GDPR Compliance

1. Introduction to GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It applies to all companies processing personal data of individuals in the European Union, regardless of where the company is located.

At NuroStride, we are committed to protecting your privacy and ensuring full compliance with GDPR requirements. This page explains how we handle your personal data in accordance with GDPR principles and your rights as a data subject.

2. Our Commitment to Data Protection

NuroStride is committed to the highest standards of data protection. Our commitment includes:

2.1 GDPR Compliance Measures

• Regular privacy impact assessments
• Data protection officer appointment
• Staff training on data protection principles
• Vendor due diligence and data processing agreements
• Incident response and breach notification procedures
• Regular compliance audits and reviews

3. Legal Basis for Processing

Under GDPR, we must have a valid legal basis for processing your personal data. Here are the legal bases we rely on:

3.1 Legitimate Interests Assessment

When we rely on legitimate interests, we conduct a balancing test to ensure our interests don't override your fundamental rights and freedoms. Our legitimate interests include:

• Providing and improving our services
• Ensuring security and preventing fraud
• Direct marketing to existing customers
• Network and information security
• Understanding customer behavior and preferences

4. Your Data Protection Rights

Under GDPR, you have the following rights regarding your personal data:

4.1 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4.2 Limitations on Rights

These rights are not absolute and may be limited in certain circumstances, such as:

• When processing is necessary for compliance with legal obligations
• For the establishment, exercise, or defense of legal claims
• To protect the rights and freedoms of others
• For reasons of public interest or scientific research

5. Personal Data We Process

We process various categories of personal data depending on your use of our services:

5.1 Special Categories of Data

Fitness and health data are considered "special categories" of personal data under GDPR, requiring additional protection. We process this data based on:

• Your explicit consent
• Necessity for health or social care purposes
• Public interest in public health

6. Sources of Personal Data

We collect personal data from various sources:

6.1 Direct Collection

• Information you provide during account registration
• Data you enter when using our services
• Communications with customer support
• Survey responses and feedback
• Marketing communication interactions

6.2 Automated Collection

• Website and app usage through cookies and analytics
• Device and browser information
• Location data (with your consent)
• Performance and error logs

6.3 Third-Party Sources

• Strava: Running activities and profile data (with your authorization)
• Social Media: Public profile information when you connect accounts
• Payment Providers: Transaction and billing information
• Marketing Partners: Lead generation and campaign data

7. When We Share Your Data

We may share your personal data in the following circumstances:

7.1 Service Providers

We share data with trusted service providers who process data on our behalf:

• Cloud hosting and infrastructure (AWS, Google Cloud)
• Payment processing (Stripe, PayPal)
• Email services (SendGrid, Mailgun)
• Analytics providers (Google Analytics, Mixpanel)
• Customer support tools (Zendesk, Intercom)

All service providers are bound by data processing agreements that ensure GDPR compliance.

7.2 Legal Requirements

We may disclose data when required by law or to:

• Comply with legal processes
• Respond to government requests
• Protect our rights and property
• Ensure user safety
• Investigate fraud or security issues

7.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity, subject to the same privacy protections.

7.4 With Your Consent

We may share data with third parties when you explicitly consent to such sharing.

8. Data Retention Periods

We retain personal data for different periods depending on the purpose and legal requirements:

8.1 Anonymization

Where possible, we anonymize personal data after the initial retention period to use it for statistical and research purposes without compromising your privacy.

9. International Data Transfers

NuroStride operates globally, and your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States.

9.1 Safeguards for International Transfers

We ensure adequate protection for international data transfers through:

• Standard Contractual Clauses (SCCs): European Commission-approved contracts
• Adequacy Decisions: Transfers to countries deemed adequate by the EU
• Binding Corporate Rules: Internal data transfer rules for multinational companies
• Certification Schemes: Industry-recognized privacy certifications

9.2 Transfer Impact Assessments

We conduct Transfer Impact Assessments to evaluate the level of protection in destination countries and implement additional safeguards where necessary.

10. How to Exercise Your Rights

You can exercise your GDPR rights through multiple channels:

10.1 Response Timeframes

• Standard Requests: Within 30 days
• Complex Requests: Up to 90 days (with notification)
• Identity Verification: May require additional time
• Urgent Requests: Expedited processing when possible

10.2 Verification Process

To protect your privacy, we may need to verify your identity before processing certain requests. This may involve:

• Confirming account details
• Answering security questions
• Providing additional identification documents

11. Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee our GDPR compliance and serve as a point of contact for data protection matters.

Contact our DPO:

• Email: dpo@nurostride.com
• Subject Line: Include "DPO Inquiry" or "GDPR Request"
• Response Time: Within 5 business days

12. Supervisory Authority

If you are not satisfied with how we handle your personal data or privacy concerns, you have the right to lodge a complaint with a supervisory authority.

12.1 EU Supervisory Authorities

You can contact the supervisory authority in your EU member state. For a list of authorities, visit: European Data Protection Board

12.2 Lead Supervisory Authority

As we serve customers across the EU, our lead supervisory authority is determined based on our main establishment in the EU or the location where most of our EU processing activities take place.

12.3 Before Filing a Complaint

We encourage you to contact us first to resolve any concerns. However, you have the right to lodge a complaint at any time without first contacting us.

13. Children's Data Protection

We are committed to protecting the privacy of children under the age of 16 (or lower age in some EU member states).

13.1 Consent Requirements

• Children under 16 need parental consent for data processing
• We verify parental consent through appropriate methods
• Parents can withdraw consent at any time
• We take reasonable efforts to verify the child's age

13.2 Parental Rights

Parents or guardians have the right to:

• Access their child's personal data
• Request rectification or erasure
• Withdraw consent for data processing
• Object to certain processing activities

13.3 Special Protections

• Enhanced privacy notices for children
• Stricter data minimization practices
• Additional security measures
• Limited data sharing with third parties

14. Automated Decision Making

We use automated processing to provide personalized running insights and recommendations. Here's what you need to know:

14.1 Types of Automated Processing

• Training Recommendations: AI algorithms suggest optimal training plans
• Injury Risk Assessment: Analysis of patterns that may indicate injury risk
• Performance Predictions: Forecasting future performance based on current data
• Content Personalization: Customizing content based on your interests

14.2 Your Rights Regarding Automated Processing

You have the right to:

• Not be subject to decisions based solely on automated processing that produce legal or significant effects
• Request human intervention in the decision-making process
• Express your point of view regarding automated decisions
• Contest automated decisions and request manual review

14.3 Safeguards

• Regular algorithm auditing for bias and accuracy
• Human oversight of significant automated decisions
• Clear explanations of automated decision logic
• Ability to opt out of certain automated processing

15. Data Breach Procedures

We have comprehensive procedures in place to detect, assess, and respond to personal data breaches.

15.1 Breach Response Process

1. Detection and Assessment: Immediate identification and risk assessment
2. Containment: Steps to prevent further data compromise
3. Investigation: Thorough analysis of the breach cause and scope
4. Notification: Reporting to authorities and affected individuals as required
5. Remediation: Measures to prevent similar incidents

15.2 Notification Requirements

• Supervisory Authority: Within 72 hours of becoming aware
• Data Subjects: Without undue delay if high risk to rights and freedoms
• Partners: Notification to relevant business partners and vendors

15.3 Information Provided

Breach notifications include:

• Nature and scope of the breach
• Categories and number of data subjects affected
• Likely consequences of the breach
• Measures taken to address the breach
• Steps you can take to protect yourself

16. Contact Information

For GDPR-related questions, requests, or concerns, please contact us:

16.1 Request Information

When contacting us about GDPR matters, please include:

• Your full name and email address associated with your account
• Clear description of your request or concern
• Any relevant account or reference numbers
• Preferred communication method for our response