Privacy Policy and Physiological Data Processing

Alldatai operates as a B2B SaaS platform for preventive workplace risk management and Operational Availability (DISPO).

• The Corporate Client (Employer): Acts as the Data Controller for its personnel’s data.
• Alldatai: Acts as the Data Processor, processing information under strict confidentiality and privacy-by-design standards, and in accordance with applicable personal data protection laws.

Alldatai collects and stores all physiological, biometric, and activity data transmitted through integrations expressly authorized by the user, including all categories of data provided by the Garmin Health API and Garmin devices.

Although our algorithms process specific metrics for workplace risk management, our infrastructure securely receives and stores the following standard categories described in the official Garmin Health API documentation:

• Physiological and biometric metrics: Continuous and resting heart rate, heart rate variability (HRV), stress levels, Body Battery, pulse oximetry (SpO₂), respiration rate, VO2 Max, and body composition data or user metrics transmitted by the API.
• Rest and sleep metrics: Detailed sleep assessment and sleep architecture (duration, deep, light, REM, and awake stages), Sleep Score, recovery time, and biological recharge indicators.
• Mobility and activity metrics: Daily steps, distance traveled, intensity minutes, active and resting calories, urban/operational mobility data, and summaries of recorded activities.
• Account and registration data: Anonymized or named user identifiers, Garmin OAuth access tokens, email address, and crew or work-shift assignment.

Collected data (including mobility, rest, and sleep-assessment metrics) is processed exclusively for the following preventive purposes, and not for diagnostic or punitive purposes:

• Assess the worker’s Operational Availability (DISPO) and biological readiness before the start of a workday or high-demand shift.
• Analyze rest quality and sleep architecture to anticipate the accumulation of biological fatigue or drowsiness during night and rotating shifts.
• Monitor mobility and activity indicators to balance physical workloads in the field.
• Identify operational risk factors to help prevent workplace accidents in critical tasks (mining, transportation, emergency response, and plant operations).
• Provide consolidated dashboards and aggregated risk reports (anonymized or pseudonymized) to the Client’s supervisors and occupational risk-prevention staff.
• Feed and calibrate Alldatai’s proprietary algorithmic models and indicators (DISPO, FRB, CTI, LBR).

Processing physiological data requires the data subject’s free, informed, and explicit consent. Users may exercise the following rights at any time:

• Access and correction: Review personal data processed through the Alldatai Mobile App.
• Withdrawal of consent and disconnection: Users have the explicit right to disconnect their Garmin account and revoke access to their data at any time through the application’s Privacy Center or by emailing privacy@alldatai.com.
• Deletion and portability: Request the deletion of historical records from the platform.

• With the Employer (Client): The contracting company receives operational visibility only (risk and availability indicators presented using status colors), in accordance with authorized occupational health and safety protocols. Detailed biological data is not used for disciplinary or punitive purposes.
• Aggregated information: Alldatai may use data that has been strictly anonymized and cannot be associated with an individual to continuously improve its algorithmic models and for internal research.

Personal and physiological data is retained only while the user’s relationship with the platform remains active, or as required by applicable labor and occupational safety laws. Following disconnection or a deletion request, data is purged or irreversibly anonymized from our primary database servers.

For questions about this policy, exercising ARCO rights (access, rectification, cancellation, and objection), or the Garmin integration, you may contact our Privacy Officer at:

• Email: privacy@alldatai.com
• Company: Alldatai SpA

This policy may be updated periodically to reflect changes in our operational, technological, or legal practices. The date of the latest update appears at the beginning of this document. We will notify users and corporate clients of any significant changes through our official channels.