GentleTime is a scheduling and biometric monitoring tool for people with autism, operated by GentleTime (RG-IT). In this policy “GentleTime”, “we”, “us”, and “our” refer to GentleTime (RG-IT).

For questions about this policy or to exercise your rights, contact us at privacy@gentletime.app.

We collect the following categories of personal data:

• Account data — name, email address, organisation name, and authentication credentials for caretakers and administrators.
• Client profile data — display name, date of birth, language preference, avatar colour, and free-text notes about care recipients (clients).
• Schedule data — pictogram-based daily schedules created by caretakers for their clients.
• Biometric data (special category) — heart rate (BPM), heart-rate variability (HRV), motion intensity, and derived stress indicators, collected via a paired Apple Watch or Wear OS watch. This data is only collected after a caretaker has recorded explicit consent in the application.
• Device data — watch pairing identifiers (device ID, platform, push token) used to deliver schedule updates.
• Usage and technical data — server logs, API request metadata, and error traces used to operate and improve the service.

We process personal data on the following legal bases under the GDPR:

• Contract (Art. 6(1)(b)) — processing necessary to provide the scheduling service to caretakers who have agreed to our Terms of Service.
• Explicit consent (Art. 9(2)(a)) — biometric and health data is special-category data under Art. 9. We process it only after a caretaker records that they hold explicit written consent from the person — or from their parent, guardian, or legal representative where the person cannot consent themselves. The caretaker is the data controller for that consent; GentleTime acts as a data processor.
• Legitimate interests (Art. 6(1)(f)) — security monitoring, fraud prevention, and service improvement, where these interests are not overridden by the data subject's rights.

• Providing and personalising the scheduling service.
• Delivering schedule updates and transition alerts to paired watches.
• Calculating and displaying stress indicators and biometric baselines to authorised caretakers.
• Billing and subscription management.
• Responding to support requests.
• Improving the service through aggregated, anonymised analytics.

We do not sell personal data. We share data only with the following sub-processors who are contractually bound to process data only on our instructions:

• Google Cloud Platform — cloud infrastructure, hosting, and logging (EU region).
• MongoDB Atlas — database storage (EU region).
• Stripe — payment processing (for billing data only; no biometric data is shared).
• Anthropic — AI processing for the optional “AI stress insights” feature (United States). Only a de-identified, pseudonymised summary is sent — aggregated stress patterns and activity labels, with no name, client identifier, or raw readings. This feature is off by default and runs only after a caretaker gives separate, explicit consent per client. Data is transferred outside the EU under Standard Contractual Clauses.

We may disclose data if required by law or to protect rights, property, or safety.

We retain personal data for as long as your account is active. Biometric readings are retained for up to 14 rolling days for baseline calculations. AI-generated stress insights, which contain only de-identified summaries, are retained for up to 90 days. Caretakers may delete all biometric data for a specific client at any time from the client settings page.

Upon account closure, we delete personal data within 30 days, except where longer retention is required by law.

Under the GDPR you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data (“right to be forgotten”). Biometric data for individual clients can be deleted directly from the application.
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw biometric consent at any time by disabling the toggle in client settings. Withdrawal does not affect the lawfulness of prior processing.

To exercise any right, contact us at privacy@gentletime.app. We will respond within 30 days.

GentleTime collects biometric data on behalf of caretakers (data controllers). The person being monitored may be a child, a sibling, or another family member — not necessarily an adult who can self-consent. Before enabling biometric monitoring, the caretaker must:

• Obtain explicit, documented consent from the person — or, if they are a child, have a cognitive disability, or cannot consent themselves, from their parent, guardian, or legal representative.
• Inform the person and/or their representative in clear, accessible language about what data is collected and why.
• Maintain a record of that consent and make it available on request.

The caretaker is solely responsible for the lawfulness of the consent they record. GentleTime provides the technical means to record and revoke consent but does not verify its adequacy.

We use industry-standard measures including TLS encryption in transit, encrypted storage at rest, and access controls. All infrastructure runs within the European Union. Despite these measures, no system is completely secure; we will notify affected users of any data breach as required by law.

GentleTime is intended for use by caretakers. Care recipients may be minors. Biometric data for minors or persons who cannot self-consent requires consent from a parent, guardian, or legal representative, which the caretaker is responsible for obtaining and documenting.

We may update this policy as the service evolves. We will notify registered users by email at least 14 days before material changes take effect. Continued use of the service after the effective date constitutes acceptance of the revised policy.

For privacy enquiries: privacy@gentletime.app.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with your national data protection authority (in the Netherlands: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl).