Privacy Policy Steady Hands App

Effective date: 15 September 2026 | Version 1.10

1. Who does this policy apply to?

This policy explains how UAB VILIMED (“we”, “us” or “our”) handles personal information through Steady Hands and associated device, processing, reporting, sharing and support services. Personal information identifies you or can be linked to you.

We are the controller for services we provide directly to you. A healthcare provider receiving information you choose to share has its own responsibilities. Where we process information solely on a provider’s instructions, the provider is the controller and we act as its processor; its notice applies to that processing. Contact us or the provider about the applicable arrangement. This policy covers our own processing and is not a provider’s HIPAA Notice of Privacy Practices.

2. What information do we collect?

Depending on the services, information and permissions you provide, we collect:

Account and profile information: identity, contact and authentication details, age, profile characteristics, preferences and healthcare-provider connections.
Health information: conditions, symptoms, medications, survey responses, movement and other measurements, task performance, health history and results or inferences derived from these data.
Images and recordings: photographs, drawings, video and information derived for image or movement assessment. This material may identify you.
Communications: enquiries, messages, reports and recipient details.
Purchases and subscriptions: transaction records and information confirming access to paid services.
Device and usage information: online and device identifiers, app and device details, notification information and operational records. Optional analytics and session recording are described below.

Sources include you, connected devices and health services, authentication providers, linked healthcare providers, service providers, service use and our analysis. Health-service use may itself reveal health interests. Features needing information you decline may be unavailable.

3. How do we use your information?

We use information to provide requested measurement, analysis, history, synchronization, reminders, reports, sharing, subscriptions and support; send service communications; protect accounts; and meet legal duties. With relevant consent, we assess usage and improve usability. Remote processing can occur during guest use or later synchronization of offline records.

Statistical and machine-learning methods analyze measurements and associated health information to produce scores, trends and estimates of similarity to condition-related patterns. Estimates may be inaccurate and do not establish a diagnosis. Results may appear in requested reports or sharing. They support assessment and professional review; we do not use them to decide insurance, employment or legal entitlements.

Anonymous measurements may support method and model development, validation and related research. This does not authorize separate research or model development using identifiable health information. Providing contact details for support or a return is not research consent. Separate studies require their own participant information and applicable authorization.

4. When do we share your information?

Service providers: authentication, hosting, storage, processing, security, communications, report delivery, optional telemetry, payment and subscription providers receive information needed for their services. Hosting, processing and report-delivery providers may receive health information.
People and organizations you select: healthcare providers and other recipients receive relevant profile and health information, communications and reports through sharing or connections you request.
Other users: leaderboard entry is optional. Choosing Add my score shares your display name, score and game details, which may reveal health-related activity. Finishing a game does not publish or update an entry. Choose Remove my entry on that leaderboard to end display, including for older entries, or contact us. Independent copies may persist.
Support and legal recipients: authorized personnel, advisers and competent authorities receive relevant information where necessary for support, security, legal obligations or legal claims.

For direct-to-consumer Steady Hands services, we do not sell personal information or exchange consumer health data for money or other valuable consideration. This statement does not authorize sales in any other activity. We do not share app-user information with advertising platforms for our promotional advertising or combine it with activity from other apps or websites. Ending a connection does not physically retract a delivered report. Where the law requires, we notify processors and other recipients of correction, deletion or restriction requests and require the corresponding action. Independent recipients may retain information only on their own lawful grounds; sharing does not remove your rights.

5. How do we use tracking technologies?

Services use identifiers and operational records for their functions. Optional analytics collects selected interactions and device information to assess usability; optional session recording captures masked navigation in selected areas. Each requires separate saved consent for the relevant account and device. Recording consent does not authorize analytics. Refusal does not restrict other services.

Optional analytics and recording exclude measurement values, diagnoses, medication notes and entered text. Recordings mask text and images; identifiers and health-interest inferences may remain personal information. Stop optional collection and manage recording through Privacy and data.

6. How do we protect your information?

We apply technical and organizational safeguards appropriate to the information and the risks. No system guarantees absolute security. Please protect your account credentials and tell us about suspected unauthorized access.

7. What choices do you have?

Health-data consent is separate from terms or policy acknowledgement. Refusal or withdrawal prevents dependent services; notices, support and rights requests remain available. Withdrawal does not invalidate earlier lawful processing or automatically erase records.

Device permissions separately govern device functions and health information. Supported offline wearables have a local consent control; phone changes apply on reconnection. Revoking permission does not erase records. Contact us about other devices or providers.

8. How long do we keep information, and how can you delete it?

Account and health history are retained while you keep the account or request history storage, unless an earlier erasure request or consent withdrawal requires deletion. Support communications are deleted when the request and related complaints are resolved. Entitlement records are kept until access expires; accounting records follow the applicable statutory period. Where a legal duty or specific claim requires longer retention, only necessary records remain until that period ends. Deletion follows the applicable deadlines below. Session recordings are configured for 30-day retention. Our retention limit for optional usage analytics is 12 months from collection, after which the information must be deleted or anonymized. Earlier applicable erasure duties still apply.

Account deletion removes profiles and anonymizes retained measurements in the active service. “Anonymous” means no individual can reasonably be identified or linked, including through other available information; removing names or replacing identifiers is insufficient. Where law uses “deidentified”, its separate conditions must also be met, including protection against linkage to a consumer or their device. Only information meeting the applicable standards may be retained indefinitely for the stated purposes. We take reasonable measures against reassociation, use it only in that form and do not attempt reidentification. Recipients must contractually meet the same conditions. Identifiable or coded datasets and model outputs remain subject to privacy and deletion rights.

Request deletion through Settings → Delete account or support@vilimed.com. Database backups and application/access logs are retained for 30 days, subject to earlier applicable erasure duties. Logs may link account, recipient and request details to health-service activity; health-data protections still apply. Backup copies may persist until expiry; deletion obligations include preventing erased information from returning to active use after restoration. Provider copies remain subject to applicable rights and deadlines. We do not keep sent report emails or attachments, although providers and recipients may hold copies. Uninstalling the app does not delete a cloud account, and deleting an account does not cancel platform subscriptions. Contact us about unconfirmed deletions.

9. What are your legal grounds and privacy rights?

Where European Economic Area or United Kingdom data protection law applies, we rely on:

Requested services: account administration, measurements, analysis, history, synchronization, reminders, reports, subscriptions and associated support rely on performance of our contract with you. Health-information processing additionally relies on your explicit consent.
Optional sharing and telemetry: public leaderboards, optional recipient sharing, usage analytics and session recording rely on separate consent for the relevant purpose, explicit where health information is involved. Necessary report delivery forms part of the requested service.
Security and general enquiries: limited account, device, usage and communication information supports our legitimate interests in preventing misuse, maintaining reliable services and responding to enquiries, balanced against your rights. This basis alone does not authorize health-information processing.
Legal duties and claims: necessary records support applicable accounting and data-protection duties. Legal claims rely on our legitimate interests and, for health information necessary for a claim, the legal-claims condition under data protection law.

Subject to applicable law, you may request access, correction, deletion, restriction or portability; object to processing based on legitimate interests or for direct marketing; and withdraw consent. Protections concerning solely automated decisions with legal or similarly significant effects remain available. You may request recipient information as required by law.

Send requests to support@vilimed.com. We may reasonably verify your identity and will explain any refusal or limitation. GDPR requests are normally free and answered within one month. Any permitted extension of up to two further months will be explained within the first month. You may complain directly to your competent supervisory authority, including Lithuania’s State Data Protection Inspectorate: https://vdai.lrv.lt/en/

Washington and Nevada consumer-health rights and appeals are explained in our separate Consumer Health Data Privacy Policy at https://vilimed.com/pages/steady-hands-consumer-health-data, also available by contacting us.

10. Where is information processed?

Information may be processed in the United States and other provider locations. Restricted EEA or UK transfers require applicable adequacy decisions or safeguards valid for that jurisdiction, such as EU Standard Contractual Clauses with the UK Addendum where required. Contact us for destinations, the applicable mechanism and copies of safeguards. Continued use is not transfer consent.

11. Can children use the services?

Steady Hands is intended for adults aged 18 or over. Please report an underage account so we can restrict further use and address collected information under applicable law.

12. How will this policy change?

We may update this policy as our services or legal obligations change. Published versions will state their effective date. We will notify you of material changes and obtain additional consent before the relevant processing where required by law. Continued use alone does not provide that consent.

13. How can you contact us?

For privacy questions and requests, including contacting our Data Protection Officer, email support@vilimed.com.

UAB VILIMED, company code 304982381. Mailing address: Medžiotojų g. 56C, Ireniškiai, LT-53275, Lithuania.