Kardi Ai

GDPR overview

Implementation is concrete rather than declarative. The privacy policy, dated 1 October 2025, is issued expressly under Regulation (EU) 2016/679, names Articles 6(1)(a) and 9(2)(a) as the basis for processing health data, spells out seven data subject rights, sets a one-month response deadline extendable by two, and names the Czech supervisory authority with its Prague address. It states that data belonging to EEA citizens is not transferred outside the EU, and lists adequacy decisions, the EU-US Data Privacy Framework and standard contractual clauses for other cases. Gaps remain: no named subprocessor list, no customer-facing data processing agreement, no designated data protection officer, and a second privacy notice on the same site still dated 2022 and written for a different domain.

Who owns the data?

KARDI AI Technologies s.r.o. is named in the privacy policy as the controller of all personal and health data, and reachable at support@kardi.ai. Healthcare providers who sell the device with the application also gain access to the health data and act as independent controllers in their own right. The chest strap itself becomes the user's property once handed over and the first subscription is paid. Users keep the full set of GDPR rights, including erasure and portability, but the policy warns that measured values can no longer be retrieved once an account is deactivated. A unique QR code ties an account to its data, and the vendor may deactivate it when a subscription lapses.

Reuse rights

Users can obtain their own records and have them sent to another controller under the GDPR portability right, in a structured, commonly used and machine-readable format, and the terms let them pass their personal QR code to any third party they choose, at their own risk. Beyond that, reuse is bounded: the terms forbid copying, modifying, reverse engineering or scraping the platform and the app, and there is no API to pull data out programmatically. On the vendor's side, ECG and health data feed the training, development and fine-tuning of the AI model, on the basis of an explicit consent granted when the privacy policy is accepted. That consent can be withdrawn at gdpr@kardi.ai, but the policy states that withdrawing it prevents the vendor from providing the core functions and restricts access to the platform. Non-health data may additionally be published in aggregated or anonymised form.

Data retention & training

Hosting summary

The vendor commits to a region rather than to a country. The privacy policy states that personal data belonging to citizens of the European Economic Area is not transferred to countries outside the European Union. The website privacy notice adds that personal data is processed within the EEA, while reserving the possibility of transfers outside it should a service provider be based there or use servers there, under adequate safeguards. For third countries the policy lists three routes: a European Commission adequacy decision, registration of the recipient under the EU-US Data Privacy Framework, or standard contractual clauses with supplementary measures. Product pages describe recordings as held in secure cloud storage without further detail. No hosting country, data centre location or cloud provider is named anywhere on the site, and no subprocessor list is published, so the jurisdiction in which ECG traces actually sit cannot be established from published sources.