Privacy Policy
Published by Cole Physical Therapy
This Privacy Policy explains how the mobile application Audio Heart Rate: HR Intervals (the "App"), published by Cole Physical Therapy ("we", "us"), handles information. It applies to the App only. Please read it together with the privacy policies of the third-party services named below.
When you use the App, the following is generated and stored locally on your device (in the App's private storage) and is not sent to us:
Because heart-rate information can relate to your health, we want to be clear that it is processed on your device for the App's features and is never collected by us. One copy of it does leave the device if you use Android's backup — see Android Auto Backup below, which we would rather state plainly than bury.
The App connects to Bluetooth Low Energy heart-rate monitors to read your heart rate. Bluetooth permissions are used solely for that connection. No Bluetooth data is transmitted off your device by us.
On Android 11 and older, the operating system required an app to hold a location permission before it could scan for any Bluetooth device at all — a platform rule, not a choice of ours. The App therefore declares the location permissions on those versions only, and they are capped so that they are not requested on Android 12 or newer. The App does not determine, use, collect or transmit your location, and on Android 12 and newer its Bluetooth scanning is declared with the system's neverForLocation flag, which tells Android that scan results must not be used to infer where you are.
So that a session keeps recording while your screen is off or you are in another app, the App runs a foreground service and may hold a wake lock for the duration of a workout. Android shows a persistent notification while this is happening. It is used only to keep the heart-rate connection and the timer alive, and it stops when the session does.
Android's built-in backup is enabled for this App. If you have device backup switched on in your Android settings, Android copies the App's data — including your workout history, heart-rate records and any body metrics you entered — into your own Google account, so that a new or reset phone can restore it. This is done by Android, into storage that belongs to you. We have no access to that copy at any point and cannot read it.
Because heart-rate information can relate to your health, we want to be explicit that this copy exists rather than leave you to assume the data never leaves the device. Your premium purchase status is deliberately excluded from the backup; everything else the App stores is included.
You can switch backup off for all apps in Settings → Google → Backup on most Android devices, and you can delete an existing backup from your Google account. See the Google Privacy Policy for how Google handles backup data.
The free, ad-supported version of the App uses Google AdMob (the Google Mobile Ads SDK) to display ads. To serve and measure ads, Google may collect and process information such as your device's advertising identifier, IP address, device and app information, and ad-interaction data. This processing is carried out by Google, not by us. For details, see:
The premium version of the App does not display ads.
The premium version is sold through Google Play Billing. Your payment is processed by Google; we do not receive or store your payment-card details. See the Google Privacy Policy and Google Play terms for how purchase data is handled.
We do not sell your personal data.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, the free version of the App shows a consent message, provided through Google's User Messaging Platform, before personalized or non-personalized ads are served. You can change your choices at any time using the privacy options available in the App, and through your device's ad settings (Settings → Google → Ads on most Android devices, where you can reset or limit your advertising identifier).
We do not sell your personal information for money. However, we want to be accurate rather than reassuring about a second category: when the free version serves personalized ads, the disclosure of an advertising identifier and related device information to Google for that purpose may qualify as "sharing" for cross-context behavioural advertising under the California Consumer Privacy Act as amended (CPRA), and as "targeted advertising" under several other state privacy laws. Those laws give you a right to opt out.
To be candid about the mechanism: the in-app privacy-options control described in Section 3 is shown only where Google's consent framework requires it, which in practice means the EEA, the UK and Switzerland. If you are in the United States, you can opt out in either of these ways, both of which we honour:
Buying the premium version also removes advertising entirely, and with it this category of disclosure. We do not knowingly sell or share the personal information of anyone under 16. We will not discriminate against you for exercising any of these rights.
Where the EU/UK General Data Protection Regulation applies, the legal bases are:
Heart-rate information is data concerning health, which the GDPR treats as a special category. The App processes it on your device, under your control, for your own personal use, and we neither receive nor store it — so we do not carry out special-category processing of it. Where any such processing is attributed to us, it rests on your explicit consent, given by choosing to connect a heart-rate monitor and record a session, and withdrawable by disconnecting, deleting the data, or uninstalling the App.
Depending on your location, you may have rights to access, correct, delete, restrict, or object to the processing of your personal data, and to withdraw consent. Because the App stores your workout data only on your device:
To make a request or ask a question, contact us at the address in Section 12. If you are in the EEA or UK and believe your rights have been infringed, you may also lodge a complaint with your local data protection authority.
Your workout and heart-rate data are held in the App's private storage, which on Android is readable only by the App itself and is protected by your device's own encryption and screen lock. The connection to a heart-rate monitor is a direct Bluetooth Low Energy link between your device and the strap, and requests to Google's advertising and billing services use encrypted connections.
Two limits are worth stating plainly rather than leaving you to infer them. A copy of your data exists in your Google account if Android backup is on, and its security is governed by that account and the protections you have on it — a strong password and two-factor authentication do real work here. And if you export a CSV or share a file, the security of that copy is governed by wherever you choose to put it. No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
Data stored on your device remains until you delete it, clear the App's storage, or uninstall the App. A backup copy held in your Google account persists there under Google's backup retention rules until you delete it or it is superseded, and uninstalling the App does not by itself remove it. Data processed by Google for advertising and purchases is retained according to Google's own policies. We retain nothing, because we receive nothing.
The App is not directed to children. It is intended for general audiences and should not be used by children under the age of 13 (or under 16 where required by local law) without appropriate adult supervision and consent. We do not knowingly collect personal data from children.
The third-party services used by the App (Google) may process data in countries other than your own. Those transfers are governed by the relevant provider's safeguards and privacy policy.
We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect any changes, and continued use of the App after an update constitutes acceptance of the revised policy.
If you have questions about this Privacy Policy or your data, contact:
Cole Physical Therapy
contact@colephysicaltherapy.com