Privacy policy.

Who is responsible

Movetrics Cloud is provided by Marius Schober, a self-employed sole proprietor trading as Movetrics Intelligence. In this policy, “I”, “me” and “Movetrics Cloud” refer to Marius Schober.

I am the controller for personal data used to operate this website, assess access requests, manage Cloud accounts, communicate with you and protect the service. This policy covers beta.movetrics.com and the associated Cloud application. Provider and VAT information are in the Impressum.

If a university, employer, laboratory, coach or other organisation decides why and how participant recordings are processed, that organisation is normally the controller of those recordings. Movetrics Cloud processes them on its documented instructions as a processor. Its participant notice and applicable data-processing agreement also apply. This policy does not replace an agreement under Article 28 GDPR.

The information processed

Information comes from you, the people who invite or administer your workspace, files and notes uploaded by authorised users, and technical information generated when the service is used.

• Website and connection data: IP address and connection information, requested resource, time, response status, browser information and technical errors processed by the hosting infrastructure. Application logs also contain operational references and timings.
• Access requests: email address and information entered in the form, including name, role, organisation, equipment and intended use. Optional fields are identified in the form.
• Account and access data: email address, display name, identity reference, approval status, workspace membership and role, sign-in attempts, session records and the version and time of recorded terms acceptance or optional choices.
• Recording and workspace data: original files and filenames; participant or examination references; dates; equipment and source metadata; signals and any marker or movement data contained in a supported file; measurement context, notes, comments and corrections.
• Derived data: normalised recordings, calculated results, charts, comparisons, reports, processing history and audit records. These can remain personal data when linked to a person or recording.
• Support data: your message, reply address, problem description, case references and inspection permission. Avoid unnecessary participant details in messages and filenames.

You can read the public pages without an account. The required request details are necessary to assess access; an approved email address is necessary to sign in. A file and sufficient measurement context are necessary for the analysis you request. Optional product-development permission is not required.

Purposes and legal bases

For participant data processed on an organisation’s instructions, the organisation determines and documents the lawful basis. My service agreement with an uploader does not itself supply a lawful basis for processing another person’s recordings.

This policy informs you about processing. Reading it or accepting the beta terms is not blanket consent to all processing or future uses. Necessary service processing does not depend on an optional reuse choice.

Participant and health data

Movement and force recordings can reveal information about health, physical condition or disability. Depending on their content and use, they may be special-category data under Article 9 GDPR. Replacing a name with a code does not remove that protection where a person remains identifiable.

Upload only recordings you are authorised to process. Minimise direct identifiers and keep participant-code keys separately. For organisational recordings, establish the required data-processing agreement, inform participants and document an Article 6 basis and, where applicable, an Article 9 exception before uploading. Explicit participant consent may be relevant; an uploader’s general checkbox does not replace it. Provider conditions may impose additional requirements for sensitive data.

The beta is designed for adult account holders and non-medical education, research and performance work. Do not upload children’s recordings or identifiable clinical records without a separately agreed and lawful arrangement. Movetrics Cloud does not use recordings for biometric identification.

If someone uploaded data about you, contact the person or organisation responsible for the recording. You may also contact me; I will help route your request without disclosing another user’s information.

Providers and international transfers

Authorised workspace members can see data according to their permissions. I may access data where necessary to operate the service, resolve an authorised support case, protect security or meet a legal duty. This does not permit unrelated reuse.

EU storage and application regions do not rule out international transfers, particularly for email, support and subprocessors. The linked provider agreements describe transfer arrangements, including European Commission standard contractual clauses where applicable. An adequacy decision can apply only where its conditions are met. Request details or copies of the safeguards applicable to your data from support@movetrics.com.

I do not sell recordings, publish them as a public dataset or use them for advertising. Necessary disclosures may be made to legal advisers or competent authorities for legal obligations or claims. Reports you download and share are outside the Cloud workspace’s access controls.

How long data stays

The hosted beta does not automatically delete every recording after 30 days. Originals are needed for reanalysis and complete exports and remain with their examination until deletion.

Eligible metadata is removed by the next successful daily cleanup. That schedule does not itself erase separate provider logs, mailboxes or backup copies.

Restricted backup or recovery copies can outlast active-storage deletion. Their use is limited to recovery, security or a valid retention duty; they are to be removed when that purpose ends, and applicable deletion instructions must be reapplied after a restore. The beta has an operator-run recovery procedure, without a promised automatic backup schedule or immediate erasure from every provider system.

If a legal obligation or concrete dispute requires longer retention, processing is limited to that purpose and the applicable duty or limitation period. It is not an indefinite general permission to retain recordings.

Cookies and device storage

The public pages do not include advertising trackers or third-party analytics. Fonts and page assets are served with the site. The hosted email-code sign-in flow uses these first-party cookies:

These cookies are necessary for the sign-in and secure service you request; device storage is based on § 25(2)(2) TDDDG. Related personal-data processing uses the service and security bases above. Blocking the cookies can prevent sign-in or workspace changes.

The app also automatically stores chart preferences in browser local storage: selected channels, display mode and zoom, associated with a recording and view identifier. They do not contain the original signal arrays and are not used for advertising. They remain until you clear the site’s local data and may be stored again when a chart is used. Clearing local storage does not delete server-side recordings.

Device storage is subject to § 25 TDDDG independently of the GDPR. Optional storage that requires consent needs a separate choice; accepting the beta terms or this notice does not provide that consent.

Optional product development

The Account page has a separate “Pseudonymous signal reuse” setting, off by default. Its purpose is to allow authorised signal data to be considered for improving import compatibility, data quality and product reliability. The current implementation can mark canonical signal datasets within the workspace as eligible and retain a link to the recorded permission. The data is not irreversibly anonymous.

This permission is voluntary and not a condition of access. It does not authorise publication, sale or AI-model training and cannot supply consent for another participant merely because you control an account. Only enable it where you can authorise the stated use for every affected recording and the necessary participant permissions and legal basis have been established separately.

Withdraw your account’s permission on the Account page or by contacting support. The app records withdrawal and excludes datasets linked to that permission from future eligible reuse. The original remains available for your requested service until separately deleted. Withdrawal does not retrospectively invalidate earlier lawful processing.

Permission to investigate a support problem is separate. It does not authorise permanent benchmark or training-dataset reuse.

Optional AI testing

OpenCode Go is the requested provider for bounded managed beta tests that explain selected evidence or propose changes for human review. Testing remains unavailable until permitted provider use and setup are confirmed. Its provider documentation describes model-specific retention and training conditions. No EU-only processing, blanket zero retention, no-training guarantee or completed provider data-processing agreement is promised by this notice. Before personal or organisational data is sent, the applicable purpose, legal basis, provider conditions, retention, transfer safeguards and necessary permissions must be established and disclosed for that use.

Only a reviewed, minimised evidence packet is intended for an AI request: selected verified results, evidence references, permitted task context and any question you choose to include. Raw signal arrays, entire source files, participant identities, filenames and unrelated workspace content are excluded by default. Avoid adding personal details to questions. Request status, packets, responses, citations and usage records can be stored in the workspace; deleting Cloud records does not itself establish deletion of a provider’s separate copies.

Managed workspace access and a personal API key are separate options. A personal API key is restricted to an eligible personal workspace and may not process institutional or teaching source data. Enabling a workspace setting does not supply permission for another participant or replace an organisation’s instructions and required agreements.

AI outputs can be wrong and require review. They cannot establish missing calibration, units, axes, timing or protocol meaning, or silently change measured values and official calculations. Training or improving a model using personal recordings requires distinct, specific authorisation and an appropriate lawful basis; ordinary uploads, these terms and the product-development setting do not authorise it.

Security and human decisions

The hosted service uses encrypted connections, private storage, authenticated workspace access, role-based permissions, server checks, database row-level restrictions, bounded processing and audit records. Operational access is limited to the task being performed. These safeguards reduce risk; they do not make an internet service risk-free.

The service does not currently make solely automated decisions determining employment, treatment, insurance or other matters with legal or similarly significant effects. Calculations and observations support human interpretation. A chart, score or future AI explanation must not be used as an automated basis for a consequential decision about a person.

Your rights

Subject to the applicable GDPR conditions, you may request access, correction, erasure, restriction of processing and portability of your personal data. You may withdraw consent at any time without affecting the lawfulness of earlier processing.

Write to support@movetrics.com or the postal address above. Requests are normally free. I may ask for information reasonably needed to establish identity or locate data. I will respond without undue delay and normally within one month; a legally permitted extension for complexity or multiple requests will be explained within that first month.

The Account page offers an export and account deletion. The export includes personal account records; complete recording lineage is included only for workspaces you own alone. Shared-workspace artifacts are excluded to protect others. Contact support for rights requests beyond that download.

Sole-owner account deletion removes its workspace and examination lineage and revokes access. Shared-workspace ownership must be resolved before automated deletion can complete; this does not remove your statutory rights or prevent you from contacting me. Some shared attribution is replaced with a deleted-account reference; external identity cleanup can finish separately.

You may complain to a data-protection supervisory authority, particularly where you live, work or consider an infringement to have occurred. For my business in North Rhine-Westphalia, the relevant authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW). You need not contact me before complaining.

Changes to this policy

I will update this notice when the service or processing changes and give advance information where required. Updating a notice does not create consent for a new purpose. Material new uses, including AI-provider processing or training, require their own assessment, information and necessary permission before they start.