Your blood pressure readings, categories, pulse, weight, whether you take medication, diagnosis status and health profile are never shared with any advertising provider.

In the European Economic Area and the United Kingdom, the App also asks for your consent under EU and UK privacy law, via Google’s User Messaging Platform, before requesting any advertising identifier. You can reopen that consent form from Settings at any time and change your choice.

If you have told the App you are under the age of consent, ad requests are tagged accordingly and personalised advertising is not requested.

You can change your ATT choice at any time in iOS Settings › Privacy & Security › Tracking. Subscribing to Premium permanently disables all advertising and the associated data collection within the App.

Google AdMob Privacy Policy: policies.google.com/privacy

8. Third-Party Services

The App uses the following third-party services. Each acts as a processor on our instructions under a data processing agreement, except Google, which acts as an independent controller for advertising.

A note on terminology: the identifiers below are pseudonymous, not anonymous. They do not contain your name or email, but because they persist on your device they are still personal data under the GDPR, and we treat them as such.

RevenueCat (United States) – processes and verifies your Premium subscription. RevenueCat receives a pseudonymous user identifier, your Apple purchase receipt, and basic technical details such as device type and app version. No health data is shared. Privacy Policy
Mixpanel (EU data residency) – collects usage analytics so we can understand how the App is used and improve it. We use Mixpanel’s European data residency, so this data is stored on servers in the EU. Events are linked only to a pseudonymous device identifier, never to your name, and Mixpanel may derive a coarse location (city or country level) from the connecting IP address. Health-related fields are removed before any event is sent, in every region — this includes your systolic, diastolic, pulse and weight values, the category a reading falls into, the internal field that records whether a reading is above the published threshold of systolic over 180 or diastolic over 120, its measurement context, and your diagnosis status, medication information and health goals. Note text is never sent. Data obtained through Apple Health is never sent. What remains is ordinary product analytics: which screens are opened, which features are used, and non-health demographics such as age group. Privacy Policy
Sentry (EU region) – collects crash reports and error logs so we can improve stability. We use Sentry’s European region, so this data is stored on servers in the EU. Reports include the pseudonymous device model, iOS version and app version, and a trail of which actions were taken before a crash — recorded as event names only, never with their values. No readings, notes, reminders or other health data are included. Privacy Policy
Google AdMob (Google Ireland Limited for users in the EEA and UK) – serves the advertisements described in Section 7 as an independent controller. No health data is shared. Privacy Policy
Apple – distributes the App, processes all payments and operates HealthKit and iCloud. Your relationship with Apple is governed by Apple’s own privacy policy, not this one.

9. International Data Transfers

We have deliberately chosen European hosting where it is available. As a result:

Mixpanel analytics and Sentry crash data are stored on servers in the European Union. Where the provider’s US parent company may access that data for support or maintenance, that access is covered by the Standard Contractual Clauses adopted by the European Commission, which form part of our data processing agreement with each provider.
RevenueCat processes subscription receipts in the United States. This transfer is likewise covered by the Standard Contractual Clauses in our data processing agreement, together with supplementary measures including encryption in transit.
Google AdMob may transfer advertising data to the United States. Google LLC is certified under the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision, and Google additionally relies on the Standard Contractual Clauses.

No health data is included in any of these transfers. Your readings, notes, reminders and health profile are never transmitted to us or to any of the providers above.

Health data can leave your device in three ways, and each is one you choose and control: through Apple Health if you grant permission (Section 5); through an iCloud or local device backup made by iOS; and through a report or backup file that you export and then share yourself. Those routes are governed by Apple’s terms or by wherever you choose to send the file, not by us.

You may request a copy of the relevant transfer safeguards by writing to us.

10. Data Retention & Deletion

On your device. Your readings, weight entries, reminders and health profile remain on your device until you delete them — we set no expiry and hold no copy. You can delete an individual reading from its detail screen in History. To remove data in bulk, use the delete option in Settings › Data & Backup, which confirms before proceeding. Where the App created Apple Health samples itself, it removes those too on a best-effort basis; samples written by other apps are left untouched. Deleting the App from your device removes all locally stored data.

With our processors. The limited data described in Section 8 is retained as follows. Where a period is fixed by the provider’s own platform policy rather than chosen by us, we say so, because we would rather be accurate than appear to offer a control we do not have.

Mixpanel – analytics events are deleted automatically after 24 months under Mixpanel’s platform retention policy. We have not asked for a longer period and will not.
Sentry – crash and error events are deleted automatically after 30 days, the retention period that applies to our plan.
RevenueCat – the subscription record is kept for as long as we need it to verify, restore and support your purchase. RevenueCat does not offer a fixed expiry window for this, so we do not promise one. The record holds a pseudonymous identifier and your Apple receipt — no name and no email address — and if you ask us to delete it we do so through RevenueCat, which removes the associated data.
Support email – correspondence is deleted once your enquiry is resolved and no longer needed, and in any case within 12 months. Where a message is relevant to a contract or to tax, German commercial and tax law (§257 HGB, §147 AO) can require us to keep it for six or ten years; in that case we restrict it to that purpose only and delete it when the period expires.
Website – we keep no server logs of our own; see Section 16.

11. Security

We take appropriate technical and organisational measures under Article 32 GDPR, proportionate to a design in which health data does not leave the device:

Your health data is stored in the App’s private container, protected by iOS file-level encryption and your device passcode or biometric lock. Keep a passcode set — it is the main protection for data at rest.
All communication with the third-party services in Section 8 uses encrypted connections (TLS).
We operate no server that stores your health data, so there is no central database of readings that could be breached.
Health fields are stripped from analytics events before transmission rather than filtered afterwards.
Access to the provider dashboards listed in Section 8 is limited to us and protected by multi-factor authentication.

No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. Backup files and exported reports that you create leave the App’s protection — treat them as you would any document containing your health information.

12. Automated Decision-Making and Profiling

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

The App does calculate things from your readings — blood pressure categories, averages, distributions and MAP figures — and it visually highlights readings above published thresholds. These are arithmetic and reference lookups performed on your device: they apply published AHA/ACC and ESH thresholds to the numbers you entered. They are informational only, no decision is taken about you on their basis, we never receive the results, and they are not used to evaluate, predict or score you. They do not constitute a diagnosis or an assessment of your health — see the Medical Disclaimer in Section 17.

13. Children’s Privacy

The App is intended for users aged 16 and over, matching the age of digital consent under Article 8 GDPR in Germany, where we are established. We do not knowingly collect personal information from children under that age.

If you tell the App you are under the age of consent in your region, advertising requests are tagged accordingly and personalised advertising is not requested. If you believe a child under 16 has used the App and provided data to us, please contact us and we will delete it promptly.

14. Your Rights

Under the GDPR you have the following rights in respect of your personal data:

Access (Art. 15) – to know what data we hold about you and to receive a copy.
Rectification (Art. 16) – to have inaccurate data corrected.
Erasure (Art. 17) – to have your data deleted.
Restriction (Art. 18) – to have processing limited while a dispute about it is resolved.
Data portability (Art. 20) – to receive your data in a structured, commonly used, machine-readable format.
Objection (Art. 21) – to object, on grounds relating to your particular situation, to processing based on our legitimate interests. This covers the analytics and crash reporting described in Section 8. Where you object to processing for direct marketing, we will stop without exception.
Withdrawal of consent (Art. 7(3)) – to withdraw any consent at any time, with effect for the future.

Exercising your rights over health data is immediate and does not require us: because your readings are on your device, you already have direct access, correction, export and deletion at any time through the App itself. For the limited data held by the processors in Section 8, write to support@getbpal.app. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. Exercising these rights is free of charge.

Right to lodge a complaint (Art. 77). If you believe we have handled your data unlawfully, you may complain to a supervisory authority. The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Hannover, Germany · lfd.niedersachsen.de

You may also complain to the supervisory authority in the EU or EEA country where you live or work, or where you believe the infringement took place. We would appreciate the chance to resolve the matter first, but you are not required to contact us before complaining.

15. California Privacy Rights (CCPA/CPRA)

This section applies if and to the extent that the California Consumer Privacy Act applies to us. We are a sole trader in Germany and do not presently expect to meet the CCPA’s thresholds for a covered “business”. We set out the position below so that California residents know where they stand either way.

In the twelve months before the date of this policy, the categories of personal information collected through the App were: identifiers (a pseudonymous app-instance identifier and, only with your ATT consent, your advertising identifier), commercial information (whether you hold a Premium subscription), internet or other electronic network activity (in-app usage and crash events), and coarse location (a city or country derived from your IP address by our analytics provider). These were collected from your device for the business purposes described in Sections 7 and 8.

Disclosure. These categories are disclosed to the service providers named in Section 8. In addition, if you grant App Tracking Transparency permission, your advertising identifier is made available to Google AdMob, which acts as an independent controller for advertising rather than as our service provider.

Sensitive personal information. The App processes health information locally on your device, but we do not receive, access, sell or share it. We do not use or disclose sensitive personal information for purposes that would give rise to the right to limit its use.

We do not sell your personal information for money. However, the disclosure of your advertising identifier to Google AdMob following ATT consent may constitute a “share” of personal information for cross-context behavioural advertising under the CPRA. We prefer to say that plainly rather than rely on a bare denial.

To opt out of that sharing — the equivalent of “Do Not Sell or Share My Personal Information” — turn off tracking in iOS Settings › Privacy & Security › Tracking, either for BPal or for all apps. This takes effect immediately, is free, and requires no request to us. Declining the ATT prompt in the first place has the same effect. Subscribing to Premium also removes advertising entirely, but you never need to pay to exercise a privacy right.

Your other rights are to know what we collect and why, to access it, to correct it, to delete it, and not to be discriminated against for exercising any of them — the App’s features and pricing do not change because you exercised a privacy right. To exercise a right, write to support@getbpal.app. We confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 days where reasonably necessary. Because we hold no account for you, we may need to ask for information to verify that a request relates to your device.

16. This Website

The website at getbpal.app is a static site. It sets no cookies, runs no analytics, and makes no requests to any third-party server — no tracking pixels, no advertising tags, no externally hosted fonts or scripts. Nothing is loaded from a content delivery network or any other outside host. This is why you see no cookie banner: there is nothing to consent to.

The site is served by Cloudflare Pages. Like any web host, Cloudflare processes the technical data needed to deliver a page and to protect the site from attacks — including your IP address, the page requested, the time, and your browser’s user agent — under its own retention practices. We ourselves receive no server logs for this site, store none, and have no access to them, so there is no record of your visit on our side. The legal basis for that processing is Art. 6(1)(f) GDPR — our legitimate interest in operating a functioning, secure website.

Links on this site to external sources such as the American Heart Association, the NHS or our service providers are ordinary hyperlinks. Nothing is requested from those sites until you click through, at which point their own privacy policies apply.

17. Medical Disclaimer

BPal is a logging tool intended to help you record and organise blood pressure readings you take with your own monitor. It does not measure blood pressure, does not provide medical advice, diagnosis or treatment, and is not a substitute for professional care. It is not CE-marked as a medical device and is not intended for use as one. The categories, averages, distributions, MAP figures and statistical summaries it calculates are for informational and self-monitoring purposes only. A single reading cannot diagnose hypertension. Always consult your doctor about your readings and before making any change to your treatment. The scope of the service is described in Section 4 of the Terms of Use.

18. Data Breach Notification

If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours of becoming aware of it where Article 33 GDPR requires, and we will inform affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by Article 34.

Because we maintain no server-side database of readings, a breach of the provider dashboards we use could not expose such a database. Risks that remain outside that boundary — your device itself, the operating system, and the software supply chain through which updates reach you — are real, and we address them through the measures in Section 11.

19. Changes to This Policy

We may update this Privacy Policy from time to time, for example when we add a feature or change a service provider. The date at the top of this page always shows the current version.

If a change materially affects how we handle your data, we will tell you in the App before it takes effect, and where the change requires your consent we will ask for it rather than assume it.

20. Contact

Muhammet Emre Yılmaz, trading as LuvleeLab
Hildesheimer Str. 120, 30173 Hannover, Germany
support@getbpal.app

Full provider details: Impressum.