Privacy Policy

1. Controller (Verantwortlicher)

The data controller responsible for the processing of personal data on this website and in relation to ARBH Labs applications in accordance with Art. 4 No. 7 GDPR is:

Aaron B. Haug
ARBH Labs
Banatstraße 12
73240 Wendlingen am Neckar
Germany
Phone: +49 151 58727540
E-Mail: [email protected]

2. Local-First Application Data

LastDose and PulseTrace keep routine logs, measurements, and settings in the applications' private storage unless you explicitly use an optional sharing, export, licensing, or purchase feature.

• Core records stay local: Medication and routine logs, timers, vital entries, and PulseTrace measurement history are stored in Android app-private storage.
• No advertising analytics SDKs: The apps do not include Google Analytics, Firebase Analytics, Mixpanel, Facebook SDK, or advertising trackers.
• On-device signal processing: PulseTrace processes camera and optional microphone input on the device; raw video and audio are not uploaded by the measurement flow.
• Optional features are explicit: Export, encrypted friend sharing, license activation, and purchases run only after you choose the corresponding feature. The friend-sharing relay handles encrypted payloads and does not receive the local content key.

3. Website Hosting & Server Log Files

When you visit our website, our hosting and content delivery provider (Cloudflare Pages / Cloudflare, Inc.) automatically collects and processes technical log data transmitted by your browser. This includes:

• Browser type and version
• Operating system
• Referrer URL
• Host name of the accessing device (IP address)
• Time and date of the server request

Legal Basis: Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the technically error-free delivery, stability, and security of our web infrastructure (e.g. defense against DDoS attacks). Server log files are deleted or anonymized automatically according to industry standard retention periods.

4. Self-Hosted Fonts & Zero External Assets

To protect your privacy and ensure compliance with European data protection regulations, all typography (including Instrument Sans and Newsreader) is hosted locally on our own servers in the /fonts/ directory. No requests or IP addresses are transmitted to Google Fonts or external CDN providers.

5. Payment and License Processing

App purchases and subscriptions may be processed by PayPal. Selected digital products may be sold through Lemon Squeezy. The checkout page identifies the provider before you pay.

Payment details are entered with the payment provider, not stored in the Android apps. ARBH Labs may retain the order reference, license record, activation status, and information needed to provide support or meet legal obligations. See the PayPal Privacy Statement and Lemon Squeezy Privacy Policy.

Legal Basis: Processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR), as well as compliance with statutory tax and accounting obligations (Art. 6(1)(c) GDPR).

6. Cookies and Tracking Technologies

Our website does not use tracking cookies, marketing pixels, or third-party profiling mechanisms. Session storage is utilized only when necessary to preserve pending checkout state or local UI preferences. No cookie consent banner is required as no non-essential cookies are set.

7. Strategic Inquiry Form

If you use the investor and partnership inquiry form, ARBH Labs stores the topic, name, email address, optional company or fund name, message, consent time, submission time, and review status. IP addresses and advertising identifiers are not stored with the inquiry. Processing is based on your consent under Art. 6(1)(a) GDPR and, where the inquiry concerns a potential agreement, Art. 6(1)(b) GDPR. The information is used only to assess and respond to the inquiry and is deleted when it is no longer required for that purpose, subject to applicable legal retention obligations. You may withdraw consent by contacting ARBH Labs.

8. Business Contacts & Client Acquisition (Geschäftskontakte)

Purpose: We research local businesses that may benefit from a new or improved website and may contact them for business purposes.

Data: Publicly available business contact details (company name, owner or contact name, business address, business phone and email, website URL) and our own observations of the business's public website (for example speed, mobile layout, technical issues, design). We process business-related data only.

Source (Art. 14(2)(f) GDPR): Publicly accessible sources, mainly the business's own website including its Impressum, Google Maps / Google Business Profile listings, and public business registers.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in identifying potential business clients and offering our services (web design, hosting and care).

Recipients: No disclosure to third parties for marketing. Technical service providers (such as our email provider) may process data on our behalf.

Notice (Art. 14(3) GDPR): We inform you within one month of obtaining the data, or at the latest with our first contact. That first message includes the objection notice below and a link to this policy.

Retention: If there is no reply within 3 months of first contact, we delete the data. If a business relationship starts, we process the data to perform the contract (Art. 6(1)(b) GDPR) and keep it for statutory retention periods (Art. 6(1)(c) GDPR). If you object, we delete immediately and keep only a minimal do-not-contact entry (company name and address) so we never contact you again.

Right to object (Art. 21 GDPR): You may object at any time, without giving reasons, to the processing of your data for direct marketing (Art. 21(2) GDPR); we then stop processing it for that purpose (Art. 21(3) GDPR). You may also object on grounds relating to your particular situation to processing based on Art. 6(1)(f) GDPR (Art. 21(1) GDPR). An informal message to Aaron B. Haug, ARBH Labs, Banatstraße 12, 73240 Wendlingen am Neckar, or [email protected] is enough.

Supervisory authority: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Heilbronner Straße 35, 70191 Stuttgart, baden-wuerttemberg.datenschutz.de.

Kurzfassung (DE): Wir recherchieren öffentlich zugängliche Geschäftskontaktdaten lokaler Unternehmen (Website, Impressum, Google-Unternehmensprofil, Register), um ihnen Webdesign-Leistungen anzubieten (Art. 6 Abs. 1 lit. f DSGVO). Ohne Antwort löschen wir die Daten 3 Monate nach der ersten Kontaktaufnahme. Sie können der Verarbeitung zu Werbezwecken jederzeit ohne Angabe von Gründen widersprechen (Art. 21 DSGVO); eine formlose Nachricht an die oben genannte Anschrift oder E-Mail genügt.

9. Your Rights Under the GDPR

As a data subject located in the European Union, you have the following rights under the GDPR regarding your personal data:

• Right of Access (Art. 15 GDPR): You have the right to request confirmation as to whether personal data concerning you is being processed and to receive information about that data.
• Right to Rectification (Art. 16 GDPR): You have the right to demand the immediate rectification of incorrect personal data or completion of incomplete personal data.
• Right to Erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data, provided statutory retention requirements do not apply.
• Right to Restriction of Processing (Art. 18 GDPR): You have the right to demand restriction of processing of your personal data under certain conditions.
• Right to Data Portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data which is based on Art. 6(1)(f) GDPR.
• Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a competent data protection supervisory authority.

To exercise any of these rights, please contact us at: [email protected].

10. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our legal obligations or technical architectures. The current version is always accessible at this URL.

Last updated: October 2026