Privacy Policy

1. Controller (Verantwortlicher)

The data controller responsible for the processing of personal data on this website and in relation to ARBH Labs applications in accordance with Art. 4 No. 7 GDPR is:

Aaron Haug
ARBH Labs
Germany
E-Mail: [email protected]

2. Local-First Application Data

LastDose and PulseTrace keep routine logs, measurements, and settings in the applications' private storage unless you explicitly use an optional sharing, export, licensing, or purchase feature.

• Core records stay local: Medication and routine logs, timers, vital entries, and PulseTrace measurement history are stored in Android app-private storage.
• No advertising analytics SDKs: The apps do not include Google Analytics, Firebase Analytics, Mixpanel, Facebook SDK, or advertising trackers.
• On-device signal processing: PulseTrace processes camera and optional microphone input on the device; raw video and audio are not uploaded by the measurement flow.
• Optional features are explicit: Export, encrypted friend sharing, license activation, and purchases run only after you choose the corresponding feature. The friend-sharing relay handles encrypted payloads and does not receive the local content key.

3. Website Hosting & Server Log Files

When you visit our website, our hosting and content delivery provider (Cloudflare Pages / Cloudflare, Inc.) automatically collects and processes technical log data transmitted by your browser. This includes:

• Browser type and version
• Operating system
• Referrer URL
• Host name of the accessing device (IP address)
• Time and date of the server request

Legal Basis: Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the technically error-free delivery, stability, and security of our web infrastructure (e.g. defense against DDoS attacks). Server log files are deleted or anonymized automatically according to industry standard retention periods.

4. Self-Hosted Fonts & Zero External Assets

To protect your privacy and ensure compliance with European data protection regulations, all typography (including Instrument Sans and Newsreader) is hosted locally on our own servers in the /fonts/ directory. No requests or IP addresses are transmitted to Google Fonts or external CDN providers.

5. Payment and License Processing

App purchases and subscriptions may be processed by PayPal. Selected digital products may be sold through Lemon Squeezy. The checkout page identifies the provider before you pay.

Payment details are entered with the payment provider, not stored in the Android apps. ARBH Labs may retain the order reference, license record, activation status, and information needed to provide support or meet legal obligations. See the PayPal Privacy Statement and Lemon Squeezy Privacy Policy.

Legal Basis: Processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR), as well as compliance with statutory tax and accounting obligations (Art. 6(1)(c) GDPR).

6. Cookies and Tracking Technologies

Our website does not use tracking cookies, marketing pixels, or third-party profiling mechanisms. Session storage is utilized only when necessary to preserve pending checkout state or local UI preferences. No cookie consent banner is required as no non-essential cookies are set.

7. Strategic Inquiry Form

If you use the investor and partnership inquiry form, ARBH Labs stores the topic, name, email address, optional company or fund name, message, consent time, submission time, and review status. IP addresses and advertising identifiers are not stored with the inquiry. Processing is based on your consent under Art. 6(1)(a) GDPR and, where the inquiry concerns a potential agreement, Art. 6(1)(b) GDPR. The information is used only to assess and respond to the inquiry and is deleted when it is no longer required for that purpose, subject to applicable legal retention obligations. You may withdraw consent by contacting ARBH Labs.

8. Your Rights Under the GDPR

As a data subject located in the European Union, you have the following rights under the GDPR regarding your personal data:

• Right of Access (Art. 15 GDPR): You have the right to request confirmation as to whether personal data concerning you is being processed and to receive information about that data.
• Right to Rectification (Art. 16 GDPR): You have the right to demand the immediate rectification of incorrect personal data or completion of incomplete personal data.
• Right to Erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data, provided statutory retention requirements do not apply.
• Right to Restriction of Processing (Art. 18 GDPR): You have the right to demand restriction of processing of your personal data under certain conditions.
• Right to Data Portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data which is based on Art. 6(1)(f) GDPR.
• Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a competent data protection supervisory authority.

To exercise any of these rights, please contact us at: [email protected].

9. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our legal obligations or technical architectures. The current version is always accessible at this URL.

Last updated: September 2026