Privacy policy

This policy explains what data the myBrux mobile app (Android and iOS), the doctor panel and the mybrux.com website collect, why we collect it, who we share it with, how long we keep it and what your rights are. We have tried to keep it plain. If anything is unclear, write to us.

1. Who is the data controller

The controller of your personal data is WM Group Wojciech Czyż, ul. Brzozowa 12, 43-230 Goczałkowice-Zdrój, Poland, Polish tax ID (NIP): 6381848290, the operator of the myBrux app. In this policy, “we” and “us” mean WM Group Wojciech Czyż.

The app is developed and published in the App Store and Google Play by SpaceIT Jakub Moskwa, which builds and maintains it on our behalf.

For anything related to personal data, write to [email protected].

2. What myBrux is

myBrux is an educational tool that helps you become aware of your jaw position and of habits related to bruxism. It does this through short reminders during the day, a pain diary, relaxation exercises and statistics.

• myBrux is not a medical device. It does not diagnose or treat anything and does not replace a consultation with a doctor or dentist.
• The app is intended for adults only (18+).
• We show no ads and do not sell data. The app uses no analytics or tracking tools, and on the mybrux.com website Google Analytics runs only with your consent.

3. What data we collect

3.1. Account data

• your email address and full name (or the name you provide);
• your password, if you sign up with email. We only store it as a secure hash, never in plain text;
• if you sign in with Google or Apple: your Google or Apple account identifier and the email and name that the service passes to us. Apple may pass a relay address if you choose “Hide My Email”. We never receive your Google or Apple password;
• your myBrux user ID, account creation date, whether you have completed the initial questionnaire, and the operating system type (Android or iOS) recorded with your login session.

3.2. Initial questionnaire

When you first open the app, we ask you to fill in a short questionnaire so we can tailor the app and reminders to you. We collect:

• age range (18 and over), gender (you can choose “prefer not to say”), type of daily occupation (if you choose “other”, you can describe it in your own words);
• stress level, how often you feel tension or pressure, how often you exercise, how regularly you sleep;
• the time you usually wake up and go to sleep. These set the window in which we send reminders;
• symptoms and history: how often you have pain in the jaw, temples or face, morning fatigue of the chewing muscles, noticed night-time teeth grinding, daytime teeth clenching, oral habits (cheek or lip biting, tongue between the teeth), use of a splint, braces or dentures, temporomandibular joint problems (TMD).

3.3. Data you record while using the app

• reminder responses: what your jaw is doing at that moment (rest, light tooth contact, clenching, grinding, bracing without tooth contact, tongue or lip habits, non-functional chewing), together with the response time and a link to the reminder;
• pain diary: date, pain locations (e.g. temporomandibular joint, masseters, temples, area under the jaw, neck, headache) and side, intensity on a 1–10 scale (0 means a pain-free day), pain character, accompanying symptoms (morning stiffness, masseter fatigue, pain while eating, limited mouth opening) and optional notes;
• relaxation exercises: type of exercise, whether it was completed, its duration and whether it was started from a reminder;
• reminder programme status: start, end, number of days;
• statistics and the “jaw score” calculated from the data above.

The data in sections 3.2 and 3.3 may reveal information about your health. This is a special category of data (Article 9 GDPR), so we handle it with particular care.

3.4. Settings and technical data

• notification hours, time zone (set automatically from your phone or chosen manually), app language;
• a push notification token, a random identifier that lets us deliver reminders to your device;
• information about a link with a doctor (who and since when), if you use that feature;
• technical data recorded by the server when the app connects to it (IP address, date and time, type of request), for security purposes.

3.5. Correspondence

If you write to us, we process your email address and the content of your message.

3.6. Data stored only on your phone

• your login token and basic profile data (name, email, ID) in the system’s encrypted storage (iOS Keychain / Android Keystore). They are removed when you sign out;
• your chosen theme (light or dark) and, for a short time, a reminder response that could not be sent yet (e.g. while you are offline).

3.7. What we do not collect

We do not collect GPS location, contacts, photos, recordings or advertising identifiers. The app does not use any third-party advertising or analytics tools. We do not sell data or use it for marketing.

3.8. In-app purchases

If you buy myBrux Plus, the payment is handled by the App Store or Google Play. We do not see your card details. We receive information about the purchase and its status, linked to your account.

3.9. Doctor accounts

If you use the doctor panel, we process your name, email address, specialty, licence number (if you provide it), subscription data and the invitations you send to patients, including the patient email address or phone number you enter.

3.10. The mybrux.com website

The website has no forms. Cloudflare, which delivers it, processes technical connection data (including IP addresses) for security.

If you agree, we use Google Analytics 4 to see how the website is used: which pages are visited, where visitors come from and what devices they use. Google then receives data about your device and browser, the pages you visit, your approximate location and identifiers stored in cookies. Your IP address is used to estimate location and is not stored in Google Analytics. We do not use this data for ads or link it to your account in the app. See also how Google uses information from sites that use its services.

Until you agree, the website does not connect to Google Analytics or store its cookies. You can change your decision at any time with the “Cookie settings” button in the website footer. Withdrawing consent removes Google Analytics cookies from your browser and does not affect the lawfulness of earlier processing.

Cookies used on the website:

• mybrux_consent: remembers your decision for 6 months. It is strictly necessary, so it does not require consent;
• _ga and _ga_*: Google Analytics cookies that tell visitors and sessions apart, for up to 2 years. Set only with your consent.

4. Where we get your data from

You provide most of the data yourself in the app. When you sign in with Google or Apple, we receive your account identifier, email and name from them. The app reads your time zone, language and push token from your device.

5. Purposes and legal bases

We process data in line with the GDPR (Regulation (EU) 2016/679):

Your account and running the app

What we do: create and maintain your account, sign you in, save your entries, calculate statistics, send reminders.

Data: account data, settings, push token.

Legal basis: Article 6(1)(b) GDPR, i.e. performance of the contract for using the app.

Health data

What we do: store and analyse your questionnaire, reminder responses, pain diary, exercises and statistics so that the app can work.

Legal basis: Article 9(2)(a) in conjunction with Article 6(1)(a) GDPR, i.e. your explicit consent, which you give in the app before filling in the initial questionnaire. You can withdraw it at any time (see section 9).

Sharing data with your doctor

What we do: give a doctor or dentist who uses myBrux access to your data.

Legal basis: Article 9(2)(a) GDPR, i.e. your explicit consent, which you give by entering the doctor’s invitation code or by asking us to connect your account to a doctor. You withdraw it by removing the doctor connection.

Doctor accounts and billing

What we do: run the doctor account, handle the subscription and issue accounting documents.

Legal basis: Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (accounting and tax obligations).

Security

What we do: protect the service against abuse and diagnose errors (server logs and error reports).

Legal basis: Article 6(1)(f) GDPR, i.e. our legitimate interest in keeping the service secure.

Website statistics

What we do: with your consent, we measure how the mybrux.com website is used so we can improve it (Google Analytics 4).

Legal basis: Article 6(1)(a) GDPR, i.e. your consent. Storing and reading cookies on your device also requires consent (Article 5(3) of the ePrivacy Directive). You can withdraw consent with the “Cookie settings” button in the website footer.

Contact and handling your rights

What we do: reply to messages and handle requests, e.g. for access to or deletion of data.

Legal basis: Article 6(1)(c) GDPR (legal obligation under the GDPR) and Article 6(1)(f) GDPR (our legitimate interest in communicating with users).

Providing data is voluntary, but without account data and the data you record in the app we cannot provide the service.

6. Who we share data with

We only share data with parties without which the app could not work, and only to the extent necessary:

• SpaceIT Jakub Moskwa, the app developer and publisher, which builds and maintains the app, panel and servers. It processes data only on our instructions;
• our server (hosting) provider, which runs our API and database: Hetzner Online GmbH (Germany). It processes data only on our instructions;
• Cloudflare (Cloudflare, Inc., USA), which carries traffic to the app, panel and website and sends our emails;
• Backblaze (Backblaze, Inc., USA), where we keep database backups;
• Sentry (Functional Software, Inc., USA), which collects server error reports. A report may contain a user identifier, IP address and request details;
• RevenueCat (RevenueCat, Inc., USA), which handles the status of myBrux Plus purchases;
• Stripe (Stripe Payments Europe Ltd., Ireland), which handles payments for doctor subscriptions;
• SMSAPI (LINK Mobility Poland sp. z o.o.), which sends invitation text messages if a doctor chooses this option. It receives the phone number and invitation code;
• Expo (650 Industries, Inc., USA), whose Expo Push Notifications service we use to send reminders. It receives the push token and the notification content. Reminder content is generic (e.g. a prompt to check your jaw position);
• Google: Firebase Cloud Messaging delivers notifications to Android phones; Sign in with Google, if you choose it;
• Apple: Apple Push Notification service delivers notifications to iPhones; Sign in with Apple, if you choose it;
• your doctor or dentist who uses myBrux, only if you enter their invitation code yourself or ask us to make this connection (Settings → Data Sharing). The doctor gets access to the data you record in the app. You can revoke access at any time: Settings → Data Sharing → Remove Doctor Connection. If the doctor transfers data into their own medical records, they are responsible for it as a separate controller;
• our email provider, for correspondence with you;
• public authorities, only where the law requires it.

When you sign in with Google or Apple, those companies act as separate controllers of your Google or Apple account data, and their own privacy policies also apply.

If you agree to website statistics, data about your use of the website also goes to Google Ireland Limited (Ireland), the provider of Google Analytics, which processes it on our behalf.

7. Transfers outside the EEA

Our API and database run on servers located in Finland.

Expo, Google, Apple, Cloudflare, Backblaze, Sentry, RevenueCat and Stripe may process some data (mainly the push token, notification content, sign-in data, technical data and purchase data) in the USA or other countries outside the European Economic Area. Such transfers rely on GDPR mechanisms: a European Commission adequacy decision (the EU-US Data Privacy Framework, for companies certified under it) or standard contractual clauses approved by the Commission. On request, we will tell you which safeguards apply. This also applies to Google Analytics data if you agree to website statistics.

8. How long we keep data

• Account data and everything you record in the app: for as long as you have an account. When you delete your account, we erase it from the database immediately, and it disappears from backups within 30 days.
• Doctor connection: until you remove it or delete your account.
• Push token: until you delete your account or it is replaced by a new token.
• Server logs: up to 14 days.
• Correspondence: for as long as needed to handle the matter, then no longer than 12 months (e.g. to show that we fulfilled your request).
• Doctor billing data: for the period required by tax law, usually 5 years from the end of the tax year.
• Data on your phone: login token and profile data until you sign out; other settings until you uninstall the app.
• Website statistics (Google Analytics): up to 14 months, if you agree.

9. Your rights

You have the right to:

• access your data and receive a copy of it;
• rectify (correct) your data;
• have your data erased;
• restrict processing;
• data portability, i.e. receive your data in a structured, commonly used format;
• object to processing based on our legitimate interest;
• withdraw your consent at any time. This does not affect the lawfulness of processing before withdrawal. The app cannot work without health data, so in practice withdrawing consent means deleting your account and data;
• lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl), or with the supervisory authority in the EU country where you live or work.

How to exercise your rights

• In the app: Settings → Onboarding Data (review and redo the questionnaire), Settings → Notification Times, Settings → Data Sharing (revoke doctor access), Settings → Account Info → Delete Account.
• By email: [email protected], preferably from the address linked to your account. We reply without undue delay and within one month at the latest. In exceptional cases this may be extended by two further months; we will let you know if so. We may ask you to confirm your identity.

Step-by-step account deletion instructions: mybrux.com/delete-account.

10. Security

• communication between the app and our server is encrypted (HTTPS);
• your login token is kept in your phone’s encrypted storage (iOS Keychain / Android Keystore);
• passwords are stored only as hashes;
• only people who need it have access to data, and a doctor gets access only after you enter their invitation code or after we connect the accounts at your request.

No system is 100% secure. If a breach occurs that may put your rights at risk, we will notify you and the Polish supervisory authority as required by the GDPR.

11. Automated decisions

The app automatically calculates statistics and the “jaw score” for your information only (and your doctor’s, if you share data with them). We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. We do not profile you for marketing.

12. Minors

myBrux is intended only for people aged 18 or over. We do not knowingly collect data from minors. If we learn that someone under 18 has created an account, we will delete it together with its data.

13. Changes to this policy

We may update this policy, for example when app features or the law change. The current version is always available at mybrux.com/privacy-policy, and the date of the last change is shown at the top. We will tell you about significant changes in the app or by email.

14. Contact

WM Group Wojciech Czyż
ul. Brzozowa 12, 43-230 Goczałkowice-Zdrój, Poland
Tax ID (NIP): 6381848290
Email: [email protected]