CPR Assistant Privacy Policy

Effective date: October 27, 2026 · App: CPR Assistant (com.thecodersteam.cprassistant)

This policy explains what data the CPR Assistant mobile app (the "App") processes, why, who it is shared with, and what rights you have. It applies to the Android App and the online services the App uses. In case of discrepancy, the Spanish version prevails.

1. Data controller

The App is provided by Adrián Daniel Abadín, an individual developer operating as TheCodersTeam, based in Saladillo, Buenos Aires Province, Argentina.

Privacy contact: aabadin@gmail.com.

2. Who the App is for

The App is a support tool to log and time cardiopulmonary resuscitation (CPR/ACLS) procedures. It is intended for people aged 18 or over, mainly healthcare professionals and trained emergency staff. It is not directed at children.

3. Data we process

3.1. Account data

Data	Required?	Purpose
Email address and password	Yes	Create your account, sign in and recover access.
First and last name	Yes	Identify you in your profile and to live-session participants.
Phone number	No	Complete your profile, if you choose to add it.
Profile photo	No	Show your avatar. Only uploaded if you pick an image.

If you sign in with Google or Apple, we receive your email address, name and an account identifier from that provider, as you authorize on its consent screen. We never receive your Google or Apple password.

3.2. Patient data and CPR records

When you log a session you may optionally enter the patient's first name, last name and national ID number (DNI). The App also creates a record of the care provided: start and end time and events (for example, cardiac rhythms, shocks, drugs administered and compression cycles), with timestamps and notes.

This is health data and therefore sensitive data under Argentine Personal Data Protection Law 25,326. It is processed only to provide the logging, sync and export features you use.

Your responsibility for patient data. You enter patient data as part of your own professional activity. For that data, you (or the institution you work for) decide what is recorded and why; we act as the service provider that stores it on your behalf. Before entering identifying patient data, make sure you have a valid legal basis (for example, medical-record regulations or the appropriate consent). If you do not need to identify the patient, do not enter their name or ID: the App works the same without them.

3.3. Live sessions

If you create a live session, other users can join by entering the code you share. Participants see the session's events and any patient data you entered for it in real time. We store which users took part, when they joined and whether they are still active. Share the code only with people who should access that case.

3.4. Data kept only on your device

A local copy of your sessions, stored in an encrypted database. The encryption key is kept in the operating system's secure storage.
Your sign-in session, in the operating system's secure storage.
If you enable fingerprint or face unlock, the check is performed by your device's operating system. The App never accesses or stores your biometric data.

Signing out deletes your account's local sessions from the device. Uninstalling the App deletes all its local data.

3.5. What we do not do

We do not show ads or use advertising SDKs.
We do not use third-party analytics or tracking tools.
We do not access your location, contacts, microphone or camera. Your profile photo is picked from your gallery, only when you ask to.
We do not sell your data or your patients' data, and we do not use it for any purpose other than those described in this policy.

4. Purposes and legal bases

Providing the service (account, logging, sync across devices, live sessions and export): performance of the agreement you accept when you create your account.
Patient health data: processed at your request and under your responsibility, as described in section 3.2.
Security and abuse prevention: our legitimate interest in protecting the service and its users.
Compliance with legal obligations, where applicable.

5. Who we share data with

Supabase Inc.: provides authentication, database, file storage and real-time sync. It processes data on our behalf and under our instructions.
Google and Apple: only if you choose to sign in with them, to authenticate you.
Participants in your live sessions: only the data of the sessions you invite them to.
Exports: if you export a PDF or CSV report, it is shared only with the app or person you choose.
Authorities: only when required by law or court order.

6. International transfers

Supabase servers may be located outside Argentina. In that case, data is transferred to provide the service, under the contractual and technical safeguards offered by the provider.

7. Security

Traffic between the App and the servers is encrypted (HTTPS/TLS).
Local data is stored in an encrypted database.
Server-side access is restricted per account: each user can access their own records and, for live sessions, only the sessions they take part in.

No system is completely infallible. If we detect a security incident affecting your data, we will notify you as required by applicable law.

8. Retention

We keep your data and session records for as long as your account exists or until you delete them. When you delete your account, we erase your data from our active systems within 30 days. The provider's backups may retain it for up to 30 additional days until they are automatically overwritten.

9. Your rights

You may request access to, correction, update and deletion of your personal data, and withdraw your consent where applicable. Email aabadin@gmail.com from your account's email address. We answer access requests within 10 calendar days and correction or deletion requests within 5 business days, as required by sections 14 and 16 of Law 25,326.

Patients who wish to exercise their rights over data entered by a professional may contact that professional or institution. If they contact us, we will help handle the request.

The Argentine Agency for Access to Public Information (AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA), as the supervisory authority under Law 25,326, handles complaints from anyone whose personal data rights have been affected.

10. Deleting your account

You can request deletion of your account and all your data by following the instructions on this page.

11. Medical disclaimer

CPR Assistant is a logging and support tool. It is not a medical device, it does not diagnose, and it does not replace clinical judgment, professional training or current protocols. In an emergency, call your local emergency number.

12. Changes to this policy

If we change this policy, we will publish the new version on this page with its effective date. For significant changes, we will also notify you in the App.

13. Contact

Adrián Daniel Abadín (TheCodersTeam) — aabadin@gmail.com