📱 AsthmaCare

Privacy Policy

← Back to Homepage

As of: October 12, 2025

1. Responsible party

The responsible party for data processing is:

2. General information on data processing

2.1 Scope of personal data processing

We only process our users' personal data to the extent necessary to provide a functional app and our content and services. Personal data is only processed with the user's consent.

2.2 Legal basis for the processing of personal data

• Art. 6 (1) (a) GDPR serves as the legal basis for processing operations for which we obtain consent.
• Art. 6 (1) (b) GDPR serves as the legal basis for processing operations that are necessary for the performance of a contract.
• Art. 9 (2) (a) GDPR serves as the legal basis for the processing of special categories of personal data (health data) after express consent has been obtained.

2.3 Data deletion and storage period

Personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Data is stored until the user account is deleted. After the account is deleted, all personal data is irrevocably deleted.

3. What data is collected?

3.1 Account data

The following data is collected during registration:

• Email address
• Password (stored in encrypted form)
• Role (parent or child)

Purpose: Authentication and account management
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract)

3.2 Child's profile data

The following data is stored for each child:

• First name
• Date of birth
• Gender
• Asthma type (allergic, non-allergic, mixed)
• Known allergies and triggers
• List of medications

Purpose: Personalized asthma monitoring and risk assessment
Legal basis: Art. 9 (2) (a) GDPR (consent for health data)

3.3 Health data

Purpose: Monitoring the course of asthma and early detection of deterioration
Legal basis: Art. 9 (2) (a) GDPR (Consent for health data)

3.4 Location data

The app uses GPS coordinates for:

• Local weather and pollen forecasts
• Location-based risk warnings (e.g., during school trips)

Storage: GPS coordinates are processed temporarily and are not stored permanently. Only the city/region is stored for weather data.

Purpose: Provision of location-based health information
Legal basis: Art. 6 (1) (a) GDPR (consent)

4. Disclosure of data

4.1 No disclosure to third parties

Your data will not be disclosed, sold, or rented to third parties. The only exception is for the processors mentioned in section 5.

4.2 Multi-user access (family)

You can grant other family members access to a child's profile. This is done exclusively through your active invitation by email. The invited user must actively accept the invitation.

5. Services used

5.1 Supabase (database and authentication)

• Provider: Supabase Inc., USA (server location: EU)
• Purpose: Storage of all app data and user authentication
• Security: Encrypted transmission (TLS/HTTPS) and storage (AES-256)
• Data protection: https://supabase.com/privacy

5.2 Open-Meteo (weather & air quality data)

• Provider: Open-Meteo, Switzerland
• Purpose: Provision of weather and air quality data for risk assessment
• Transmitted data: GPS coordinates (temporary)
• Data protection: Open Source, GDPR-compliant

5.3 German Weather Service (pollen data)

• Provider: German Weather Service (DWD), Germany
• Purpose: Provision of pollen forecasts
• Data transmitted: Region/postal code

6. Data security

Technical measures

• 🔒 Encrypted transmission: All data is transmitted encrypted via HTTPS/TLS.
• 🔐 Encrypted storage: Database encryption with AES-256.
• 👤 Access control: Row Level Security (RLS) – users can only see their own data.
• 🔑 Password security: Passwords are hashed and never stored in plain text.

7. Your rights

7.1 Right of access (Art. 15 GDPR)

You have the right to obtain information about your stored personal data.

7.2 Right to rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate data.

7.3 Right to erasure (Art. 17 GDPR)

You may request the deletion of your account and all associated data at any time. This can be done directly in the app under "Settings → Delete account."

7.4 Right to data portability (Art. 20 GDPR)

You have the right to receive your data in a structured, commonly used, and machine-readable format (JSON export available in the app).

7.5 Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority:

8. Revocation of consent

You can revoke your consent to data processing at any time. Revocation is effected by:

• Deleting your account in the app
• Sending an email to: falte@notsan-brb.de

9. Data protection for children

The app is aimed at families with children. Registration and administration is carried out by parents or legal guardians. Children may only use the app with the consent and under the supervision of their parents.

Minimum age for independent use: 16 years (in accordance with Art. 8 GDPR)

10. Contact

If you have any questions about data protection, please feel free to contact us at any time:

More information:
Privacy Policy • Imprint • Terms • Disclaimer • Back to Homepage

Last update: October 12, 2025
© 2025 westflügelmedia • AsthmaCare