Privacy Policy for the Abel app

In short

Your personal data is to be processed securely, confidentially and only for the purposes described in this privacy policy. We do not sell your personal data.

If you use Abel through your employer, the employer as a general rule receives only anonymised or aggregated statistics. Information about you as an individual is not shared with your employer unless there is a specific legal basis for it. Where the sharing rests on consent, that consent must be freely given, explicit and tied to clearly specified data, recipients and purposes.

In the app you can manage your consents and access much of your data. You can also contact us if you want access, rectification, erasure or to exercise your other rights.

Our Terms of Service are published separately.

1. Data controller and contact

Abel Technologies AS, company registration number 919 608 811 (“Abel” or “we”), is the data controller for the processing of personal data described in this policy.

If you have questions about privacy, you can contact us at legal@abel.no.

You can contact us if you have questions about how we process your personal data, or if you wish to exercise your rights. Enquiries to us are treated confidentially.

2. What we process, why, and for how long

Account and identification

When you create an account, we register your name, your national identity number when you identify yourself through BankID or another strong electronic ID, your email address, telephone number, language and the necessary information about your device. When you make a purchase, we also process the necessary payment and transaction data.

The processing is necessary in order to create and administer your account, identify you securely and deliver the service you have asked for. The legal basis is GDPR article 6(1)(b).

It is stated at registration which information you must provide in order to create and use the account. If you do not provide the necessary account and identification data, we cannot create the account or deliver the service.

Account data is stored for as long as you have an active account. If the account has been inactive for five years, the account data is erased or anonymised, unless we have an obligation or another legal basis for keeping certain data longer. Payment and transaction data is kept for as long as the accounting legislation requires.

Basic features

When you record training, meals, habits, goals or your own measurements, such as height, weight and maximum heart rate, we process that data in order to give you the features and the follow-up you have chosen to use.

The legal basis is the agreement with you, cf. GDPR article 6(1)(b).

Recording this data is voluntary. If you do not record it, certain features, calculations or forms of follow-up will not be available.

The data is stored until you delete it or delete your account, unless we have an obligation or another legal basis for keeping certain data longer.

Connected devices

You can connect the Abel scale and a Garmin account to the Abel app. When you connect a device or service, we ask for your explicit consent to collect and process the health and activity data concerned. The legal basis is GDPR article 6(1)(a) and article 9(2)(a).

Before you consent, you are told which data we will collect and what the data is to be used for. The consent is common to all connected devices. You can withdraw it at any time in the app. Withdrawal does not affect the lawfulness of the processing.

The Abel scale

If you weigh yourself on the Abel scale, the measurements are sent over Bluetooth directly from the scale to the app on your phone. No third party receives the measurements, and they are stored encrypted with Nexthop in Norway together with the rest of your data. Basis: the common consent for connected devices described above. You can disconnect the scale in the app at any time; all further collection from the scale then stops.

Data that has already been collected is stored until you delete it or delete your account, unless we have a statutory obligation to keep certain data longer.

Garmin smartwatch

If you connect the Abel app to your Garmin account, we collect health and activity data through the Garmin Health API every time your watch synchronises. We collect only what you have granted permission for and what the app uses: activities (Activities), daily health statistics (Daily Health Stats) and history (History). We do not collect location data, and we never receive your Garmin login credentials.

The data is used to show you history, trends and insights in HealthVault and in the follow-up you receive from your health counsellor. Basis: the common consent for connected devices (GDPR art. 6(1)(a) and 9(2)(a)). We do not use Garmin data for marketing, and we never sell it.

The data is stored with Nexthop in Norway, with role-based access control and logging of access to health data, until you delete it or delete your account, unless the law requires longer retention. No other sub-processor receives the Garmin data, we do not run artificial intelligence or external analytics services on it, and your employer never sees it at an individual level.

Garmin learns that you have connected to Abel, but receives no health data or other information about you from us — only access tokens and the period we are requesting data for. Garmin's own processing is governed by Garmin's privacy policy.

You can disconnect in the app, or withdraw the access in Garmin Connect. All further collection then stops; data that has already been collected stays in your account until you delete it.

Garmin and Garmin Connect are trademarks of Garmin Ltd.

Health counselling

If you receive health counselling, we process, among other things, messages between you and your health counsellor, training and meal plans, tasks, statuses, surveys and other data necessary in order to give and follow up the health counselling. Your health counsellor is given access to the data that is necessary in order to follow you up, including relevant history in the app.

The processing is necessary in order to deliver the counselling service you have entered into an agreement about, cf. GDPR article 6(1)(b).

Use through your employer

If you get access to Abel through your employer, the employer may receive anonymised statistics about use and results at group level. We apply fixed thresholds and other measures to prevent individuals from being identified directly or indirectly. We do not report statistics where the group is so small, or the data so distinctive, that individuals could be recognised.

Your employer does not get access to your answers, your messages, your measurements or other information about your health at an individual level.

Information about you as an individual is shared only where there is a specific legal basis. Where the sharing rests on consent, we obtain in advance a freely given and explicit consent stating which data may be shared, who is to receive it, the purpose of the sharing and how long the consent applies. It has no negative consequences for you if you do not consent, or if you later withdraw your consent.

Surveys

In some services you may be asked to answer surveys about, among other things, health, wellbeing or your working day. We use the answers to assess which follow-up is relevant, tailor the counselling and follow your development over time.

Answering the surveys is voluntary. The processing is part of the health counselling and rests on the agreement with you, cf. GDPR article 6(1)(b).

Your answers are part of your history in the app and are stored for as long as you have an account, or until you delete them.

Quality assurance of health counselling

In order to administer and quality-assure the health counselling, authorised management personnel may be given access to the necessary information about capacity, progress and operational status. Access is limited according to professional need. The legal basis is our legitimate interest in ensuring the quality of the service, cf. GDPR article 6(1)(f). Management personnel do not have access to the content of your conversations, unless this is necessary in order to follow up a specific quality or safety incident and there is a valid legal basis for it.

Offers of health counselling

If you use the app without a health counsellor, we may contact you with information about the possibility of health counselling. We then use your contact details, but not health data, survey answers, measurements or the content of your use, for marketing purposes. The legal basis is our legitimate interest in informing you about our services, cf. GDPR article 6(1)(f). You can opt out of such contact at any time under Profile in the app, or by contacting us.

Marketing

We send newsletters, tips and offers by email or as push notifications where you have consented to it, or where we have another valid basis under the applicable marketing rules. You can withdraw your consent, or opt out of further marketing, at any time. We do not use health data, survey answers or measurements for marketing.

Support

When you contact support, we process your contact details, the content of your enquiry and other data necessary in order to investigate and answer the case. The legal basis is that the processing is necessary in order to deliver the service, cf. GDPR article 6(1)(b), or our legitimate interest in providing support and correcting faults, cf. article 6(1)(f).

We ask you not to send health data or other sensitive information to support unless it is necessary. Screenshots, logs and error reports are to be reviewed, and unnecessary personal data removed or masked, before the data is used further for troubleshooting.

Support cases are erased or anonymised no later than one year after the case is closed, unless the data is necessary in order to establish, exercise or defend a legal claim.

Troubleshooting, security and notifications

We process the necessary technical data and logs in order to detect and correct faults, safeguard information security, prevent misuse and send the notifications you have chosen to receive. The data may include IP address, device and operating system information, timestamps, event data and technical user identifiers.

The processing rests on our legitimate interest in offering a secure and stable service, cf. GDPR article 6(1)(f). Technical logs are stored for 1 year, unless a security incident makes it necessary to keep certain data longer. We may use anonymised and aggregated data, which cannot be linked to you, for statistics, research and to improve the service.

3. Who has access at Abel

Access to your personal data is granted according to professional need and is limited through role and access management. Health data is protected by appropriate technical and organisational security measures. Access to health data is logged and followed up.

In the app you can see recorded look-ups in your data under “Access log”, under “Profile”.

4. Data processors

We use suppliers who process personal data on our behalf. The suppliers may process the data only on documented instructions from Abel, and are governed by data processing agreements.

The following key suppliers are used:

Nexthop: cloud provider for running the platform, servers and databases, in Norway.
Amazon Web Services (AWS): sending email and SMS, and file storage. Servers in the EU/EEA.
Stø (BankID): identification with BankID in Norway; name and national identity number.
Signicat: identification with MitID in Denmark and BankID in Sweden; name and national identity number.
Nexi (NETS): payment services; payment transactions.
Expo: push notifications.
PostHog: error tracking; technical data in the event of a fault.

Garmin is not a data processor for us. Garmin is an independent data controller for your Garmin account, and Garmin's processing is governed by Garmin's own privacy policy. See “Garmin smartwatch” in section 2.

5. Transfers to countries outside the EEA

We aim for your personal data to be processed within the EU/EEA. Some of our suppliers may nevertheless process or make personal data available from countries outside the EEA.

Where personal data is transferred to a country the European Commission has decided has an adequate level of protection, the transfer rests on that adequacy decision. For other transfers we use the EU standard data protection clauses and carry out the necessary assessments and supplementary security measures.

6. Retention periods

We do not store personal data for longer than is necessary for the purpose it was collected for. The data is then erased or anonymised, unless we have a statutory obligation or another valid basis for storing it further.

The most important retention periods are:

Account and profile data: for as long as the account is active, and erased or anonymised after five years of inactivity.
Health and activity data recorded by the user: until you delete the data or the account, unless statutory requirements entail longer retention.
Data from connected devices: until you delete the data or the account. Disconnecting stops further collection, but does not automatically delete data that has already been received.
Messages, plans and surveys from health counselling: until you delete the data or the account. Any internal notes: 6 months after the counselling relationship has ended.
Support cases: no later than one year after the case is closed.
Technical logs: one year.
Marketing data: until you withdraw your consent or opt out, and thereafter the opt-out data necessary to ensure that the opt-out is respected.
Accounting and payment data: for as long as the accounting legislation requires.

When you delete your account, the data associated with the account is erased or anonymised, unless certain data has to be stored because of statutory requirements, or in order to establish, exercise or defend legal claims.

7. Your rights

You can contact us at legal@abel.no if you wish to exercise your rights. Which rights apply may depend on the legal basis for the processing and on whether statutory exceptions apply.

You may have the right to:

Access: You can obtain information about which personal data we process about you, and receive a copy of it. Much of the data can be exported directly from the app.
Rectification: You can have inaccurate data corrected and incomplete data completed. Some data you can correct yourself in the app.
Erasure: You can ask for personal data to be erased where the conditions for erasure are met. The right does not apply where we have a statutory obligation or another valid basis for keeping the data.
Restriction: In certain cases you can require that the processing of the data be restricted.
Data portability: Where the processing rests on consent or on a contract and is carried out automatically, you may have the right to receive data you have provided to us, in a structured, commonly used and machine-readable format.
Objection: You can object to processing that rests on our legitimate interest. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary in order to establish, exercise or defend a legal claim.
Objection to marketing: You can object at any time to the processing of personal data for direct marketing. The data will then no longer be used for that purpose.
Withdrawing consent: You can withdraw a consent at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of the processing that took place before the consent was withdrawn.

We reply without undue delay, and normally within one month at the latest. Where a request is particularly extensive or complex, the deadline may be extended in accordance with the data protection legislation. We will inform you if that is the case.

If you believe that we are processing personal data in breach of the rules, you can contact us at legal@abel.no. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). Information about how to complain is available at www.datatilsynet.no.

8. Where the data comes from

We receive personal data mainly directly from you, through the app and through your contact with your health counsellor or with support.

When you connect an external device or service, we receive the data you have given us permission to collect from the supplier concerned, for example Garmin.

If you get access through your employer, we may receive the necessary contact and administration data from the employer, such as name, contact details, place of work and information about which service you have been offered. The employer is not to send us diagnosis data or other health data unless this is necessary, lawful and expressly agreed.

Providing health data and connecting external devices is voluntary. Certain identification and contact data is necessary in order to create an account and deliver the service. If you do not provide such necessary data, we cannot create the account or deliver the service in question.

9. Language

This privacy policy is written in Norwegian. Translations into other languages have been produced automatically in order to make it more accessible. In the event of any conflict between the Norwegian version and a translation, the Norwegian version prevails.

Abel Technologies AS, company registration number 919 608 811.

Version: 5 September 2026