Consent to the Collection and Processing of Medical Personal Data


I hereby freely, voluntarily, and in my own interest give my consent to Limited Liability Company "GLS Consulting" (OGRN 1127747153192, INN 7717738764), legal address: 127572, Moscow, Uglichskaya St., 12, bldg. 1, office 209, hereinafter referred to as the Operator, to collect and process the following special category of personal health data, obtained by the Fasti.me Service through a one-time or periodic request initiated by the User from health data storage applications such as “Health” on iOS and Android, utilizing the HealthKit and Health Connect platforms:
- heart rate.
No other medical data is processed.
The specified data is provided strictly based on the user's individual permission and is extracted from the local storage on their device.


Legal Basis for Processing
The processing is carried out pursuant to Article 10 of the Federal Law No. 152-FZ as well as Articles 6(1)(a) and 9(2)(a) of Regulation (EU) 2016/679 (GDPR) — the data subject’s consent to the processing of special categories of personal data.


Purposes of Processing
- Displaying data visualization in the User’s personal account;
- Overlaying heart rate data on the user's calendar events;
- Analyzing the user’s states (stress/calm) in the context of events;
- Providing personalized suggestions and visualizations without automated decision-making;
- Improving service algorithms for the display and visualization of health information based on the provided data, without automated decision-making or profiling.

Fasti.me does not provide medical services. The display of personalized graphs and visualizations of user states (such as heart rate) in connection with calendar events is intended solely for the User’s self-analysis. This information does not constitute a medical diagnosis, recommendation, opinion, or prescription, is not used for automated decision-making, and does not have any legally significant consequences.


Data Source and Access Restrictions
Medical data is collected locally from the user's device via health data storage applications, such as Health on iOS and Android, exclusively with the User’s explicit permission. The User may restrict access to specific data categories at any time through the system settings of the relevant application.


Transfer to Third Parties
The medical personal data specified in this consent will not be shared with third parties except as necessary for the operation of the Service and the storage of data on the Operator’s technical infrastructure, provided confidentiality is maintained. Processing is carried out exclusively by the Operator for the purposes stated above.


Cross-Border Transfer
Cross-border transfer of medical personal data is not performed. Data is collected locally and transferred only to the Operator’s servers located within the territory of the Russian Federation.


Data Processing Security
The security of data processing is ensured through the use of encryption, access controls, segmented infrastructure storage, and logging of access requests.


Data Retention and Withdrawal of Consent
Consent is valid until the date of account deletion or until consent is withdrawn, unless otherwise provided by law. I have been informed that I may withdraw my consent at any time by sending a written request to info@fasti.me, or by restricting access through the relevant health data application settings on my device. Upon receipt of a withdrawal notice, the Operator will cease processing and delete the data, unless otherwise required by the laws of the Russian Federation.
Withdrawing consent is as simple as providing it.


Personal Data Subject Rights
I have been informed of my rights, including:
- access to my personal data;
- rectification or deletion of data;
- withdrawal of consent;
- restriction of processing;
- lodging a complaint with Roskomnadzor or an authorized EU supervisory authority (the data protection authority in your country);
- the right to data portability in a machine-readable format (.csv).


Consent Confirmation
Consent is given by an active action—clicking the “Accept”/“Confirm” button in the Fasti.me app or web service interface, which is equivalent to providing a simple electronic signature in accordance with the legislation of the Russian Federation. Detailed information about personal data processing is available in the Privacy Policy: https://fasti.me/privacy_policy 
Processing does not involve automated decision-making, including profiling as defined in Article 22 of Regulation (EU) 2016/679 (GDPR). All analytics and visualizations provided by the service are for informational purposes only. You will not be subject to any legal or other consequences based on these data.