Last updated: October 2026
The following information provides a simple overview of what happens to your personal data when you visit our website or use our "Syncvita" app. Personal data is any data that can be used to personally identify you.
Data processing is carried out by the website operator. Their contact details can be found in the "Information about the responsible party" section of this privacy policy.
Your data is collected exclusively by you providing it to us. This includes:
The data is used exclusively to retrieve your health data (steps, weight, heart rate, etc.) via our API and import it into Apple Health.
If you turn on the optional Apple Health export, we additionally store the selected Apple Health data for your own analyses (see section 4).
If you additionally connect an AI assistant, we transfer data from the Apple Health export to that assistant when it requests it (see section 5).
You have the right at any time to receive free information about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. Further rights can be found in this privacy policy.
The protection of your personal data is of particular concern to us. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
The responsible party for data processing is:
Digitmedia e.K.
Gertrudstr. 17
44388 Dortmund
Germany
Represented by: Tim Friedrich
Phone: +49 (0)231 58 69 99 72 – 0
E-Mail: support@digitmedia.de
The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.
We store your data (API key and the health data you transmitted, with date and time) without a fixed time limit so that you can use it over longer periods; there is no automatic deletion. You can delete all stored data or only data before a certain date yourself at any time – in the Syncvita app, in the web app under "Manage data" or via the API. If you delete your API key (account), we immediately delete all associated data. Deleted data disappears from our server backups as soon as these are overwritten in the regular rotation.
For data from the optional Apple Health export, section 4 applies: we store it until you delete it or withdraw your consent.
For server logs, the retention period in section 3 ("Server logs") applies instead.
Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.
You have the right to object at any time to the processing of personal data concerning you for reasons arising from your particular situation.
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies.
You have the right to have data that we process automatically based on your consent or in fulfillment of a contract handed over to you or a third party in a common, machine-readable format.
This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.
Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, their origin and recipients and the purpose of data processing and, if applicable, a right to correction or deletion of this data.
You have the right to request the restriction of the processing of your personal data.
This section describes transferring data to Apple Health. For the optional upload of data from Apple Health (Apple Health export), the information in section 4 applies.
When using our "Syncvita" service, the following data is collected and processed:
This data is used exclusively for the purpose of synchronizing your health data with Apple Health.
We do not analyse your health data for our own purposes: no profiling, no statistics about you, no use for advertising, market research or training AI models. We do not sell your data and do not pass it on – except to an AI application you connect yourself (section 5). We process it solely to deliver it to Apple Health or to the AI application you connected, and we store it until you delete it.
For every request to our API we automatically log the IP address, app identifier (user agent), time, type and address of the request as well as the identifier of your API Key. This applies regardless of which Syncvita features you use. We use these logs solely to detect and defend against attacks and abuse and to fix errors.
The legal basis is our legitimate interest in secure operation free of abuse (Art. 6(1)(f) GDPR). You can object to this processing under Art. 21 GDPR.
We automatically delete log entries in our database and the log files on our server (daily logs as well as error and security logs) after 365 days.
The processing of data is based on your consent (Art. 6 Para. 1 lit. a GDPR) or for the fulfillment of a contract (Art. 6 Para. 1 lit. b GDPR).
Your data is stored and processed exclusively on servers in Germany. The transmission of your data is encrypted via HTTPS. Access to your data is only possible via your personal API Key.
Your data is not passed on to third parties. Processing takes place exclusively on our servers for the purpose of providing the service.
Exception: if you have connected an AI assistant yourself, its provider receives the retrieved data from your Apple Health export (see section 5).
Your data is processed exclusively on servers in Germany. When using our app worldwide, data transmission from your location to our German servers is encrypted via HTTPS.
Exception: with a connection to an AI application that you set up, retrieved data reaches its provider, depending on the provider also in third countries such as the USA (see section 5).
The Syncvita app optionally lets you upload data from Apple Health to our server ("Apple Health export"). This feature is turned off by default. It only becomes active if you turn it on in the app using a setup assistant, choose the data types and the time range, and give your explicit consent. Consent is voluntary. If you do not consent or end the export later, you suffer no disadvantage: transferring data to Apple Health keeps working as before. If you do not use the export, none of this data is stored on our server.
Only the data types you select in the assistant are uploaded. You can choose from:
Some of these data types are particularly sensitive because they allow conclusions about illnesses or habits: heart rhythm events (notifications about a high, low or irregular heart rate, signs of atrial fibrillation and the AFib History), breathing disturbances during sleep and signs of sleep apnea, insulin delivery, blood alcohol content and the number of alcoholic beverages, falls, and noise exposure from environmental and headphone audio levels. For notifications (heart rhythm, sleep apnea) we only transfer that and when the event occurred, not a measured value. Only select these data types if you want to transfer them; like all other export data they are health data under Art. 9 GDPR and are protected in the same way.
Every single value is transferred as it is stored in Apple Health – including values that other apps, your Apple Watch or Syncvita itself wrote there. For each value we store:
When turning the export on, you also choose how far back data is transferred: 30 days, 90 days, 1 year or all available data. After that the app continuously transfers new and changed values. Values you delete in Apple Health are also deleted on our server as soon as the app reports the deletion.
In particular, the following are not transferred: cycle tracking and sexual health data, symptoms, moods and emotions (State of Mind), health records, medications, ECG recordings and hypertension notifications, as well as workout routes and other location data.
We store the data solely so that you can use it for your own health analyses. To do so, we keep it up to date (changes and deletions from Apple Health are applied) and make it available to you. Syncvita itself does not analyse your health data, makes no diagnoses and gives no recommendations; Syncvita is not a medical device.
We also make your export data available in the web app under "Manage data": after entering your API key you see your values as an overview, history and table. The display runs encrypted (HTTPS) directly between your browser and our API; your API key is only kept in your browser until you sign out. Anyone who knows your API key can also retrieve this data, so please do not share it.
Connecting your export data to AI assistants is a separate step and only possible with a separate consent that names the respective provider. Without that consent we do not pass your export data to any AI provider. Details are in section 5.
The legal basis for the Apple Health export is your explicit consent under Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. You give it in the app before the first upload by actively agreeing after the selected data types have been shown to you. Without this consent no upload takes place.
Storing the record of your consent (see "Record of your consent") is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.
For technical API logs, the legal basis described in section 3 ("Server logs") applies.
For your export data:
Export data is stored exclusively on servers in Germany. It is only transferred to countries outside the EU or EEA if you connect an AI assistant yourself (see section 5). The transfer from the app to our server is encrypted (HTTPS/TLS) and only possible with your personal API key.
Our servers are operated by a hosting provider in Germany. The provider processes the data only on our behalf and according to our instructions; we have a data processing agreement under Art. 28 GDPR with this provider. Other recipients of your export data only exist if you connect an AI assistant yourself (see section 5).
On your iPhone, the app only reads Apple Health while the device is unlocked. Read values remain protected by iOS file encryption until they are uploaded.
We store your export data until you delete it, withdraw your consent, deselect the data types concerned or delete your Syncvita account (API key). In these cases we immediately and completely delete the data concerned from our server. You can delete all export data or only data before a certain date at any time (in the app, in the web app under "Manage data" or via the API). There is no automatic deletion after a fixed period, because the data is intended precisely for analyses over longer periods.
Deleted data disappears from our server backups as soon as these are overwritten in the regular rotation; until then it is not used.
We keep the record of your consent and of its withdrawal even after withdrawal, because we must be able to demonstrate that the processing was lawful. It contains no health values and is deleted together with your Syncvita account.
We log export requests like all API requests (see section 3, "Server logs"). For export operations the log only contains counts (e.g. how many values were transferred), no health values.
You can withdraw your consent at any time – as easily as you gave it: in the Syncvita app, in the "Apple Health export" view, with "End export and delete data". After you confirm, the app stops uploading and we immediately delete all uploaded export data from our server. Transferring data to Apple Health is not affected. You can also declare the withdrawal to us directly (contact details in section 10).
If you deselect individual data types under "Change data types", we immediately delete the data of exactly those types.
Important: deleting the app or revoking read access in the iOS settings stops further uploads, but does not delete your data on our server. Please use the function in the app for that or contact us.
Withdrawal takes effect for the future; the lawfulness of processing carried out until then remains unaffected (Art. 7(3) GDPR).
So that we can demonstrate that and to what you consented (Art. 7(1) GDPR), we store for every consent, change and withdrawal:
Regarding your export data you have in particular the following rights:
To exercise these rights, please use the contact details in section 10. Because Syncvita works without user accounts, we will agree with you how we can securely match your API key before we provide information or hand over data. Please do not send us your full API key by email unless we ask for it.
The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. You may also contact any other data protection supervisory authority.
Should a breach affecting your export data occur despite our safeguards, we will report it to the competent supervisory authority within 72 hours (Art. 33 GDPR). If the breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay (Art. 34 GDPR). Since we do not collect email addresses, we will inform you via the Syncvita app and on this website.
This section corresponds to consent version 1.0 (as of October 2026), which your consent in the app refers to. If we change the scope or purpose of the export, we will ask for your consent again in the app.
Starting from version 1.8 of the Syncvita app, you can connect the data you shared in the Apple Health export (section 4) to an AI application that supports the Model Context Protocol (MCP) – for example Claude by Anthropic, ChatGPT by OpenAI or another application of your choice, including an AI that runs locally on your own device. You can then ask the AI questions about your own health data, for example how your resting heart rate has developed. This feature is turned off by default, requires an active Apple Health export and needs its own, separate consent for every connection. If you do not set up a connection, no AI application receives any data from us.
A connection is only created on your initiative: you add Syncvita in your AI application (e.g. Claude or ChatGPT) using the address https://mcp.syncvita.de/mcp. A Syncvita sign-in page then shows you a pairing code, which you enter in the Syncvita app under "AI assistants". The app shows you the application, its sign-in address and the data types it can read and asks for your consent. We recognise Claude and ChatGPT by their fixed sign-in addresses; all other applications state their name and sign-in address themselves and are therefore marked as "not verified". Only after you confirm does the application receive an access key that lets it only read your data. It does not receive your API key.
The assistant can read all data types you shared in the Apple Health export (list in section 4), including data types you share later; there is no selection of individual data types per connection. It only retrieves data when you ask it a question in a conversation that requires the data. Depending on the question, we transfer:
Through Syncvita the assistant can only read your data. It cannot change or delete data or write anything to Apple Health.
We transfer the data solely so that the assistant you connected can answer your questions about your own health data. Syncvita itself does not analyse the data in this case either and makes no diagnoses. Answers from an AI assistant can be wrong and do not replace medical advice.
The legal basis for the transfer to the AI application is your explicit consent under Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. You give it separately for every connection in the app after the application has been named and the retrievable data types have been shown to you. This consent is independent of your consent to the Apple Health export.
As a record, we store for every consent and every withdrawal the time, the provider, the version of the consent text, the app version, the language and the data types retrievable at that time (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). This record contains no health values and is deleted together with your Syncvita account.
The only recipient is the AI application you connect or its provider. The provider is not our processor but processes the data as an independent controller under its own privacy terms and according to your settings there – for example how long conversations are kept and whether they are used for training AI models. For Claude and ChatGPT you can find the privacy policies here:
If you connect another AI application, its privacy terms apply. We have not verified these applications; please check yourself who provides them and whether they pass your data on to other services – for example to an AI model in the cloud. An AI that runs entirely locally on your device does not transfer the retrieved data to third parties.
Anthropic and OpenAI also process data in the USA, i.e. outside the EU and the EEA. Other providers of AI applications may also process data outside the EU and the EEA; whether and where follows from their privacy terms. An adequacy decision of the European Commission applies to the USA only for companies certified under the EU-U.S. Data Privacy Framework. Where a transfer to a third country is not covered by an adequacy decision, it is based on your explicit consent under Art. 49(1)(a) GDPR. Please note the risk: the level of data protection in third countries such as the USA is not comparable to that of the EU in every respect; in particular, authorities there may be able to access the data without effective legal remedies being available to you.
Data only leaves our server in Germany if you have set up a connection yourself and the assistant retrieves data during a conversation with you. We never send data to an AI provider on our own initiative.
For every retrieval by an AI assistant we log the connection, the type of retrieval, the number of entries delivered and the time – no health values and no search parameters. For every connection we also store the provider, the name of the assistant and the time of connecting, of the last use and, if applicable, of disconnecting, so that the app can show you your connections. The legal basis is our legitimate interest in being able to trace access and detect abuse (Art. 6(1)(f) GDPR).
We delete the access logs after 365 days. When a connection is disconnected, its access keys become invalid immediately and are deleted; we delete the remaining data of the disconnected connection, including its access logs, 365 days after disconnecting. We keep the record of your consents and withdrawals until your Syncvita account is deleted. Registration data of an AI assistant (client registration) through which no connection was ever established is deleted after 30 days. If you delete your Syncvita account, we delete all data of your connections immediately. Section 3 applies to the technical server logs.
You can withdraw your consent at any time by ending the connection in the Syncvita app under "AI assistants" with "Disconnect". The assistant's access becomes immediately invalid; it can no longer retrieve any data afterwards. If you end the Apple Health export or delete your Syncvita account, we automatically disconnect all connections. You can also declare the withdrawal to us directly (contact details in section 10).
Important: data the AI application retrieved before you disconnected is stored in your conversations with the application or its provider. We cannot delete it. Please delete the conversations concerned directly in the application (e.g. in Claude or ChatGPT) or contact its provider. If you only remove Syncvita in the application, please also disconnect it in the app.
The withdrawal takes effect for the future; the lawfulness of the transfers made until then remains unaffected (Art. 7(3) GDPR).
Your rights from section 4 ("Your rights") also apply to the data of your connections. Please exercise rights against the AI provider, for example access to or deletion of your conversations, directly with that provider.
This section corresponds to consent version ai-1.1 (as of October 2026), to which your consent to connecting an AI assistant refers. If we change the scope, purpose or recipients, we will ask for your consent again in the app.
We do not use analytics tools, cookies or advertising services. Only the data necessary for the functionality of the app (API Key, step count, date) is processed.
For the optional Apple Health export we additionally process only the data whose upload you consented to (see section 4); we do not use this data for analytics or advertising either.
In addition there are the server logs described in section 3, which we use only for security and troubleshooting.
Our service is generally aimed at persons who have reached the age of 16. Persons under 16 years of age require the consent of their legal guardians.
We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.
We take the following technical and organizational measures to protect your data:
If you have any questions about the collection, processing or use of your personal data, for information, correction, restriction or deletion of data, or revocation of given consent, please contact:
Digitmedia e.K.
Gertrudstr. 17
44388 Dortmund
Germany
E-Mail: support@digitmedia.de
Phone: +49 (0)231 58 69 99 72 – 0