Introduction
Welcome to anomalie. Your privacy is a cornerstone of our service. We are committed to protecting your personal data and processing it in a way that is transparent, secure, and respectful of your rights. This Privacy Notice provides a detailed overview of our data practices. Your use of our App is subject to our Terms of Use, and the processing of your personal data is governed by the principles and legal bases described herein.
The processing of your data is carried out in strict compliance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”). Given that the core purpose of our App is to help you store and visualize your physical performance and further health data, we process data that is classified as health data under Art. 4(15) GDPR. This special category of personal data is subject to heightened protection, a responsibility we take seriously. This Privacy Notice explains the specific safeguards and legal bases we rely on to process your personal data lawfully and securely.
1. Name and Contact Details of the Controller
The controller for the processing of your personal data is anomalie GmbH, Marienburger Straße 26b, 10405 Berlin.
You can reach us via email: support@getanomalie.com
We have designated a data protection officer (“DPO”) who serves as an independent expert and your point of contact for all matters related to the protection of your personal data. You can reach our DPO with any questions, concerns, or requests to exercise your rights:
- By post at the address above, with the addition “Attn: Data Protection Officer”
- By Email: dpo@getanomalie.com
2. Purposes and legal bases for data processing
We process your personal data exclusively for specified, explicit, and legitimate purposes. Each processing activity relies on a valid legal basis as required by the GDPR. Due to the health-focused nature of our App, many of our processing activities depend on your explicit consent, which grants you direct control over how your personal data is used.
A. Core functionality of our App (contract performance & explicit consent)
To provide you with the full suite of services offered by our App, which includes the secure storage and visualization of your data, the processing of certain data is essential.
Data categories:
- Registration data: This includes your name and email address, which are necessary to create and identify your account, and a password.
- User-Provided Health & Fitness Data: This is the core data you entrust to us. It includes, but is not limited to: physiological metrics like VO₂max, detailed heart rate data, data on physical activities (such as type, duration, intensity, distance), and anthropometric data like body weight, height, age, and gender. It also includes any health-related information you manually enter, such as perceived exertion, wellness notes, and training logs.
- Data generated by the App: Data derived from your inputs, such as calculated metrics and visualizations presented in the App.
Purpose of processing:
- Account management: To create, secure, and maintain your user account, allowing you to access your data and our App’s services.
- Service delivery: The purpose of this processing is strictly limited to enabling the App’s core functionality: storing your data securely and visualizing your performance metrics for your personal use.
- Contract fulfillment: To fulfill our contractual obligations to you as detailed in our Terms of Use, which form the basis of our service relationship.
Legal basis:
- The processing of your non-sensitive registration data is necessary for the performance of the contract between you and us (Art. 6(1)(b) GDPR).
- The processing of your health and fitness data is based on your explicit consent (Art. 9(2)(a) GDPR). You provide this specific, informed, and unambiguous consent during the registration process through an active opt-in. Please be aware that without this consent, we cannot process your health data, and therefore the core functionality of the App cannot be provided.
B. App analytics, cookies & tracking (explicit consent)
To ensure the security, stability, and continuous improvement of our App, we would like to use cookies and analytics tools to gather insights into how our App is used.
Important note on health data: When using an application that is specifically focused on health and physical performance, even technical usage data (like your IP address, device ID, or browsing patterns within the App) can allow for inferences to be made about your health status or interests. For this reason, we treat such usage data as health data, and its collection requires your explicit consent.
Data categories:
- Technical data: IP address, device type, operating system version, browser type and version, and unique device identifiers.
- Usage data: Aggregated and pseudonymized data on how you interact with the App, such as features used most frequently, time spent on certain screens, clicks, and general navigation patterns.
Purpose of processing:
- App improvement: To analyze usage patterns in an aggregated form to understand how our App is used. For example, this helps us identify which features are most valuable, where users might be encountering difficulties, and how we can improve the overall user experience and functionality.
- System health: To ensure the technical stability and security of our platform by identifying, troubleshooting, and resolving bugs, errors, or security threats in a timely manner.
Legal basis: The processing of this data is based on your explicit consent (Art. 9(2)(a) GDPR), which you can grant and manage within the App. You will be asked for this consent separately and transparently. You have the free choice to refuse or withdraw your consent at any time through the App, without any negative impact on the core functionality of the App.
Analytics providers: Google Analytics, Sentry, Vercel Analytics, Facebook Ads Manager, TikTok Ads Manager.
C. Communication with you (consent / legitimate Interest)
When you proactively contact us, for instance via email or a contact form, we process the data you provide to handle your request effectively.
Data categories: Your name, email address, the content and metadata of your message (including date and time), and any other data you voluntarily provide.
Purpose of processing: To respond to your inquiries, provide technical or user support, and manage our communication with you. This includes answering questions about our App, assisting with account issues, or receiving feedback.
Legal basis: Depending on the context, this processing is based on our legitimate interest in providing efficient and effective customer support (Art. 6(1)(f) GDPR). If your inquiry itself contains health data, our processing of that specific information is based on your explicit consent (Art. 9(2)(a) GDPR) as described under section A above.
D. Sharing data with health professionals (explicit consent)
Our App allows you to share your health and fitness data with a health professional of your choice (e.g., your doctor, coach, or physiotherapist). This optional feature is designed to put you in full control of your data.
Data categories: You have granular control and can select precisely which of your health and fitness data, analysis reports, or time periods you wish to share.
Purpose of processing: To enable you to provide a selected health professional with secure access to your data for the purposes of independent consultation, information sharing, and/or performance coaching.
Legal basis: This sharing functionality is based on your separate and explicit consent (Art. 9(2)(a) GDPR), which you can provide within the App.
Controller roles in the sharing process:
- When you decide to use the sharing feature, we and the respective health professional act as joint controllers (Art. 26 GDPR). Our joint responsibility is strictly limited to the specific processing operation of making the data available to the health professional.
- The moment the health professional accesses your data, they become an independent controller for any subsequent processing. From this point on, we have no control over their use of your data. Their processing is governed by their own professional duties and data protection obligations.
We inform you about the essential aspects of our joint control arrangement with health professionals:
- We are responsible for providing the App as secure technical platform that allows you to initiate and control the sharing of your data.
- The health professional is responsible to process your data for the purposes of independent consultation, information sharing, and/or performance coaching.
- For the processing under joint control, we are your designated contact point. To exercise your rights concerning the data processing carried out by the health professional after they have received your data, you must contact them directly.
E. Use of data for scientific research (explicit consent)
We ask for your consent to use your data for scientific research purposes.
Data categories: Your health and fitness data.
Purpose of processing: Your data will be processed to produce an anonymized dataset from which individuals cannot be re-identified. This process involves removing direct identifiers and aggregating the data. The resulting anonymized dataset may then be used by us or shared with trusted research partners (such as universities or sports science institutes) for scientific research.
Legal basis: This processing is based solely on your separate and explicit consent (Art. 9(2)(a) GDPR). Participation is voluntary. You can withdraw your consent at any time.
F. AI-powered features (explicit consent)
We use AI-supported features to organize health information, extract structured data from documents, identify trends, draft summaries, and prepare informational recommendations inside your Health Profile. Depending on the feature you use, the data sent for processing may include selected health and fitness measurements, age in years, gender, questionnaire answers, document contents, dates, and trends derived from those records.
Before sending structured Health Profile data to a large language model, we exclude account-level fields such as your name, email address, postal address, raw date of birth, account ID, authentication ID, and Health Profile ID. We also limit the payload to the information needed for the requested feature. These structured payloads are data-minimized and pseudonymized. A document that you explicitly submit for AI-supported extraction is transmitted as submitted and may contain direct identifiers or other personal details within the document. Questionnaire answers may likewise contain details that you entered in free text. We therefore continue to treat every AI payload as personal health data and do not describe it as anonymous.
We use various AI Models. Data is transmitted over encrypted connections. The legal basis for processing health data in AI-supported features is your explicit consent under Art. 9(2)(a) GDPR. You may withdraw that consent with effect for the future; features that require AI processing will then no longer be available to you.
G. AI model training (explicit consent)
Not currently active. If activated, will require your separate and explicit consent.
H. Apple Health (HealthKit) data via wearables (explicit consent)
On the anomalie iOS app, you may choose to connect Apple Health (HealthKit) so your Health Profile stays current with the health and fitness data already collected on your iPhone or Apple Watch.
Data categories: Sleep, heart rate and heart rate variability (HRV), workouts and activity, steps, body measurements, and nutrition, to the extent Apple Health holds them and you grant HealthKit permission for each category individually.
Purpose of processing: HealthKit data is used exclusively to build and keep your Health Profile current, the same way we process data from a connected wearable or an uploaded lab report. It is never used for advertising, never sold, and never shared with third parties for marketing purposes.
Legal basis: This processing is based on your explicit consent (Art. 9(2)(a) GDPR), granted per HealthKit data category through Apple's own permission sheet on your device, in addition to the App's wearable-connection consent.
Processor: Terra (Terra API Inc., trading as Terra, tryterra.co) receives the HealthKit data your device shares on our behalf, in order to normalize it into the marker series stored in your Health Profile. Terra processes this data strictly under our instructions and a data processing agreement, and does not use it for its own purposes.
Retention: HealthKit data is retained for as long as the rest of your Health Profile (see Section 5) and is deleted together with your account.
Disconnecting and deleting: You can disconnect Apple Health at any time from the Apple Health card in the App, or in iOS Settings → Health → Data Access & Devices → anomalie. Disconnecting stops new HealthKit data from being read; data already stored in your Health Profile is removed when you delete your account.
I. Connected AI assistants (explicit consent)
You may connect an AI assistant such as ChatGPT, Claude or Codex to one Health Profile you own. The assistant can then read that Health Profile through anomalie; you confirm the connection on anomalie before any access is granted, and you can disconnect it at any time under Account › Assistants.
Data categories: Readings, clinical facts, document metadata and timeline items from the connected Health Profile, as requested by the assistant. Your name, email address, date of birth and internal identifiers are not passed to the assistant. When the assistant asks anomalie a health question on your behalf, anomalie receives the text of that question.
Question history: Health questions an assistant asks anomalie are saved to your Health Profile. anomalie uses them to make your insights, messages and recommendations more personal, and our team may review them to support you and to improve anomalie. Before questions are used in an AI-supported feature, account-level identifiers are removed as described in Section F. You can see and delete individual questions or your whole question history at any time under Account › Assistants; deleted questions are removed immediately.
Legal basis: Your explicit consent (Art. 9(2)(a) GDPR), given when you allow the connection on the consent screen, which describes this processing. You can withdraw it at any time by disconnecting the assistant; questions already saved remain in your Health Profile until you delete them or your account.
Recipients: The assistant's provider (for example OpenAI or Anthropic) processes what you ask it and what anomalie returns under its own terms, as a separate controller you have chosen.
Retention: The question history is kept until you delete it or delete your account.
J. Workout routes and maps
When a connected wearable or app (for example Strava or a GPS watch via Terra) records a workout with GPS, we store the route of that workout so we can show it on a map in your workout overview. Before the route is stored, the first and last 200 metres are removed, so the place where you start and finish (often your home) is not kept.
Map display: To draw the map behind a route we use map services: Mapbox (Mapbox, Inc., USA) for the small route previews on your workout cards, and Google Maps (Google Ireland Limited / Google LLC) for the full map on a workout's page. Your route itself is never sent to these services: we draw it on top of the map in your browser or app. To deliver the map image, the map service receives the area of the map being shown (its centre and zoom level) together with the technical data every web request carries, such as your IP address and browser or device information.
Exercise animations: For strength workouts, the exercise list shows a short animation of each exercise, loaded from ExerciseDB (AscendAPI). Which animation is shown is decided on our servers; ExerciseDB only receives the request for that animation file together with the technical data every web request carries, such as your IP address and browser or device information. No workout data, sets or weights are sent.
Legal basis: Storing and showing your workouts, including their routes, is part of the service you use (Art. 6(1)(b) GDPR) and, as health and fitness data, is based on your explicit consent given when you connect the wearable or app (Art. 9(2)(a) GDPR). Loading the map from a map service and exercise animations from ExerciseDB is based on our legitimate interest in showing your workouts in a clear, visual way (Art. 6(1)(f) GDPR).
Retention: Routes are kept as long as the workout they belong to. They are deleted when you delete the workout, disconnect the wearable or app it came from, or delete your account.
3. Recipients of personal data
We only disclose your data to trusted third-party service providers (processors) when necessary for providing our services, when legally compelled to do so, or when based on your explicit consent.
Categories of recipients:
- Hosting and database providers: Vercel, Inc. (USA); Supabase, Inc. (USA)
- AI service providers: Anthropic, PBC (USA)
- Payment providers: Stripe, Inc. (USA) and its European affiliates; Shopify Payments
- Wearable and Apple Health data processors: Terra API Inc. (USA)
- Map providers (map area and request data only, never your route): Mapbox, Inc. (USA); Google Ireland Limited / Google LLC (Google Maps Platform)
- Analytics service providers (with consent): PostHog, Inc., Google Analytics, Sentry, Vercel Analytics, Facebook Ads Manager, TikTok Ads Manager
- Legal authorities: Only if legally required
4. International data transfers
We ensure equivalent data protection outside the EU/EEA by:
- Using Standard Contractual Clauses (SCCs)
- Conducting Transfer Impact Assessments (TIAs)
- Implementing supplementary measures
5. Data retention periods
- Registration data: Deleted from production systems within 30 days after account deletion; backups retained up to 90 days.
- Health and fitness data: Deleted with account deletion.
- Server log files: Retained for 14 days.
- Data for legal obligations: Retained up to 10 years.
6. Your rights as a data subject
You have the right to:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object (Art. 21 GDPR)
- Withdraw consent (Art. 7(3) GDPR)
- Lodge a complaint with: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
7. Data Security
We implement encryption (TLS 1.2+, AES-256), strict access controls, secure development environments, incident response plans, security reviews, and staff training.
8. Changes to this Privacy Notice
We may amend this notice. Significant changes will be communicated, and renewed consent will be sought where necessary.