Last updated: 27 July 2026
We, PARI Pharma GmbH (‘PARI’), based in Starnberg, are part of the PARI Group. We work passionately towards a world in which everyone can breathe freely. To this end, we develop innovative, high-quality and scientifically tested products to treat respiratory diseases.
The PARI Connect app (‘app’) has been specifically developed for patients with a chronic lung condition and can only be used in conjunction with an eTrack controller. The aim is to support patients and carers during treatment and to provide them with a treatment management tool.
This privacy policy applies to our mobile iOS and Android apps. We store and process your health data only with your consent. In this privacy policy, we explain the nature, purpose and scope of data collection in the context of use of the app. We would like to point out that online data transfer may be vulnerable to security breaches. Data cannot be completely protected against access by third parties.
We are aware of our responsibility towards you and your data. We will handle your data with the greatest of care at all times and in compliance with the applicable data protection regulations.
The ‘controller’ for processing your ‘personal data’ under the data protection regulations is ourselves,
PARI Pharma GmbH
Moosstrasse 3
82319 Starnberg
Germany
You can reach our data protection officer as follows:
PARI Pharma GmbH
Data protection officer
Moosstrasse 3
82319 Starnberg, Germany
or
4.1. Registration
What categories of personal data do we process under this data processing activity?
PARI Pharma GmbH will create a user account for you. We require an email address, a password and a nickname to do so.
Please create a nickname that does not allow any conclusions to be drawn about your name. Also with respect to the email address you enter, you may use an address that does not allow any conclusions to be drawn about your name. This allows you to protect your identity too.
Once you have successfully registered, we will send you a confirmation email to the email address you entered.
What do we process your personal data for when you register?
Data processing is carried out to provide your user account.
What is the legal basis for this data processing activity?
The legal basis for this is the performance of a contract with you concerning use of the app as per Art. 6 (1), sentence 1, (b) of the GDPR / UK GDPR.
Who do we share your personal data with during this data processing activity?
We will not share your data with third parties unless you explicitly enable this in the app to give your doctor access. More information about this can be found under the section on data recipients and the ‘Share data’ function (see below).
4.2. Multi-factor authentication
What categories of personal data do we process under this data processing activity?
Multi-factor authentication can be set up to additionally restrict access to the app. A mobile phone number is used for this. Ideally, this should be a different mobile phone number to the one for your device where you install the app. The mobile phone number stored in your user account is also saved for this purpose. You then receive an additional PIN as an SMS to log into the app. Alternatively, you can set up a passkey. When you log in using a passkey, we only process the data required for this purpose, in particular the public part of the passkey, device-related identifiers and technical verification values. Private keys and biometric data remain exclusively on your device.
What is the legal basis for this data processing activity?
Processing takes place based on Art. 6 (1) (b) of the GDPR / UK GDPR, to provide a secure login process, supplemented by Art. 6 (1) (f) of the GDPR / UK GDPR, based on our legitimate interest in ensuring our systems’ security.
Who do we share your personal data with during this data processing activity?
The creation, management and any cloud-based synchronisation of the associated private key only takes place locally on your terminal device or by means of the services you have selected within your operating system (e.g. Apple iCloud Keychain, Google Password Manager or a Microsoft account). PARI has no influence over this synchronisation process or over any related transfers of data by the operating system providers to third countries (such as the USA). The platform providers in question are responsible for this data processing activity as part of your user relationship with them. More information about how these processing activities are safeguarded can be found in your operating system provider’s privacy policy.
4.3. Data processing in the context of app functions, data storage and data management
What do we process your personal data for during these data processing activities?
We store data in the app so you can view and retrieve it at any time.
The following additional data can be specified for the app’s above functions:
Height, date of birth, manual information about treatment performance, appointments, medication, activities, and vital parameters such as weight, oxygen saturation, lung function and blood sugar.
What is the legal basis for these data processing activities?
You provide your personal data and health data on a voluntary basis. Processing of this data is based on your consent as per Art. 6 (1), sentence 1, (a) and Art. 9 (2) (a) of the GDPR / UK GDPR. You may revoke this consent at any time with effect for the future. The lawfulness of processing carried out based on consent up until revocation of the same is not affected by such revocation, however. You may send your revocation to datenschutzpari.com at any time. Please note that the processing of this personal data is necessary to guarantee all of the app’s functionalities.
Who do we share your data with during this data processing activity?
Your data will not be disclosed to third parties unless you actively grant your doctor or a treatment buddy access to your data, in accordance with your chosen settings, using the ‘Share data’ or ‘Invite buddy’ functions. More information about this can be found under the section on data recipients (see below).
What do we process your personal data for during these data processing activities?
PARI can anonymise the data collected during your use of the app to remove any references to you as an individual. The anonymised data is no longer personal data. What characterises anonymised data is the fact that it lacks any references to specific individuals, and this information can also no longer be recovered following the anonymisation process. We use the anonymised data, among other things, for scientific research and statistical purposes, and particularly for the purpose of evaluating, communicating and (if necessary) proving the effect, use and benefits of the app.
What is the legal basis for these data processing activities?
The anonymisation processing activity takes place based on Art. 9 (2) (j) of the GDPR / UK GDPR.
Who do we share your data with during this data processing activity?
The data is not disclosed to third parties for the anonymisation process.
The app itself does not use cookies. However, in some country versions, we have integrated important information and content from our website within the app for you. Only technically necessary cookies are used if you use these functions. No advertising or statistical tracking takes place. The legal basis is our legitimate interest as per Art. 6 (1) (f) of the GDPR / UK GDPR. Our interest is to provide user-friendly presentations in the app.
Information about data processing can be found on our website at: https://www.pari.com/en/data-protection/privacy-policy-internet/
Our app transfers the data you enter in the app to a PARI-managed service in the AWS cloud for secure storage and to provide you with the desired app features. For transfer, the data is encrypted for security reasons and to protect the transfer of confidential content. This encryption prevents the data you transfer from being read by unauthorised third parties. The data is also stored in encrypted form on the server.
We work with Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg, Luxembourg (‘AWS’) and ‘Google Analytics Firebase’ (Google Ireland Limited, based at Gordon House, Barrow Street, Dublin 4, Ireland) as partners for technical implementation and management of the app. We have concluded appropriate contracts (in particular processing contracts) to ensure that your personal data is processed according to the statutory requirements. Processors are not third parties. See (16) below for information about potential data transfers to third countries.
Your data may be viewed by the following recipients. Some of them only have access to pseudonymised data.
Minors may only use our app before the age of 16 with the consent of a parent or guardian. Use of the app is prohibited if a parent or guardian does not consent to the processing of the minor’s personal data. You therefore confirm to us that you are at least 16 years old, or that your parents have consented to you using the app, during the registration process.
We require the following access permissions to provide our services through the app: (i) Bluetooth; (ii) also Wi-Fi if you choose to transfer data over Wi-Fi; and (iii) your smartphone’s microphone if you use the cough detection function.
If you contact us (e.g. using the contact form within the app, or by email, phone or fax), we will store and process your enquiry, including all personal data resulting from the same (e.g. name, enquiry), for the purpose of processing your enquiry. The legal basis for processing is our legitimate interest in responding to your enquiry, as per Art. 6 (1), sentence 1, (f) of the GDPR / UK GDPR.
Google Analytics Firebase
In the Android version of the app, we use Google Analytics Firebase (hereinafter referred to as ‘Google Firebase’) to analyse app crashes (Firebase Crashlytics) and to send push notifications. The provider is Google Inc., Google Ireland Limited, based at Gordon House, Barrow Street, Dublin 4, Ireland.
Google Firebase stores information for these purposes, including the number and duration of sessions, operating systems, device models and region.
The use of Google Firebase may involve transferring your personal data to the USA. The storage period for the data collected in this way is a maximum of 14 months.
Google Firebase is used to send push notifications for the purpose of performance of our contract with you concerning use of the app as per Art. 6 (1), sentence 1, (b) of the GDPR / UK GDPR.
Data is processed for the purpose of analysing crash reports based on your consent to data processing under Art. 6 (1), sentence 1, (a) and Art. 9 (2) (a) of the GDPR / UK GDPR, and corresponding national legislation.
More information about Google Firebase can be found at:
https://www.firebase.com/terms/privacy-policy.html
During transfer to Google Analytics Firebase, your data is encrypted using the HyperText Transfer Protocol Secure (HTTPS) and transferred over logically separate network infrastructures. More information about the above-mentioned protection measures can be found at https://firebase.google.com/support/privacy. Alternatively, you are welcome to contact us by email on the above-mentioned contact address.
iOS developer reports
If you have activated the sharing of iPhone analytics data with Apple Inc. and its subsidiaries in your iPhone settings, we may also gain access to anonymised crash reports from Apple Inc. These crash reports contain, among other things, anonymised information about operating system specifications and performance and usage statistics, but no personal data.
We analyse your data in pseudonymised form as part of our efforts to improve our products. This is a legitimate interest as per Art. 6 (1) (f) of the GDPR / UK GDPR. When you use our app, your behaviour and the app’s usage behaviour may be statistically evaluated and analysed to improve our products. These analyses take place internally. Your pseudonymised data is not disclosed to third parties.
All data processed with the app is processed on servers belonging to Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg, Luxembourg (‘AWS’). Data processing takes place within the EU.
The use of AWS results in data being transferred to AWS and, under certain circumstances, from AWS to Amazon Inc. in the US. Amazon Inc. may process the data transferred to it to create anonymised user profiles for statistical purposes. We generally have no influence over such data processing. AWS is therefore responsible for this data processing activity.
AWS has implemented compliance measures for international data transfers. These apply to all of AWS’s activities worldwide in which it processes personal data belonging to natural persons based in the EU and the UK. Data transfers to the US are based on the standard contractual clauses (SCCs). Further details can be found here: aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/.
AWS is also an active participant in the EU-US Data Privacy Framework, including the UK Extension, which governs the correct and secure transfer of personal data belonging to EU and UK citizens to the US. Through the EU-US Data Privacy Framework, including the UK Extension, and through the SCCs, AWS undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and managed in the US.
For more information about how user data is handled, please refer to AWS’s privacy policy: https://aws.amazon.com/en/privacy/?nc1=f_pr. Google may also transfer your data to the USA. Google is an active participant in the EU-US Data Privacy Framework, including the UK Extension, which governs the correct and secure transfer of personal data belonging to EU and UK citizens to the US. Google also uses standard contractual clauses (SCCs). Through the EU-US Data Privacy Framework, including the UK Extension, and through the SCCs, Google undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and managed in the US. For more information, please refer to: https://policies.google.com/privacy?hl=en.
With regard to the optional use of passkeys and any related cloud-based synchronisation of the private key by your operating system provider (e.g. Apple or Microsoft) to third countries, please refer to the clarification given above under the section entitled ‘(4.2) Passkey’ above. As this transfer takes place entirely within your own personal user environment, PARI does not itself carry out any separate transfer to third countries in this respect and has no influence over this data processing activity.
Unless expressly stated otherwise in this privacy policy, the data stored in connection with this app will be deleted once it is no longer required for the purpose for which it was collected, provided that there are no statutory retention requirements precluding deletion of the same – e.g. in the case of data that must be retained for reasons under commercial or tax law. According to national statutory requirements, retention may be required for up to 10 years on grounds relating to commercial and tax law.
You also have the right to revoke your consent to the processing of your data, to request that your data be deleted, or to object to the processing of your data. We will then delete all of your data if we are not subject to any statutory retention requirements.
Your data will also be deleted as follows:
Once you have not used the app for 12 consecutive months (i.e. you have become inactive), we will ask you by email whether you wish to continue using the app. We will delete all of your data if you do not log into the app within 28 days of that email notification.
You have the right at any time to request that we grant you access to the data stored about you (Art. 15 of the GDPR / UK GDPR). This also applies to the recipients or categories of recipients that the data is disclosed to, and the purpose and duration of storage.
You also have the right to request rectification under the conditions set out in Art. 16 of the GDPR / UK GDPR, the right to request erasure under the conditions set out in Art. 17 of the GDPR / UK GDPR, and the right to request restriction of processing under the conditions set out in Art. 18 of the GDPR / UK GDPR.
If personal data is processed for the performance of tasks carried out in the public interest (Art. 6 (1), sentence 1, (e) of the GDPR / UK GDPR) or to safeguard legitimate interests (Art. 6 (1), sentence 1, (f) of the GDPR / UK GDPR), you can object to the processing of your personal data at any time with effect for the future. If you file an objection, we must refrain from any further processing of your data for the aforementioned purposes, unless we can demonstrate compelling and legitimate grounds for processing that outweigh your interests, rights and freedoms, or processing is necessary for the establishment, exercise or defence of legal claims.
Under the conditions set out in Art. 21 (1) of the GDPR / UK GDPR, data processing may be objected to on grounds relating to the data subject’s particular situation.
Furthermore, you may request a data transfer at any time under the conditions set out in Art. 20 of the GDPR / UK GDPR.
Please contact datenschutzpari.com to exercise these rights
You have the right to lodge a complaint with a data protection supervisory authority without prejudice to any other administrative or judicial remedy. You may contact the data protection supervisory authority in your usual place of residence or our company headquarters for this purpose.
If you use the app within a study, personal data may, in the context of that study, also be processed jointly with the study’s controller, as per Art. 26 of the GDPR / UK GDPR. Please get in touch with your study’s controller if you have any questions about this. More information about data processing within the study can be found in the detailed patient information and the privacy notices relating to taking part in the study, which you will receive from the study’s controller. The study’s controller is also the point of contact for any enquiries you may have.
We reserve the right to modify our security and data protection measures if this becomes necessary due to technical developments. In such cases, we will also adapt our privacy policy accordingly. Please, therefore, ensure that you have accessed the latest version of our privacy policy in each case.
The current version of our privacy policy can be found in the app under ‘More’.