Privacy Policy

Last updated: June 2026

1. Who we are

This study is conducted by Vedran Bajer, PhD candidate at the Faculty of Information Studies in Novo Mesto (FIS), Slovenia. The study is supervised by academic staff at FIS and approved by the FIS Ethics Committee.

Contact: vedran.bajer@student.fis.unm.si

2. What data we collect

  • Anonymised participant code (e.g. ANON_HR_8X92) — generated at registration
  • Age bracket, gender category, country of residence
  • Wearable sensor data: steps, distance, calories, sleep duration and stages, resting heart rate, HRV, SpO2, workout activity
  • Device provider / brand
  • Technical metadata (data ingestion timestamps, error logs)

We do not collect names, email addresses, phone numbers, IP addresses, GPS or location data, audio, camera, contacts, or any other personally identifying information.

3. Legal basis for processing

We process your data on the basis of your freely given, specific, informed and unambiguous consent (GDPR Art. 6(1)(a)).

Some of the data we collect (heart rate, heart rate variability, sleep, and where available SpO2) is health data, which is a special category of personal data under GDPR Art. 9. We process this data on the basis of your explicit consent (Art. 9(2)(a)), in the context of scientific research carried out with appropriate safeguards (Art. 9(2)(j)).

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. How we use your data

Data is used exclusively for academic research within Vedran Bajer's PhD dissertation. It will not be sold, shared with third parties for commercial purposes, or used for advertising. Aggregated, anonymised findings may be published in academic journals or conference proceedings.

5. Data storage and security

All data is stored in Google Cloud Platform (BigQuery), in the European Union (europe-west1) region. Access is restricted to the research team via role-based IAM controls. Data is encrypted at rest and in transit.

Wearable data is fetched via Spike Technologies (spikeapi.com), an EU-registered API intermediary. Spike acts as a data processor under a data processing agreement.

6. Retention period

Data will be retained for the duration of the PhD project (estimated until end of 2027) and for a maximum of 5 years thereafter for academic audit purposes, unless you request earlier deletion.

7. Your rights

Under GDPR you have the right to:

  • Access a copy of your data
  • Rectification of inaccurate data
  • Erasure ("right to be forgotten") — all your data deleted within 30 days
  • Restriction of processing
  • Data portability
  • Withdraw consent at any time without penalty

To exercise any right, email vedran.bajer@student.fis.unm.si with your participant code. Requests will be fulfilled within 30 days.

8. Complaints

If you believe your data rights have been violated, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), ip-rs.si. If you reside in another EU or EEA country, you may also lodge a complaint with the data protection supervisory authority in your country of residence.

9. Cookies

This website does not use tracking cookies or analytics. No cookies are set beyond what is technically required to process form submissions.