Data Privacy

1. Controller

The controller responsible for processing your personal data is:

DreamDoc UG (haftungsbeschränkt)
Michaelstr. 33
09116 Chemnitz
Germany

Website: https://www.dream-doc.com

If you have any questions about privacy, data protection, data access, deletion, or your rights, contact us through the Contact form on our website. DreamDoc has not appointed a separate data protection officer; the controller above is the contact for data-protection matters.

2. What DreamDoc Does

DreamDoc provides digital health, wellness, readiness, baseline, recovery, and self-awareness tools. Depending on the product or service you use, DreamDoc may process wearable data, active test results (including resting HRV sessions and reaction-time / PVT-B style tests), lifestyle context, uploaded documents, app usage information, and account data in order to generate personal summaries, trends, readiness signals, baseline-based insights, and optional result emails.

DreamDoc does not replace medical diagnosis, emergency care, or professional medical advice. The service is intended to support personal awareness, prevention-oriented self-management, recovery tracking, and structured health-related reflection. Clinic, study, or partner programmes may apply additional written terms.

3. Categories of Data We May Collect

Depending on how you use DreamDoc, we may process the following categories of personal data:

Account and authentication

• Email address
• Unique user ID
• Account creation date
• Account status
• Authentication and login-related information

Wearable and derived health signals

• Heart rate and heart-rate-related signals
• HRV / beat-to-beat related values, where available
• Stress-related metrics
• Respiration-related values
• Sleep-related signals and sleep summaries
• PulseOx / oxygen saturation values, where available
• Activity data, steps, active calories, and training load
• Recovery, readiness, fatigue, system-wave, and baseline-related calculations generated by DreamDoc
• Glucose / CGM-related values where you connect a supported service (for example Dexcom)

Active tests

• Reaction time / psychomotor vigilance-style (PVT-B) test results
• Short resting HRV or recovery test results (HRV+)
• Test timestamps, trial series, and trend history

Profile and voluntary context

• Age or year of birth
• Height and weight
• Gender, where voluntarily provided
• Fitness level or training context
• Symptoms, recovery actions, subjective status, or daily notes, where voluntarily entered
• Food intake, sleep quality, stress, training, or lifestyle context, where voluntarily entered
• Uploaded medical or health-related documents and associated metadata, where you choose to upload them

Communications and service operation

• Account-related messages (registration, security, policy, export/deletion notices)
• Optional product result emails (for example morning baseline, HRV session, or reaction-time reports) when email is enabled for the connected app
• Messages sent by authorised clinic or study staff to participating users, where you take part in such a programme
• Date and time of last app use; device and app-related technical information
• Error logs, crash-related information, and system diagnostics
• Server logs, IP address, browser type, operating system, and access timestamps when using our websites or APIs
• Privacy-preserving website analytics for outbound Connect IQ store links (day-salted hash of IP and user agent; no advertising cookies)

We only collect data that is necessary for the service, voluntarily provided by you, technically required, or explicitly enabled through device permissions, app settings, or connected services.

4. Health-Related Data and Special Category Data

Some data processed by DreamDoc may qualify as health-related data or special category data under applicable data protection law. This may include wearable signals, recovery metrics, HRV, sleep-related information, stress-related metrics, glucose-related information where enabled, symptoms, readiness data, uploaded health documents, and other health-related context.

Where required by law, DreamDoc processes this type of data only with your explicit consent or another applicable legal basis. You may withdraw your consent at any time with future effect. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Why We Use Your Data

We process personal data for the following purposes:

• To create and manage your DreamDoc account
• To authenticate users and provide access to the apps, login/register services, and platform
• To connect your Garmin Connect IQ apps or other supported services with your DreamDoc account
• To calculate personal baselines, trends, readiness summaries, recovery indicators, fatigue signals, system-wave status, and wellness-related insights
• To display personal summaries in the app, on the watch, or in connected DreamDoc services
• To send optional baseline, HRV, or reaction-time result emails when you enable email for the relevant Connected App
• To provide pre-assessment, recovery, follow-up, prevention-oriented, clinic, or study support features where enabled under separate agreements
• To process uploaded documents and, where enabled for your account or organisation, AI-assisted document or chat features for explanation and organisation of information you provide
• To allow users to download, access, correct, and delete their data
• To send account-related, non-marketing messages, such as registration confirmations, data export or deletion notices, policy updates, security notices, or account expiration information
• To measure privacy-preserving website clicks to Connect IQ store listings and to maintain service security, prevent misuse, debug errors, and improve technical reliability
• To comply with legal obligations

We do not use your health-related data for advertising targeting. We do not sell your personal data.

Core Garmin connectivity and the consumer Connect IQ apps are offered without a mandatory consumer fee. Any paid options (for example long-term storage or AI token usage), if and when offered to you, are disclosed at the point of purchase or activation and are not required to use the basic Connected App features.

6. Legal Bases for Processing

Depending on the specific processing activity, DreamDoc may rely on the following legal bases:

• Consent — for processing health-related data, optional profile data, optional connected-service data, optional result emails, and certain app permissions.
• Explicit consent — where required for special category health-related data.
• Contract performance — where processing is necessary to provide the DreamDoc apps, account, platform, or requested service.
• Legitimate interests — for security, fraud prevention, technical maintenance, service improvement, and basic privacy-preserving usage analytics, provided these interests are not overridden by your rights and freedoms.
• Legal obligation — where we must retain or process certain information to comply with applicable law.

7. Garmin Connect IQ, Dexcom, and Third-Party Services

If you use DreamDoc’s Garmin Connect IQ applications (myBaselines / Body Baselines, HRV+, and/or Reaction Time), certain data may be collected from your compatible Garmin device and transferred to DreamDoc after you connect or register the app with DreamDoc.

Data submitted to the DreamDoc application is submitted to DreamDoc and not to Garmin. Garmin is not responsible for data that you choose to submit to DreamDoc through the DreamDoc apps or related DreamDoc services.

Garmin may process data independently when you use Garmin devices, Garmin Connect, or the Garmin Connect IQ Store. Garmin’s own processing is governed by Garmin’s privacy policies and terms.

If DreamDoc integrates with other optional third-party services, such as glucose data platforms (for example Dexcom), health data sources, or clinic systems, we process such data only where you actively connect the service, provide the required credentials or permissions, or otherwise enable the integration. Those providers remain independent controllers of data they process under their own terms.

8. Sharing of Data

We do not sell, rent, or trade your personal data.

We may share personal data only where necessary for one of the following purposes:

• With technical service providers who help us operate hosting, storage, security, email delivery, analytics, AI processing where enabled, communication, or infrastructure services (under appropriate contractual safeguards)
• With clinics, healthcare providers, coaches, study organisers, or specialists only where you explicitly enable such sharing or participate in a service or study that requires it
• With legal, regulatory, or governmental authorities where required by law
• With professional advisors, such as legal or tax advisors, where necessary and legally permitted

Service providers are required to process data only under appropriate contractual safeguards and only for the purposes instructed by DreamDoc. A named list of current subprocessors can be provided on request via the Contact form.

9. AI-Assisted Features

Where enabled for your account or organisation, DreamDoc may use automated or AI-assisted processing to help organise uploaded documents, summarise information you provide, or support chat-style explanations. These features are informational and do not provide medical diagnosis or treatment.

A general consumer “agentic” health coach may be rolled out over time; until it is generally available, advanced AI chat features may be limited to specific organisation or pilot groups. Health-related data processed for these features is not used for advertising targeting.

10. International Data Transfers

Where possible, DreamDoc aims to process and store personal data within the European Union or the European Economic Area.

If personal data is transferred to countries outside the EU or EEA (for example where a specialised email, hosting, or AI provider processes data there), DreamDoc will use appropriate safeguards where required, such as adequacy decisions, standard contractual clauses, or other legally recognized transfer mechanisms.

11. Storage Period

We store personal data only for as long as necessary for the purposes described in this Privacy Policy.

• Account data is stored for as long as your user account remains active.
• Wearable, readiness, baseline, test, document, and health-related data is stored for as long as needed to provide longitudinal summaries, baseline comparisons, and the requested DreamDoc functionality.
• Technical logs and privacy-preserving click analytics are stored only for the period necessary for security, debugging, operational reliability, and product measurement.
• Data that must be retained for legal, accounting, or compliance reasons may be stored for longer where required by law.

If you delete your account, DreamDoc will delete or anonymize your personal data unless legal retention obligations require longer storage.

12. Your Rights

Subject to applicable law, you may have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure of your data
• Right to restriction of processing
• Right to data portability
• Right to object to certain processing activities
• Right to withdraw consent at any time with future effect
• Right to lodge a complaint with a competent data protection authority

For DreamDoc UG (Chemnitz), the competent supervisory authority is typically the Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner). You may also contact the authority in your place of residence if different.

You can access, export, or delete your account data through the app where these functions are available. You may also contact DreamDoc via the Contact form to exercise your rights.

13. Data Security

DreamDoc uses technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

• Encrypted data transfer using SSL/TLS
• Secure server and database communication
• Regular server updates and security patches
• Access limitation based on operational necessity
• Technical monitoring and logging for security and reliability
• Data minimization where possible

No digital system can be guaranteed to be completely secure. However, we take appropriate steps to protect your data in line with the sensitivity of the information processed.

14. Children

The consumer DreamDoc service is intended for users aged 18 and older. DreamDoc is not intended for children unless a specific product, clinic programme, or parental/guardian-supported use case explicitly allows it under a separate written arrangement. If we become aware that personal data has been collected from a child without appropriate authorization, we will take steps to delete the data where required.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or data processing practices.

If material changes are made, we will inform users through appropriate channels, such as the app, website, or account-related email.

Last updated: 8 October 2026

This page describes DreamDoc’s current processing practices for counsel and user review. It is not a substitute for independent legal advice.