Live capture: Spring wood sky island
- Bio Mandala Hub App
- Privacy Policy
Bio Mandala Hub App Privacy Policy
What the app collects, why we collect it, where it is stored, who can access it, and how you can view your information, withdraw consent or delete your account.
At a glance
This policy applies to Bio Mandala Hub App for Android and iOS, operated by Big Heart Digital Culture Co., Ltd. (referred to as “we” or “us”).
- Stay local when signed outYou can use the app without signing in; records remain on your phone and are not uploaded to our servers.
- Consent before uploadAfter signing in with Google or Apple, you read and sign a consent form before practice records are uploaded.
- Personal reports stay personalOnly you can view your personal reports and long-term trends.
- Organizations see aggregatesYour organization receives group statistics without direct personal links; groups with fewer than three people are not displayed.
- No sale or advertisingWe do not sell or rent personal data. The app has no ads or tracking or analytics SDKs.
- Account deletion is availableDelete your account in the app or on the web. See account deletion instructions.
Who is responsible for your data?
Big Heart Digital Culture Co., Ltd. operates the app and is responsible for collecting, processing and using personal data in the app and on our servers.
- Company
- Big Heart Digital Culture Co., Ltd. (大心數位文化股份有限公司)
- Taiwan Business ID
- 80543884
- asupeduer@ibigheart.com
- Telephone
- +886-937-222-223
Information we collect
The information handled depends on whether you sign in.
Using the app without signing in
Device connections, measurements, practice records and reports remain on your phone and are not transmitted to our servers. We do not collect your personal data in this mode.
After signing in
| Information | When obtained | Purpose |
|---|---|---|
| Account identifier, email address and display name provided by Google or Apple | On sign-in | Identify your account; we never receive your password |
| Nickname | When you enter one | Display on the group session screen; otherwise, a random code is shown |
| Birth year and month (not day) and sex | Before your first measurement | Compare with age- and sex-matched reference norms to calculate six-axis scores and equivalent age |
| Physiological measurements: heartbeat intervals, EEG band power, derived metrics and equivalent-age differences | During wearable-assisted practice | Personal reports and long-term trends |
| Practice time, journey and earned awards | Each session | Personal reports and group statistics |
| Organization membership, rooms and reservations | When joining an organization or session | Participation in organized sessions |
| On-site identity: Google name or avatar, only when enabled by you | When you opt in within the app | Display on the group screen; removed when the session ends or you turn the feature off |
Practice records and statistical datasets do not include birth year/month, sex or actual age. They keep only the difference relative to equivalent age; the policy describes these datasets as not permitting your actual age to be reconstructed.
Information we do not collect
- Contacts
- Location
- Microphone audio
- Camera images
- Advertising ID
- Use of other apps
The camera is used only to scan a QR code for joining a session. Images are not saved or uploaded. The app contains no advertising or third-party analytics, tracking or crash-reporting SDK.
Phone permissions
Your phone requests each permission. You may refuse it or turn it off later in system settings.
| Permission | Used for | If declined |
|---|---|---|
| Bluetooth | Connect heart-rate straps, armbands, watches and EEG headbands | Devices cannot connect and measurements cannot generate reports |
| Camera | Scan session QR codes | You can use an invitation link or search for your organization instead |
| Notifications | Session reminders and measurement status | No reminders; measurement remains available |
| Health data (Health Connect on Android, Health app on iOS) | Read-only access to display sleep, heart rate, HRV and related records alongside app data | Other functions still work |
| Background execution (Android) | Continue measurements when the screen is off | Measurements may stop when the screen turns off |
Health data read from your phone is displayed only on your phone and is not uploaded to our servers, used for ads or provided to third parties.
Purposes and consent
Required consent: providing the service
When signing in, you read and sign a consent form appropriate to your role (platform service, organizational data or campus supplement). Under Article 19, Paragraph 1, Subparagraph 5 of Taiwan's Personal Data Protection Act, this consent covers providing relaxation sessions, generating your reports and preparing group statistics without direct personal links for your organization.
If the consent form changes, the app asks you to confirm the new version at your next sign-in or before practice.
Optional consent: separate choices
Two uses beyond the service purpose have independent choices. Declining them does not affect app features:
- Publishing outcomes: Aggregate figures and charts may present program outcomes. Identifiable names, photos or testimonials require additional individual consent.
- AI model training: Statistical values without participant codes may train our own analysis models; they are not supplied to third parties to train their models.
Withdrawing consent
You can withdraw optional consent under “Settings → Data Authorization” or “Settings → Consent Forms”. If required consent is withdrawn, new personal trend analyses stop. Existing records remain until deleted through the account deletion process.
About measurement results
Mandala Hub is not a medical device. Measurements show changes before and after relaxation practice; they are not for diagnosis, treatment or health examinations. Physiological data may relate to personal health, so we apply heightened protection. If authorities classify it as special-category personal data under Article 6 of Taiwan's Personal Data Protection Act, we will comply with that Article.
Who can access your data?
- You
- Your session reports, long-term trends and equivalent age in the app and your personal web reports
- Your organization
- Group aggregates such as participation counts and average changes only. Groups smaller than three are not shown; individual records are not available to organizations
- Other session participants
- Your nickname or random code on the large screen; your Google name and avatar only if you enable them
- Our authorized staff
- Role-limited access for operations or support, with an access record
Pseudonymous identifiers
Each practice record uses an identifier instead of a name or email. We derive it through one-way HMAC-SHA256 using a key held by us and your account identifier. Pseudonymization is not the same as anonymization: because we hold the key, the records remain personal data under law and you retain your rights.
External services
| Service | Data processed |
|---|---|
| Google Sign-In / Sign in with Apple | Authentication; your interaction with Google or Apple is governed by their respective privacy policies |
| Plain-language AI explanation (only when you request it) | The server sends this session's metrics, journey and award names to an external AI service to produce an explanation, without your name, email, nickname or account code. Processing servers may be outside Taiwan |
| Phone system backups (Google / iCloud) | Your phone may back up app records to your own Google or iCloud account. Google or Apple controls these backups; we cannot access them |
We do not sell or rent personal data or provide it to third parties for marketing. Any legally required disclosure (for example, a lawful request by a judicial authority) is limited to what the law requires.
Storage and retention
Servers and databases are located in Taiwan, with backups in multiple locations. App-to-server connections are encrypted using HTTPS or WSS. Sign-in credentials are stored in the phone's secure storage (Keychain or Keystore).
| Information | Retention |
|---|---|
| Account information and practice records linked to you | Until you delete your account |
| Birth year/month and sex | Stored with the account and deleted with it |
| Name and avatar for on-site display | Temporarily stored during the session; deleted after it ends or when you disable display |
| Statistics without personal links | Retained for organization operations and audit records, without links to an individual |
| System backups | Rotated out within 90 days |
No system can guarantee absolute security. If a personal data breach occurs, we will notify you and the competent authorities as required by law.
Your rights
Under Article 3 of Taiwan's Personal Data Protection Act, you may inquire about or review your data, request a copy, request additions or corrections, request a stop to collection, processing or use, and request deletion.
- View records
- “Achievements” in the app or “My Results” on the web
- Change nickname and display settings
- App “Settings”
- Withdraw optional consent
- App “Settings → Data Authorization”
- Delete account
- App “Settings → Account Settings → Delete Account” or via the web. See account deletion instructions
- Other requests
- For access, copies or stopping use, email asupeduer@ibigheart.com. We reply within 15 days, with a possible 15-day extension if we explain why
Minors
- For children under seven, a legal representative must provide consent.
- For ages seven to under eighteen, consent or ratification of a legal representative is required in addition to the minor's consent.
- Schools arranging group practice must obtain written consent from a legal representative in advance. In-app consent does not replace it.
- Legal representatives may exercise these rights on the minor's behalf, including requesting deletion.
Updates to this policy
When this policy changes, its version and effective date will be updated here. For significant changes to the scope or purpose of use, the app will ask you to reconfirm the consent form at your next sign-in or before practice.
For site-wide and organizational data governance, see Privacy and compliance.
Questions about your information?
Email asupeduer@ibigheart.com or use “Settings → About” in the app to contact us.