Privacy Policy

Last updated: 2026-03-24

VitalSigns AB ("we", "us") develops the CPRGuide app for CPR training. We value your privacy and are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR).

Data Controller

VitalSigns AB is the data controller for the processing of your personal data. Contact: info@vitalsigns.se

What Data We Collect

When you create an account, we collect:

  • Account details: email address, username, and password (stored encrypted)
  • Optional profile details: first name, last name, and phone number
  • Organization link: if your email domain matches a registered customer, your account may be linked to an organization and department

When you use the app, we also collect:

  • Training data: CPR session results (compression rate, depth, blood flow, scores)
  • Leaderboard results: scores linked to your username
  • Certificates/diplomas: results from certification and diploma flows
  • Device information: device attestation (Google Play Integrity / Apple App Attest) to verify app authenticity

Why We Collect Your Data

  • Create and manage your user account
  • Save and display your training results and progress
  • Issue CPR certificates and diplomas
  • Enable leaderboards and challenges
  • Link your account to your employer's organization (if applicable)
  • Ensure app integrity through device attestation

Legal basis: consent (Article 6.1a GDPR) at account registration, and legitimate interest (Article 6.1f) for app security and device attestation.

How We Store and Protect Your Data

  • The database is hosted on Microsoft Azure with encryption at rest and in transit
  • Passwords are stored encrypted (hashed) and cannot be read by anyone
  • Authentication tokens (JWT) are stored in the device's secure storage (iOS Keychain / Android KeyStore)
  • Training data is cached locally on the device for offline use
  • All communication between the app and the server is over HTTPS

Data Sharing

We never sell your personal data. We share data with:

  • Microsoft Azure: backend hosting and database storage
  • Google / Apple: device attestation — no personal data is transferred, only the device's authenticity status
  • Your employer: if your account is linked to an organization, administrators may view your training results within that organization

How Long We Keep Your Data

We retain your personal data for as long as you maintain an active account. When you request deletion of your account, all personal data, training results, certificates, and associated data are permanently deleted.

Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate data via your profile settings
  • Erase your account and all associated data
  • Withdraw consent at any time by deleting your account
  • Lodge a complaint with the Swedish Authority for Privacy Protection (IMY)

Age Requirement

The app is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13.

Changes to This Policy

We reserve the right to change this privacy policy. For material changes, we will notify you via the app or email.