Privacy Policy

This privacy policy is applicable to the Healthterra app for mobile devices, together with any related services operated by Konstantinos Vrousgos (collectively, the “Application”). Konstantinos Vrousgos is hereinafter referred to as the “Service Provider”.

Data Controller Information

Konstantinos Vrousgos acts as the Data Controller responsible for the processing of your personal data.

Name: Konstantinos Vrousgos Address: Thessaloniki, Greece Email: kostasvrou12@gmail.com

For data protection inquiries and to exercise your GDPR rights, please contact the Data Controller using the contact information above.

What information does the Application collect and how is it used?

The Application collects the following categories of personal data:

User-provided data:

• Profile identifiers, such as a username chosen by you during profile setup
• Physical characteristics and fitness profile data, such as age, gender, height, weight, and activity level
• Historical health and wellness records, including but not limited to, water intake, calorie intake, exercise activity, step counts, and earned achievements

Authentication and Account data:

• For Anonymous Users: An anonymous user identifier generated automatically by Firebase Authentication. This identifier is not linked to your name, email address, or any other directly identifying information.
• For Google Sign-In Users: If you choose to authenticate via Google, Firebase Authentication processes your Google account tokens, providing the Application with your email address, full name, and an authenticated user ID. This allows your entire account profile, health and wellness logs (including water, calories, steps, and exercises), historical data records and unlocked achievements to be securely saved, synced, and restored across devices.

Leaderboard data:

• If you explicitly opt-in via the Application’s settings or profile setup, your username and health performance scores are stored in Firebase Cloud Firestore and are visible to other users of the Application through the leaderboard feature. If you do not opt-in, your data remains private and is not shared with the leaderboard.

Device and usage data:

• Technical and diagnostic data, including but not limited to device type, mobile operating system, unique device identifier, IP address, and application usage metrics. This data is collected automatically by the Application and its third-party SDKs.

The Application does not collect your phone number. If you use the Application anonymously, it does not collect your email address or real name. However, if you choose to sign in using your Google Account, the Application will collect the email address and name associated with that account to facilitate account creation, data synchronization, and account recovery.

The Service Provider uses this information solely to provide and improve the Application’s features. The Service Provider does not use this information to send marketing communications.

Legal basis for processing your personal data

Where the GDPR applies, the Service Provider relies on one or more lawful bases to process your personal data, including:

Contract performance: processing necessary to provide the Application or fulfil a contract with you.

Consent: where you have given explicit consent to processing, including for analytics or optional features. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

Legitimate interests: where processing is necessary for the Service Provider’s specific legitimate interests, such as maintaining network and information security, preventing fraud and abuse, or improving the Application’s core functionality through analytics, provided those interests are not overridden by your data protection rights or fundamental freedoms.

Legal obligation: to comply with laws or government requests.

Cookies and similar technologies

The Application or its third-party SDKs may use cookies, SDKs, pixels, and similar technologies to support functionality, analytics, and service delivery. Where required by law, the Service Provider will obtain your consent before using non-essential tracking technologies.

Automated decision-making and profiling

If the Application uses automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, you have the right to request human review, express your point of view, and contest the decision. Information about the logic involved and the likely consequences of that processing will be provided where required by law.

What information does the Application collect automatically?

In addition to the information described above, the Application may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device’s unique device ID, the IP address of your mobile device, your mobile operating system, and information about the way you use the Application.

Does the Application collect precise real-time location information of the device?

This Application does not gather precise information about the location of your mobile device.

Does the Application use Artificial Intelligence (AI) technologies?

The Application does not use Artificial Intelligence (AI) technologies to process your data or provide features.

Do third parties see and/or have access to information obtained by the Application?

The Application uses third-party services that may receive certain personal data as described below.

The Application transmits the following data to Firebase services operated by Google:

• An anonymous user identifier (via Firebase Authentication)
• Username and leaderboard scores (via Firebase Cloud Firestore), which are visible to other users of the Application through the leaderboard feature
• Device integrity signals (via Firebase App Check and the Play Integrity API) to protect the Application against abuse

The Service Provider may also disclose information:

• As required by law, such as to comply with a subpoena or similar legal process
• When the Service Provider believes in good faith that disclosure is necessary to protect rights, safety, investigate fraud, or respond to a government request
• With trusted service providers who work on the Service Provider’s behalf, who do not have an independent use of the information disclosed to them, and who have agreed to adhere to the rules set forth in this privacy statement

Where the GDPR applies, the Service Provider enters into Data Processing Agreements (DPAs) with third-party service providers that process personal data on its behalf, as required by Article 28 of the GDPR. These DPAs impose the same data protection obligations on those service providers as described in this Privacy Policy.

Third-party services used by the Application:

• Google Play Services
• Firebase Authentication
• Firebase Cloud Firestore
• Firebase App Check

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data outside the European Economic Area (EEA). Where such transfers occur, the Service Provider will use an appropriate transfer mechanism required by GDPR Chapter V, including:

• Adequacy decisions by the European Commission
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Other safeguards or derogations recognized under GDPR Chapter V, including consent where legally permitted

Countries outside the EEA may not provide the same level of data protection as the EEA. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

What are my opt-out rights?

You can delete all your personal data at any time using the in-app “Delete Account” feature, accessible from the Profile screen. This permanently removes your account and all associated data from both your device and Firebase servers.

Alternatively, you can stop all further data collection by uninstalling the Application. Please note that uninstalling removes local data from your device but does not automatically delete data already stored on Firebase servers. To ensure complete deletion of all data, use the in-app “Delete Account” feature before uninstalling, or contact the Service Provider at kostasvrou12@gmail.com.

What is the data retention policy and how can you manage your information?

The Service Provider retains your personal data only for as long as it is necessary to provide the Application’s features:

• Local data (including, but not limited to, health records, profile information, and app settings): Stored on your device and retained until you delete your account using the in-app “Delete Account” feature or uninstall the Application.
• Firebase data (including, but not limited to, your anonymous user identifier, Google account email and name if provided, custom username, physical characteristics, health logs, historical data entries and unlocked achievements): Retained securely on Firebase servers to ensure seamless data backup and account recovery across device reinstalls. This data is permanently and completely removed when you utilize the in-app “Delete Account” feature or contact the Service Provider to request deletion[cite: 2].
• Aggregated and anonymized data: May be retained indefinitely as it no longer identifies you.
• Data required for legal compliance: Retained for as long as required by applicable law.

How to delete your data:

You can delete all personal data directly within the Application by navigating to the Profile screen and selecting “Delete Account.” This will permanently and immediately delete your account and all associated data from both your device and Firebase servers.

Alternatively, you may contact the Service Provider at kostasvrou12@gmail.com to request deletion. Please include your unique Account ID displayed on your Profile screen. The Service Provider will respond within one month of receiving your request, extendable by up to two additional months where necessary due to complexity, as permitted by applicable law.

Please note that some locally stored data may remain on your device until the Application is uninstalled, even after account deletion.

How does the Application address children’s privacy?

The Application is not intended for children under 16 years of age, or where a higher age of digital consent is established under applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. The Service Provider does not knowingly collect personally identifiable information from children under 16 years of age, or where a higher age of digital consent is established by applicable law, in violation of applicable law. In the event the Service Provider discovers that a child has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (kostasvrou12@gmail.com) so that they will be able to take the necessary actions.

How is your information kept secure?

The Service Provider is committed to safeguarding the confidentiality of your information. The Service Provider implements electronic and procedural safeguards to protect information it processes and maintains. Access to personal data is limited to those who need it to operate, develop, or improve the Application. However, no security system can prevent all potential security breaches.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law.

As the Application uses anonymous authentication and does not collect email addresses or other direct contact information, the Service Provider is unable to notify individual users by email. In the event of a high-risk breach, the Service Provider will instead notify affected users by:

• Posting a prominent notice within the Application on next launch
• Updating this privacy policy page with full details of the breach
• Posting a notice on the Application’s Google Play Store listing

Such notices will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address it. The Service Provider will make all reasonable efforts to inform affected users as promptly as possible.

How will you be informed of changes to this Privacy Policy?

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at kostasvrou12@gmail.com.

This privacy policy is effective as of 2026-06-02

What are your GDPR data protection rights?

Under the GDPR, you have the following rights:

Right of Access: You can request access to your personal data.

Right to Rectification: You can request correction of inaccurate data.

Right to Erasure: You can request deletion of your personal data (the “right to be forgotten”). You may also exercise this right directly within the Application via the “Delete Account” feature on the Profile screen.

Right to Restrict Processing: You can request that the Data Controller limits how they use your data.

Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format.

Right to Object: You can object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing purposes at any time.

Right to Withdraw Consent: Where processing is based on your consent, you can withdraw it at any time by contacting the Data Controller.

Rights Regarding Automated Decision-Making: You have rights related to automated decisions that affect you.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority. Contact details for each country’s Data Protection Authority can be found at: https://edpb.ec.europa.eu/about-edpb/members_en

If you are located in the United Kingdom, you may contact the Information Commissioner’s Office at https://ico.org.uk

What are your California privacy rights (CCPA/CPRA)?

If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

Right to Know: You can request disclosure of the categories and specific pieces of personal information the Service Provider has collected about you.

Right to Delete: You can request deletion of personal information the Service Provider has collected from you, subject to certain exceptions.

Right to Correct: You can request correction of inaccurate personal information.

Right to Opt-Out: You can opt out of the sale or sharing of your personal information for cross-context behavioral advertising.

Right to Limit Use of Sensitive Personal Information: You can limit the use of your sensitive personal information to essential purposes.

Right to Non-Discrimination: The Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, please contact the Service Provider at kostasvrou12@gmail.com. The Service Provider will verify your request using the information you provide and respond within the timeframes required by law. You may designate an authorized agent to make a request on your behalf.

How do you give your consent?

Where processing is based on consent (such as displaying your username and scores on the public leaderboard), you provide that consent by affirmatively opting in via a checkbox within the Application’s Profile screen. You may withdraw consent and hide your profile from the leaderboard at any time by turning this feature off in the settings, without affecting processing carried out before withdrawal.

How can you contact the Data Controller?

If you have any questions regarding privacy while using the Application, or wish to exercise any of your data protection rights, please contact the Service Provider via email at kostasvrou12@gmail.com.