Privacy Notice
EU Regulation 2016/679 (GDPR)
Last updated: 4 October 2026
Data Controller
The Data Controller for client data is the practitioner who uses Stress Index to follow their own clients. For details about your specific Controller, refer to the contact details of the practitioner who gave you access to the app. The technology platform (app and website) is provided by The Performance Lab S.r.l. For questions about the processing carried out by the platform: Email: support@stressindex.io
Personal data collected
The app and the website collect the following categories of data: 1. ACCOUNT DATA • First and last name • Email address • Account creation date and time 2. HRV MEASUREMENT DATA • Recorded RR intervals (ms) • Computed HRV indices (RMSSD, SDNN, DFA α1, etc.) • Date, time and duration of the sessions 3. CLIENT DATA • First name, last name, date of birth, sex • Lifestyle information (optional) • Notes entered by the practitioner 4. TECHNICAL ERROR DATA • See the section "Technical error monitoring" HRV data may amount to data concerning health under Art. 9 GDPR. The practitioner is responsible for obtaining their clients' consent.
Purposes and legal basis
• SERVICE DELIVERY (Art. 6(1)(b) GDPR) Managing HRV sessions, computing indices, storing the history. • WELLNESS DATA (Art. 9(2)(a) GDPR) Processing of wellbeing-related data subject to the person's explicit consent. • MARKETING COMMUNICATIONS (Art. 6(1)(a) GDPR) Only with explicit consent, which you can withdraw at any time from the settings. • SECURITY AND RELIABILITY (Art. 6(1)(f) GDPR) Access logs for fraud prevention and account security; technical error monitoring to fix malfunctions of the app and the website.
Technical error monitoring
To notice malfunctions and fix them, the app and the website send an automatic report when a technical error occurs. The service is provided by Sentry (Functional Software, Inc.), acting as a data processor on our behalf. DATA PROCESSED: • Technical errors: type of error, the point in the program where it happened, date and time • Anonymous user identifier: a random code assigned to the account, with no name or email • Version of the app or website • Device: model, operating system, browser type DATA NOT SENT: • First name, last name and email address • Measurements, RR intervals, indices and scores • Notes and content entered by the practitioner or the client PURPOSE: finding and fixing errors, keeping the service working and secure. This data is not used for profiling or advertising. LEGAL BASIS: legitimate interest in keeping the service reliable and secure (Art. 6(1)(f) GDPR). DATA LOCATION: European Union (Sentry's EU region, Frankfurt, Germany). RETENTION: reports are deleted automatically within 90 days.
Data retention
Data is stored on Supabase infrastructure (AWS, Frankfurt EU-Central-1 datacentre, Germany). RETENTION PERIOD: • Account data: until the account is deleted • HRV and client data: until the practitioner deletes it or closes the account • Access logs: 90 days • Technical error reports: 90 days • Encrypted backups: 30 days SECURITY: • Encryption in transit: TLS 1.3 • Encryption at rest: AES-256 • Row-Level Security (RLS): each practitioner can reach only their own data • No data is transferred outside the European Union
Your rights (GDPR)
Under Articles 15-22 GDPR you have the right to: • ACCESS (Art. 15): obtain a copy of your personal data • RECTIFICATION (Art. 16): correct inaccurate or incomplete data • ERASURE (Art. 17): ask for deletion (the "right to be forgotten") • RESTRICTION (Art. 18): restrict the processing • PORTABILITY (Art. 20): receive your data in a structured, machine-readable format • OBJECTION (Art. 21): object to the processing, including technical error monitoring • WITHDRAW CONSENT: at any time, without affecting the lawfulness of earlier processing To exercise your rights: support@stressindex.io You also have the right to lodge a complaint with your national data protection authority.
Contacts
Email: support@stressindex.io Website: stressindex.io To exercise your rights, or for any question about how your personal data is processed, write to the email address above. We reply within 30 days of receiving your message.