This Privacy Policy applies to the Heda mobile application developed by EXSports Oy (hereinafter "Service Provider" or "we") and describes how we collect, use, and protect your information. Heda is a versatile migraine diary that integrates with Google Health Connect to allow you to log and track migraine episodes, symptoms, and related health data.
Summary: Your migraine diary data is stored locally on your device. With your explicit consent we may read health data from Google Health Connect. With your explicit consent we collect anonymous crash reports to fix bugs. We do not collect usage analytics. We do not sell your data. You have full control over your data under GDPR. You can also enter or import the same health values yourself, without using Health Connect at all.
Heda is a diary application. The migraine entries, symptom records, pain levels, triggers, medications, and other diary content you create are stored locally on your device. This data is not transmitted to EXSports Oy's servers.
If you choose to use the Google Health Connect integration, selected health data (such as sleep sessions and stages, heart rate, heart rate variability, step counts, and exercise sessions) may be read from Health Connect in accordance with your permissions. Heda only reads data from Health Connect — it never writes data to it. This data exchange takes place on your device between Heda and the Health Connect platform. EXSports Oy does not receive or store this data on external servers.
Health Connect is not the only way this data can reach the app. You may also enter these same health values manually (resting heart rate, heart rate variability, sleep duration, step count, and exercise) for any day, or import them from a CSV file you export from another device or application. Values you enter or import are stored locally in the same encrypted on-device database as data read from Health Connect, are used for the same purpose, and are likewise never transmitted to EXSports Oy's servers. They remain on your device even if you revoke Health Connect permissions, and are removed when you delete your local data.
⚠️ Health Data Notice: Migraine diary entries and health metrics are considered sensitive personal data under GDPR. This data is processed locally on your device. We strongly recommend enabling device screen lock and device encryption to protect your diary data.
The application requires sign-in with a Google account via Android's Credential Manager. Your Google account email address is used solely to authenticate your identity and to link any premium entitlement purchases to your account. We do not collect your name or any other profile information beyond the email address provided by Google Sign-In.
Your Google account email address is processed by Supabase (our authentication and backend provider) to manage your login session and to verify one-time Premium purchase entitlements via Google Play. See Section 5 for details on Supabase as a third-party service.
Support inquiries: If you contact us for support via email (info@exsports.fi), we may retain your name and email address solely for the purpose of responding to your inquiry. This data is stored securely and deleted no later than six months after the support matter is resolved, or earlier if you request deletion.
With your explicit consent (requested upon first app launch), the application may collect crash reports automatically. No usage analytics are collected.
Important Note: Crash reports do NOT include any diary entries, migraine data, health records, symptom information, or any personal health data you enter into the app.
You can withdraw your consent at any time in the app's settings menu under Settings → Privacy & Data.
Heda may integrate with Google Health Connect to read health data (such as sleep sessions and stages, heart rate, heart rate variability, step counts, and exercise sessions) from your device. Heda never writes data back to Health Connect. This integration requires your explicit permission through the Android Health Connect permissions dialog. You can grant or revoke these permissions at any time in your device's Health Connect settings. Using Health Connect is optional: the same health values can instead be entered manually or imported from a CSV file, as described in section 1.1.
Data exchanged via Health Connect remains on your device and is governed by Google's Privacy Policy and the Health Connect terms of service. EXSports Oy does not receive or process Health Connect data on external servers.
Information collected is used solely for the following purposes:
| Data Type | Purpose | Legal Basis (GDPR) |
|---|---|---|
| Diary & health data | Stored locally; used only within the app on your device | Contract performance (Article 6(1)(b)) |
| Google account email address | Authentication via Google Sign-In; linking premium entitlement purchases | Contract performance (Article 6(1)(b)) |
| Crash reports (GlitchTip) | To identify and fix technical errors | Consent (Article 6(1)(a)) |
| Support inquiry data | To respond to your support requests | Legitimate interest (Article 6(1)(f)) |
We explicitly do NOT:
The application does not collect precise or approximate location information from your device. No GPS, Wi-Fi-based, or network-based location data is accessed or stored.
The application does not use Artificial Intelligence (AI) or Machine Learning (ML) technologies to process your personal data or make automated decisions affecting you.
The application uses the following third-party services. Each has its own privacy policy governing their data practices:
The Service Provider does not sell personal data to third parties. Data may be shared with the above service providers solely to operate and improve the application, and only to the extent necessary.
Supabase stores authentication data (your Google account email) on infrastructure located in the EU. For details, see Supabase's Privacy Policy.
Crash report data processed by GlitchTip may be stored outside the EU/EEA depending on the service configuration. Crash reports contain no personal health data. For details, see GlitchTip's Privacy Policy.
The Service Provider may disclose information if required by law, such as in response to a valid court order, to comply with legal processes, or to protect the rights, property, or safety of EXSports Oy, our users, or the public.
| Data Type | Retention Period |
|---|---|
| Diary & health data (local) | Stored locally on device; deleted when app is uninstalled, when you use "Delete local data" in Settings → Privacy & Data, or when you clear app data |
| Google account email (Supabase) | Retained for as long as you have an active account; deleted upon account deletion (via Settings → Privacy & Data → Delete account) or by contacting us |
| Crash reports (GlitchTip) | Up to 90 days, then deleted |
| Support inquiry emails | Until the issue is resolved + 6 months, unless deletion is requested |
To request deletion of your data, contact us at info@exsports.fi. We will respond within 30 days (as required by GDPR Article 12).
If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):
To exercise any of these rights, contact us at info@exsports.fi.
Upon first launch, the application will ask for your consent before enabling crash reporting (via GlitchTip). You may decline without affecting the core diary functionality of the application. No usage analytics are collected. Health Connect permissions are requested separately and you can manage them at any time in Android settings.
Continued use of the application after any updates to this Privacy Policy constitutes your acceptance of those changes.
Heda is intended for users aged 18 and older. The application is not directed at minors. The Service Provider does not knowingly collect personal information from minors. If you believe a minor has accessed the application, please contact us at info@exsports.fi.
The Service Provider implements physical, electronic, and procedural safeguards to protect your information. Specifically:
Access to any collected crash data is restricted to authorised personnel only. We recommend enabling device screen lock and biometric lock within the app to further protect your health diary data.
You can stop all data collection by uninstalling the application. You can also:
This Privacy Policy may be updated from time to time. We will notify you of any material changes by updating the effective date at the top of this page and, where appropriate, notifying you within the application.
By using this application, you also agree to the Disclaimer & Terms of Use. The Privacy Policy and Disclaimer together constitute the full agreement between you and EXSports Oy regarding the use of this application.
Contact us and we will respond within 30 days, as required by the GDPR.
info@exsports.fi →