Privacy Policy

Company Information

Bionet Co., Ltd.

This App is developed and operated by Bionet Co., Ltd. and distributed through Sommet Inc. Bionet Co., Ltd. is responsible for all personal information processing.

1. Information We Collect

We collect only the minimum personal information necessary to provide our services.

1.1 Account Information (Stored in AWS Cognito)

1.2 Service Usage Information (Firebase Analytics)

1.3 Information We Do NOT Collect

The following information is NOT transmitted to external servers and is stored only locally on your device:

The following information is NOT collected at all:

• Medical records or diagnostic information
• GPS location data (Note: On Android, system location permission may be requested for Bluetooth device scanning. This is a technical requirement of the operating system. CUROfit does not collect, store, or transmit your location data.)
• Financial or payment information
• Social Security numbers or government-issued IDs
• Contacts, photos, call history

2. How We Collect Information

2.1 Information You Provide

• Name and email address entered during account creation

2.2 Automatically Collected

• App usage statistics through Firebase Analytics (anonymized)
• Basic analytics data through app stores (Google Play, App Store)

2.3 NOT Collected

The following are NOT subject to collection:

• Biometric data measured from CURO pace device
• Personal basic information entered directly in the app (date of birth, gender, etc.) and contact information (phone number)

Explanation: The above data is processed only within the user's mobile device and is not transmitted to company servers.

2.4 App Permissions

CUROfit may request the following device permissions:

These permissions are used only for device connection functionality. No personal information is collected through these permissions.

3. Data Storage and Security

3.1 Storage Locations

3.2 Security Measures

Technical Security

• Data at rest: AES-256 encryption (account), device-level encryption (local)
• Data in transit: TLS 1.2 or higher (app-to-server)
• BLE communication: BLE 4.0+ standard pairing security
• Authentication: AWS Cognito secure authentication, 8-digit PIN code authentication

BLE Communication Security

BLE communication with CURO pace device does not apply separate application-level encryption:

1. Data Storage Method: Biometric data is stored locally on the device only and is not transmitted externally
2. Transmission Range: BLE communication occurs only between the device and the user's own mobile device (within 10m)
3. Security Measures: BLE 4.0+ standard pairing security applied, only paired devices can receive data

Administrative Security

• Minimized personal information access rights (role-based access control)
• Employee privacy protection training
• Access log recording and regular audits
• Internal management plan for personal information processing
• Designation and authority management of personal information handlers

4. Data Retention and Deletion

4.1 Retention Period

4.2 Deletion Procedure

• In-app deletion: Settings > Account > Delete Account
• Web deletion request: https://apps.ebionet.com/curofit/account-deletion/
• Email request: security@ebionet.com
• Processing time: Response within 10 days of request (PIPA); within 30 days (GDPR/CCPA). Deletion completed within 30 days.
• Local data: Automatically deleted when app is uninstalled
• Service operation records (customer request processing history, etc.): Deleted within 30 days after account deletion

4.3 Deletion Method

• Electronic files: Permanently deleted using irreversible methods
• Paper documents: Shredded or incinerated

5. Third-Party Disclosure

5.1 Principle

We do NOT sell, rent, or share your personal information with third parties.

5.2 Exceptions

Personal information may be disclosed only in the following cases:

• With your explicit consent
• When required by law
• Upon request by investigative authorities following legal procedures

6. Data Processing Outsourcing

6.1 Outsourcing Status

6.2 Outsourcing Management

• Privacy protection obligations specified in outsourcing contracts
• Regular audits of contractors' personal information processing status

7. International Data Transfer

7.1 Transfer Status

7.2 Safeguards

• Standard Contractual Clauses (SCCs) applied
• Data processing agreements executed
• Encrypted transmission (TLS 1.2+)

8. Your Privacy Rights

8.1 Rights Content

8.2 How to Exercise Rights

• Personal information management and deletion: Settings > Profile
• Measurement data management: Settings > Data Management
• Web account deletion request: https://apps.ebionet.com/curofit/account-deletion/
• Email: security@ebionet.com
• Response time: Within 10 days of request (PIPA); within 30 days (GDPR/CCPA). Deletion completed within 30 days.

8.3 Local Data

Data stored locally (biometric measurements, personal basic information) is managed directly by the user:

• Delete individual data within the app
• Reset all data in app settings
• All local data is deleted when the app is uninstalled

9. Analytics and Tracking

9.1 Firebase Analytics

We use Firebase Analytics to improve our services.

What we collect:

• App launches and session duration
• Screen views and user flows
• Device information (model, OS version)
• Country/region (country level only)
• Crash and error reports

9.2 How to Opt Out

You can limit analytics data collection through device settings:

• iOS: Settings > Privacy & Security > Tracking > Disable "Allow Apps to Request to Track"
• Android: Settings > Google > Ads > Opt out of Ads Personalization

9.3 No Disadvantage for Opt-Out

Opting out of analytics collection does not restrict your use of the service.

10. Children's Privacy

CUROfit is not intended for children under the following ages:

• United States: Under 13 years of age (COPPA)
• Republic of Korea: Under 14 years of age (PIPA)
• EEA/UK: Under 16 years of age (GDPR)

11. Personal Information Protection Officer

12. Complaints and Remedies

If you believe your privacy rights have been violated, you may contact the following authorities:

Korea

United States (California)

• California Attorney General: oag.ca.gov/privacy

European Union

• Contact your local Data Protection Authority (DPA)

13. Changes to This Privacy Policy

13.1 Change Notification

• Minor changes: Posted within the app
• Material changes: Email or in-app notification at least 7 days before effective date

13.2 Effectiveness

Modified policy becomes effective from the effective date.

14. Future Feature Expansion Notice

When cloud backup or premium features are introduced in the future, separate consent will be obtained for the collection of additional personal information (date of birth, gender, biometric data, etc.).

Document History