Privacy policy for the LEEK app

1. Controller

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed, because the legal requirements for doing so (Art. 37 GDPR, Section 38 BDSG) are not met. For any question about data protection, please write to the address above.

2. Scope

This privacy policy applies to the Android app “LEEK” (package name com.syrax.leek) and to its use together with the LEEK Pulse Pro fitness band. For this website and the shop, the general privacy policy applies.

3. Core principle: processing on your device

The app is built so that your data does not leave your phone. All readings, calculations (recovery, load, sleep scoring and the like) and settings are kept in the app’s protected storage area on your device. Android shields that area from other apps.

Syrax has no access to this data: the app does not send it to us, and there is no registration or sign-in. It also follows that we can neither view your data nor restore it for you once it has been deleted from the device.

4. What the app processes

4.1 Profile details

Date of birth, sex, height and weight, which you enter during setup or later in your profile, along with your settings (language, goals, reminders and so on). Purpose: calculating calorie burn, heart rate zones, stride length as well as recovery, sleep and fitness values. Without these details the figures would be markedly less accurate.

4.2 Health and activity data

Values measured by the band or derived from those measurements, in particular heart rate and heart rate variability (HRV), blood oxygen saturation (SpO₂), stress values, sleep duration and sleep stages, steps, distance, calorie burn, activities and workouts, plus derived values such as recovery, load or fitness age. Where the band records further values (skin temperature, for example), the same applies. Purpose: displaying, evaluating and charting your health and fitness data over time.

This is health data and therefore subject to special protection (Art. 9 GDPR). It is processed locally only.

4.3 Location data

• Bluetooth scanning: on Android 8 to 11 the operating system requires a location permission in order to scan for Bluetooth devices. The app neither determines nor stores a location in the process.
• Workout recording: if you start a workout with route recording, the app records your GPS location in order to show distance, pace and route. Recording runs only during the workout and only while the app is open or showing a visible notification. The route is stored locally. The app does not request background location permission.

4.4 Band data and Bluetooth

The Bluetooth address, device name, hardware and firmware version and battery level of your band, so that the app can reconnect and offer the features that match your device. If the app detects further LEEK Pulse Pro bands nearby, it stores their Bluetooth addresses locally together with a colour marker so that you can reliably tell your own band from the others. Names of other Bluetooth devices are only displayed during the scan and are not stored.

4.5 Call alert on the band (optional)

If you switch on the call alert, the app requests the “Phone” permission (phone state). It uses that permission solely to detect that your phone is ringing and to make the band vibrate. The app does not read phone numbers, contacts or the call log, and nothing is stored.

4.6 Activity recognition

With your permission (“Physical activity”), the app uses the activity recognition of Google Play services to detect whether you are walking, running or cycling, so that activities can be classified automatically. Recognition happens on the device.

4.7 Reminders, notifications and the app code

Reminders (to move or to drink, for example) are scheduled locally. The app code printed on the packaging is only verified; all that is stored is the fact that the app has been unlocked.

4.8 What the app does not collect

The app does not read contacts, text messages, the call log, photos or files outside its own storage. It contains no advertising, tracking or analytics software and produces no error reports that are sent to us.

5. Permissions at a glance

Android prompts you for most permissions. You can withdraw any permission at any time under Settings › Apps › LEEK › Permissions; the feature concerned will then no longer be available.

6. Legal bases

• Health and activity data: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give when setting up the app.
• Profile details and app features: provision of the features you have asked for (Art. 6(1)(b) GDPR).
• Location, phone state, activity recognition: your consent, given by granting the respective Android permission (Art. 6(1)(a) GDPR).
• Storing and reading information on your device: strictly necessary in order to provide the service you have explicitly requested (Section 25(2) no. 2 TDDDG).

You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR) – for instance by revoking permissions, resetting the data in the app or uninstalling the app. The lawfulness of processing carried out until then remains unaffected.

7. Third parties and external services

We do not sell data and do not pass it on for advertising purposes. Data leaves your device only in the following cases:

7.1 Google Maps (map display)

To display workout routes, the app uses map material from Google Maps. For users in the European Economic Area the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When a map is loaded, your IP address, technical device information and the map section displayed are transmitted to Google – and with it, indirectly, the approximate area of your route. Your health data is not transmitted.

This may involve a transfer to Google LLC in the United States. An adequacy decision of the EU Commission exists for the USA (EU-US Data Privacy Framework), and Google LLC is certified under it. The legal basis is our legitimate interest in a working map display (Art. 6(1)(f) GDPR). Further information: policies.google.com/privacy

7.2 Google Play services

For location during a workout and for activity recognition, the app uses interfaces of Google Play services, which are part of your Android device. Which data Google itself processes in doing so depends on your device settings and on Google’s privacy policy.

7.3 Android backup

If you have enabled backup in your Android settings, Android backs up the app’s data – including your health data – to your Google account so that it can be restored on a new device. From Android 9 onwards this backup is end-to-end encrypted when a screen lock is set. Syrax has no access to that backup. You can disable the backup at any time in your Android settings under System › Backup.

7.4 Google Play Store

The app is distributed through Google Play. Google’s privacy terms apply to downloading, installing and updating it. If you have agreed in your device settings to share usage and diagnostics data, Google provides us with aggregated, non-personal crash and stability statistics.

7.5 Exports and backup files you initiate

You can export your data as a backup file or share evaluations. You choose the destination yourself (a folder, a cloud storage service or a messaging app, for example). Please note: the file contains your health data unencrypted. Further processing by the service you choose is governed by that service’s privacy terms.

7.6 The fitness band

The LEEK Pulse Pro stores readings temporarily on the band until they are transferred to the app over Bluetooth. The app contains a software library from the band manufacturer for this Bluetooth communication; it transmits no data to the manufacturer or to any third party.

8. Retention and deletion

Your data stays stored until you delete it. There are several ways to do that:

• In the app: Settings › Reset deletes all data the app has stored.
• Via Android: Settings › Apps › LEEK › Storage › Clear data.
• Uninstalling: when you uninstall the app, Android removes all of its data from the device.

Files you have exported yourself and an existing Android backup are not covered by this; please delete those at the respective storage location or in your Google account.

9. Data security

The data sits in the protected app area, which other apps cannot access. Band and phone communicate directly over Bluetooth Low Energy, with no server in between; the Google Maps module loads map data over an encrypted connection. We recommend protecting your phone with a screen lock and installing system updates promptly.

10. Children and young people

The app is intended for people aged 16 and over. People under 16 may use the app only with the consent of their parent or guardian.

11. Not a medical device, no automated decisions

The app and the LEEK Pulse Pro are fitness and wellness products, not medical devices. They are not intended to diagnose, treat or prevent disease. Assessments such as recovery, load or sleep quality are guidance values. There is no automated decision-making producing legal effects within the meaning of Art. 22 GDPR.

12. Your rights

Under the GDPR you have the following rights:

• Access to the data processed (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17) and restriction of processing (Art. 18)
• Data portability (Art. 20) – via the app’s export function
• Objection to processing based on legitimate interests (Art. 21)
• Withdrawal of consent with effect for the future (Art. 7(3))

Because your data resides solely on your device, you can exercise most of these rights directly in the app: view, correct, export and delete your data. If you have questions, we are glad to help at syrax.shop@proton.me.

Right to lodge a complaint: you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state where you reside. The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de

13. Changes to this privacy policy

We update this privacy policy when the app or the legal requirements change. The current version is always available in the app and on this page. In the event of material changes – in particular if data were to leave your device to a greater extent in future – we will inform you in the app beforehand and obtain your consent where required.