Privacy statement

Information on data protection in accordance with Art. 13 GDPR

With the following information, we would like to present transparently how we process your personal data when you participate in the research project “SmArt-E” and in doing so use the “HealthTrain” mobile app, which legal bases and retention periods exist and to whom we may forward data. We would also like to inform you explicitly about your rights according to the EU-GDPR (General Data Protection Regulation).

Data controller and information on the data protection officer

Hochschule für Gesundheit
Der Kanzler
Gesundheitscampus 6-8
D-44801 Bochum

T +49 (0)234 77727-0

If you have any questions about data protection or your rights listed below, please contact our data protection officer at:

T +49 (0)234 77727-140

Purposes and legal basis of data processing

Your personal data will be processed for the following stated purposes based on the stated legal bases:

  • Registration and use of the HealthTrain app
  • Participation in the research project "SmArt-E”

The legal bases for data processing are Art. 6 para. 1 lit. a) GDPR, Art. 9 para. 2 lit. a) GDPR.

Please note the following:

To use the app, you have to provide some personal data for registration to create an account on the HealthTrain app. HealthTrain II B.V. processes this personal data only for the purpose of creating a personal account.

For more details, please consider the HealthTrain App Terms of Use.

Types of personal data

Registration and use of the app

Account registration in the app:

  • Mobile phone number (used for account verification).
  • First name and surname
  • Date of birth (used to associate a user account with a participant invitation)
  • Email address (used for account recovery)

Data from crash reports used to analyze, improve, and maintain the app:

  • IP address
  • Device type
  • Operating system version
  • HealthTrain app version

Participation in the research project "SmArt-E":

When participating in the research project, health-related data is also collected, which qualifies as special personal data according to Art. 9 GDPR.

  • General: name, age, email address: can be used for communication with services, e.g., onboarding steps for therapists, appointment reminders for participants or data security notifications.
  • selected and used training and education programs, app usage time, date and duration of video calls and frequency of text messages.
  • Information module: modules viewed with date, answers regarding the questions for reflection
  • Exercise module: Selected exercises including parameters, exercise program performed with date and changes made, evaluation of individual exercises and weekly program.
  • Physical activity module: selected physical activity, mode of activity increase, values of baseline and final assessment (activity minutes), training days.

Data processing and transfer of data to third parties when using the app

HS Gesundheit collects your personal data through deployment of the HealthTrain app for the purposes stated above (participation in the research project SmArt-E).

The app developer is Health Train II B.V., Grebbeberglaan 15, 3527 VX, Utrecht, The Netherlands.

HealthTrain II B.V. operates exclusively within the framework of a data processing agreement with HS Gesundheit. The control and responsibility for data processing lies with HS Gesundheit. HealthTrain qualifies as a processor and does not collect the personal data for this specific purpose without a written instruction of HS Gesundheit.

Your personal data will be transferred by HealthTrain II B.V. to the trust center of the Competence Centre for Clinical Studies Bremen (Vertrauensstelle des Kompetenzzentrums für Klinische Studien Bremen (KKSB)) at the University of Bremen and will be pseudonymized there.

The address of the Competence Center is: Kompetenzzentrum für Klinische Studien Bremen (KKSB), Fachbereich 03 I Mathematik und Informatik, Linzer Str. 4, D-28359 Bremen, Germany.

Pseudonymization means that your personal data, by which you can be clearly identified as a participant in the SmArt-E research project, is replaced by an identification number. In this way, data can only be traced back to you by the KKSB.

The re-identification key is kept in the KKSB's trust center for the duration of the study.

All data collected will only be used for research purposes and may be passed on in pseudonymized form for scientific evaluation to the University of Bremen (SOCIUM), the Ruhr University Bochum (Department of General Medicine) and the HS Gesundheit Bochum (Department of Applied Health Sciences). The institutions involved do not have the possibility to draw conclusions about concrete persons from these pseudonymized data (de facto anonymization).

Study results will only be published in anonymized form.

Further information on data processing

Your personal data will only be processed within countries of the European Economic Area and will not be forwarded to third countries outside the European Economic Area.

There is no legal or contractual obligation for you as a study participant to provide us with your personal data; this is also not necessary for the conclusion of a contract. Therefore, the processing of your personal data is based on your (explicit) consent.

The personal data collected from you will not be used for an automated decision-making process (including profiling).

Connecting the app with your Google Fit account

You have the option to integrate this app with your Google Fit account. The use of information received from Google Fit APIs will adhere to the Google Fit User Data and Health Research Policy and Google Fit Developer and User Data Policy, including the Limited Use requirements.

Duration of storage

In accordance with the principles of storage limitation, data avoidance, and data economy, we only store your personal data for the duration of the research project until 30.06.2025. If a study extension has to be applied for, it would be necessary that the storage of your data is extended by exactly this period.

The data will be stored in anonymized form at the Competence Center for Clinical Studies Bremen (KKSB) for ten years after completion of the study and then deleted.

Your rights

You have the following rights in relation to your personal data towards the HS Gesundheit under the General Data Protection Regulation (GDPR):

  • the right to withdraw your consent at any time (Art. 7 (3) GDPR)
  • the right to object to processing (Art. 21 GDPR)
  • the right of access by the data subject (Art. 15 GDPR)
  • the right to rectification (Art. 16 GDPR)
  • the right to erasure (Art. 17 GDPR); published data can only be erased to a limited extent
  • the right to restriction of processing (Art. 18 GDPR)
  • the right to data portability in a machine-readable format (Art. 20 GDPR)
  • the right to lodge a complaint with the supervisory authority LDI NRW (Art. 77 GDPR)

Based on the processing of your personal data, you have the following rights:

  • in accordance with Art. 15 GDPR, to request information about your personal data processed by us. In particular, you can request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your data have been or will be disclosed, the envisaged storage period, the existence of a right to request rectification, erasure, restriction of processing or to object to such processing, the right to lodge a complaint, the source of your data if it has not been collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;

  • in accordance with Art. 16 GDPR, to obtain the immediate correction of inaccurate or incomplete personal data stored by us;

  • in accordance with Art. 17 GDPR, to obtain the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

  • in accordance with Art. 18 GDPR, to obtain the restriction of the processing of your personal data, insofar as the accuracy of the data is contested by you, the processing is unlawful, but you object to its erasure and we no longer require the data, but you need it for the assertion, exercise or defence of legal claims, or you have objected to processing pursuant with Art. 21 GDPR;

  • in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, common, and machine-readable format or to request that it be transferred to another controller;

  • in accordance with Art. 7 (3) GDPR, to withdraw your consent at any time. This has the consequence that we may no longer continue the data processing based on this consent in the future. We would like to point out that the withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until its withdrawal;

  • in accordance with Art. 77 GDPR, to informally contact the competent supervisory authority for data protection and lodge a complaint at any time:

    Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information) (LDI)
    Postfach 20 04 44
    D-40102 Düsseldorf

    Telephone switchboard: +49 (0)211 / 38424 - 0


We may amend this statement if certain developments make this necessary, for example in the event that new forms of data processing are going to take place. The most up-to-date privacy statement can be found on We advise you to consult this privacy statement regularly so that you are kept informed of any possible changes.