Privacy policy
You can read hrv.expert without an account and without cookies. If you create an account or subscribe, we store only what you agree to, in the EU, and you can export or erase it at any time.
Last updated
Who is responsible
The controller of personal data for hrv.expert is CardioMood SA, Chemin du Pré-Fleuri 5, 1228 Plan-les-Ouates, Geneva, Switzerland. You can reach our data protection contact at dpo@cardiomood.com.
Our representative in the European Union under Article 27 of the GDPR is Nuvem Catita Unipessoal Lda, Av. Aida 411 – Centro Comercial Estoril Garden, 2765-187 Estoril, Portugal ( info@nuvemcatita.com).
Reading the site
The site is served by Cloudflare. To deliver pages and protect the site from attacks, Cloudflare processes technical data such as your IP address and browser details. We do not use this data to identify you. Visitors who are not signed in get no cookies.
What you type into the HRV checker and your quiz answers are processed in your browser and never sent to us. Measurement tools that use your camera or a Bluetooth heart rate strap, when we add them, will work the same way.
What we store, and why
Each purpose needs its own consent, recorded with the time and the exact wording you agreed to. You can withdraw any of them at any time in your account settings or by writing to us.
| Purpose | What we store | Legal basis |
|---|---|---|
| Your account | Your email address, when you confirmed you are 16 or older, the terms version you accepted, and your sign-in sessions | Our contract with you (the terms) |
| Tracking your HRV | The readings, tags, notes and optional profile details (birth year, sex, activity level) you enter | Your explicit consent. HRV readings are health data under Article 9 of the GDPR, so we store them only while this consent is on. |
| Newsletter and email course | Your email address, the lists you joined, when you consented and confirmed, the page you signed up on, your time zone and which emails were sent | Your consent, confirmed by email |
| Research statistics (optional) | Nothing extra. If you opt in, your readings are included in anonymised percentile tables. Only groups of at least 50 people are ever published, and no individual values leave our database. | Your explicit consent |
All of this is stored in Cloudflare's European Union data region. Nobody at hrv.expert or CardioMood can view an individual's readings: the admin tools show only counts and anonymised tables.
How long we keep it
- Your account and readings: until you erase them or remove your account. Removing your account erases everything tied to it at once.
- Sign-up confirmations that are never confirmed: 7 days.
- Sign-in links: 15 minutes. Sessions: 30 days after you last used the site, or until you sign out.
- Records of emails we sent: 90 days.
- Addresses that bounce or report our emails as spam stay on our email provider's do-not-send list, so we never email them again.
Services that handle your data
| Service | Provider | Why | Where |
|---|---|---|---|
| Cloudflare Web Analytics | Cloudflare, Inc. | Cookieless, privacy-friendly visit statistics | Public pages, production only |
| Cloudflare Turnstile | Cloudflare, Inc. | Checks that a form that sends an email is used by a person, not a bot. It sets no cookies. | Sign-in and newsletter forms, loaded only once you start using the form |
| Cloudflare Email Service | Cloudflare, Inc. | Sends sign-in links, confirmations, the email course and the newsletter. Your browser never contacts it. | Our server, when we email you |
Cloudflare Web Analytics counts visits without cookies and without building a profile of you. It records the page, the referring site, your country and your type of device. It does not run on account pages.
Cookies and browser storage
When you sign in, we set one cookie, __Host-hrvx_session, which keeps you signed in. It is
strictly necessary, holds no tracking information and is removed when you sign out. We set no other
cookies.
The site also keeps a few settings in your browser's local storage, which never leave your device:
| Key | What it holds |
|---|---|
hrvx:theme | Your colour theme choice: light, dark or follow your system. |
hrvx:progress:v1 | Which course lessons you have completed and your best quiz score for each. |
To remove them, use "Reset my progress" on the course page, choose "System" in the theme switch, or clear this site's data in your browser settings.
Your rights
Under the GDPR and the Swiss Federal Act on Data Protection you can access, correct, export and erase your data, object to its use, ask us to restrict it, and withdraw consent at any time. Most of this you can do yourself:
- Download everything we hold about you, or your readings as CSV, from account settings.
- Turn each consent on or off there. Turning off health-data storage lets you erase your readings at the same time.
- Remove your account there; it takes effect immediately.
- Leave any email list with the one-click link in every email.
For anything else, write to dpo@cardiomood.com. You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or the authority in your EU country.
Changes
We will update this page when the site changes how it handles data, and change the date at the top. If a change affects what you agreed to, we will ask again.