Privacy Policy

CPAP Analysis is operated by Fellbeck Ltd (Company No. 16944419). This policy describes how we handle your data. The short version: your health data stays on your device and your private iCloud.

Data Controller

Fellbeck Ltd is the data controller for any personal data processed in connection with CPAP Analysis.

• Company: Fellbeck Ltd (Company No. 16944419)
• Contact: hello@cpapanalysis.com

Health Data

CPAP Analysis reads therapy data from your CPAP device's SD card – including AHI scores, respiratory events, pressure, flow rate, and SpO2/pulse oximetry readings. All of this data is processed on your device and your private iCloud.

• Your health data is never uploaded to our servers
• We cannot see, access, or retrieve your health data
• Your health data is never used for advertising, marketing, or data mining

If you enable iCloud sync, data is encrypted and synced through your personal iCloud account. We have no access to your iCloud.

Subscription Management

We use RevenueCat to manage in-app purchases. When you make a purchase, RevenueCat processes the following data:

• Purchase history and subscription status
• Anonymous app user identifier
• Device type and operating system version
• Country/region (derived from IP address for fraud prevention)

No health data is shared with RevenueCat. RevenueCat acts as a data processor under our instruction and does not sell personal data. RevenueCat is SOC2 Type 2 compliant.

For details, see RevenueCat's Privacy Policy and Data Processing Addendum.

Usage Analytics

The app sends anonymous usage data to TelemetryDeck, a privacy-focused analytics service hosted in the European Union, to help us improve the app: which screens are used, whether flows complete, and how imports end. It never includes your therapy data and never includes anything that could identify you – no names, no email addresses, no advertising identifiers, and TelemetryDeck does not store IP addresses.

Email Signup for Unsupported Machines

If the app can't read your CPAP machine yet, its screen may ask for your email address. Leaving it is optional. If you do, we store:

• your email address
• the machine you chose
• what you signed up for – sending us a copy of its SD card, or being told when the app can read it – and when
• the anonymous app account reference the app uses for purchases, so a lifetime membership can be added to the right account

It is kept in our own store on Cloudflare, which runs the server the app sends it to. Only we read it.

We use it for one thing: to write to you personally about sending a copy of your SD card, or to tell you when the app can read your machine. Leaving your email is not a marketing subscription, does not make you a member, and is not agreeing to share any therapy data – it shares none. A card copy is only ever sent by you, outside the app, after our email has explained what it is used for.

We keep it until the follow-up is finished – we have told you the app can read your machine, or you have told us you won't be sending a card copy – and then delete it. If you send a copy, we keep it after your membership is added so we can tell you when support is out. There is no time limit before then, because an offer you accepted does not expire. To have it deleted sooner, email hello@cpapanalysis.com.

International Data Transfers

RevenueCat processes subscription data on servers in the United States (AWS). These transfers are governed by Standard Contractual Clauses and the EU-US Data Privacy Framework. Anonymous usage data is processed by TelemetryDeck on servers in the European Union. Email signups are stored by Cloudflare, whose data centres may be outside the UK and EU, including in the United States. These transfers are governed by Cloudflare's Data Processing Addendum, which includes Standard Contractual Clauses, and the EU-US Data Privacy Framework.

We Never See Your Therapy Data

Your therapy data stays on your device and your private iCloud. We don't know how your therapy is going: no readings, no night dates, and nothing derived from them ever leaves your phone. The app sends anonymous usage data – never your therapy data – to TelemetryDeck to help us improve the app. It contains no advertising identifiers and nothing that could identify you. RevenueCat's SDK contacts its servers to verify subscription status, which means it is aware when the app is opened. We do not sell or share any data with third parties for advertising or marketing purposes.

Do Not Track

CPAP Analysis does not track users across websites or apps. We honour Do Not Track browser signals.

Data Retention and Deletion

• On-device data: Deleting the app removes all therapy data from your device.
• Subscription records: RevenueCat retains purchase records in accordance with their retention policy. Contact us at hello@cpapanalysis.com to request deletion.
• Email signups: Kept until the follow-up is finished or you ask us to delete yours – see Email Signup for Unsupported Machines.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Under GDPR (EEA/UK)

• Right of access, rectification, and erasure
• Right to restriction of processing and data portability
• Right to object to processing
• Right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office)

Under CCPA/CalOPPA (California)

• Right to know what personal information is collected
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to non-discrimination for exercising your rights

To exercise any of these rights, contact us at hello@cpapanalysis.com. We will respond within 30 days.

Children's Privacy

CPAP Analysis is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@cpapanalysis.com.

Security

Your therapy data is stored on your device and, if iCloud sync is enabled, encrypted and synced through your personal iCloud account. Both are protected by Apple's built-in security.

Data Breach Notification

In the unlikely event of a data breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours (GDPR) and affected individuals within 60 days (FTC Health Breach Notification Rule), as applicable.

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through app update notes. The "Last updated" date at the top of this page will always reflect the most recent revision.

Contact

If you have questions about this privacy policy or your data, contact us:

• Fellbeck Ltd (Company No. 16944419)
• Email: hello@cpapanalysis.com