Health Data Statement
Detailed conditions for processing step-count and Health Connect data.
Block B · User-facing, separate consent
Health Data Statement
Step count and Health Connect data processing (iOS / HealthKit currently inactive)
HE-001-EN
⚠️ GOVERNING LANGUAGE NOTICE This document is an English translation of the Hungarian Health Data Statement (HE-001). In case of any discrepancy between the Hungarian and English versions, the Hungarian version shall prevail. Hungarian version: https://cashleticsapp.com/legal.php?slug=egeszsegugyi-adat&lang=hu |
| Data Controller | Mózer Ferenc (sole trader / egyéni vállalkozó) 6044 Kecskemét, Hetény-Belsőnyír 268/2., Hungary |
| Effective date | 12 October 2026 |
| Prepared by | Dr. Crespo Zsuzsanna | zsuzsanna@crespo.hu |
| Version | v1.10.2 |
| GDPR reference | Art. 9(2)(a) — explicit consent for special category data |
| Related documents | AT-001-EN, ROPA-001, DPIA-001, HJ-001-EN, HE-001 (HU) |
| Governing language | Hungarian (HE-001) — this EN version is a translation |
1. Why Is Step Count Special Category Data?
⚠️ SPECIAL CATEGORY DATA — GDPR ARTICLE 9 Step count qualifies as health data under GDPR Article 9 and European Data Protection Board guidance, as it can indirectly reveal information about a person's physical condition and health status. Processing is only lawful with explicit consent — implied or general consent is NOT sufficient. |
The Cashletics application can access step count data from the following sources — exclusively based on the user's decision:
Android: Health Connect API (primary source) or device sensor (fallback)
iOS: HealthKit API — currently inactive; to be updated before the iOS launch
2. What Data We Collect and Why
| Data | Exactly what | Purpose | What we do NOT collect |
|---|---|---|---|
| Step count | Daily aggregate step count (integer) | Activity tracking, gamified reward calculation | Raw GPS data, route, location |
Data minimisation: the application stores only aggregated daily data — per-minute, per-hour, or raw sensor data is NOT retained.
3. Legal Basis for Processing
| Legal basis | GDPR Art. 9(2)(a) |
| Explanation | Explicit consent of the data subject to processing their special category data |
| Requirements | Explicit (not implied), informed, freely given, unambiguous |
| When obtained | When the step count feature is enabled — feature-bound permission request (HJ-001-EN Section 5) |
| Form | Separate notice dialog; consent is given by tapping „Continue to permission”, followed by the Android permission request; optional (not mandatory) |
| Revocable? | Yes — at any time, without retroactive effect (GDPR Art. 7(3)) |
4. In-App Consent Text
The text below is shown when the user switches on the step-count feature, before the Android permission is requested (HJ-001-EN Section 5). Texts in quotation marks are the app's verbatim interface texts (version 1.0.46+47); the app displays the document version from the active legal configuration.
|
The „Continue to permission” button is the explicit consent: if there is no current consent, the server records it at this point (health_accept event; healthConsent, healthPolicyVersion), and only then is the Android permission request opened.
The „Not now” button declines: no system permission request is opened and the rest of the app remains usable.
The in-app consent and the Android permission are separate states: the system permission can still be refused or revoked after the consent.
The „Open Health notice” button opens the detailed notice on health data.
5. Data Flow and Storage
| Step | Description | Where it happens |
|---|---|---|
| 1. Source | Health Connect API or device sensor | On the user's device |
| 2. Aggregation | Daily total calculated (raw data discarded) | On the user's device |
| 3. Storage | Aggregated daily data uploaded | Cloud Firestore (Google LLC, EU-US DPF) |
| 4. Use | Activity display, reward calculation, statistics | Within the application |
| 5. Deletion | Upon consent withdrawal or account deletion | Permanently from Firestore |
Retention period: until withdrawal of consent, with deletion within 30 days thereafter; in any case no longer than 90 days from the last synchronisation. Upon account deletion, all health data is immediately and permanently erased.
6. Prohibited Uses
Under the Google Play Health Permissions Policy and GDPR Article 9, health data (step count) may only be used for permitted purposes. The following are expressly prohibited:
Advertising purposes — data is NOT shared with AdMob or any other advertiser
Transfer to third parties without notification
Use for credit, insurance, or employment decisions
Publication on the public leaderboard
Storage of raw sensor data
7. Android — Health Connect Details
| Parameter | Value |
|---|---|
| API | Android Health Connect (androidx.health.connect) |
| Permissions requested | READ_STEPS; READ_HEALTH_DATA_HISTORY; ACTIVITY_RECOGNITION. READ_HEALTH_DATA_HISTORY is used for weekly/monthly/yearly aggregated step totals; ACTIVITY_RECOGNITION supports Android activity/step-count permission handling. The app still does not process GPS, routes, heart rate, workout type or other health data. |
| Permission request method | Health Connect system dialog — user grants via Android system UI |
| Withdrawal method (1) | Cashletics > Settings > Health Data > Disable |
| Withdrawal method (2) | Android Settings > Health Connect > Cashletics > Remove permissions |
| Play Console declaration | Health Connect API usage declaration required — GPS-001 |
| Play Data Safety type | "Health info" and "Fitness info" — optional, user-shared |
8. iOS — HealthKit Details (currently inactive)
iOS / HealthKit currently inactive; to be updated before iOS launch HealthKit integration details to be added before App Store submission. Structure is identical to the Android section; only API-specific details differ. |
| Parameter | Android equivalent | iOS value |
|---|---|---|
| API | Health Connect | iOS / HealthKit currently inactive |
| Permissions requested | READ_STEPS; READ_HEALTH_DATA_HISTORY; ACTIVITY_RECOGNITION. READ_HEALTH_DATA_HISTORY is used for weekly/monthly/yearly aggregated step totals; ACTIVITY_RECOGNITION supports Android activity/step-count permission handling. The app still does not process GPS, routes, heart rate, workout type or other health data. | iOS / HealthKit currently inactive |
| Info.plist key | — | iOS / HealthKit currently inactive |
| Withdrawal method | Android settings | iOS / HealthKit currently inactive |
| App Store declaration | Play Console Health declaration | iOS / HealthKit currently inactive |
9. Your Rights Regarding Health Data
| Right | How to exercise |
|---|---|
| Withdrawal (GDPR Art. 7(3)) | App > Settings > Health Data > Disable — takes effect immediately |
| Erasure (GDPR Art. 17) | privacy@cashleticsapp.com — executed within 30 days |
| Access (GDPR Art. 15) | privacy@cashleticsapp.com — response within 30 days |
| Restriction (GDPR Art. 18) | privacy@cashleticsapp.com |
| Portability (GDPR Art. 20) | privacy@cashleticsapp.com — JSON format |
| Complaint (GDPR Art. 77) | NAIH: www.naih.hu | ugyfelszolgalat@naih.hu |
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. After withdrawal, the step count feature stops, and already stored aggregated data is deleted within 30 days.
10. Cross-Reference — Synchronised Documents
Health data processing appears in the following documents — all must be consistent with each other:
| Document | Relevant section / row | Synchronised element |
|---|---|---|
| AT-001-EN | Section 6 | Health data standalone section, retention, legal basis |
| AT-001 (HU) | Section 6 | Same content in Hungarian |
| ROPA-001 | Health data row | GDPR Art. 9 flag, 90-day retention |
| DPIA-001 | Risk assessment | Special category data risk analysis |
| HJ-001-EN | Section 5 — step-count permission | In-app text and UI flow |
| GPS-001 | Health info declaration | Play Console Data Safety form |
| HE-001 (HU) | Full document | Hungarian source version |
⚠️ GOVERNING LANGUAGE NOTICE This document is an English translation of the Hungarian Health Data Statement (HE-001). In case of any discrepancy between the Hungarian and English versions, the Hungarian version shall prevail. Hungarian version: https://cashleticsapp.com/legal.php?slug=egeszsegugyi-adat&lang=hu |
Version History
| Version | Date | Change | Approved by |
|---|---|---|---|
| v1.5 | 2026 | Initial release — final | Dr. Crespo Zsuzsanna |
| v1.7 | 1 August 2026 | Sybell registered address corrected (DPA-001); DPA-002 clause 3.6 breach notification narrowed + non-excludable liability categories; DPA-003 liability cap (12 months’ fees, min. HUF 500,000); publication date updated | Dr. Crespo Zsuzsanna |
| v1.8 | 1 August 2026 | Legal review approved (DPIA-001, LIA-001, PR-001; DPA-002 clause 3.6 + liability framework; DPA-003 liability cap). Signatures pending. | Dr. Crespo Zsuzsanna |
| v1.9 | 1 August 2026 | PiggyRun mini-game, Piggy Coin, entry ticket types (standard/silver/gold) and random reward packages (loot boxes) regulated; loot box gambling-law classification approved; gamification data elements extended (AT-001, ROPA-001); DPA-001 AdMob/Firebase acceptance dates; DPIA-001 I4 closed. | Dr. Crespo Zsuzsanna |
| v1.9.1 | 1 August 2026 | Sybell (DPA-002): instead of signing the draft agreement, Section 11.1 of Sybell’s GTC (20 July 2026, Art. 28(3) and (9) GDPR) governs the processing; references updated; GTC archived. | Dr. Crespo Zsuzsanna |
| v1.10 | 1 August 2026 | DPA-003 (Balázs Bánki): implementation of the developer comments — narrowing of the developer role and data categories, incident notification under Art. 33(2) GDPR, notification of unlawful instructions under Art. 28(3) GDPR, clarification of third-country transfers, deletion of the minimum liability floor. Addition of administrator feature switches and audit log (ROPA-001 row 17, 12-month retention); clarification of the admin interface access matrix (SZ-001 2.1). | [külön nem került jóváhagyásra — a v1.10.1 váltotta fel] |
| v1.10.1 | 6 August 2026 · suppl. 4 September 2026 and 5 September 2026 | EN terminology alignment (Article, Data Controller); implementation of the legal review decisions; data categories of the four undocumented collections in Section 4 of AT-001. Supplement of 4 September 2026: placeholder instead of a pre-filled signature date in unsigned copies (14 documents); GDPR Article 12(3) “without undue delay” wording implemented (AT-001 HU/EN, EJ-001); in DPIA-001 the retention of health data after withdrawal changed from 7 to 30 days, aligned with HE-001; corrected EU-US Data Privacy Framework reference in the English version of BH-001; in DPA-002 the processing relationship recorded as based on Section 11.1 of the Sybell GTC and the Controller's written instruction instead of a signature; column misalignment corrected in the Article 28 record of DPA-001. In addition: in ROPA-001 and ATJ-001 the number of recorded processing activities corrected to the actual 25 (previously 17 and 16 respectively); in the consent examples of HJ-001 the reference to the never-published AT-001 v1.8.3 corrected to the published v1.8. Implementation of the legal review decisions (4 September 2026): the assistance obligation under GDPR Article 28(3)(f) added as clause 3.7 of DPA-002 and clause 3.10 of DPA-003; in the Play Data Safety table of GPS-001, transfers to Firebase Analytics are no longer declared as sharing — consistent with the document's own conceptual distinction — and health and fitness data are no longer declared as required; Firebase Analytics (L1) and the aggregated analysis built on it (L3) removed from the scope of LIA-001, as their legal basis is consent, with the exclusion table extended accordingly; the incorrect reference to the Hungarian Infotv. removed from the age-limit reasoning of KK-001, together with the identical wording in GPS-001 and XHV-001; the response deadline in EJ-001 aligned with the public undertaking in AT-001 (60 days in total at most); an explanatory note added to the 30-day undertaking under Article 12(3); the Hungarian version of BH-001 supplemented with the description of third-country transfers; AT-001 now states the storage location of Cloud Firestore as the eur3 European multi-region, consistent with ROPA-001; the developer added to the list of processors in AT-001, and the instruction clause of DPA-003 extended with the transfer wording; in six places the term “anonymised” refined to “pseudonymised”. Based on the Controller's statement of 4 September 2026: two-factor authentication for the admin interface is recorded with its actual completion date (1 September 2026) instead of an expired deadline; the emergency shutdown access issued in the developer's name has not yet been activated, therefore the access matrix of SZ-001 and the transitional provision in clause 3.9.8 of DPA-003 record the current and the final state separately, listing the data actually accessible through that role; the revocation of the earlier project-level (Editor) permission is recorded. The data subject branch of INC-001 received the exemption grounds under GDPR Article 34(3), the retention period of ROPA item 06 was aligned with AT-001, an expired external reference was replaced, and header-row repetition was enabled for two multi-page tables in SZ-001. The duplicate logo on the first page — already present in the header — has been removed from the document body (29 documents); the header logo is unchanged and no document text was altered. Supplement of 5 September 2026: retention period clarified with deletion within 30 days after withdrawal; the package-level legal approval recorded in the version table. Supplement of 6 September 2026: based on the Controller's reply of 5 September 2026, the effective date of the package was changed from 1 August 2026 to 1 October 2026 (79 places; the applicability wording of DPA-003, the approval dates in D2-UGY and the dates in the version tables were deliberately left unchanged). Supplement of 24 September 2026: the effective date of the package changed from 1 October 2026 to 12 OCTOBER 2026. Reason: under Section 14 of ASZF-001 and Section 9 of AT-001, users must be notified of changes at least 15 days before the effective date; publication and notification took place on 27 September 2026 (instead of the previously planned 25 September). The signature date of KK-001 and PR-001 is the day of publication. | Dr. Crespo Zsuzsanna |
| v1.10.2 | 3 October 2026 · suppl. 8 October 2026 | References aligned with HJ-001-EN v1.10.2 (based on the controller's technical deviation list of 2 October 2026): the step-count permission is a feature-bound permission requested when the feature is switched on (HJ-001-EN Section 5); the developer implementation marker removed from Section 4 and from the consent statement. No change in substance. The effective date remains 12 October 2026. Supplement of 8 October 2026, before publication (based on the controller's technical answers of 3 October 2026): Section 4 contains the app's actual, verbatim notice text; consent is given with the „Continue to permission” button of the notice dialog, there is no separate checkbox. | Dr. Crespo Zsuzsanna |
| Role | Name | Date | Signature |
|---|---|---|---|
| Prepared by | Dr. Crespo Zsuzsanna | ||
| Received / approved by | Mózer Ferenc |
Next review: 1 August 2027
v1.5a supplement — Android Health permissions:
The current Android permission set remains unchanged in the source code: READ_STEPS, READ_HEALTH_DATA_HISTORY and ACTIVITY_RECOGNITION. These are used only for reading step count, historical aggregated step totals, and Android activity-recognition support. Cashletics does not request or process location data, GPS routes, heart rate, workout type, or other health data.