Privacy policy

This policy applies to stabilerkern.de, the member area mitglieder.stabilerkern.de and the apps “Stabiler Kern: Atemsystem” and ATMO.

1. Controller

Sergius Geier · Stabiler Kern
Matth-Grünewald-Ring 32, 97422 Schweinfurt, Germany
Email: kontakt@stabilerkern.de

2. Hosting, server log files and email

The website, member area, database and email (mailboxes and sending) are operated for us by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, as our processor (Art. 28 of the General Data Protection Regulation (GDPR, German: DSGVO)). All connections are TLS-encrypted.

Each time a page is accessed, the server stores log files: IP address, date and time, file requested, amount of data, referrer, browser and operating system. The purpose is secure operation (Art. 6(1)(f) GDPR). The log files are deleted as soon as they are no longer required for this purpose.

3. Cookies and external content

stabilerkern.de sets no cookies and uses no analytics or advertising services. Fonts and videos are served from our own server; no third-party content is loaded.

The member area only sets technically necessary cookies: “SKSID” for login and form protection, deleted when you close your browser; “report_back” to take you back to your result after buying a test report, 2 hours. Legal basis: Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), Art. 6(1)(b) GDPR.

4. Contact form and intro call

For your request by form or email, we process your name, email address and, optionally, phone number and message; for the form, also the time, page and language. We store form requests on our web space, forward them to ourselves by email and confirm receipt to you by email. To prevent misuse, we limit requests per IP address, which we store for this purpose only as a hash value. Legal basis: Art. 6(1)(b) GDPR, for misuse prevention Art. 6(1)(f) GDPR. We delete the request once it has been dealt with and no retention obligation applies.

5. Where-You-Stand Check

The voluntary Where-You-Stand Check is evaluated in your browser; nothing is transmitted unless you submit it. If you request your result by email, we store your email address and your evaluation (overall and partial scores, range, strongest warning area), send you the result and get in touch with you if you wish. The legal basis is your consent via the tick box in the form (Art. 6(1)(a) GDPR, for health-related information Art. 9(2)(a) GDPR), which you can withdraw at any time by email. We store the data until you withdraw your consent or the purpose no longer applies.

6. Member account, purchases and emails

For purchases, appointments and self-tests, we keep an account for you in the member area. We process:

• email address, name, password (as a hash only), optional two-factor login;
• purchases, subscriptions, access rights, appointments and invoices;
• emails to you: confirmations, password links, appointment reminders, notices of new videos and about subscriptions and trial periods;
• cancellations via the cancellation form: name, email address, contract and, where applicable, reason;
• to prevent misuse of forms such as login, registration and ordering: IP address and the email address entered, for no more than 24 hours.

Course videos show your email address as a watermark. For online appointments, you receive a link to a video conferencing service; its privacy notice applies to its use.

Legal bases: contract (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) GDPR), protection against misuse and against the sharing of our content (Art. 6(1)(f) GDPR). If you delete your account, we remove your password, access rights and app logins immediately. What we are required to keep (invoices and payment records, section 9; records under section 8) we retain with your name and email address until the end of the respective period.

Online withdrawal (“Vertrag widerrufen”): We store your name, email, contract details and the time of receipt; if you are logged in, also your account and contract; your IP address only in encrypted form (hash) to prevent misuse. Purpose: processing your withdrawal and the legally required acknowledgement of receipt (Art. 6(1)(c) GDPR in conjunction with Section 356a BGB). Retention: 6 years (Section 257 HGB).

7. Self-tests

For the self-tests in the member area, we store your answers, depending on the test your gender, children and relationship status, your result and your email address in your account, which we create for this purpose if you do not have one yet. You receive an email with the link to your result and a single reminder about the full report. Legal basis: Art. 6(1)(b) GDPR; for the reminder Art. 6(1)(f) GDPR, to which you can object at any time. We store the data until you ask us to delete it.

8. Health check and participation agreement

Before your first appointment, online or in person, you fill in the health check in the member area and sign the participation agreement.

Health check

We store:

• your health information, every submitted version with its time;
• your emergency contact: name and phone number;
• your name, your drawn signature, and the time and version of your consent;
• the traffic-light assessment and notes by Sergius Geier.

The purpose is to plan your appointments safely; you cannot take part without the health check. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you give in the health check; for the emergency contact Art. 6(1)(f) GDPR. If the assessment is amber or red, Sergius Geier receives an email with your name, the traffic light and the points that triggered it, without any other health information.

Participation agreement

We store your first name and surname, date of birth, signature, time, IP address and the wording of the version you signed, in order to document the agreement and the minimum age of 18 (Art. 6(1)(b) and (f) GDPR). You decide voluntarily, with a separate tick box, whether photos and videos of you may be used (Art. 6(1)(a) GDPR).

Access, deletion, withdrawal

Only Sergius Geier can see your health information. It is stored with IONOS as our processor (section 2). Health information, emergency contacts, signatures and the participation agreement are retained for as long as they are needed for your care and necessary records. The relevant purpose and any applicable legal retention duties determine the storage period. There is no automatic deletion after a blanket three-year period. You can withdraw your consent at any time with effect for the future by email to kontakt@stabilerkern.de.

9. Payments, invoices and videos

Stripe and PayPal process payment data partly under their own responsibility, for example to prevent fraud. We retain invoices, credit notes and payment records for 8 years and business letters such as purchase confirmations for 6 years, in each case from the end of the calendar year (Section 147(3) AO (German Fiscal Code), Section 14b UStG).

10. App “Stabiler Kern: Atemsystem”

The app uses your member-area account. For this, our server processes login data, login tokens (as a hash only, valid for 30 or 180 days), time-limited offline unlocks and, as with ATMO, Apple App Attest to verify a genuine app installation. Videos are played via Vimeo (section 9). The app stores the nervous system check, exercise history and reminders only on your device. Legal basis: Art. 6(1)(b) and (f) GDPR. Logging out invalidates the tokens; you can delete your account in the app. Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, is responsible for app distribution.

11. ATMO children’s breathing app

Parent account and server data

An ATMO parent account can only be created by an adult. For registration and administration, we process the parent’s name, email address, a securely stored password hash, session and security data, and the status of purchases, subscriptions and unlocks. Children do not get their own account or their own login details.

Processing serves to provide the account, restore purchases, prevent misuse and perform the contract (Art. 6(1)(b) and (f) GDPR). Account data is stored until the account is deleted; records of payments required by law may be retained beyond that in accordance with statutory retention periods.

Local child profiles

Child profiles created by the parent, with name or nickname, age, chosen avatar, exercise progress, training days, favourites and agreed reward, are stored exclusively locally on the device and are not transmitted to our server. They can be deleted in the protected parents’ area. Apple does not treat data that is processed exclusively on the device as data collected by the app provider.

Microphone and blow control

The optional blow control is only used after it has been activated by the parents and after system permission has been granted. During a supported exercise, ATMO evaluates the current volume level locally. For this purpose, the technical audio library temporarily creates a low-resolution file in the app cache. Speech or audio content is not listened to, analysed, permanently stored or transmitted to our server or to third parties. When the measurement ends, the technical recording is unloaded; without microphone permission, the exercise works in timer mode.

App integrity and purchase verification

For security-relevant processes, ATMO uses App Attest on Apple devices. This involves processing device-bound cryptographic attestations, one-time challenges, key identifiers and counters in order to confirm a genuine, unmodified app installation and to prevent replay attacks. The attestations are not used for advertising or cross-app tracking.

Apple purchases and restorations are verified on the server side using the transaction data provided by Apple. We only store the purchase references required for the product, entitlement status, expiry, restoration and protection against misuse. We do not receive payment data such as full credit card details; payment processing is handled by Apple.

Local reminders, advertising and analytics

Optional exercise reminders are scheduled locally on the device. ATMO contains no personalised advertising, no third-party ad networks and no cross-app tracking. Support requests are only processed to deal with the matter in question.

12. Zykluslandkarte

The Zykluslandkarte app has its own privacy policy (in German).

13. Recipients and third countries

Data is received only by the service providers named here. We do not pass on data for advertising. Transfers to third countries are based on the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework or on safeguards under Art. 46 and 47 GDPR (standard contractual clauses, binding corporate rules).

14. Your rights

You have the right at any time to:

• Access to information about your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent you have given, with effect for the future (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, Bavarian State Office for Data Protection Supervision), Promenade 18, 91522 Ansbach.

Last updated: 11 October 2026