.svg){kind=logo}
Last updated: 8 August 2026 Effective date: 22 August 2026 Supersedes: v2026.04.23
This Privacy Policy explains how Eforto BV and Eforto Health Inc. ("Eforto", "we", "us", "our") collect, use, disclose, and protect personal data when you visit our websites, use the Eforto Connect mobile application, interact with the Eforto Metrics platform, purchase or use an Eforto Device (the R1 general wellness device or the M1 medical-device ecosystem), or otherwise engage with us (collectively, the "Services"). "Services" has the same meaning as in the Eforto Terms of Service.
| Role | Entity | Address | Registration | Contact |
|---|---|---|---|---|
| Controller for the European Economic Area, the United Kingdom, and Switzerland | Eforto BV | 's Herenweg 16, 1860 Meise, Vlaams-Brabant, Belgium | Crossroads Bank for Enterprises BE 1030.787.326 | compliance@eforto.com |
| Controller for the United States. Business Associate under HIPAA where acting for a Covered Entity | Eforto Health Inc. | 530 7th Avenue, Suite 902, New York, NY 10018, United States | EIN 33-1384803 | compliance@eforto.com |
| Data Protection Officer | Tom Massaer | c/o Eforto BV, 's Herenweg 16, 1860 Meise, Belgium | dpo@eforto.com |
dpo@eforto.com is a monitored functional mailbox. The Data Protection Officer's contact details have been notified to the Belgian Data Protection Authority in accordance with Article 37(7) GDPR.
Eforto BV is the controller for personal data processed for its own purposes in connection with the Services in the European Economic Area, the United Kingdom, and Switzerland. This covers account administration, direct sales, marketing, website analytics, and support.
Eforto Health Inc. is a separate controller for personal data processed for its own purposes in connection with the Services in the United States. It is not a joint controller with Eforto BV in respect of those activities, except as stated in Section 1.3.
We act as a processor, and the customer is the controller, when we provide the Services to a healthcare institution, research institution, contract research organisation, or life-science company for that organisation's own purposes. That processing is governed by the Eforto Data Processing Agreement and, where HIPAA applies, by the Eforto Business Associate Agreement. In that role we do not decide why or how your data is used. Your rights are exercised in the first instance against that organisation, and we will assist it in responding.
We act as a Business Associate under HIPAA where we handle Protected Health Information on behalf of a Covered Entity or of another Business Associate.
For the following processing activities only, Eforto BV and Eforto Health Inc. jointly determine the purposes and the means of processing and act as joint controllers within the meaning of Article 26 GDPR:
The essence of the arrangement is as follows. Eforto BV is responsible for providing the information required by Articles 13 and 14 GDPR and acts as the single point of contact for data subjects. Eforto BV is responsible in the first instance for responding to requests under Articles 15 to 22 GDPR, and Eforto Health Inc. provides the assistance necessary for a timely response. Each party is responsible for the security of the processing that it performs and for maintaining its own record of processing activities under Article 30 GDPR. Each party notifies the other without undue delay of any personal-data breach affecting jointly controlled processing. Transfers between the two entities are governed by the intra-group data-transfer instrument described in Section 6.
Irrespective of this allocation, you may exercise your rights under the GDPR against each of the joint controllers. The full text of the arrangement is available on request at dpo@eforto.com.
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password hash, language preference, professional role | You |
| Profile and demographics | Year of birth, sex, height, dominant hand | You |
| Health and wellness metrics. Special category data under Article 9 GDPR. Sensitive personal information under Cal. Civ. Code § 1798.140(ae) | Grip-strength raw values, muscle-fatigability values, self-perceived fatigue responses, derived reference-range comparisons | Device sensors and questionnaires |
| Device and log data | Device serial number, firmware version, application version, IP address, crash logs, diagnostic logs | Device and application |
| Advertising identifiers | Mobile advertising identifier, cookie identifiers used for marketing pixels. Collected only where you have given consent. See Section 8 | Application and website, on consent |
| Payment and shipping | Billing and delivery address, last four digits of the payment card, VAT or tax identification number | Checkout provider |
| Support records | Emails, call notes, screenshots you provide | You |
| Clinical study data (M1 and R1 in research use) | Investigator site, study code, pseudonymised outcome measures | Investigator, study sponsor, device |
| Post-market surveillance data | Adverse-event reports, device complaints, performance-trend data. Processed under 21 CFR Parts 803 and 806 for the M1 in the United States, and under Articles 83 to 86 of Regulation (EU) 2017/745 for any device that Eforto places on the European Union market as a CE-marked medical device | Clinicians, patients, device |
No diagnosis. The R1 Services and the M1 platform supply objective measurements. We do not interpret results to diagnose, screen for, predict, treat, cure, or prevent any disease or condition. Clinical interpretation of M1 outputs remains solely with the qualified healthcare professional.
| Purpose | Legal basis (Art. 6 GDPR) | Special-category basis (Art. 9 GDPR) | United States equivalent |
|---|---|---|---|
| Account registration and authentication | Contract, Art. 6(1)(b) | Not applicable | Not applicable |
| Providing measurements and dashboards | Contract, Art. 6(1)(b) | Explicit consent, Art. 9(2)(a), for the R1. Provision of health or social care, Art. 9(2)(h), for the M1 where processing is carried out under the responsibility of a health professional | HIPAA treatment and healthcare-operations, or business-associate processing |
| Product improvement and quality analytics on pseudonymised data | Legitimate interests, Art. 6(1)(f) | Scientific research, Art. 9(2)(j), with Article 89 safeguards including pseudonymisation and access controls | De-identification under 45 CFR § 164.514(b) |
| Marketing to business contacts and newsletters | Consent, Art. 6(1)(a), or legitimate interests in respect of existing customers and similar products, Art. 6(1)(f) and Art. XII.13 of the Belgian Code of Economic Law | Not applicable. No health data is used in marketing | CAN-SPAM |
| Device vigilance, post-market surveillance, and recall | Legal obligation, Art. 6(1)(c) | Public interest in public health, Art. 9(2)(i) | 21 CFR Parts 803, 806, and 820 |
| Payment processing and fraud prevention | Contract, Art. 6(1)(b), and legitimate interests, Art. 6(1)(f) | Not applicable | Applicable state and federal law |
| Age assurance on account creation | Legitimate interests in restricting the Services to adults, Art. 6(1)(f) | Not applicable | Applicable state law. COPPA is addressed in Section 10 |
| Establishing, exercising, or defending legal claims | Legitimate interests, Art. 6(1)(f) | Art. 9(2)(f) | Applicable state and federal law |
Where we rely on legitimate interests, we balance those interests against your rights and freedoms and record that balancing test. You may object at any time under Article 21 GDPR. Where we rely on consent, you may withdraw it at any time under Article 7(3) GDPR, without affecting the lawfulness of processing carried out before withdrawal.
| Data set | Default retention | Rationale |
|---|---|---|
| Account and identity data | For the life of the account, then 24 months | Warranty administration, dispute defence, and re-activation. Account metadata is kept longer than health metrics because it is needed to evidence who agreed to what, and when, and to administer warranty and recall obligations |
| Health and wellness metrics | Under your control for the life of the account. Raw identifiable metrics are deleted within 30 days of account closure | Data minimisation and user autonomy |
| Pseudonymised research aggregates | Retained after account closure | Research continuity under Art. 9(2)(j) and Art. 89 GDPR. These aggregates do not identify you |
| Regulatory vigilance and post-market records | 10 years after the last unit is placed on the market | For any device that is CE-marked and placed on the European Union market, Article 10(8) of Regulation (EU) 2017/745, being 10 years for non-implantable devices and 15 years for implantable devices. For the M1 in the United States, 21 CFR Part 820.180 requires retention for 2 years after release for distribution or the expected life of the device, whichever is longer. Eforto applies the longer period as a matter of policy |
| Clinical investigation data | Up to 25 years after the end of the study, or such longer period as the protocol, the sponsor agreement, or national law requires | Regulatory, sponsor, and good clinical practice obligations under ICH-GCP E6(R3). Where an investigation is conducted under Articles 62 to 82 of Regulation (EU) 2017/745, Annex XV Chapter III requires the sponsor to retain documentation for at least 10 years after the end of the investigation, or 15 years for implantable devices |
| HIPAA documentation | 6 years | 45 CFR § 164.530(j) |
| Payment records and invoices | 7 years | Article III.86 of the Belgian Code of Economic Law, and applicable United States tax law |
| Support tickets | 3 years | Defence of legal claims |
| Marketing and newsletter data | Until consent is withdrawn, then 6 months | Evidence of consent under Art. 7(1) GDPR |
| Website analytics and cookies | 13 months for Matomo. Session-only for strictly necessary cookies | Belgian Data Protection Authority cookie guidance, and data minimisation |
Back-ups are overwritten on a six-month rolling cycle. Data in a back-up is not actively accessed or processed, and follows the retention schedule once the rolling cycle completes.
| Recipient | Role | Location | Safeguard |
|---|---|---|---|
| UniWeb BV, 's Herenweg 16, 1860 Meise, Belgium | Sub-processor. Provides hosting, software development, infrastructure, and information-security services. UniWeb BV is also the legal manufacturer of the Devices and holds the quality-management system. It is the parent company of Eforto BV and an affiliate of Eforto Health Inc. under common ultimate ownership | Belgium | Art. 28 GDPR data-processing terms. HIPAA subcontractor agreement where Protected Health Information is involved |
| Interxion Belgium (Digital Realty), Brussels | Data-centre and colocation provider. Hosts the Eforto Metrics platform | Belgium | Art. 28 GDPR data-processing terms. No access to plaintext data |
| Stripe | Payment processing. We never store full card numbers | Ireland and United States | Art. 28 GDPR terms. Standard Contractual Clauses for the United States leg |
| Matomo (self-hosted) | Website analytics | Belgium | Self-hosted. No transfer to a third party. Google Analytics is not used in the EU or UK build |
| HubSpot | Customer-relationship management and business-contact communications | European Union, Frankfurt data residency | Art. 28 GDPR terms. Standard Contractual Clauses where data touches United States servers |
| Google Workspace (Google Ireland Ltd) | Email, documents, and collaboration | European Union, with possible United States access | Art. 28 GDPR terms. Standard Contractual Clauses |
| Healthcare providers and study sponsors | Independent controllers or controllers for whom we act as processor | Varies | HIPAA Business Associate Agreement or GDPR Data Processing Agreement |
| Regulators, including the U.S. Food and Drug Administration, the Belgian Federal Agency for Medicines and Health Products, and competent EU authorities | Recipients under a legal obligation | Varies | Disclosed only where required by law |
| Professional advisers, auditors, and insurers | Recipients | European Union and United States | Confidentiality obligations |
| Buyers or investors in a corporate reorganisation | Recipients | Varies | Confidentiality, data minimisation, and Section 11 notice |
The current sub-processor register is published at https://compliance.eforto.com/sub-processor-register and is consistent with Annex 3 of the Eforto Data Processing Agreement. We notify contracted customers of intended changes to sub-processors in accordance with that Agreement.
We do not sell your personal information for monetary consideration.
Where you opt in to marketing pixels, we share personal information for cross-context behavioural advertising within the meaning of Cal. Civ. Code § 1798.140(ah). You may opt out at any time using the "Do Not Sell or Share My Personal Information" link, by adjusting your cookie preferences, or by transmitting a Global Privacy Control signal, which we honour.
We do not use or disclose sensitive personal information, including your health and wellness metrics, for cross-context behavioural advertising, for profiling, or for any purpose other than those permitted by Cal. Civ. Code § 1798.121(a) and the implementing regulations.
We do not sell or share the personal information of any person we know to be under sixteen (16) years of age.
Where we support a clinical study, research project, or marketing campaign for a hospital, university, life-science company, contract research organisation, or wellness brand (a "Project Sponsor"), the following applies. All clinical investigations are conducted under Ethics Committee or Institutional Review Board approval, and, as applicable, under Regulation (EU) 536/2014, Articles 62 to 82 of Regulation (EU) 2017/745, ICH-GCP E6(R3), 45 CFR Part 46 (the Common Rule), and 21 CFR Parts 11, 50, 56, and 812.
All Eforto Metrics production data is hosted in Belgium, in an Interxion data centre operated as described in Section 5.1. Eforto operates no secondary data centre outside the European Economic Area. Personal data of users in the European Economic Area, the United Kingdom, and Switzerland is not transferred outside the European Economic Area for hosting purposes.
A limited number of transfers to the United States nonetheless occur:
Each of those transfers is a restricted transfer under Chapter V GDPR and is carried out under the following mechanisms, supported by a documented Transfer Impact Assessment:
EU-U.S. Data Privacy Framework: not currently relied upon. Eforto Health Inc. is not certified under the EU-U.S. Data Privacy Framework and does not rely on it as a transfer mechanism. Should Eforto Health Inc. obtain certification, and once that certification is published on dataprivacyframework.gov, this Policy will be updated. Binding Corporate Rules may be pursued in future, subject to approval by the lead supervisory authority.
This Section applies to rights under the GDPR, the UK GDPR, the Swiss FADP, the California CCPA as amended by the CPRA, the Virginia CDPA, the Colorado CPA, the Connecticut CTDPA, the Utah UCPA, the Texas TDPSA, the Oregon OCPA, and other United States state privacy laws as they take effect.
| Right | EU, UK, Switzerland | California | Other United States states | How to exercise |
|---|---|---|---|---|
| Access and copy | Yes | Yes | Yes | Privacy Dashboard in the application, or compliance@eforto.com |
| Rectification | Yes | Yes | Yes | In-app profile, or email |
| Erasure or deletion | Yes | Yes | Yes | "Delete account" in the application, or email |
| Restriction of processing (Art. 18 GDPR) | Yes | No | No | dpo@eforto.com |
| Withdraw consent (Art. 7(3) GDPR) | Yes | Not applicable | Not applicable | In-app toggle, or email |
| Data portability | Yes | Yes | Yes | CSV export in the dashboard |
| Opt out of sale or sharing | Not applicable | Yes | Yes | "Do Not Sell or Share" link. We honour Global Privacy Control signals |
| Limit use of sensitive personal information (Cal. Civ. Code § 1798.121) | Not applicable | Yes | Varies | "Limit Use" link in the cookie banner |
| Opt out of profiling and targeted advertising | Art. 21 and Art. 22 GDPR | Yes | Yes | dpo@eforto.com, or the cookie banner |
| Non-discrimination | Not applicable | Yes | Yes | Automatic |
| Appeal a denied request | Not applicable | Not applicable | Yes | appeals@eforto.com |
| Human review of an automated decision (Art. 22 GDPR) | Yes | Varies | Varies | dpo@eforto.com |
Response times. We respond without undue delay and in any event within one month of receiving your request, as required by Article 12(3) GDPR. Where a request is complex, or where you have made a number of requests, we may extend that period by up to two further months, and we will tell you about the extension and the reasons for it within one month of receiving your request. For residents of California, Virginia, Colorado, Connecticut, Utah, Texas, and Oregon, we respond within 45 days, extendable once by a further 45 days where reasonably necessary, with notice to you.
Verification. We verify the identity of a requester proportionately to the sensitivity of the data concerned. An authorised agent may submit a request with written authorisation.
Automated decision-making. Eforto does not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing. Measurement outputs are interpreted by you or by your healthcare professional.
Complaints. If you are not satisfied with our response, you may lodge a complaint with your supervisory authority. In Belgium, that is the Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be. In the United Kingdom, the Information Commissioner's Office. Where we act as a processor for a healthcare or research organisation, please raise the matter with that organisation in the first instance.
We use:
Rejecting non-essential cookies is as easy as accepting them. There are no pre-ticked boxes. Consent is refreshed at least annually. We honour Global Privacy Control signals, and we treat a Do Not Track signal as an opt-out of non-essential tracking.
10.1 The Services are for adults. The Services are intended for persons aged eighteen (18) years and over. We do not knowingly permit a person under eighteen to create an account. Our public account-creation, webshop, and application interfaces are restricted to adults, and we therefore operate no parental-consent flow on those interfaces.
10.2 If a minor creates an account. If you believe that a person under eighteen has created an account, please tell us at compliance@eforto.com. We will delete the account and the associated personal data promptly on verification.
10.3 Paediatric research. Measurements may be collected from participants under eighteen in a clinical investigation or research study conducted by a Project Sponsor under a Clinical Investigation Agreement or a Research Data License and Collaboration Agreement with Eforto. In that case:
10.4 United States. The Services are not directed to children under thirteen (13). We do not knowingly collect personal information from a child under thirteen. Should we become aware that we have inadvertently done so, we will delete that information as soon as reasonably practicable, consistent with the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501 to 6506, and 16 CFR Part 312.
10.5 European Union digital age of consent. Where the Services are extended in future to persons below eighteen outside a research context, processing based on consent will require the consent of a holder of parental responsibility where the person is below the applicable digital age of consent under Article 8 GDPR, which is thirteen years in Belgium under Article 7 of the Belgian Data Protection Act of 30 July 2018. No such extension is currently in place.
We publish changes on this page. For a material change we notify you by email or in-app alert at least fourteen (14) days before it takes effect. Non-material changes, including typographical corrections and contact-detail updates, take effect on publication. The "Last updated" date at the top of this Policy shows when it was last revised. Previous versions are available on request at compliance@eforto.com.
Eforto BV (European Union) 's Herenweg 16, 1860 Meise, Vlaams-Brabant, Belgium Crossroads Bank for Enterprises: BE 1030.787.326 Email: compliance@eforto.com
Eforto Health Inc. (United States) 530 7th Avenue, Suite 902, New York, NY 10018, United States EIN: 33-1384803 Email: compliance@eforto.com
Data Protection Officer Tom Massaer, c/o Eforto BV, 's Herenweg 16, 1860 Meise, Belgium Email: dpo@eforto.com
Belgian supervisory authority Gegevensbeschermingsautoriteit / Autorité de protection des données Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, Belgium www.gegevensbeschermingsautoriteit.be