Privacy Policy
Last updated: 8. Oct 26
Who we are
Resona is a sole proprietorship registered in Denmark under CVR number 46756487.
Resona is the data controller for the personal data described in this Privacy Policy.
Contact: hello@resonahrv.com
This Privacy Policy explains how information is handled when you use the Resona app, visit resonahrv.com or contact us.
In short
Resona is built on a simple principle: your physiological data belongs to you.
Your profile, sessions and physiological measurements are stored locally on your iPhone. Resona does not operate a cloud account or backend for this information, and we cannot access, view or restore it.
The Resona app does not use advertising technology or tracking across apps and websites. From Resona 1.1.1, you can choose to share usage statistics via TelemetryDeck. This is voluntary and off until you say yes. Your physiological measurements and personal results stay on your device and are not included in usage statistics.
Our website is hosted by Squarespace. We use Squarespace Analytics and a limited Activity Log to understand visits to the website. Analytics and performance cookies are only placed after your consent through the cookie banner. Squarespace may still record limited page-visit information without these cookies, as described below.
Subscriptions and payments are processed by Apple. We do not receive your payment-card details.
Information stored by the app
Profile information
You may choose to provide a name, date of birth and gender. All profile fields are optional.
Your name may be used to personalize greetings within the app. Your date of birth and gender are stored locally as part of your profile and are not currently used to calculate your results.
Session information
During a measured session, Resona may store:
● Heart rate and RR intervals received from your compatible chest strap.
● Heart-rate variability measurements calculated from those intervals.
● Information about the breathing rhythms tested during the session.
● The breathing rhythm currently used to guide you.
● Session duration and measurement-quality information.
● Your optional answer about how the session felt.
This information may concern your health or physiology. It is processed locally within the app and is not included in TelemetryDeck statistics.
Sensor information
Resona stores the name and technical identifier of your most recently used heart-rate strap so that the app can recognize and reconnect to it.
Settings
Resona stores the preferences you choose, such as reminder time, appearance, color scheme and your choice about sharing usage statistics.
Why the app processes this information
Session and physiological information is processed to provide the biofeedback features you request, compare your responses at different breathing rhythms, identify the rhythm to which you respond most clearly and display your progress over time.
Profile information is used for your local profile and personalization. Sensor information is used to reconnect to your chosen chest strap, and settings are stored to remember your preferences.
This processing takes place locally when you use the relevant features. We do not use this information for advertising, external profiling, marketing or unrelated research. Separate, optional usage statistics are described under “Usage statistics (TelemetryDeck)”.
Local storage and security
Your profile, measurements and session history are stored in Resona’s private storage on your iPhone and protected by the security features provided by iOS. Other apps cannot ordinarily access this private storage.
Your sessions, measurements and profile are marked for exclusion from iCloud and computer backups. Resona does not provide cloud synchronization or a server-side backup of this information.
A small set of preferences — appearance, language, reminder time and the name of your most recently used strap — is stored in the standard iOS preferences system. Depending on your backup settings, these preferences may be included in an iCloud or computer backup. They contain no session or health information.
We cannot access or recover your history. Your information may be permanently lost if you delete it, delete the app, erase or lose your iPhone, or change devices. Offloading an app through iOS may preserve its local data and is not the same as deleting the app.
No security measure can provide an absolute guarantee, but keeping session information on your device limits the places in which it is stored.
Bluetooth
Resona uses Bluetooth to discover and connect to the heart-rate sensor you select.
The app receives the technical information needed to identify and connect to the sensor, together with the heart-rate and RR-interval data transmitted by it. Resona does not use Bluetooth to collect unrelated information from nearby devices.
Measurements are processed locally on your iPhone and stored as part of your Resona data. If you have enabled usage statistics, the app may send events about the connection process and fixed error codes, but not the sensor’s name, identifier or measurements.
How sessions are analyzed
HRV measurements, breathing comparisons and progress figures are calculated locally on your device.
Resona does not send your measurements or personal session results to a cloud analysis service and does not use external artificial intelligence to analyze them. Locally calculated information is removed when you permanently delete the underlying Resona data.
Apple Health
Resona does not currently read information from or write information to Apple Health.
If this changes, this Privacy Policy and the relevant information within the app will be updated before the feature is made available. Access to Apple Health would require your permission through Apple’s Health permissions.
Subscriptions and payments
Resona subscriptions are purchased through Apple’s App Store. Apple processes the purchase, payment and renewal under its own terms and privacy policy.
We do not receive your payment-card details, billing address or full Apple Account details. Through Apple’s StoreKit system, the app receives transaction and subscription-status information required to determine whether you have access to subscription features.
If you have enabled usage statistics, purchase and restore outcomes may be included as described below. Receipts and transaction identifiers are not sent to TelemetryDeck.
Apple may provide developers with aggregated App Store performance information and diagnostic or crash information where users have chosen to share it. This information does not include your Resona sessions or physiological measurements and is not intended to identify you to us.
You can manage or cancel your subscription through your Apple Account settings.
Usage statistics (TelemetryDeck)
This section applies from Resona 1.1.1.
You can choose to share usage statistics via TelemetryDeck, an analytics service provided by TelemetryDeck GmbH in Germany. The feature is off until you actively say yes. You can decline without losing access to app features or your subscription, and change your choice at any time under Settings › Privacy.
When the feature is on, the app sends:
● Usage events: app openings, introduction steps, session starts and endings with session type and chosen duration, searching for and connecting to the heart-rate sensor, fixed error and status codes, subscription-screen views, and purchase and restore outcomes. Purchase events may include the subscription plan, outcome and whether a verified transaction included a free trial.
● Technical information and device preferences: app version and build, SDK version, device model, screen information, iOS version, language, region and locale, time zone, color scheme, layout direction and run context, such as App Store or TestFlight, together with information about the event’s time.
● General usage counts: for example, the number of app sessions, days the app has been used and duration of app use. These are not your physiological measurements or personal session results.
● Technical identifiers: a hash of the device’s vendor identifier (identifierForVendor) and a random session identifier. The hashed identifier allows events from Resona on the same device to be grouped over time without sending your name or an account identity.
Your heart rate, RR intervals, heart-rate variability (HRV), breathing rhythms, scores and other personal session results are not sent. Nor are your name and profile details, the sensor’s name and identifier, receipts, transaction identifiers, error messages or device accessibility settings.
The identifier is hashed on the device before it is sent. TelemetryDeck states that it is hashed again with its own salt on its servers and that IP addresses are not stored. The transmitted identifier is not your name or email address. Because it can group events over time, we describe it as a hashed identifier rather than a guarantee that all information is anonymous.
We use the statistics to understand and improve the app’s features, sensor connection and purchase flow. The legal basis is your consent under Article 6(1)(a) of the GDPR. The information is not used for advertising or tracking across apps and websites, and is not combined with your local profile or measurement data or the website’s Activity Log.
If you turn the feature off, the app stops recording new analytics events and starting new network transmissions. Pending events from the previous opt-in are excluded from later transmission. A transmission that had already started before you opted out may finish and cannot be recalled.
Opting out and deleting data in the app do not automatically delete statistics that TelemetryDeck has already received. TelemetryDeck states that there is no fixed deletion deadline for archived analytics events. A period during which data is available in the analytics tool is therefore not necessarily a deletion deadline.
You can contact hello@resonahrv.com with questions or rights requests about statistics already shared. We will assess which information we can identify and handle in connection with your request; we do not receive your name or email address with the statistics.
Further information is available in TelemetryDeck’s Privacy Policy and Privacy FAQ.
When information leaves your device
Resona does not upload your profile, physiological measurements, breathing rhythms, personal session results or answers about how a session felt.
Information may leave your device when:
● You choose to send information by email.
● You have enabled “Share usage statistics”, as described above.
● Your device communicates with Apple to purchase, verify or restore a subscription.
● Apple receives diagnostic information under the diagnostic-sharing choices you have made in iOS.
The public App Store version of Resona does not include the diagnostic-file export tools used in internal development builds.
If you contact us
If you email hello@resonahrv.com, we receive your email address and any information you choose to include in your message.
We use this information to respond to your inquiry, provide support and, where necessary, establish, exercise or defend legal claims.
The legal basis is our legitimate interest under Article 6(1)(f) of the GDPR in responding to inquiries and operating our support function.
Support correspondence is normally deleted within 12 months after the inquiry has been resolved, unless it must be kept longer to comply with a legal obligation or to establish, exercise or defend a legal claim.
Email is not a secure channel for sensitive information. Please do not send physiological measurements or other sensitive personal data unless necessary for your support request.
The Resona website
The Resona website is hosted by Squarespace.
When you visit the website, Squarespace processes technical information to deliver, secure and operate it. Depending on your use and cookie choices, information may also be processed for traffic statistics. This information may include:
● Your IP address.
● Information about your browser, network and device.
● The pages you view.
● The website or page that referred you.
● Your approximate geographic location inferred from the IP address.
● The date and time of your visit.
● Information about how you interact with the website.
The purposes and legal bases for the different processing activities are described below.
Necessary cookies
Squarespace uses necessary cookies and similar technologies to securely deliver the website and enable its basic functionality.
These cookies may be used for security, fraud prevention, network management, remembering cookie choices and enabling website features. They cannot be disabled through our cookie settings.
Processing technical information necessary to operate and protect the website is based on our legitimate interest under Article 6(1)(f) of the GDPR in providing a secure and functional website. Cookies strictly necessary for these purposes do not require cookie consent.
The necessary cookies used may vary depending on the active Squarespace features. A description is available in Squarespace’s cookie documentation.
Squarespace Analytics
We use Squarespace Analytics to understand general website traffic. With your consent, analytics and performance cookies are used to recognize visits and connect activities within the same visit.
Squarespace Analytics may process browser, network and device information, IP address and approximate location, referring pages, pages visited, clicks and internal links, scrolling and searches, dates, traffic sources and visitor sessions.
Squarespace may use the following analytics and performance cookies:
● ss_cid — recognizes visitors and sessions; expires after two years.
● ss_cpvisit — recognizes visitors and sessions; expires after two years.
● ss_cvisit — recognizes visitors and sessions; expires after 30 minutes.
● ss_cvr — recognizes visitors and sessions; expires after two years.
● ss_cvt — recognizes visitors and sessions; expires after 30 minutes.
These cookies are non-essential and restricted until you accept them through the cookie banner. The legal basis for the cookies and associated processing is your consent under Article 6(1)(a) of the GDPR and applicable cookie rules.
You may reject analytics cookies without losing access to the website. Rejection stops the use of these cookies, but does not necessarily stop all page-visit information in Squarespace. Limited traffic recording without analytics cookies is described under “Activity Log and limited traffic recording”.
Activity Log and limited traffic recording
We use Squarespace’s Activity Log and limited page-visit information to understand recent visits and basic traffic patterns, maintain the website and identify potential technical or security issues. Squarespace may record these page visits even when analytics cookies are rejected. Without those cookies, statistics cannot connect multiple page visits as one visitor’s session in the same way.
The Activity Log may show:
● IP address.
● Approximate location inferred from the IP address.
● Browser and operating system.
● Referring website or page.
● Pages visited.
● Date and time of the visit.
Activity Log entries are available to us for seven days. This period describes our access to the log, not necessarily Squarespace’s retention of other information.
We do not use this information for advertising, behavioral profiling or identifying individual visitors. It is not combined with Resona app data or used for marketing.
The legal basis is our legitimate interest under Article 6(1)(f) of the GDPR in understanding, maintaining and protecting the website. Our assessment takes account of the limited purpose, the short access period for the Activity Log and the absence of combination with app data or marketing.
You have the right to object to this processing by contacting hello@resonahrv.com. We will assess your request in accordance with applicable data-protection law.
Your cookie choices
You can accept or reject non-essential cookies through the cookie banner and manage your preferences.
You can change or withdraw cookie consent using the cookie-settings link on the website. You can also delete previously stored cookies in your browser. Withdrawal does not affect the lawfulness of processing before withdrawal.
If you reject or withdraw consent, Squarespace’s analytics and performance cookies will not be used going forward while your rejection is remembered. Necessary cookies remain active, and the limited recording described above may continue.
Website cookie choices and app usage-statistics choices are separate. A choice on the website does not change your choice in the app, or vice versa.
We do not currently use Google Analytics, Meta Pixel or third-party advertising cookies on the website. If additional analytics or advertising tools or embedded third-party services are introduced, this policy and the cookie information will be updated before activation.
Squarespace and transfers
Squarespace processes website information as our hosting and analytics provider. Squarespace may also process certain information for its own security, legal and service-improvement purposes.
Squarespace and its service providers may process information outside the European Economic Area. Where required, Squarespace states that it uses transfer mechanisms such as adequacy decisions, the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses.
Information about these transfers and safeguards is available in Squarespace’s Privacy Policy. See also Squarespace’s Cookie Policy.
Sharing and service providers
Depending on how you interact with Resona, information may be processed by:
● Apple, for App Store distribution, subscriptions, payments and optional diagnostics.
● Squarespace, for website hosting, security and analytics.
● Our email provider, when you contact us.
● TelemetryDeck, for usage statistics if you have opted in.
These providers process information under their own legal obligations and, where applicable, on our behalf under data-protection terms. They do not receive access to your locally stored measurements or personal session results through Resona’s usage statistics.
We do not sell your personal data.
How long information is retained
Your local profile, measurements and session history remain on your device until you delete them or remove the app and its data. We do not hold a server-side copy of this information.
Usage statistics you have chosen to share are stored by TelemetryDeck. No fixed deletion deadline is stated for archived events. Opting out stops new transmissions but does not automatically delete statistics already received. See “Usage statistics (TelemetryDeck)”.
Support correspondence is normally retained for up to 12 months after the inquiry has been resolved, unless a longer period is required for legal reasons.
Individual Squarespace Activity Log entries are available to us for seven days. Analytics cookies remain on your device for the periods listed above unless you delete them earlier. Aggregated analytics and other information processed by Squarespace may be retained longer under its retention practices.
For information we hold ourselves, we determine retention by considering its purpose, any legal obligations and the need to handle legal claims.
Your choices and rights
Access and correction of local data. Information stored locally by Resona is shown in the app. You can update optional profile information and settings there. Because we do not receive this local information, we cannot access, correct or provide a copy of it for you.
Deletion of local data. You can delete your Resona data from the Privacy section of the app or delete the app and its data through iOS. We cannot restore permanently deleted information. Deletion in the app does not delete statistics already received by TelemetryDeck.
Data export. The public version of Resona does not include an export feature. Your local information is viewable within the app, but we cannot produce an export because we do not have access to it.
Usage statistics and consent. You can withdraw consent at any time by turning off “Share usage statistics” under Settings › Privacy. Withdrawal does not affect the lawfulness of processing before withdrawal. Website cookie consent is changed separately through the cookie settings.
Personal data processed by us or our providers. Where information is personal data, applicable rules may give you rights of access, correction, erasure, restriction, objection and data portability. This also includes questions about usage statistics, not only email correspondence and website information. These rights may be subject to conditions and exceptions, including whether we can identify the relevant information.
To make a request, email hello@resonahrv.com. We may need additional information to identify the relevant data and confirm that the request comes from the appropriate person. We normally respond within one month. Where the rules allow an extension, we will explain the extension and its reason.
Complaints
If you believe your personal data has been handled unlawfully, you have the right to complain to:
The Danish Data Protection Agency — Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark — datatilsynet.dk
You may also contact the data-protection authority in the EU or EEA country where you live or work.
Children
Resona is not designed for children under 13.
We do not knowingly receive personal data directly from children. We do not receive dates of birth or other profile details from the app and therefore cannot determine an individual user’s age from usage statistics.
Changes to this Privacy Policy
We may update this Privacy Policy if Resona’s functionality, service providers or legal obligations change.
If a change materially affects how information is handled, the updated policy will be made available before or when the change takes effect. The date at the top shows when the current version was updated.
Contact
If you have questions about privacy or personal data, contact:
Resona
CVR: 46756487
Email: hello@resonahrv.com