hrv.expert

Data request letter

Your app shows heart rate by the minute, but the export gives one number a day? Build a letter that asks the company for a copy at the detail you can see, citing the law where you live.

The service

Where you live

What you see in the app

Open the app and tick what it shows you. For each, pick the finest detail you can see, such as one value per minute on a heart-rate graph, and how far back the history goes.

The app’s own export gives me

Format and extras

Format of the files
Also ask them to tell me

About you

The address your account uses, so they can find it.

Such as a username. Don’t enter passport or ID numbers here; if the company needs more, it will ask. In Russia, add them to the line the letter leaves for them.

Which letter

Your letter

Choose a service and where you live, and the letter appears here.

Saved only on this device, your name and email included. Nothing is sent to us.

Everything runs in this browser. Nothing you type is sent to us or stored on our server, and your answers stay here only if you tick "Remember". Privacy

How to write your letter

  1. Pick the service and where you live. The tool shows where that company takes requests, from its own privacy policy.
  2. Open the app and tick what it shows, with the finest detail you can see and how far back it goes. Details the maker states are filled in for you; check them.
  3. Copy the letter, save it as a text file, or open it as an email to the company’s privacy address. Keep a dated copy of what you send.
  4. If the reply leaves things out, come back, choose Follow-up and say what was missing.
  5. When the reply arrives, open the files under Check what they sent. The tool compares them with your answers and fills in the follow-up letter with what is missing.

Why the detail matters

Many wearables keep more detail than their exports give. WHOOP’s export has one HRV value per day; Oura’s developer documentation describes sleep heart rate "based on 30-second samples" while its app shows 5-minute values. Under the GDPR, a copy of your data "must therefore contain all the personal data undergoing processing" (CJEU, C-487/21), and the European Data Protection Board says self-service tools "should never limit the scope of personal data received". If the app can show you a value per minute from last March, the letter asks the company for those values at that detail, and to say which, if any, exist only on your phone.

What a letter cannot do

A company has to copy only what it still holds. Data kept only on your phone never reaches the company, and Apple says it cannot read the Health data you sync to iCloud: export those on the phone. A company may ask you to narrow a very large request, and in the UK the clock stops while it does, which is why the letter names the data and dates up front. Scores such as recovery or readiness fall under the right of access but not under portability, so the letter asks for them under the first.

How the archive check works

The check opens the files in this browser; nothing is uploaded. It reads ZIP archives (and a ZIP inside one), CSV and other tables, JSON, Apple Health’s export.xml, FIT, TCX and GPX files, and the RR files of apps such as Elite HRV and Welltory. In each file it finds the timestamps, works out which kind of data each column or field holds, and measures the period covered and the typical time between two values, the median: once a day, say, or every 5 minutes. It then sets that against what you said the app shows.

What the check cannot do

It can see only what the company sent, not what it holds and left out. Columns are matched to kinds of data by their names, from a short list of names in the makers’ own documentation and rules of thumb for the rest, so a column can be misread: look over the table before you send anything. The detail is measured from the timestamps, so a file that repeats a daily value every minute would look like minute data. It reads up to 2 GB of files at a time.

Questions

Do I have to say why I want my data?
No. Under the GDPR the company cannot ask you for a reason, and your first copy is free (CJEU, C-307/22).
What if they send a PDF?
For the right of access a PDF can be enough, the EDPB says. For the raw data your device recorded, the portability right asks for a structured, machine-readable format, which is why the letter asks for CSV or JSON.
What if nothing comes back?
Send a short reminder, then the follow-up letter. In the EU you can then complain to your data protection authority. In the UK, the ICO recommends raising it with the company first, then complaining to the ICO. In California, the California Privacy Protection Agency takes complaints.
Why is the letter in English?
Most companies’ privacy teams read English, and the legal quotes are given as the official English texts word them. Letters in other languages may follow.
Are my files uploaded when I check them?
No. The files are read by your browser, in the background, and nothing in them is sent to us or anywhere else. The findings you choose go into the letter on this page, and stay in this browser only if you ask it to remember your answers.

This tool drafts a letter; it is not legal advice. Rules differ by country and change, and a company may have reasons the law allows to hold some data back.

Read more

Sources