Privacy Policy

PEM Tracker is a small, invite-only tool that helps people living with ME/CFS and long COVID track post-exertional malaise (PEM) by combining wearable data with a short daily questionnaire. It is run by a private individual, not a company.

What is collected

Account information

• Your email address and display name, obtained from Google when you sign in.

Signing in uses Google only to confirm your identity. PEM Tracker never receives your Google password, and requests no access to your Gmail, Drive, contacts, or calendar.

Health and wearable data

Only if you explicitly connect a device, and only within the permissions you approve on Google's screen. PEM Tracker asks for three read-only permission groups — activity and fitness, health metrics and measurements, and sleep — plus an optional fourth for ECG readings, which you can leave unticked without changing anything else. It asks for no permission to write anything back to your device or your Google account.

Within those, what is stored is:

• Heart rate — a reading every five minutes across the whole day, each one recording the average, highest and lowest beat rate in that window; plus your resting heart rate once a day. For roughly two hours around the time you wake, the same readings are collected once a minute instead of once every five, because the measurement described below needs that detail to mean anything.
• Heart rate variability — a daily figure, and the individual readings taken through the night, each with how its variation splits between slower and faster rhythms (low- and high-frequency power).
• ECG readings, only if you allow them, and only the ones you take yourself in your device's ECG app — the 30-second trace of your heart's electrical activity (250 measurements a second), when it was taken, its average heart rate, and your device's own result, which can include a sign of atrial fibrillation.
• Breathing rate — a daily figure, and a separate figure for each stage of sleep.
• Blood oxygen saturation — a daily figure.
• Body temperature, as a deviation from your own baseline rather than an absolute reading.
• Sleep — when each session started and ended, and how long was spent in each stage.
• Movement and exertion — step counts, as a daily total and, for the same two hours around waking, minute by minute; Active Zone Minutes, meaning time spent above a heart-rate threshold your own device sets for you; the energy your device estimates you burned through activity, in calories — from Oura rings, which report it as part of your daily activity summary; sedentary periods, meaning the stretches of the day you were inactive, with their start and end times; and, where your device provides it, minute by minute through the day, how it classified your movement — resting, light, moderate or vigorous. Fitbit devices report that classification; Oura rings do not. It is used to work out how much moderate activity a day held compared with your own usual, which is one of the inputs to your score.
• Readiness or recovery scores, where your device produces them. Oura rings do; Fitbit devices do not.

Two of those deserve saying plainly, because "heart rate" and "activity" can sound like less than they are. The heart-rate record is a continuous five-minute trace of your entire day — roughly 288 readings, and about 135 more at one-minute detail around waking — not a daily average. And on a device that reports the movement classification, the activity record is minute by minute for the whole day, not only around waking: that, the sedentary periods and the minute-by-minute morning step counts together form a timeline of when you were still, when you first moved, and roughly how hard you were moving at any point in the day. Read together, those describe the shape of your day and the hour you got up, not only your health, and they are stored for as long as you keep the account.

Values PEM Tracker works out from the above

These do not come from your device. They are calculated here and stored alongside the measurements:

• Your PEM estimate, and the individual components behind it.
• A standing heart-rate rise, comparing a quiet minute before you first get out of bed with the minutes just after, used as a rough personal indicator of how well you are tolerating being upright. Your first few steps are used to work out when you stood up. This is not a test for POTS or for anything else — a wrist device cannot tell whether you are standing up — and the clinical thresholds you may have read about do not apply to it.
• Sleep efficiency, time in each sleep stage, and a heart-rate and variability curve for each night.
• Daily totals for active minutes, for time spent inactive, and — on an Oura ring — for the calories your device estimates you burned through activity.
• Sleep fragmentation — the number of brief awakenings in each night, how many there were per hour asleep, and how many times your sleep shifted from one stage to another.
• A nightly blood-oxygen low point — the lowest blood-oxygen reading of the night, and how much that reading moved across the night.
• Heart-rate lability — how much your heart rate swings from moment to moment within a short window, worked out separately for your waking hours and for the night. This is a different measure from the daily heart-rate-variability figure listed further up.
• From each ECG reading: your heart rate, heart rate variability, how much of that variability follows your breathing and a breathing rate, which beats needed correcting, and whether the reading was clear enough to use. This is worked out on this service's own server, and no other company is involved.
• Two nightly figures from the overnight heart-rate-variability readings: the middle level of the faster, breathing-linked rhythm while you slept, and the lowest level of the slower rhythm that night.
• Overnight strain — a figure from 0 to 100 combining five overnight measures (how much heart rate variability rose through the night, breathing rate, sleep efficiency, and overnight heart rate and its lowest point), each compared with your own earlier nights.

Information you enter yourself

• Daily symptom ratings and exertion entries you type into the questionnaire
• Any notes you choose to add

Technical records

• A security log of sign-ins, sign-outs, and account changes, with IP address and timestamp. This exists to detect unauthorised access, and for no other purpose.
• A record of each time your health data is read or written, noting whether it was you or the operator. This is what makes the statement further down — that operator access happens only when running or repairing the service — something you can check rather than something you have to take on trust.

What is never collected

• No advertising identifiers, no analytics, no third-party scripts, no tracking pixels
• No location or GPS data
• No contacts, messages, photos, or files
• No payment information — the service is free and has no billing

Your consent

Health information is sensitive, so it is only collected after you have explicitly agreed to this policy and to the Terms of Service. Agreement is a deliberate step at sign-in — not something inferred from continuing to use the service, and not a pre-ticked box.

• Your agreement is recorded with the date and the version of the documents you were shown, so it is always clear what you actually agreed to.
• If these documents change in a way that affects what happens to your information, you are asked again rather than carried over on the old agreement.
• You can withdraw your agreement. Withdrawal is recorded alongside the original — the history is kept intact rather than overwritten — and it stops further collection. Withdrawing is not the same as deleting: if you want the stored data gone as well, use the delete option, which is permanent.

How your data is used

To produce your dashboard and PEM estimates, to improve how PEM is detected, and to keep your account secure. Specifically, your data is not:

• sold, rented, or licensed to anyone;
• shared with advertisers, data brokers, insurers, or employers;
• published, or shared outside this service in any form.

PEM detection is calibrated individually: your personal thresholds are derived from your own history and applied to your account alone.

Where your data is stored

On a self-hosted server operated privately in Alberta, Canada. It is not a commercial cloud platform, and no third-party processor holds a copy.

• Each account's files are stored in a separate, access-restricted directory, reachable only through a request that has already established which account it belongs to.
• If you connect a wearable, its access token is encrypted where it is stored.
• All traffic between your browser and the service is encrypted with TLS.
• The security log is written so that later alteration of it is detectable.

Who can access your data

• You — through your own account.
• The operator — the person who runs the server necessarily has administrative access to the machine, and therefore the technical ability to read stored data. This is stated plainly rather than implied: no claim is made that your data is inaccessible to the operator. It is accessed only when required to run, repair, or secure the service, or to evaluate a possible improvement to it as described below — and each such access is recorded, so you can ask for the record of who has read your data and when.
• Nobody else. There are no employees, contractors, or sub-processors.

Data would only be disclosed to a third party if required by a valid Canadian legal order.

Evaluating a possible new measurement

Deciding whether a new measurement is worth collecting requires looking at it first. There is a separate operator tool for that, and this section exists because it would otherwise be the one kind of access the description above does not quite cover.

The alternative was worse, and it is worth saying why. Without this tool, the only way to obtain a measurement was to add it to the ongoing collection list for everyone, permanently — which meant asking you to agree to collecting something before anyone knew whether it was useful, and asking again to stop. Repeated agreement requests make agreement meaningless. So evaluation is deliberately separated from collection: a measurement can be looked at once, and only becomes part of what is collected on an ongoing basis if it proves out — at which point it is named in this policy and you are asked, once, with a reason.

What that tool can and cannot do:

• It cannot widen what you have permitted. It refuses unless the permission group covering the measurement has already been granted by you. It never asks your device provider for anything new.
• It refuses unless your agreement to this policy is current, and unless your device connection is active. Withdrawing either stops it.
• It reads a bounded window — at most 120 days — not your whole record.
• Each use is written to the tamper-evident record before your credential is used, so an evaluation that fails partway through still appears. It is recorded against your account and you can ask for it, like any other access.
• Anything retrieved is stored inside your own record, not in a separate working area. That is deliberate: it means deleting your account deletes it too, and exporting your data exports it too, without either of those depending on someone remembering that this data exists.

Measurements obtained this way are not part of ongoing collection and are not listed above as collected data, because they are not being collected — they were looked at once. If one is ever promoted to ongoing collection, this policy is updated to name it in the list above and you are asked to agree again before it begins.

Retention and deletion

Your health data is kept until you delete it. There is no fixed retention period, and inactive accounts are not harvested. It is the record you came here to build, so nothing ages it out on your behalf.

The operational records around it are a different matter, and they are cleared on a schedule rather than accumulating indefinitely. As currently configured:

• Security events — around two years.
• Records of who read or wrote your data — around one year.
• Ended or expired sign-in sessions — around a month.

Deleting your account permanently removes your wearable data, questionnaire responses, stored access tokens, active sessions, and your account record. Entries in the security log are retained, but identifying details are stripped so the remaining record cannot be traced back to you.

You can also disconnect PEM Tracker from your Google account at any time at myaccount.google.com/permissions. Doing so stops any further data being retrieved; it does not by itself delete data already stored, so use the in-app delete if you want everything gone.

Backups

The server takes routine snapshots so the service can be restored after a failure. A deleted account may persist in a snapshot until that snapshot ages out, normally within 14 days. Snapshots are stored on the same private hardware and are not sent to any third party.

If something goes wrong

No service can promise it will never have a security incident, and this policy does not pretend otherwise. What it can describe is what happens if one occurs.

• Incidents affecting the security of stored information are recorded when discovered, including those that turn out to be minor.
• Each one is assessed for whether it creates a real risk of significant harm to the people involved, with the reasoning written down at the time.
• Where that risk exists, the people affected are told, and the incident is reported to the relevant privacy commissioner.

You can also raise a concern yourself at any time using the contact address below. If you are not satisfied with the response, you can take it to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner of Alberta.

Cookies

One cookie is set, and only after you sign in. It identifies your session so you stay logged in. It is not used for tracking, profiling, or advertising, and it is cleared when you sign out. No other cookies are set.

A session also ends on its own after a stretch without use, so an unattended or forgotten browser does not stay signed in indefinitely.

Your choices

• Connecting a wearable device is optional; the questionnaire works without one.
• You can disconnect a device without deleting your account.
• You can export your data at any time — including everything you entered yourself, which exists nowhere else. See the Terms of Service for what an export contains.
• You can delete your account and all associated data at any time.
• You can ask for a copy of the record of who has accessed your data.
• You can withdraw your agreement to this policy without deleting your account.

Children

The service is not intended for anyone under 16, and accounts are issued by invitation only.

Changes to this policy

If this policy changes in a way that materially affects how your data is handled, you will be told before the change takes effect, and asked to review it at your next sign-in.

Contact

Questions, access requests, or complaints: admin@multimail.space.