CalmEd legal
Privacy Policy
Last updated: August 2026
This privacy policy outlines how your personal data (hereinafter: "Personal Data") is processed by TAGWARE LIMITED, 66, Arch., Makariou III, CRONOS COURT, 7th floor, Office 71, 1077 Nicosia, Cyprus (hereinafter: “TAGWARE”, “We”, “Us”, etc.) when you use the digital application CALMED (hereinafter: "CALMED", “the Application”, etc.) and its associated features, including the website <calm-ed.com>(hereinafter: “Website”). We are committed to protecting your Personal Data in relation to your use of CALMED and/or Website. Therefore, we collect and process your Personal Data in accordance with this Privacy Policy and applicable data protection laws, particularly the General Data Protection Regulation (EU) 2016/679 (hereinafter: "GDPR") or other applicable national laws, in case you reside outside of the European Union.
About CALMED
CALMED is a digital application designed for Android and iOS devices, intended to provide users with access to exercises (video followed by textual instructions) that may assist them in reducing the frequency of involuntary body movements that they experience themselves or observe in others. The Application is intended for individuals who wish to engage in such exercises as part of their personal efforts to reduce or alleviate such movements.
CALMED or the Website is not intended to diagnose, treat, cure, or prevent any disease, medical condition, or other health-related condition, and it does not constitute medical advice, diagnosis, treatment, or a substitute for consultation with a qualified healthcare professional or other appropriately qualified specialist. The exercises and information made available through the Application are provided for informational and supportive purposes only based on the “Open System of Human Development Stimulation” method, developed by Prof. Dr. Lazar Stošljević and Prof. Dr. Miodrag Stošljević, which has been published and described in more than fifteen university textbooks, monographs and practical manuals, as well as in over 250 scientific and professional publications.
Users should seek appropriate medical or other professional advice where they have concerns regarding involuntary body movements or any other health-related condition. The Application does not guarantee that the exercises made available through it will reduce or eliminate involuntary body movements or produce any particular result.
About the Controller
The data protection controller is:
TAGWARE LIMITED
66, Arch., Makariou III, CRONOS COURT, 7th floor, Office 71
1077 Nicosia
Cyprus
Registration number HE397352
Email: apps@tagware.com.cy
General overview of data processing activities
We collect and process Personal Data from you which you provide to us when using CALMED and/or the Website. This involves, in particular:
Intended use of the Application, including:
User account registration and creation in CALMED,
Use of CALMED and the associated features,
Collection of device data for the technical provision of CALMED,
Billing for our services in connection with the use of CALMED,
Communication in connection with support requests.
Compliance with legal obligations and other legally permissible data processing.
Certain Personal Data processed through CALMED, such as information relating to involuntary movements (tics), stress level, questionnaires and progress within the Application, may constitute personal data concerning health within the meaning of Article 9 GDPR. Where such data are processed, TAGWARE processes them on the basis of the User's explicit consent pursuant to Article 9(2)(a) GDPR.
Detailed description of data processing in connection with the provision and use of the Application
In the following, we will describe how we process your Personal Data in connection with the provision and use of CALMED, including (i) the categories of Personal Data concerned, (ii) the purposes of data processing, (iii) the respective legal bases on which we process your Personal Data, as well as (iv) the storage period for your Personal Data:
a. Personal Data processing for the intended use of CALMED
The Personal Data provided by you in connection with the intended use of CALMED are processed by Us as follows:
I User account registration and creation
Using CALMED requires prior registration and the creation of a user account after downloading the Application from the App Store, Google Play Store or any other relevant source. Please note that those online stores are independent controllers and they might collect your Personal Data in accordance with their own rules and policies which are not under our control. In the following, we will describe how we process your Personal Data in connection with registration and creation of a user account in CALMED:
Categories of data
In connection with the registration and creation of a user account in CALMED, we collect the following Personal Data from you (hereinafter: "User Data"):
Unique User ID,
Username,
Email address,
Password hash,
Date and time of account creation,
Date and time of the last modification of the data,
Authentication Data, which might include the following: internal identifier of the authentication record; identifier of the user to whom the record is linked; type of login method; password hash; user identifier at an external service provider, where such login method is used; date of creation and modification of the authentication record.
Users may create an account and access CALMED using their existing Google or Apple account. Where a user chooses to register or log in using Google or Apple, we may receive certain information from those subjects that are necessary to create and manage the user's account, depending on the permissions granted by the user and the information made available by Google or Apple. We process this information for the purposes of creating and managing the user's account, authenticating the user's identity, enabling access to CALMED, and maintaining the security of the account and the Application. The use of Google/Apple authentication is optional. Users may alternatively register or log in using other authentication methods made available through the Application. The processing of information obtained through Google/Apple authentication is subject to this Privacy Policy and, where applicable, Google's/Apple’s own privacy policies and terms.
| Purposes of data processing | Legal basis of data processing | Storage period |
|---|---|---|
We process your User Data to:
|
The legal basis for processing your User Data for the creation and administration of your account and the provision of CALMED is the performance of a contract between you and us pursuant to Article 6(1)(b) GDPR. Where the processing involves special categories of personal data (including personal data concerning health), such data are processed on the basis of the User's explicit consent pursuant to Article 9(2)(a) GDPR. Where the processing is necessary to comply with applicable legal obligations, including accounting, tax and regulatory requirements, the legal basis is Article 6(1)(c) GDPR. Where the processing is necessary to ensure the security, integrity and proper functioning of CALMED, prevent fraud or unauthorised access, or establish, exercise or defend legal claims, the legal basis is our legitimate interests pursuant to Article 6(1)(f) GDPR. |
We store your User Data for as long as your user account remains active. If you delete your account or terminate your use of CALMED, your User Data will be deleted or anonymised without undue delay, unless we are required or permitted by applicable law to retain certain information for a longer period, for example to comply with legal, tax, accounting or regulatory obligations or to establish, exercise or defend legal claims. |
II Use of the CALMED
In the following, we will describe how We process your Data in connection with using CALMED and the associated features:
Categories of data
In connection with using the Application and the associated features, we collect the following Personal Data from you (hereinafter: "Application Data"):
Profile and status data,
Unique token for access to the video (JWT token - a temporary technical access token generated to enable secure access to video content)
Information about watched videos,
Questionnaires,
Training development technical metrics (the application tracks the user’s viewed and completed exercises, the current week or module, and the unlocking of subsequent content),
Training weekdays,
Information as to whether the user has completed a one-time purchase and is entitled to access the paid content;
Payment method or payment channel,
The user's Stripe customer identifier, where Stripe is used,
Apple's original transaction identifier, where Apple is used,
Google's order identifier, where Google is used,
In order to verify and, where applicable, restore purchases, we may also process the product identifier, purchase status, purchase token or receipt, and the transaction identifier received from Google Play or the Apple App Store.
The Application Data might also include the following information about you that you completely voluntarily provide to us by filling out the initial questionnaire:
First and last name and/or nickname,
Age or age group,
Self-assessment of stress level,
Type of involuntary movements (tics), for example motor or vocal,
Frequency of tics,
The goal you want to achieve by using CALMED,
The user's progress through the program and exercises reviewed or completed, if such progress is recorded.
The Application Data might also include the following technical information in order to detect and resolve technical issues; we use standard application and server logs. Production logs may contain technical data related to API access, such as the requested endpoint, HTTP method, response status, the date and time of the request, and processing duration (hereinafter: “Technical Data”).
| Purposes of data processing | Legal basis of data processing | Storage period |
|---|---|---|
We process your Application Data to provide CALMED and associated features, in particular:
|
The legal basis for processing your Application Data is the performance of a contract between you and us pursuant to Article 6(1)(b) GDPR. Where the Application Data include special categories of personal data, including information relating to tics, stress level, questionnaires or the User's progress within the Programme, such data are processed on the basis of the User's explicit consent pursuant to Article 9(2)(a) GDPR. Where processing is necessary to ensure the security, integrity and proper functioning of CALMED or to prevent fraud and unauthorised access, the legal basis is the Provider's legitimate interests pursuant to Article 6(1)(f) GDPR. | We store your Application Data for as long as required for the provision and use of CALMED and, where legal storage periods exist that go beyond this (e.g. for regulatory reasons), for the duration of the legal storage period. Production logs are retained only for the period necessary to ensure system security and resolve technical issues. |
III Billing for our services provided in connection with CALMED
In the following, we will describe how we process your Personal Data to bill our services provided in connection with the Application:
Categories of data
In connection with the billing of our services, we collect pseudonymous payment information provided by a payment processor (Google, Apple, Stripe, etc)(hereinafter: "Billing Data").
| Purposes of data processing | Legal basis of data processing | Storage period |
|---|---|---|
| We process your billing data to bill you for our services in connection with the use of the Application. | The legal basis for processing payment-related data for the purpose of processing and completing your purchase is the performance of a contract pursuant to Article 6(1)(b) GDPR. The legal basis for retaining invoices and payment records for the period required under applicable accounting, tax and other legal requirements is compliance with our legal obligations pursuant to Article 6(1)(c) GDPR. | We retain Billing Data for the period required by applicable tax, accounting and financial regulations, which may extend beyond the duration of your use of CALMED |
IV Communication in connection with support requests
In the following, we will describe how we process your Personal Data for communication in connection with support requests:
Categories of data
When you contact us regarding a support request, we may collect the Personal Data you voluntarily provide in connection with your support request (e.g. by phone, contact form or e-mail).
| Purposes of data processing | Legal basis of data processing | Storage period |
|---|---|---|
| We process these Personal Data for the purpose of communicating with you, e.g. to receive error messages and answer questions as part of your support request. | The legal basis of processing your Personal Data is your consent to the processing of your Data for the intended use of the Application given during registration. Also, the processing of your Personal Data is necessary for performance of a contract between you and us. | Support requests and related correspondence are retained for as long as necessary to resolve the request and for up to two (2) years thereafter, unless a longer retention period is required by law or is necessary for the establishment, exercise or defence of legal claims. |
c. Compliance with legal obligations
In the following, we will describe how we process your Personal Data in order to comply with legal obligations:
Categories of data
In order to comply with applicable legal obligations, we process the Personal Data provided by you or third parties in the context of the intended use of CALMED, including Technical and Billing Data.
| Purposes of data processing | Legal basis of data processing | Storage period |
|---|---|---|
| In order to comply with our legal obligations, we may be required to share some or all of your Personal Data with competent regulatory and supervisory authorities. | The legal basis for processing your Personal Data for compliance with our legal obligations is, as applicable, in conjunction with the respective special legal provision of GDPR or other applicable regulations. | We store your Personal Data for as long as required for the compliance with our legal obligations and, where legal storage periods exist that go beyond this (e.g. for regulatory reasons), for the duration of the legal storage period. Technical and security logs are generally retained for up to twelve (12) months, unless a longer retention period is necessary for investigating security incidents, preventing fraud or complying with legal obligations. |
d. Other permissible data processing operations
To the extent permitted by law, we reserve the right to process your Personal Data for other processing purposes. In this case and to the extent required by law, we will inform you again about this further data processing and obtain your consent.
Where permitted by applicable law, we may process Personal Data on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR, including for the establishment, exercise or defence of legal claims, the protection of our systems and services, fraud prevention, network and information security, and the enforcement of our legal rights, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
Your Personal Data may e.g. also be processed by us in other ways and may also be disclosed to third parties if we are legally obligated to do so - e.g. by court order or if this is required to support criminal or legal inquiries or other legal investigations or proceedings in Cyprus or in other countries or to safeguard legitimate interests, as the case may be, in conjunction with the respective special legal provision of GDPR, e.g. for the provision of services or for the enforcement and defense of legal claims.
Children’s Personal Data
CALMED is not intended for direct use by children and is not directed to individuals who have not reached the age at which they may validly consent to the processing of personal data under applicable law. The Controller does not knowingly collect or otherwise process personal data directly from children.
Where the Application is used by a parent or legal guardian for the purpose of monitoring, tracking, or supporting a child’s progress or achieving the intended effects of CALMED in relation to a child, the parent or legal guardian acts as the user of the Application and is responsible for any personal data relating to the child that they choose to provide through CALMED.
By using CALMED for such purposes, the parent or legal guardian represents that they have the legal authority to provide the child’s personal data and, where required under applicable law, to consent to the processing of such personal data on behalf of the child. The processing of any child-related data provided by a parent or legal guardian will be carried out solely for the purposes described in this Privacy Policy.
If we become aware that personal data has been collected directly from a child without the required parental or guardian authorization, or otherwise in breach of this Privacy Policy or the Terms of Use, we will take reasonable steps to delete such personal data without undue delay.
Your Consent
At the end of this section you will find the wording of your declaration of consent to the processing of your Personal Data for the intended use of CALMED, including the processing of Personal Data concerning health (required consent). If you are a parent or legal guardian of a child, at the end of this section you will also find the wording of your declaration of consent to the processing of your and your child’s Personal Data for the intended use of CALMED, including the processing of Personal Data concerning your child’s health (required consent).
Please note that the use of CALMED requires your prior consent to the processing of your Personal Data for the intended use of the Application. Where the processing involves special categories of personal data, including personal data concerning health, your explicit consent is obtained in accordance with Article 9(2)(a) GDPR.
You have the option to withdraw your consent given during registration through the Profile section, under Privacy & Account. Once the consent is withdrawn, we will cease the processing of your Personal Data that we process based solely on your consent and delete such Personal Data no later than 30 days from the date of confirmation, unless they are required to comply with applicable legal obligations.
If you do not give your consent to the processing of your Data for the intended use of the Application or if you subsequently withdraw it, TAGWARE will not be able to provide you with the functions of CALMED. In this case, we will delete your account.
I consent to the processing of my personal data (including health data) for the following purposes:
Required: For the purposes described in the Privacy Policy, including providing CALMED functionalities, monitoring and recording progress, billing for services, and providing support.
If the parent or legal guardian is using CALMED in order to help their children to reduce the frequency of involuntary body movements:
I confirm that I am the parent or legal guardian of the child, or that I otherwise have the legal authority to provide consent for the processing of the child’s personal data. I have read and understood the Privacy Policy and I expressly consent to the processing of the child’s personal data that I choose to provide through the Application for the purposes described in the Privacy Policy, including providing the Application’s functionalities, monitoring and recording progress, personalizing the user experience, and improving the services.
Data recipients
a. Data Processors
Your Personal Data collected by CALMED may be processed by the processors who we engage and who assist us in the operation of CALMED and the provision of our services. Processors shall process personal data solely in accordance with our documented instructions, pursuant to a data processing agreement governing the processing of personal data, and shall implement appropriate technical and organizational measures to ensure the protection of personal data in accordance with the applicable data protection laws. Such processors may include providers of technical support, user authentication services, hosting services, and other service providers whose engagement is necessary for the operation of CALMED and provision of our services.
We have concluded contracts with all of our processors, stipulating in particular that the data processing will be carried out exclusively according to TAGWARE's instructions and that all employees who come in contact with TAGWARE's data have been obligated to comply with data protection regulations.
The processors include the following:
| Categories of processors | Reason for engagement |
|---|---|
| Service providers | So they can provide their services to us. Examples of such service providers include those we hire to:
|
| Hosting service |
|
| Other TAGWARE group companies, including companies that TAGWARE acquires |
|
b. Other recipients
Moreover, we may disclose your Personal Data to the following categories of recipients for the aforementioned processing purposes:
Regulatory and supervisory authorities, e.g. to comply with legal obligations,
Accountants, legal advisors, tax advisors, etc. supporting us in the context of our management, and
Purchasers of our business, e.g. if we were to sell or negotiate to sell any part of our business to a buyer or possible buyer. In this case, we may transfer your personal data to a successor or affiliate as part of that transaction.
Each of the above recipients processes your Personal Data independently as a controller.
c. Third-party data processing
Please note that in the context of providing CALMED, TAGWARE also collaborates with other partners who are not processors and who may collect Personal Data directly from customers, without any data transfer by TAGWARE.
The videos available on CALMED are hosted by the platform MUX (Mux Inc., based in California, United States of America), which can independently process some of your Personal Data that you provide when accessing the specific video materials, in accordance with their privacy policies. When you play a video, MUX, as our video delivery service provider, may process certain technical information that is necessary to deliver, secure, and operate the video service. This may include your IP address, User-Agent, approximate location derived from your IP address, information about the playback technology used, and technical interactions with the video content. We do not disclose your name, email address, or responses to the health questionnaire to MUX.
This also includes the payment service providers Google Payment Ireland Limited, Apple Distribution International Ltd., Stripe Inc., PayPal or other services with registered office in the EU or United States of America, as well as their respective processors. If you make any payments via those services, you will be automatically redirected to their website. Such third-party providers are not "recipients" of TAGWARE. They collect the customer's Personal Data independently and based on your decision to make the payment through them. We would furthermore like to note that your contractual relationship with those services is independent of your contractual relationship with us. You may inform yourself about their privacy policies on the following links:
International data transfer
The processing of your Personal Data may be carried out by TAGWARE in Cyprus, in a Member State of the EU or the EEA or, if an adequacy decision pursuant to Art. 45 GDPR exists, in a third country outside the EU or the EEA. Some of our processors are based in the Republic of Serbia, a territory that does not have an adequacy decision, and we take steps to ensure that we handle your personal information subject to appropriate safeguards. We provide appropriate protections for cross-border transfers as required by applicable law for international data transfers. Where applicable, the standard contractual clauses and the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers, approved by the European Commission and the UK Information Commissioner, respectively, are implemented. Where required by such laws, you may request a copy of the suitable mechanisms we have in place by contacting us as detailed below.
Security, storage and erasure
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss, or misuse. Our application and database are hosted on a secure virtual private server (VPS) provided by a third-party hosting provider. Administrative access to the server is restricted to authorized personnel who require such access for the performance of their tasks and is protected through secure authentication mechanisms. Access credentials and authentication keys are securely managed and are not publicly shared or stored within the application source code. The mobile application does not have direct access to the database. Instead, communication is performed through secure application interfaces (APIs), and the application server accesses the database only after appropriate authentication and authorization checks have been performed. Communication between the application and the server is protected through encrypted connections using appropriate security protocols. The database is not publicly accessible via the internet and is accessible only to authorized systems and personnel where necessary for the provision, maintenance, and security of the service. We rely on our hosting provider and system administrators to maintain the security of the hosting infrastructure, including measures such as server access management, firewall configuration, monitoring, backups, and system recovery mechanisms. We regularly review and maintain these measures to ensure an appropriate level of security, taking into account the nature, scope, context, and purposes of processing personal data, as well as the risks to individuals’ rights and freedoms.
We generally only store your Personal Data for as long as is necessary to achieve the purposes for which the Personal Data was collected or until you withdraw your consent. If there are additional legal storage periods (e.g. for regulatory reasons), your Personal Data will be stored for the duration of the legal storage period.
You may end your use of CALMED at any time and delete your account. To do so, you may use the Profile section within the Application, under Privacy & Account. Before confirming the deletion request, the Application will clearly inform the user of the consequences of deleting the account. Once the deletion request is confirmed, the account will be deactivated and your Personal Data, health questionnaire data, progress data, and any other data that is not required to comply with applicable legal obligations will be permanently deleted without undue delay and, in any event, no later than 30 days from the date of confirmation.
We may retain certain information where and for as long as required to comply with applicable laws, resolve disputes, enforce our agreements, or protect our legal rights. Also, we may retain the confirmation of the payment you made regarding CALMED in case you want to create a new account based on your prior purchase in order to re-verify the one-time purchase you made.
Certain information may be retained where necessary to comply with applicable legal obligations, including accounting, tax and regulatory requirements, to establish, exercise or defend legal claims, process complaints, prevent fraud, or verify your previous purchase and entitlement to access CALMED. Such retained information is limited to the minimum data necessary for those purposes, including transaction records and, where necessary, your email address.
Health-related Data are stored logically separate from billing and transaction records and are subject to additional technical and organisational safeguards.
Where possible, Personal Data that are no longer required are permanently deleted or irreversibly anonymised. Where immediate deletion is not technically possible (for example, because the data are contained in secure backups), the data will be securely isolated and permanently deleted in accordance with our backup retention procedures.
Where Personal Data have been disclosed to our processors, we will instruct them to delete or anonymise such data unless they are required to retain them under applicable law.
Your data protection rights
According to the GDPR, you are entitled to the following data protection rights pursuant to statutory requirements:
Right of access, rectification, erasure and restriction: You have the right to request at any time information about your Personal Data stored by us (Art. 15 GDPR). When we process or use your Personal Data, we take reasonable steps to ensure that your Personal Data are accurate and up-to-date for the purposes they were collected for. If your Personal Data are inaccurate or incomplete, you may request that they be rectified (Art. 16 GDPR). You furthermore may have the right to request the erasure (Art. 17 GDPR) or restriction of processing (Art. 18 GDPR) of your Personal Data if, for example, your Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed and statutory retention obligations do not require their continued storage.
Right to data portability: You may have the right to receive the respective Personal Data you provided to us in a structured, commonly used, and machine-readable format or to transmit those Personal Data to another controller (Art. 20 GDPR).
Right to withdraw your consent: If you have given consent to the collection, processing and use of your Personal Data, you may withdraw your consent at any time with effect for the future; however, the lawfulness of the processing performed based on the consent until its withdrawal shall not be affected by such a withdrawal (Art. 7 para. 3 GDPR).
Automated decision making (including profiling): You have the right not to be subject to a decision based solely on automated processing (including profiling) that has legal effects on you or similarly significantly affects you (Article 22 (1) GDPR). Please note that we do not use such automated decision-making or profiling within the meaning of Art. 22 GDPR in connection with CALMED.
Right to object: You may object at any time, for reasons relating to your particular situation, to the processing of your Personal Data under Art. 6 para. 1 lit. e) or f) GDPR. After you lodge such an objection, we will no longer process your Personal Data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims (Art. 21 para. 1 GDPR, co-called "restricted right to object"). In this case, you must provide reasons for your objection which result from your particular situation.
In addition, you have the right to lodge a complaint with the relevant supervisory authority if you believe your Personal Data are not being processed lawfully. The competent supervisory authority for TAGWARE is the Office of the Commissioner for Personal Data Protection; postal address: kypranoros 15, Nicosia 1061 , Cyprus; telephone: +357 22818456; e-mail: commissioner@dataprotection.gov.cy.
Contact details
For all questions regarding the protection of your Personal Data, you may contact TAGWARE LIMITED at apps@tagware.com.cy.
Updates of the privacy policy
We reserve the right to update this privacy policy from time to time, in particular in order to reflect changes to our services, e.g. technical and organizational adjustments to CALMED, changes in legislation or case law, or your feedback. We therefore recommend that you visit this website regularly to find out how your Personal Data is protected and processed. We will notify you in advance by e-mail and/or in CALMED of any material changes to this privacy policy.