Privacy policy

Last updated: 11 September 2026

This privacy policy explains how we process personal data when you use the Azume app, the Azume hardware, and our website and online shop at azume.com (together, the "Services"). Protecting your data matters a great deal to us, particularly because Azume processes health data, which enjoys an especially high level of protection.

1. Controller

The controller for data processing within the meaning of the GDPR is:

WatchMePay GmbH (operator of the Azume brand)
Wallfahrerweg 1
82166 Gräfelfing
Germany
Email: service@azume.com

2. Data we process

a) Account and login data

  • Email address
  • Password (stored exclusively as a cryptographic hash)
  • Your name, if you provide it
  • Account settings
  • Messages you send us through the feedback function in the app (name, email address, subject, message)
  • The time and version of the consent you gave (record-keeping obligation under Art. 7(1) GDPR)
  • Your device's push token (a technical identifier that lets us deliver notifications) and your time zone
  • Streak data: the date you last opened the app and the length of your streak

b) Health and fitness data (special category, Art. 9 GDPR)

  • Steps, distance, calories burned
  • Sleep data (sleep stages, sleep duration, periods of wakefulness)
  • Heart rate (HR), resting heart rate and heart rate variability (HRV)
  • Blood oxygen saturation (SpO₂)
  • Training and workout data
  • Breathing exercises you complete (time and duration)
  • Date of birth or age
  • Gender; if you select "diverse", also the metabolic basis you choose (male/female), used to calculate your basal metabolic rate
  • Height
  • Body weight, including your weight history
  • Calculated values such as your Wellness, Recovery and Stress scores and VO₂max
  • Daily values imported from other health apps (see sections 2f and 3.5): sleep duration and sleep stage totals, recovery, resting heart rate, heart rate variability (HRV), blood oxygen and respiratory rate. Respiratory rate currently comes exclusively from imported data; the Azume One does not measure it itself.

We use your date of birth, gender, height and body weight to calculate your basal metabolic rate and to display metrics such as calories burned and your weight history correctly.

c) Device and connection data

  • Bluetooth pairing (BLE), device identifiers, battery level, firmware information, synchronisation times

d) Location data

Only during a workout with GPS recording that you start yourself: precise location (GPS), the distance and speed calculated from it, and the route. Azume does not collect location outside of a workout you have started. Automatically detected workouts and workouts without GPS contain no route. Details on how the recording works and how you control it are in section 3.6.

e) Order and shop data (only when purchasing via azume.com)

  • Name, delivery and billing address
  • Order history
  • Payment data (processed by the payment service provider; we do not store complete payment details)

f) Data from an import from other services

If you use the import function, we process the health data contained in the export file you upload, depending on the source for example sleep duration and sleep stages, recovery, resting heart rate, heart rate variability, blood oxygen and respiratory rate from a tracker you used previously. You decide which file you upload and when. Without an import you start yourself, this processing does not take place.

3. Purposes and legal bases

3.1 Providing the app and your account – We process account and login data in order to provide you with your account and the app's functions. Legal basis: Art. 6(1)(b) GDPR (contract).

3.2 Processing your health data – Azume collects your health data from your device, syncs it to your account, stores it and analyses it in order to show you metrics, trends and scores. The same applies to the health data you enter in your profile yourself. As this is a special category of personal data, we process it exclusively on the basis of your explicit consent. Legal basis: Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR. You give this consent actively in the app (during registration, before any health data is collected). We record the time and version of your consent so that we can demonstrate it. You can withdraw it at any time with effect for the future (see section 8). Withdrawal does not affect the lawfulness of processing carried out up to that point. Without this consent we cannot provide Azume's health features.

3.3 Bluetooth pairing with the hardware – Device and connection data to establish and maintain the connection between the app and your Azume device. Legal basis: Art. 6(1)(b) GDPR.

3.4 Transfer to Apple Health (iOS only) – If you enable the Apple Health integration in the app, Azume writes sleep data, heart rate, heart rate variability (HRV), resting heart rate, blood oxygen saturation (SpO₂), steps, distance and active and resting energy to the Apple Health app on your iPhone.

The transfer only happens if you switch it on explicitly. You grant permission in the app's settings and additionally in the iOS permission dialog, where you can allow or deny each data type individually. The legal basis is your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future by disabling the integration in the app settings or by revoking the permissions in the iOS system settings.

Azume only writes data to Apple Health and does not read any data from it; we have no access to data from other apps. The transferred data remains on your device or in your iCloud and is managed there by Apple. Apple is not our processor in this respect; Apple's privacy terms apply to that processing. If you have enabled iCloud sync for Health, the data is synchronised between your devices in accordance with Apple's terms.

If you switch the integration off in the app settings or delete your account via the app, we remove the data written by Azume from Apple Health again. This requires the app to be installed on your device at that time, as only the app can access Apple Health. Re-enabling the integration does not restore the removed data; only new measurements from the next synchronisation onwards are transferred.

3.5 Importing data from other health apps – The import function lets you bring health data you previously recorded with another provider or another tracker into Azume. The purpose is to preserve your earlier history when switching to Azume. You can upload the export file of another health app when you sign up or later in your profile settings. Azume does not connect to the other provider; you decide which file you upload. Importing is optional and only possible after you have consented to the processing of your health data.

The file you upload is transferred to our servers in the European Union (Ireland) and read there in order to extract the daily values. The original file is deleted immediately after processing and is not stored permanently. The extracted daily values are assigned to your account and shown in the app as imported history. They are not included in the calculation of your Azume scores. If your Azume One has recorded its own values for a day, those take priority; imported values are marked as imported in the app.

The legal basis is your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR), which you give before the import starts. You can withdraw it at any time with effect for the future; the imported data is then deleted. It is likewise deleted if you delete your account. If you would like it removed beforehand without deleting your account, a message to service@azume.com is enough.

3.6 Workouts with GPS recording – When you start an outdoor workout in the app (walking, running, hiking or cycling outdoors) and have granted location access, the app uses your smartphone's GPS during that workout to record distance, speed and route. Recording only runs while the workout is active, including when the screen is locked, until you pause or end the workout. iOS indicates this with the location symbol, Android with a "Workout running" notification. You grant location access through your operating system ("While Using the App") and can revoke it there at any time; workouts are then recorded without GPS.

The route is stored together with the workout on our servers in the EU. By default, the start and end of each route (up to 200 metres each) are removed on your device before it is stored, so that your home address, for example, cannot be identified; very short routes under 50 metres are not stored at all. Using the "Route privacy" switch under Profile → Settings, you can choose to have future routes stored in full. We do not use location data for advertising or tracking and do not share it with third parties.

The legal basis is Art. 6(1)(b) GDPR. The processing is necessary to provide the feature you started.

3.7 Maps – We display a workout's route on a map: on iPhones with Apple Maps (Apple Distribution International Ltd., Ireland), on Android devices with Google Maps (Google Ireland Limited, Ireland). To do this, the app loads map tiles from the respective provider, which for technical reasons receives your IP address and the map area displayed. The route itself is drawn onto the map on your device and is not transmitted to the map provider. Legal basis: Art. 6(1)(b) GDPR.

3.8 Notifications – With your permission, the app sends you notifications, for example when your Azume One's battery is low, when you reach your daily goals, as a weekly recap or in the evening. Most of these are scheduled directly on your device. For reminders triggered by our server, we store your device's push token and your time zone; they are delivered via your operating system's push service, on iPhones via the Apple Push Notification service. You can turn notifications off at any time in your device settings. Legal basis: Art. 6(1)(b) GDPR.

3.9 Sharing and profile picture – Using "Share", you can create an image of a daily, weekly or monthly summary or of a single workout (with its route, if you choose). The image is created on your device and only leaves it if you pass it on yourself via your device's share menu or to another app (e.g. Instagram). We do not transmit any data from our servers to Instagram or other platforms; once shared, the privacy policy of the respective platform applies. The route appears on the image as it is stored, so without its start and end if "Route privacy" is switched on.

A profile picture you select from your photos or take with the camera stays on your device and is not transmitted to us.

3.10 Orders in the shop – Processing of your order, delivery and payment data to perform the contract. Legal bases: Art. 6(1)(b) GDPR (purchase contract) and Art. 6(1)(c) GDPR (retention obligations under tax and commercial law).

3.11 Communication – We use your contact details to answer enquiries and to send you service-related messages. This includes messages you send us through the feedback function in the app. We only send marketing emails with your separate consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

4. Recipients and processors

We use carefully selected service providers that process data on our behalf (processing under Art. 28 GDPR). We do not sell personal data and do not pass on your health data for third-party purposes.

  • Supabase – backend/database: storage of your account and health data and processing of the import files you upload. Supabase also provides the server functions for data import and data export and the storage for export files, likewise in the EU. Our contractual partner is Supabase Pte. Ltd., based in Singapore; the server location is Ireland. A data processing agreement including the EU Standard Contractual Clauses is in place (see section 5).
  • Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) – delivery of push notifications and map display (Apple Maps) on iPhones
  • Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) – map display (Google Maps) on Android devices
  • Shopify – operation of the online shop azume.com: order and customer data
  • Shopify Payments – payment processing in the shop
  • Shopify Email – sending our service and marketing emails
  • Hotjar (Hotjar Ltd., Malta) – analysis of website usage, only with your consent given via the consent banner
  • DHL – shipping your order

For resilience, our hosting provider creates automated backup copies of the database every day. These are stored on servers in Ireland and are automatically overwritten after seven days at the latest. If you delete your account, your data is removed from live operation immediately; it disappears from the backup copies after that period at the latest. Restoration takes place solely in the event of a technical failure and never to restore individual deleted accounts.

5. Transfers to third countries

Your account and health data is stored with Supabase in the West EU region (Ireland) and therefore within the European Union. Our contractual partner is Supabase Pte. Ltd., based in Singapore. For processing operations that may take place outside the EU, we have concluded a data processing agreement with the provider that incorporates the EU Standard Contractual Clauses (Art. 46 GDPR).

With Apple and Google, data may be transferred to their parent companies Apple Inc. and Google LLC in the USA. Both are certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR).

Where other service providers process data outside the EU or the EEA, for example in the USA, we likewise ensure an adequate level of data protection, in particular through EU Standard Contractual Clauses or certification under the EU-US Data Privacy Framework. You can request a copy of these safeguards from us.

6. Retention periods

  • Health and profile data: for as long as your account exists. If you withdraw your consent or delete your account, we delete this data from live operation immediately
  • Workout routes: until you delete the corresponding workout, withdraw your consent to the processing of health data (all workouts and their routes are deleted in that case) or delete your account
  • Data imported from other services: until you withdraw your consent or delete your account; we also remove it earlier on request. The uploaded export file itself is deleted immediately after processing
  • Account data: until you delete your account
  • Streak data: until you delete your account
  • Push token and time zone: until you delete your account
  • Export files: the download link is valid for 30 minutes; the file is deleted automatically shortly afterwards
  • Feedback messages: until you delete your account
  • Device and connection data: for the duration of the pairing and of your account
  • Backup copies: database backups are automatically overwritten after seven days at the latest; deleted data disappears from them after that period at the latest (see section 4)
  • Order and invoice data: in accordance with statutory retention periods, generally up to 10 years

7. Data security

  • Encrypted transmission (TLS/HTTPS)
  • Login via email and password; passwords are stored exclusively as a cryptographic hash and are not visible even to us
  • Access restriction at database level (Row Level Security) for all tables of the application database; every access rule is bound to your user ID, so that you only ever see your own data. Analytical views also run with the permissions of the calling user and do not bypass this restriction
  • Server-side permission checks on all privileged database functions; unauthenticated access has no execution rights whatsoever
  • Separation of identity and health data: no table containing health data holds names or email addresses; the assignment is made exclusively via a pseudonymous identifier (pseudonymisation under Art. 4(5) GDPR)
  • Encryption of the database and the backup copies at rest
  • Administrative access to the database environment exclusively via an account with two-factor authentication; restrictive, need-based access rights within the team

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can also delete your account and all associated data at any time directly in the app under "Delete Account". For anything else, a message to service@azume.com is enough.

Data export: In your profile settings, you can download a copy of all data stored in your account at any time as a ZIP file containing CSV tables (Art. 15 and 20 GDPR). The download link is valid for 30 minutes.

Withdrawing consent: You can withdraw your consent at any time with effect for the future (Art. 7(3)). If you withdraw your consent to the processing of health data (in your profile settings), we immediately delete all stored health data, including imported data, workouts and routes, and the data Azume has written to Apple Health. Your account remains. We keep the record of when you gave and withdrew your consent (Art. 7(1) GDPR).

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

9. Automated analysis

Azume calculates metrics from your health and profile data (Wellness, Recovery and Stress scores, VO₂max and your basal metabolic rate). These are for your information only. No automated decision with legal effect within the meaning of Art. 22 GDPR takes place.

Azume is not a medical device. The values and metrics displayed serve wellness and fitness purposes only and are not intended for the diagnosis, treatment or prevention of disease.

10. Cookies and tracking (website)

Our website azume.com uses necessary cookies to operate the site. We only use non-essential cookies and tracking technologies, in particular usage analysis via Hotjar (Hotjar Ltd., Malta), with your consent. Hotjar records usage data such as the pages you visit, click and scroll behaviour, and browser and device type. You give your consent via our consent banner and can change or withdraw it there at any time.

11. Minors

The Services are intended for people aged 16 and over. We ask for your date of birth when you register; if the age entered is under 16, registration is not possible. We do not knowingly process health data of persons under the age of 16.

12. Changes to this privacy policy

We update this privacy policy when our data processing changes or when legal requirements make this necessary. The current version is always available in the app and at azume.com.

13. Contact

If you have any questions about this privacy policy or your data, you can reach us at: WatchMePay GmbH, Wallfahrerweg 1, 82166 Gräfelfing, Germany, email: service@azume.com