Privacy Policy

App Name: Road Health (Android and iOS)
Operator: AS&A s.r.o., Hlavná 742, 925 91 Kráľová nad Váhom, Slovakia
Data Protection Contact: support@roadhealth.org
Last Updated: October 25, 2026

This Privacy Policy describes how the Road Health mobile application for Android and iOS (the "App") collects, processes and stores data. It applies to the App, to the associated public map website, to registration in the App and to the beta tester registration form on our website.

1. What Data We Collect and Why

Road Health is a community platform for road quality mapping, pothole detection and pavement condition analysis. To provide this service, the App collects the following categories of data:

• Precise location data (GPS): The App collects location data while you drive, including while the App runs in the background and the screen is off or locked. The location is also used to download road sections, hazards and nearby services (for example tyre shops) around you. Purpose: to determine the geographic position of road surface defects and to map the condition of the road network. Legal basis: your consent, given through the iOS or Android location permission dialog. You may withdraw it at any time in your device settings.
• Motion sensor data (accelerometer): The App reads the accelerometer built into your device to measure vibration and impacts transmitted through the vehicle; from these readings it calculates road quality and calibration values. Purpose: automatic detection of potholes and evaluation of road surface quality without requiring manual input. Legal basis: your consent, given by starting road monitoring in the App.
• User-submitted hazard reports: The App lets you report a road hazard (for example a pothole) using a button. Such a report records the type of hazard and the location at which you submitted it. Purpose: to warn other users about hazards ahead. Legal basis: your consent, given by submitting the report.
• Device and installation identifiers: The App uses a device identifier – on Android the system identifier Android ID, which stays the same for the App on a given phone even after the App is reinstalled (it changes, for example, after a factory reset), on iOS a random identifier that the App creates on first launch. It is not the advertising identifier and is not shared with other apps. In addition, the App creates a random installation identifier with every installation; it is sent together with the summary ride statistics and is also stored in the backup file. A shortened device code is attached to diagnostic data (on iOS derived from the device identifier by a one-way hash, on Android a separately generated random code). Purpose: to tell devices and installations apart, to link a registration to the device, to prevent ride summaries from being overwritten or counted twice after a reinstallation or a backup restore, and to troubleshoot data collection. Legal basis: our legitimate interest in the reliable operation of the App.
• Diagnostic data: The App sends technical events about its operation – changes of measuring mode, the state of permissions, GPS speed and accuracy at the moment of a decision, sensor statistics and the phone model. Purpose: to keep the App working correctly and to fix errors in data collection. Legal basis: our legitimate interest in the reliable operation of the App.
• Trip summary statistics (registered users only): If you have registered and confirmed your email address in the App, it sends a summary of your driving to our server about once a day: kilometres mapped, metres of yellow and red road sections, the date the counter was last reset, and monthly summaries of these values and of warnings before poor road sections. The summaries contain no locations or routes. Purpose: the shock counter, monthly trip overviews and counting kilometres for the beta testers' public promise. Legal basis: your consent, given by registering in the App.
• Email address and preferred language (registration): You can register voluntarily in the App or, as a beta tester, through our website. Registration in the App sends your email address and preferred language together with the device identifier. Purpose: sending a confirmation email, unlocking the PDF of the RH Red Report in the App, sending testing instructions and notifying you about updates. Legal basis: your consent, given by submitting the registration.
• AI assistant on the website (the “Help” window): If you type a question to the AI assistant on our website, the text of the question is processed by an AI provider headquartered and hosted in the EU (Mistral AI, France) to generate an answer; the provider does not use questions to train its models and does not retain them longer than strictly necessary to generate the answer (Zero Data Retention). We store questions and answers anonymously – without IP address, name or cookies and without any link to the app; email addresses, phone numbers and licence plates are removed automatically before storage. Records are deleted after 90 days. Please do not enter personal data in your questions. Purpose: to answer your question and to find out which information is missing on the website. Legal basis: your consent, given by sending the question.
• Record of a strong impact (RH Red Report – Crash, Android): If the App detects a very strong impact while you drive and the car then sharply slows down or stops, it saves a record on your device: position and speed for a short time before and after the impact, the course of the acceleration and your answer to the question whether an accident happened. You can add photos to it. The record stays on your device. Only a short section of measured points at the moment of impact (position, time, speed, acceleration), marked as an impact, is sent to our server – just like the other points of your drive, so that the link in the PDF works – together with a technical event entry (impact strength, speed, whether the car stopped) so that we can evaluate how reliable the detection is. The App does not promise to call for help. Purpose: a record for you, for example for your insurer. Legal basis: your consent, given by starting road monitoring; for the technical entry, our legitimate interest in the reliable operation of the App.
• Backup of your data (Android): The App prepares a backup file on your device containing your rides, RH Red Reports and settings (without photos and without registration). If Google backup is turned on on your phone, Android transfers it to your Google account, and when you install the App on a new phone, the App offers to restore it. You can also export the backup to a file yourself, store it wherever you like and import it later. We have no access to this file – in your Google account it is processed by Google under its own policies; when exported, by the storage you choose. You can turn the backup off in the App (Settings → My data). Purpose: so that you do not lose your data when you change or reinstall your phone. Legal basis: your consent (the switch in the App; you start export and import yourself).
• In-car navigation: To search for a destination and calculate a route, the App sends your position, the destination and the search text to our navigation server in the EU (Germany) – without any identifier of you or your device. Saved destinations (home, work, favourites and recent destinations) stay on your device. Purpose: navigation to the destination. Legal basis: your consent, given by starting navigation or a destination search.

We do not collect your name, phone number, contacts or the contents of any other app. Photos you attach to an RH Red Report stay on your device – they are only inserted into the PDF created on your phone and are not uploaded to our servers. Drive telemetry is not stored with your name or email address and we do not use it to identify you; if you register, it can, however, technically be associated with your registration through the device identifier.

2. Where Data Is Stored

Drive telemetry (location, sensor readings, derived road quality), diagnostic data and registration data are stored within the European Union – in our cloud database provided by Supabase (eu-west-1) and on our web server operated by a hosting provider in Slovakia.

All transmission between the App, the website and the database is encrypted using HTTPS/TLS.

Our navigation server is also located in the EU (Germany). RH Red Report records, photos and saved navigation destinations are stored only on your device, or in the backup in your Google account or in a file you export yourself.

3. Third-Party Services (Google & Apple)

On Android the App uses the following Google services, which process data under Google's own privacy policy (https://policies.google.com/privacy):

• Google Play Services — Fused Location Provider: supplies location data to the App.
• Google Play Services — Activity Recognition: detects whether the device is in a moving vehicle, so that the App can pause measurement when you are not driving and conserve battery.
• Google Maps SDK: renders the map inside the App.
• Android Auto: if you connect your device to a compatible vehicle, the App can display road information on the vehicle's screen.
• Android backup (Google): if Google backup is turned on on your phone, it transfers the App's backup file to your Google account and returns it when you install the App on a new phone.

On iOS the App uses the following Apple system services, which process data under Apple's privacy policy (https://www.apple.com/legal/privacy/). On iOS, driving is detected from GPS speed; the App does not use motion activity recognition.

• Apple Core Location: supplies location data to the App on iOS.
• Apple Core Motion: supplies accelerometer readings used to measure vibrations and road surface quality.
• Apple Maps (MapKit): renders the map inside the iOS App.

4. How Long We Retain Data

• Raw drive telemetry (individual measurement points): retained in the active database for a short period — currently several days — after which it is aggregated into evaluated road segments and moved to archive storage or deleted. Raw points are not kept in the active system indefinitely.
• Aggregated road condition data (evaluated road segments): retained for as long as it remains relevant for describing the condition of the road network. Because road surfaces change over time, older segments are progressively superseded by newer measurements.
• User-submitted hazard reports: retained until the hazard is no longer relevant, or until you request deletion.
• Diagnostic data: retained only for as long as needed to troubleshoot the App.
• Trip summary statistics: retained for as long as your registration is active, and deleted upon your request.
• Email address, language and device identifier from registration: retained for as long as your registration is active (for beta testers registered through the website, for the duration of the beta programme), and deleted upon your request.
• Data on your device (rides, RH Red Reports, photos, saved destinations): kept on your device according to the rules in the App (for example the last 10 records of RH Red Report – Crash) and deleted when you uninstall the App. The backup in your Google account follows your Google settings; an exported file is managed by you.

5. Pseudonymisation and the Public Map

Drive telemetry is stored without your name or email address. Drives are identified by randomly generated identifiers (a session and drive identifier); diagnostic data also carry a code derived from the device identifier. If you register, this data can technically be associated with your registration through the device identifier; we do not use it to identify you.

However, we want to be transparent: location traces are not fully anonymous data. A sequence of precise positions and times can, in principle, reveal patterns such as regularly travelled routes. We therefore treat this data as pseudonymised personal data under the GDPR and protect it accordingly.

On the public interactive map we publish only aggregated road quality segments combined from multiple drives, together with hazard reports. We do not publish individual drive traces.

6. Third-Party Sharing

We do not sell, rent or trade your personal data, we do not use it for advertising and we do not combine it with data from other companies.

We do not share your data with commercial third parties, other than the service providers necessary to operate the App (Supabase for data storage, our web hosting provider, Google and Apple for the services listed in section 3), which act as processors on our behalf.

To determine speed limits and nearby services, the App queries the public OpenStreetMap servers (Overpass API) with a location, without any identifier of you or your device.

We may disclose data if required to do so by law.

For navigation we operate our own server in the EU with the server provider Hetzner (Germany), which acts as a processor on our behalf.

7. Your Rights

Under the GDPR you have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data;
• request restriction of processing;
• object to processing;
• request a copy of your data in a portable format;
• withdraw your consent at any time (this does not affect the lawfulness of processing carried out before withdrawal);
• lodge a complaint with the Slovak Data Protection Authority (Úrad na ochranu osobných údajov Slovenskej republiky, https://dataprotection.gov.sk).

To exercise any of these rights, contact us at support@roadhealth.org. We will respond within one month.

You can also stop all data collection at any time by revoking the location permission in your device settings, or by uninstalling the App. On iOS you can also switch off collection directly in the App (Menu → Data collection → “Collect while driving”).

You can also create a copy of the data stored in the App yourself at any time: Settings → My data → Export backup (Android).

8. Children

The App is not directed at children and we do not knowingly collect data from children under 16.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be announced on our website and, where appropriate, through an update in the Apple App Store or Google Play Store. The date at the top of this document indicates when it was last revised.

10. Cookies and analytics

The website voisano.org stores only the cookies listed below in your browser. Analytics cookies are stored only after you click “Accept” in the cookie bar; necessary cookies are required for the website to work.

You can change or withdraw your consent at any time via “Cookie settings” in the footer of the website.

The live map (mapa.php) is displayed using Google Maps; when the map loads, Google processes your IP address under its own terms.