Privacy Policy

Last updated: September 19, 2026

1. About this Privacy Policy

This Privacy Policy explains how Digital Rebels GmbH, operating under the name Fitrockr (“Fitrockr”, “we”, “us” or “our”), processes personal data when you use Fitrockr websites, applications, APIs, platforms and related services.

Fitrockr provides a wearable and health-data platform that may be used for, among other purposes:

• healthcare and patient monitoring;

• research and clinical trials;

• fitness and wellness programs;

• coaching;

• employee and workplace safety programs;

• insurance programs;

• elderly care and assisted living;

• defense and other specialized programs;

• surveys, ePROs, eCOAs and electronic assessments;

• wearable-data integration and APIs;

• data analytics and reporting;

• health and fitness assessments;

• monitoring, alerting and risk prediction.

Because Fitrockr may process different categories of information for different customers and use cases, the exact processing activities applicable to you depend on the Fitrockr product, project and configuration you use.

This Privacy Policy should therefore be read together with any project-specific privacy notice, consent form, participant information sheet, customer agreement, data processing agreement or other privacy information provided to you.

Where another organization, such as a hospital, research institution, employer, insurer, coach or other customer, determines the purposes and means of processing your personal data and uses Fitrockr to process that data on its behalf, that organization may be the controller of your personal data and Fitrockr may act as its processor. In those circumstances, the organization’s privacy notice and instructions also apply.

3. What personal data do we process?3. What personal data do we process?

Depending on the Fitrockr product, integration, project configuration and permissions granted to us, we may process the following categories of personal data.

3.1 Identification and contact information

This may include:

• first and last name;

• email address;

• username;

• profile photograph;

• country;

• language;

• time zone;

• customer or participant identifier.

3.2 Account and authentication information

This may include:

• account credentials;

• authentication information;

• account status;

• roles and permissions;

• organization affiliation;

• login information;

• security and authentication logs.

Passwords are stored using appropriate security mechanisms and are not stored in plain text.

3.3 Demographic and profile information

Depending on the configuration, this may include:

• year or date of birth;

• age;

• gender or sex;

• height;

• weight;

• country;

• other profile information provided by you or the organization operating the Fitrockr project.

3.4 Wearable and sensor data

Fitrockr may receive data from supported wearable devices, sensors and other connected systems.

Depending on the device and integration, this may include:

• heart rate;

• resting heart rate;

• heart-rate variability;

• activity;

• steps;

• distance;

• calories;

• sleep;

• respiration;

• blood oxygen / SpO2;

• body temperature;

• blood glucose information where provided through supported integrations;

• stress and recovery metrics;

• workouts;

• movement data;

• accelerometer and gyroscope data;

• device status;

• battery information;

• other physiological, biometric or sensor measurements made available by the relevant device or integration.

The precise data collected depends on the device, integration and permissions enabled.

3.5 Health and wellness information

Depending on the use case, Fitrockr may process information concerning:

• physical health;

• physiological measurements;

• medical or health-related information provided by you;

• symptoms;

• health assessments;

• health-related questionnaires;

• lifestyle information;

• medication information where provided;

• blood or laboratory results where manually entered or imported;

• health-related goals;

• health or fitness assessments.

Some of this information may constitute special-category health data under the GDPR or consumer health data or sensitive personal information under applicable U.S. laws.

3.6 Location data

Certain Fitrockr applications may process location information, including precise location information obtained from your mobile device.

Location functionality may be used, depending on the configuration, to:

• record geographic information associated with an activity;

• display routes or activities;

• support location-based functionality;

• support connectivity between a mobile device and a wearable or sensor;

• provide services requested by you or the organization operating the service.

Where technically required for the relevant functionality, location information may be collected while an application operates in the background.

You can control location permissions through your device’s operating-system settings, subject to the functionality of the particular Fitrockr application.

We do not use precise location information for purposes unrelated to the relevant Fitrockr functionality unless separately disclosed and, where required, consented to.

3.7 Surveys, ePROs and assessments

Fitrockr may process information entered into:

• surveys;

• electronic patient-reported outcomes (ePROs);

• electronic clinical outcome assessments (eCOAs);

• ecological momentary assessments (EMAs);

• questionnaires;

• diaries;

• tasks;

• assessments;

• participant-reported measurements.

The contents of these assessments depend on the project.

3.8 Usage, technical and security information

We may process:

• IP address;

• device type;

• operating system;

• application version;

• browser information;

• device identifiers;

• crash information;

• diagnostic information;

• timestamps;

• login and authentication events;

• API requests;

• security logs;

• audit logs;

• information concerning use of the Fitrockr platform.

3.9 Communications

If you contact us, we may process:

• your name;

• email address;

• organization;

• correspondence;

• support requests;

• attachments;

• information necessary to resolve your request.

4. Sources of personal data4. Sources of personal data

We may obtain personal data:

1. directly from you;

2. from your mobile device;

3. from wearable devices and sensors;

4. from health-data platforms and APIs that you or an authorized organization connect to Fitrockr;

5. from healthcare providers, research organizations, employers, insurers, coaches or other Fitrockr customers;

6. from administrators of a Fitrockr project;

7. from integrations and third-party systems;

8. automatically when you use Fitrockr;

9. from other sources where permitted by applicable law.

Where personal data is received from a source other than you, the applicable privacy information will identify the relevant source where required by law.

5. Why do we process personal data?5. Why do we process personal data?

We process personal data only for defined and legitimate purposes.

Depending on the applicable Fitrockr service, these purposes may include:

5.1 Providing Fitrockr services

We process personal data to:

• create and administer accounts;

• authenticate users;

• connect wearable devices;

• collect and synchronize wearable and sensor data;

• store and display data;

• provide dashboards;

• provide analytics and reports;

• provide APIs;

• provide monitoring and alerts;

• provide surveys and assessments;

• support challenges and competitions;

• provide coaching functionality;

• provide other services requested by you or our customer.

5.2 Research and clinical projects

Where Fitrockr is used for research or clinical projects, we may process personal data on behalf of the relevant research organization or sponsor in accordance with the applicable project documentation, instructions and agreements.

Fitrockr does not independently determine the scientific purpose of a research project merely because the Fitrockr platform is used to conduct it.

5.3 Healthcare and patient monitoring

Where Fitrockr is used in healthcare, we process data to provide the functionality requested by the relevant healthcare organization or other customer.

Fitrockr does not provide medical diagnosis or treatment merely by providing software functionality.

Any medical or healthcare decisions remain the responsibility of the relevant healthcare professional or organization unless expressly stated otherwise.

5.4 Security and fraud prevention

We process technical and account information to:

• protect Fitrockr;

• detect and prevent unauthorized access;

• detect abuse;

• investigate security incidents;

• maintain system integrity;

• protect users and customers;

• maintain audit trails;

• comply with security requirements.

5.5 Customer support

We process information necessary to respond to inquiries, diagnose problems and provide technical support.

5.6 Legal and regulatory compliance

We may process personal data where necessary to:

• comply with legal obligations;

• respond to lawful requests;

• establish, exercise or defend legal claims;

• maintain legally required records;

• comply with regulatory requirements.

5.7 Communications

We may use contact information to send:

• transactional communications;

• service notifications;

• security notifications;

• technical information;

• account-related communications.

Where legally required, marketing communications are sent only after obtaining the necessary consent or on another legally permitted basis.

You may unsubscribe from marketing communications at any time.

5.8 Product improvement

Where legally permitted and subject to applicable contractual and project restrictions, we may use appropriately limited technical and usage information to:

• maintain;

• troubleshoot;

• test;

• secure;

• improve

Fitrockr products and services.

We do not use identifiable health information from customer projects for unrelated product-development purposes unless an appropriate legal basis, authorization, consent or contractual arrangement exists.