Privacy Policy

Last updated: 18 July 2026 · Applies to the Miab app and the Miab family pilot

Who we are

Miab is operated by Oliver Haughey, based in Ireland ("we", "us"). The Miab app runs on the phone of a person who has personally agreed to take part — usually an older person living alone whose family wants gentle reassurance that everything is normal.

Questions, requests, or complaints: email us — we reply personally.

What we collect

The app sends a regular short "heartbeat" to our server containing:

Step count — read from the phone's health data (steps only, nothing else)
Motion type — whether the phone is still, walking, running, cycling, or driving
Battery level
Screen activity — total minutes the phone has been actively used, as a single number
App permission settings — which phone permissions the app relies on (such as motion, notifications, or background refresh) are switched on or off, so we can tell whether the app is able to do its job. This is about the app's own settings, never about what the phone is used for.

Each heartbeat is tied to a random device code (a UUID) generated on the phone the first time the app opens — not to a name, phone number, email address, Apple or Google ID, or any other personal detail.

What we never collect

No location. The app asks for location permission on iPhone only because that is how the iPhone allows it to wake up in the background and send its heartbeat. Location coordinates are never read, stored, or transmitted — where the phone goes stays on the phone.
No content. No messages, calls, emails, photos, contacts, or browsing.
No app names. We see minutes of screen activity as a number, never which apps or websites were used.
No microphone or camera access.
No other health data. Step count is the only health reading used.

Why we collect it

To learn the participant's normal daily rhythm and let their chosen family contact know when everything looks normal — and when it doesn't. During the pilot phase, a real person reviews the pattern and sends the family contact a short daily update; there is no automated alerting yet.

The app permission settings help us understand how well the monitoring is working: if a permission is switched off, the readings that depend on it stop or degrade, and knowing which ones are off tells us — and the family contact — whether a quiet day is really quiet or just the app being unable to see.

Legal basis

Our legal basis is explicit consent (GDPR Articles 6(1)(a) and 9(2)(a) — step count and motion are treated as health data, so we ask for explicit consent to be safe). Consent is given personally by the person being monitored, before anything is collected. It can be withdrawn at any time by deleting the app or emailing us; we then delete the associated data within 30 days.

Where data lives and how long we keep it

Data is stored on servers in the European Union (Railway, Amsterdam region) and is retained for the duration of participation plus 90 days, unless deletion is requested sooner. When the pilot ends for a family, collection ends with it.

We do not sell or share personal data with anyone. The daily status updates derived from it go only to the family contact the participant nominated. Our server hosting provider (Railway) processes data on our behalf under a data processing agreement.

The nominated family contact can also see whether the app's permissions are switched on or off, so they can help keep the monitoring working — for example, by mentioning that a permission got switched off after a phone update. Switching a permission off is always the participant's choice; the family contact sees that it is off, never why.

Your rights

You can ask at any time to access, correct, or delete your data, to receive a copy of it, or to withdraw consent — just email us. You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) or your local supervisory authority.

If we change this policy, we'll update the date at the top and, for anything meaningful, tell participants directly.