HTM°Solutions Privacy Policy

Company-wide privacy notice covering the website, business contacts, HTM Heat Tracking and research activities

Document ID HTM-POL-001

Version Final v1.0

Effective date: 6 August 2026

Document owner: HTM°Solutions Oy

Contents

1. Introduction and scope

2. Data controller

3. Website visitors

4. Marketing and business relationships

5. HTM Heat Tracking application

6. Research and validation activities

7. Third-party services

8. International data transfers

9. Legal bases for processing

10. Data minimisation

11. Data retention

12. Information security

13. Your rights

14. Account deletion

15. Children

16. Changes to this Privacy Policy

17. Contact information

‍

1. Introduction and scope

HTM°Solutions Oy ("HTM", "we", "our" or "us") is committed to protecting the privacy and personal data of our customers, website visitors, prospective customers, partners, distributors, research collaborators and users of our digital services.

This Privacy Policy explains what personal data we collect, why and how we process it, the parties with whom it may be shared, how long it is retained, and the rights available to individuals under applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

This Privacy Policy applies to:

·       the HTM°Solutions website and online forms;

·       marketing, sales, customer, partner and supplier relationships;

·       HTM mobile applications, including HTM Heat Tracking;

·       HTM cloud and support services; and

·       research and validation activities in which HTM acts as a controller or joint controller.

Where a customer, research organisation or other partner determines the purposes and means of processing, HTM may act as a processor. In such cases, the relevant agreement and the customer or partner privacy notice may also apply.

2. Data controller

Unless otherwise stated, the controller of the personal data described in this Privacy Policy is:

HTM°Solutions Oy
Passipolku 6
FI-02330 Espoo
Finland

Email: info@htmsolutions.fi

Website: https://www.htmsolutions.fi

3. Website visitors

When you visit our website, we may process technical and usage information necessary to operate, secure and improve the website. Depending on the services and cookie choices in use, this may include:

·       IP address and approximate location derived from the IP address;

·       browser type, device type and operating system;

·       pages visited, referral source, date, time and duration of the visit;

·       cookie identifiers and similar technologies; and

·       information submitted through contact, demo or other online forms.

We use this information to operate and secure the website, respond to requests, understand website performance and improve content and usability. Where non-essential cookies or analytics are used, we request consent as required by law. Further information is provided through our cookie notice or consent management tool.

4. Marketing and business relationships

HTM primarily operates in the business-to-business market. We may process personal data relating to prospective and existing customers, partners, distributors, investors, suppliers, research organisations, universities, public authorities and other professional contacts.

The data may include:

·       name, business email address and telephone number;

·       company, organisation, role, job title and country;

·       communication history, meeting notes and event participation;

·       commercial, project and contractual information; and

·       marketing preferences and consent records.

The information may be obtained directly from you, from your organisation, from public business sources, from professional networking services such as LinkedIn, or through events, meetings, referrals and correspondence.

We process this data to respond to enquiries, arrange demonstrations, prepare quotations, manage customer and partner relationships, perform contracts, administer projects, provide support and send relevant business communications. We may send marketing communications where permitted by applicable law or where consent has been provided. Recipients can unsubscribe at any time.

We do not use contact details collected through the HTM Heat Tracking application for marketing unless the individual has separately opted in or another lawful basis applies.

5. HTM Heat Tracking application

This section applies specifically to users of the HTM Heat Tracking mobile application and related cloud services.

5.1 Account and profile information

We process an email address, a unique user identifier and an optional display name or pseudonym. In professional deployments, the display name may be an employee number or other pseudonymous identifier used by authorised supervisors to distinguish users in live monitoring views.

User profile information and push notification functions are managed using Google Firebase services. Authentication credentials are handled through the relevant authentication service. HTM does not store users’ passwords in readable form.

5.2 Exercise and fitness information

For each exercise, we may process:

·       exercise name;

·       start and end time;

·       duration;

·       exercise history; and

·       related session metadata required to provide live monitoring and post-exercise review.

An exercise must have a name so that it can be identified and reviewed later.

5.3 Health and physiological information

During an exercise, the application receives heart-rate data from a compatible wearable device. Using heart rate, environmental data and HTM proprietary models, the application calculates physiological indicators such as:

·       estimated core body temperature;

·       Physiological Strain Index (PSI) or other heat-strain indicators;

·       estimated sweating or sweat loss; and

·       other physiological metrics made available in the service.

Exercise results and physiological measurements are stored in HTM backend services, including a PostgreSQL database, so that authorised users can review and analyse completed exercises.

HTM Heat Tracking is currently offered as an activity and fitness application and is not represented in this Privacy Policy as a certified medical device or diagnostic service.

5.4 Location and environmental information

Precise location is required while a live exercise is active. It is used to determine local environmental conditions, such as ambient temperature and relative humidity, which are required for heat-strain calculations. The application does not use location when a live exercise is not active.

The latest location used during a live exercise may be stored with the exercise record. Without the required location permission, a live exercise cannot be started.

5.5 Connected devices and identifiers

To pair, identify and manage compatible wearable devices, we may process:

·       mobile device model and operating system version;

·       paired wearable device manufacturer and model;

·       wearable serial number, model ID or other device identifier;

·       firmware and battery information where available; and

·       connection and synchronisation timestamps.

These identifiers are used for device pairing, synchronisation, support and reliable delivery of application functionality.

5.6 Notifications

HTM Heat Tracking uses Firebase Cloud Messaging to provide optional Android notifications when the application is running in the background. Notifications may display heart rate, estimated core temperature, PSI and estimated sweating information.

Notification messages are not stored as a separate message history by HTM. Users may disable notifications in their device settings, although some background functionality and situational awareness may then be limited. Exercises can still be started without notifications.

5.7 Diagnostics and performance

We use Sentry for crash reporting, diagnostics and application performance monitoring. Sentry may process crash logs, stack traces, application version, device and operating system details, network and performance data, and technical identifiers needed to diagnose errors and improve reliability.

These diagnostics are not used for advertising or marketing and cannot currently be disabled by the user within the application.

6. Research and validation activities

HTM participates in research, development and validation projects with universities, research institutes, occupational health and safety organisations, healthcare organisations and other partners.

Research projects are conducted under separate agreements defining the roles and responsibilities of the participating organisations. Where required, projects are subject to applicable ethical approvals, informed-consent procedures and data protection requirements.

Research and validation data are anonymised or pseudonymised where appropriate. The specific privacy information, legal basis, retention period and data-controller roles for a research project may be provided separately to participants.

7. Third-party services and data sharing

HTM does not sell or rent personal data. We may disclose personal data only where necessary and lawful, including to service providers acting on our behalf, professional advisers, authorities where required by law, or parties involved in a corporate transaction.

The services used in connection with HTM Heat Tracking currently include:

·       Google Firebase for user profiles, authentication-related functions and push notifications;

·       HTM backend and PostgreSQL database services for exercise and physiological data; and

·       Sentry for crash reporting, diagnostics and performance monitoring.

Service providers are required to process personal data only in accordance with HTM instructions, applicable agreements and data protection law. HTM remains responsible for selecting appropriate providers and contractual safeguards.

8. International data transfers

HTM configures its cloud services to store customer data within the European Union where such options are available. For example, Sentry is configured to use its European data region (Frankfurt, Germany), and Google services are configured to use European data locations where available. Some service providers may process limited operational metadata outside the EEA in accordance with applicable data protection legislation and appropriate contractual safeguards.

9. Legal bases for processing

Depending on the context, HTM processes personal data on one or more of the following legal bases:

·       performance of a contract or steps requested before entering into a contract;

·       compliance with a legal obligation;

·       legitimate interests, such as operating and securing services, managing business relationships, improving reliability and preventing misuse, provided that such interests are not overridden by individual rights; and

·       consent, where required, including certain marketing, cookie, research or optional processing activities.

Special-category data, including health information, are processed only where a valid legal basis and an applicable condition under Article 9 of the GDPR are available, such as explicit consent, employment or occupational-health arrangements permitted by law, scientific research safeguards, or another applicable legal ground.

10. Data minimisation

HTM is committed to collecting and retaining only the personal data reasonably necessary for the purposes described in this Privacy Policy. We periodically review our data flows, permissions and retention practices to reduce unnecessary processing and support pseudonymous use where appropriate.

11. Data retention

We retain personal data only for as long as necessary for the purpose for which it was collected, to provide services, manage customer and business relationships, comply with contractual and legal obligations, establish or defend legal claims, and maintain security and audit records.

Retention periods vary depending on the data category, contractual requirements, research protocol and applicable law. Following a verified account-deletion request, application account data are normally deleted within 30 days unless certain information must be retained for legal, regulatory, security, audit or dispute-resolution purposes.

12. Information security

HTM implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, misuse or destruction. Measures may include encrypted communications, access controls, authentication mechanisms, logging, backup procedures, vulnerability management, software updates and contractual controls for service providers.

No method of transmission or storage is completely secure. HTM continuously evaluates and improves its security practices in proportion to the risks and nature of the processing.

13. Your rights

Subject to applicable law, you may have the right to:

·       obtain confirmation of whether your personal data are processed and request access;

·       request correction of inaccurate or incomplete data;

·       request deletion of personal data;

·       request restriction of processing;

·       object to processing based on legitimate interests or to direct marketing;

·       withdraw consent at any time where processing is based on consent;

·       request data portability where applicable; and

·       lodge a complaint with a competent supervisory authority.

To exercise your rights, contact info@htmsolutions.fi. We may request information necessary to verify your identity. Rights may be subject to limitations under applicable law.

14. Account deletion

Users of HTM Heat Tracking may request deletion of their account and associated personal data by following the instructions on our Account Deletion page:

https://www.htmsolutions.fi/account-deletion

15. Children

HTM services are intended for professional and adult users and are not directed to children. We do not knowingly collect personal data from children through HTM Heat Tracking without an appropriate legal basis and any required authorisation. If you believe that a child’s data have been provided to us inappropriately, please contact us.

16. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, legal requirements or business practices. The latest version and its effective date will be published on our website. Material changes may also be communicated through the application, email or another appropriate channel.

17. Contact information

Questions, requests or concerns relating to this Privacy Policy or the processing of personal data may be sent to:

HTM°Solutions Oy
Passipolku 6
FI-02330 Espoo
Finland

Email: info@htmsolutions.fi

Website: https://www.htmsolutions.fi

We encourage individuals to contact us first so that we can address privacy-related questions promptly and transparently. Individuals also have the right to contact the Finnish Data Protection Ombudsman or another competent supervisory authority.

‍

‍