How the Cave Health app collects, uses, stores, shares and protects your personal data, in line with the UAE Personal Data Protection Law.
This Privacy Policy explains how CAVE Technologies (United Arab Emirates) - the data controller, referred to here as "Cave Health", "the App", "we", "us" or "our" - processes your personal data when you use the Cave Health mobile application and related services. It is written to align with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and, where applicable, UAE health-sector rules including Federal Law No. 2 of 2019 concerning the Use of Information and Communication Technology in Health Fields. If you have any questions or wish to exercise your rights, contact us at admin@cave.business (see Section 19). Please read this policy together with any Terms of Use and the medical disclaimer in Section 18.
This policy applies to all users and channels of the Cave Health service, including:
We do not currently operate a separate user website or support portal. If one is introduced, this policy will be updated to cover it.
Depending on how you use the App, we process the following categories of personal data. Health and fitness measurements are treated as sensitive personal data and are given stronger safeguards and consent handling.
When a watch is connected over Bluetooth, the App reads and displays:
With your permission, the App uses your device location to show local context on the dashboard (for example, your city) and to attach a location reference to stored records. The App requests precise (fine) location; on Android this is also required by the operating system to perform Bluetooth scanning.
If you enable "Analytics & Crash Reports", the App may collect anonymous usage and crash information. This setting is off by default and is optional. The current release does not include any analytics or crash-reporting tools, so no such data is collected at this time; if this changes, this policy and the in-app setting will be updated to name the provider.
If you contact us, we process the content of your message and the contact details you provide, to respond and keep support records.
Server-side identifiers (IP address, server logs): these are only generated if optional server synchronisation is enabled. Server sync is not active in the current release (see Section 8).
We process personal data only for specified, legitimate purposes, and not for unrelated purposes without a valid legal basis or fresh consent.
| Purpose | Data used | Legal basis (PDPL) |
|---|---|---|
| Pair, connect and communicate with your watch | Device data, Bluetooth address | Performance of the service / your request |
| Display real-time and historical health, activity and sleep metrics; create daily summaries | Health & fitness data (sensitive) | Your explicit consent |
| Provide reminders, notifications and health-status indicators | Goals, notification preferences, health data | Your consent |
| Manage your account and authenticate sign-in | Email, credentials | Performance of the service |
| Show local context (city) on the dashboard | Location | Your consent |
| Provide technical support | Support communications, device data | Our legitimate interest / your request |
| Detect security incidents and improve reliability | Diagnostics, crash data (if enabled) | Your consent (analytics) / legitimate interest (security) |
| Meet legal obligations | As required | Legal obligation |
Where we rely on consent - in particular for sensitive health data - that consent is obtained in a clear, specific and unambiguous way, is recorded, and can be withdrawn as easily as it was given. Using the App does not, by itself, substitute for the specific consent required to process health data.
Optional activities each have their own separate control, so you can accept or decline them independently:
Withdrawing consent does not affect processing already carried out before withdrawal. To withdraw consent to health-data processing entirely, unpair your watch and/or delete your data (Section 13).
| Permission | Why it is needed | Optional? |
|---|---|---|
| Bluetooth (Scan / Connect / Nearby Devices) | To find, pair with and communicate with your Cave watch. | Required for watch features |
| Location (precise) | Required by Android to perform Bluetooth scanning, and to show local context (city) on the dashboard. | Optional - watch pairing may be limited if denied |
| Camera | To scan your watch's pairing QR code. Used only while the scanner screen is open. | Optional |
| Notifications | To deliver connection status, sleep, workout and reminder notifications. | Optional |
| Storage | Activity snapshot files are written to the App's own private storage; no access to your shared media or other apps' files is required (Section 7). | Not required |
| Foreground service (connected device) | To keep the watch connected and record data while the App is in the background. | Required for background sync |
Background collection: while a watch is connected, a foreground service keeps recording measurements in the background; a persistent notification informs you when this is active. If a permission is denied, the related feature is disabled but the rest of the App continues to work. You can review or revoke any permission at any time in your device settings.
By default, your data is stored on your device:
Uninstalling the App, or using Profile → Delete Account & Data, removes the private database and all app-private snapshot files from your device. Unpairing your watch deletes its stored identity from the App.
Current status: server synchronisation is not active in the production release. All data described above is processed and stored on your device only, and no health data is uploaded to our servers at this time.
International transfers. In the current release no personal data leaves your device, so no international transfer takes place. If, in future, any personal data is transferred to or accessed from outside the UAE, we will rely on a transfer mechanism permitted by the PDPL - an adequate-protection jurisdiction, appropriate contractual safeguards, or your explicit consent - and will identify the relevant countries and safeguards here.
Current status: in the current release the App does not transmit your personal or health data to us or to any third party. The categories below apply only where the corresponding feature is enabled.
We do not sell or rent your personal or health data, do not use it for advertising, and do not share it with insurers or employers.
UAE law places strict requirements on health information generated through health services provided in the UAE. Where Federal Law No. 2 of 2019 applies, health data generally must not be stored, processed or transferred outside the UAE without an authorised decision from the competent health authority; patient information must be kept confidential and may need to be retained for a statutory period.
Cave Health is provided as a consumer wellness and fitness application. It does not provide regulated health or medical services, does not make medical diagnoses, and - in the current release - processes all health data on your device within the UAE, with no transfer of health data outside the country. Should the service later introduce features or integrations that bring it within the scope of Federal Law No. 2 of 2019, we will confirm the applicable licensing, localisation and retention requirements before enabling any overseas hosting.
| Data | Retention |
|---|---|
| Local health & fitness readings and daily summaries | Kept on your device until you delete the data or uninstall the App |
| Activity JSON snapshot files (app-private storage) | 7 days (rolling) for the upload queue; all snapshot files are removed on "Delete Account & Data" or uninstall |
| Smartwatch identifiers / device info | Until you unpair the watch or uninstall the App |
| Location references | Stored with the related record; removed with that record |
| Account information | For the life of your account; deleted within 30 days of an account-deletion request |
| Analytics / crash records | Not collected in the current release |
| Server data & backups | Not applicable - server synchronisation is inactive |
| Support tickets | 24 months from resolution |
Where a fixed period cannot reasonably be stated, we retain data only for as long as necessary for the purpose it was collected, applying the criteria above.
Subject to the PDPL and any applicable health-record rules, you have the right to:
To exercise any right, contact us using the details in Section 19. We may need to verify your identity before acting on a request, and we will respond within the period required by law.
Because server synchronisation is inactive, deletion in the current release removes every copy the App holds. If, in future, server backups or legal-retention obligations apply, we will isolate any data we are required to keep and delete it when the obligation ends.
We apply technical and organisational measures appropriate to the risk, aimed at protecting the confidentiality, integrity, availability and recoverability of your data. In the current (on-device) release these include:
When server synchronisation is introduced, additional controls will apply, including encryption of health data in transit and at rest, role-based and least-privilege access to backend systems, multi-factor authentication for administrators, audit logging, secure backups, vendor assessment, vulnerability testing and secure deletion. No method of storage or transmission is completely secure, but on-device data is kept in the App's private storage, isolated from other apps.
We maintain procedures to identify, investigate and contain personal-data breaches, assess the affected data, and document corrective action. Where a breach meets the legal threshold, we will notify the competent UAE authority, and we will notify affected users where the breach is likely to prejudice the privacy or confidentiality of their personal data.
Because Cave Health may process sensitive health data and produces automated health-status indicators, we regularly assess whether a Data Protection Officer (DPO) is required. As the current release processes health data on-device only, a formal DPO has not been appointed and is not considered mandatory at this stage. Before enabling server synchronisation, large-scale processing, or any new high-risk processing, we will complete a documented data-protection and security impact assessment and re-assess the need for a DPO.
Cave Health is intended for adults and is not directed to anyone under 18. We do not knowingly collect data from children under 18. At sign-up, users confirm they meet the minimum age, and the App does not target or advertise to children. If you believe a child has provided us data, contact us (Section 19) and we will delete it. A parent or guardian may contact us at any time to request deletion of a child's data.
Automated analysis. The App calculates simple health-status indicators (for example labelling a reading as "Normal" or "Elevated") by comparing your measurements against general reference ranges. These indicators are produced by fixed rules - the App does not use AI/profiling, does not make decisions that affect your access to any service, and human review is available on request (Section 12). The indicators have limitations and may not be accurate for your individual circumstances.
Medical disclaimer. Unless the App and device hold the required medical approvals:
Your consent to this Privacy Policy is separate from, and does not amount to, medical consent.
The data controller responsible for your personal data is CAVE Technologies, United Arab Emirates. To exercise your rights, ask a question, or make a complaint about how we handle your data, contact us at:
Email: admin@cave.business
We will acknowledge your request, verify your identity where needed, and respond within the legally required time. If you are not satisfied with our response, you may lodge a complaint with the competent UAE data-protection authority.
We may update this Privacy Policy from time to time. We will change the "Last updated" date and version above and, for material changes, provide an in-app notice. Where a change involves a new use of health data, new sharing, or new overseas transfers, we will seek fresh consent rather than relying on your continued use of the App.