PRIVACY POLICY

TABLE OF CONTENTS

1. INTRODUCTION AND DATA CONTROLLER INFORMATION

This Privacy Policy governs the processing of personal data by Barták Imre Gergő, an individual sole proprietor registered in Hungary ("we," "us," "our," "Data Controller," "Data Fiduciary"), in connection with the RepsUp mobile application ("App," "Service").

Data Controller Details:

Legal Name	Barták Imre Gergő (Individual Sole Proprietor)
Registered Address	Erdős köz 3, 8256 Ábrahámhegy, Veszprém, Hungary
Contact Email	privacy@repsup.app
EU/EEA Establishment	Hungary (EU Member State)

Our Role: Under applicable data protection laws including the GDPR, India's DPDPA, CCPA/CPRA, Washington's My Health My Data Act, and others, we are the Data Controller/Data Fiduciary. This means we determine the purposes and means of processing personal data within the App, even though all processing occurs locally on your device and we have no access to your data.

2. WHAT INFORMATION IS PROCESSED

The App processes the following categories of personal information exclusively on your device:

Data Category	Specific Data Types	Purpose of Processing	Sensitivity Level
Workout Data	• Workout plan names • Exercise names and descriptions • Sets, repetitions, rest times • Weight/resistance values • Personal notes and comments	Core app functionality for workout planning and tracking	Standard Personal Data
Health & Biometric Data	• Heart rate (BPM) - Read/Write • Active energy/calories - Read/Write • Workout sessions - Write only • Timestamped heart rate samples	Real-time performance monitoring and health tracking	Special Category/Sensitive
App Preferences	• Apple Watch usage preference • Display mode (Calendar/List) • Haptic feedback settings • Sound preferences	User experience customization	Standard Personal Data
Technical Data	• Device model • iOS/watchOS version • App version • Timezone	Technical support and data export functionality	Standard Personal Data
Age Verification Data	• Date of birth (momentary check) • Region (if under 18, momentary check)	Age verification only - NOT stored or saved	Not retained

3. SENSITIVE HEALTH DATA AND SPECIAL CATEGORY INFORMATION

3.1 Classification by Jurisdiction

Jurisdiction	Classification	Legal Requirement
EU/UK/EEA	Special Category Data (Article 9 GDPR)	Explicit consent required
Washington State	Consumer Health Data (MHMDA)	Separate consent for each type
California	Sensitive Personal Information	Opt-in consent required
Other US States	Sensitive Personal Information	Opt-in consent (varies by state)
Canada	Sensitive Information / Health Information	Express consent required
India	Sensitive Personal Data	Explicit consent required
Australia	Sensitive Information	Express consent required
New Zealand	Health Information	Individual's authority required
South Africa	Special Personal Information	Explicit consent required

3.2 Health Data We Process

With your explicit, granular, and informed consent, the App accesses the following health data from Apple HealthKit:

• Heart Rate Data:
  • Real-time heart rate during workouts (beats per minute)
  • Timestamped heart rate samples for workout analysis
  • Access: Read (live during watch workouts) and Write to HealthKit
  • Purpose: Display workout intensity, create performance charts, and save a complete record to Apple Health
• Active Energy/Calories:
  • Energy expenditure during workouts (kilocalories)
  • Access: Read and Write to HealthKit
  • Purpose: Track calories burned and workout effectiveness
• Workout Sessions:
  • Complete workout summaries including duration, type, and metrics
  • Access: Write-only to HealthKit
  • Purpose: Save workout history to Apple Health

4. LEGAL BASIS FOR PROCESSING

4.1 General Principles

We process personal data only when we have a valid legal basis under applicable law. The legal basis varies by jurisdiction and data type:

4.2 Legal Basis by Jurisdiction

5. DATA SHARING AND THIRD PARTIES

5.1 Data Movement Scenarios

Your data only moves in the following user-initiated scenarios:

Scenario	Data Involved	Recipient	User Control
Apple Health Integration	Workout sessions, calories, heart rate	Apple Health app (on-device)	Requires explicit permission
Device Sync	Workout plans, settings, completed sessions	Your paired Apple Watch	Automatic with pairing
Data Export	All app data (JSON format)	User-selected location	User-initiated only

5.2 What We DON'T Do

• We do NOT sell or rent personal information
• We do NOT share data with advertisers
• We do NOT use analytics or tracking services
• We do NOT store data in the cloud
• We do NOT transfer data internationally
• We do NOT engage in profiling or automated decision-making

6. DATA RETENTION

6.1 General Retention Principle

Your data is retained on your device indefinitely until you choose to delete it. This aligns with the ongoing purpose of fitness tracking and progress monitoring.

6.2 Jurisdiction-Specific Requirements

Jurisdiction	Requirement	Our Implementation
EU/UK (GDPR)	No longer than necessary for purpose	User-controlled deletion at any time
New Zealand	Health records: 10-year minimum retention	User responsibility to maintain backups if required
India (DPDPA)	Delete when purpose fulfilled or consent withdrawn	User-initiated deletion available
Colorado (CPA)	Annual review for biometric data	User can review and delete via app
South Africa (POPIA)	Delete as soon as reasonably practicable	User-controlled deletion

6.3 Deletion Methods

• Selective Deletion: Delete individual workouts or exercises within the app
• Complete Deletion: Uninstall the app from all devices
• Health Data: Revoke permissions in iOS Settings > Health > Data Access & Devices > RepsUp

7. DATA SECURITY

7.1 Technical Safeguards

Your data is protected by multiple layers of security:

• Device-Level Encryption: iOS hardware encryption (AES-256)
• Access Control: Face ID, Touch ID, or device passcode required
• Application Sandboxing: iOS app isolation prevents other apps from accessing data
• Secure Framework: Apple's SwiftData with built-in encryption
• Network Security: No network transmission of personal data
• Secure Communication: Apple Watch sync uses encrypted Bluetooth

7.2 Organizational Measures

• Privacy by Design: Local-only architecture eliminates server breach risks
• Data Minimization: Only essential data for fitness tracking
• No Server Access: Technical impossibility of remote access
• Regular Security Reviews: App security assessments with each update
• Data Protection Impact Assessments: Conducted for health data processing
• Secure Development: Following Apple's security best practices

8. CHILDREN'S PRIVACY

8.1 Age Verification Process

During onboarding, we perform an age verification check:

• Users must provide their date of birth
• If under 18, users must also provide their region
• This information is used solely for age verification
• The data is NOT stored or saved
• It is immediately discarded after the verification check

8.2 Minimum Age Requirements by Region

Region	Minimum Age	Legal Basis
India	18 years	DPDPA Section 9
EU/UK/EEA	16 years (or lower if permitted by member state, not below 13)	GDPR Article 8
Quebec, Canada	14 years	Law 25
United States & Other Regions	13 years	COPPA and local laws

8.3 Verifiable Parental Consent (VPC) for Minors

If a user is identified as being below the age of consent for their region, they are directed to our Verifiable Parental Consent (VPC) process. Access to the Service is only granted after a parent or legal guardian provides verified consent directly on the device.

1. Present Parental Gate: The App will display a dedicated screen for the parent or guardian, instructing the child to hand over the device.
2. Provide Direct Notice On-Screen: This screen serves as the legally required "Direct Notice." It clearly explains the types of personal information the app collects from their child (including workout and optional health data) and provides a direct link to this Privacy Policy.
3. Verify Consent with Passcode: The parent must confirm they have read the notice and agree to the terms by checking several boxes. To verify their consent, they are required to create a 4-digit "Parental Passcode." This action serves as a reasonable effort to ensure an adult is present and providing consent.
4. Activate Account: Once the parent creates the passcode and confirms consent, the child's access to the App is activated. A secure, scrambled (hashed) version of this passcode is stored locally on the device to serve as a record of consent.

8.4 Parental Rights

As a parent or guardian, you have full control over your child's data. Since all data is stored exclusively on your child's device, you can:

• Review and Manage Data: Access the App on your child's device at any time to review their workout plans, health data, and other information.
• Delete Data: You can delete specific data within the app or delete all data by uninstalling the app from the device.
• Withdraw Consent: You can withdraw your consent at any time by deleting the app from your child's device. This action is permanent and will erase all associated data.
• Contact Us for Assistance: If you have any questions or need help managing your child's data, please contact us at privacy@repsup.app.

If we become aware that we have collected personal information from a child in violation of applicable law, we will take immediate steps to delete that information.

8.5 Special Protections for Children

For users under 18 (or the age of majority in their jurisdiction):

• No behavioral tracking or profiling
• No targeted advertising (we have no ads at all)
• No data sharing with third parties
• Enhanced privacy protections by default

India-Specific: We are legally prohibited from and do not engage in any tracking, behavioral monitoring, or targeted advertising directed at children (users under 18) in compliance with the DPDPA.

9. YOUR PRIVACY RIGHTS

You have comprehensive rights over your personal data. These rights vary by jurisdiction but generally include:

9.1 Universal Rights

Right	Description	How to Exercise
Access	View and obtain a copy of your data	Use "Export My Data" in app settings
Rectification	Correct inaccurate data	Edit directly within the app
Erasure	Delete your data ("right to be forgotten")	Delete in app or uninstall
Portability	Transfer data to another service	Export as JSON file
Restrict Processing	Limit how data is used	Adjust app permissions
Object	Object to specific processing	Withdraw consent or stop using app
Withdraw Consent	Revoke previously given consent	Settings > Health > Data Access > RepsUp

9.2 How to Exercise Your Rights

Since all data is stored on your device, you can exercise most rights immediately through the app. For assistance or questions, contact us at privacy@repsup.app.

9.3 Response Timeline

If you contact us for assistance:

• Acknowledgment: Within 48-72 hours
• Response: Within 30 days (45 days for complex requests with notification)
• No Fee: Generally free, except for manifestly unfounded or excessive requests

10. DATA BREACH PROCEDURES

10.1 Breach Response

In the unlikely event of a security incident affecting the app that could compromise data security:

Jurisdiction	Authority Notification	User Notification
EU/UK (GDPR)	72 hours to supervisory authority	Without undue delay if high risk
California (CCPA)	Not required	Without unreasonable delay
India (DPDPA)	72 hours to Data Protection Board	As directed by Board
Canada (PIPEDA)	As soon as feasible	As soon as feasible if risk of harm
Australia	72 hours to OAIC	As soon as practicable
South Africa	As soon as reasonably possible	As soon as reasonably possible

10.2 Breach Notification Content

Any breach notification will include:

• Nature and date of the incident
• Types of data potentially affected
• Potential consequences
• Measures taken to address the breach
• Recommended protective actions
• Contact information for questions

11. UNITED STATES RESIDENTS - STATE SPECIFIC RIGHTS

11.1 California - CCPA/CPRA Rights

11.2 Washington - My Health My Data Act (MHMDA)

11.3 Colorado Privacy Act (CPA)

11.4 Connecticut Data Privacy Act (CTDPA)

11.5 Virginia Consumer Data Protection Act (VCDPA)

11.6 Utah Consumer Privacy Act (UCPA)

11.7 Other State Rights

Residents of Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, and Texas have similar rights including access, correction, deletion, and portability of personal data.

12. EUROPEAN, UK, AND SWISS RESIDENTS - GDPR RIGHTS

12.1 Your Rights Under GDPR/UK GDPR/Swiss FADP

12.2 Special Category Data

Health data is "special category data" under Article 9 GDPR, requiring:

• Explicit consent (Article 9(2)(a))
• Enhanced security measures
• Data Protection Impact Assessment (completed)
• Clear purpose limitation

12.3 Supervisory Authority

You have the right to lodge a complaint with a supervisory authority:

• Hungary (Lead Authority): Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
• Your Country: Find your authority at https://edpb.europa.eu/about-edpb/board/members_en

12.4 Data Transfers

No international data transfers occur as all data remains exclusively on your device.

13. CANADIAN RESIDENTS - PIPEDA AND LAW 25

13.1 PIPEDA Rights (Federal)

13.2 Quebec Law 25 Additional Rights

14. INDIAN RESIDENTS - DPDPA RIGHTS

14.1 Legal Basis - Consent Only

Important for Indian Users: Our SOLE legal basis for ALL personal data processing is your explicit consent, which must be:

• Free (given voluntarily)
• Specific (for identified purposes)
• Informed (with clear information)
• Unconditional (no bundled consent)
• Unambiguous (clear affirmative action)

We do NOT rely on contract, legitimate interests, or any other legal basis for Indian users.

14.2 Your Rights as a Data Principal

14.3 Grievance Officer

14.4 Sensitive Personal Data

Health and fitness data (heart rate, calories, workout metrics) is considered sensitive personal data under Indian law and receives enhanced protection.

15. OTHER REGIONAL PROVISIONS

15.1 Australia - Privacy Act 1988

15.2 New Zealand - Privacy Act 2020 & Health Information Privacy Code

15.3 South Africa - POPIA

16. DATA PROTECTION OFFICERS AND REPRESENTATIVES

16.1 Appointed Officers

Role	Jurisdiction	Name	Contact
Data Protection Officer	EU/UK/EEA (GDPR)	Barták Imre Gergő	privacy@repsup.app (Subject: "DPO Inquiry")
Privacy Officer	Quebec (Law 25)	Barták Imre Gergő	privacy@repsup.app
Grievance Officer	India (DPDPA)	Barták Imre Gergő	privacy@repsup.app (Subject: "DPDPA Grievance")
Information Officer	South Africa (POPIA)	Barták Imre Gergő	privacy@repsup.app

16.2 EU Representative

Not required as we are established in Hungary, an EU member state.

16.3 Why We May Not Need All Officers

As a small-scale processor with all data stored on user devices, we may not meet the thresholds requiring certain officers. However, we have designated these roles to ensure compliance and provide clear points of contact.

17. CONSENT WITHDRAWAL PROCEDURES

17.1 How to Withdraw Consent

You can withdraw your consent at any time. Withdrawal is as easy as giving consent:

1. For Health Data (HealthKit):
   • Go to Settings > Health > Data Access & Devices > RepsUp
   • Toggle off specific permissions (Heart Rate, Active Energy, Workouts)
   • Takes effect immediately
2. For All Data Processing:
   • Stop using the app
   • Uninstall from iPhone and Apple Watch
   • All data is permanently deleted

17.2 Consequences of Withdrawal

• Health tracking features will be disabled
• Historical data remains on device unless you delete it
• No penalty or discrimination for withdrawing consent
• You can re-consent at any time to restore functionality

17.3 Partial Withdrawal

You can withdraw consent for specific data types while continuing to use other features:

• Disable heart rate but keep workout tracking
• Disable calorie tracking but keep exercise logging
• Each permission is granular and independent

18. POLICY UPDATES

18.1 Notification of Changes

We will notify you of material changes through:

• In-app notification upon next launch
• App Store update description
• Email notification (if you've contacted us and provided email)

18.2 Review and Acceptance

• You'll have 30 days to review material changes
• Continued use after notification constitutes acceptance
• You can export your data and stop using the app if you disagree
• Non-material updates take effect immediately

18.3 Version History

This is Version 2.1, effective September 18, 2025. Previous versions are available upon request.

19. CONTACT INFORMATION

For Specific Inquiries:

Inquiry Type	Email Subject Line
EU/UK Data Protection	"DPO Inquiry"
India DPDPA Grievances	"DPDPA Grievance"
California CCPA/CPRA	"CCPA Request"
Washington MHMDA	"MHMDA Request"
General Privacy	"Privacy Inquiry"
Data Access Request	"Data Access Request"
Data Deletion Request	"Data Deletion Request"

---

End of Privacy Policy
© 2025 Barták Imre Gergő - All Rights Reserved
RepsUp - Plan & Track Workouts™ is a trademark of Barták Imre Gergő
Version 1.0 - Effective September 18, 2025