How we protect participants.

Last updated: 19 August 2026

About us

Behapp is a service aimed at collecting and analysing behavioural data gathered from smartphones of participants for the sole purpose of supporting scientific (and medical) research endeavours. This service will therefore only be present in formal scientific studies and is set up to adhere to standards, regulations and ethical considerations that apply to human subject research. The service is operated by Revolution3758 B.V. in the Netherlands.

From the perspective of a participant, your experience with Behapp will mainly revolve around our smartphone application, also named Behapp, which is responsible for collecting said behavioural data from your smartphone. In this privacy policy document we will tell you about the kinds of data that we collect, how we use the data and how we protect the data and by extension your privacy.

What information is being collected?

Our smartphone applications can tap into various sources of information on your smartphone.

It is important to know that this application will never register any content on its own (what you write, what you say or what someone says or writes to you). The only exception is content you actively choose to provide yourself, for example when a questionnaire asks you to type or record an answer.

The exact information collected from your phone will be clearly communicated to you before you decide whether you install the app. This is called the informed consent process. Below, we provide a full overview of the data collection capabilities of the app, which may or may not be activated for you. The exact combination of sources used by our app depends on the study you are involved in and on your phone's operating system. Researchers responsible for your study may choose to exclude sources if they deem it unnecessary for their research.

• Location data: we continuously record location data expressed as latitude/longitude coordinates accompanied by additional data like altitude, speed and accuracy.
• Call history: we look out for activity in terms of placing, receiving and possibly missing phone calls. For each activity we record the type of call, if applicable the duration of the call and the phone number of the third party involved with the call. This number is anonymised on the phone (using one way hashing) before being sent over to us.
• WiFi access points: we perform regular scans for WiFi access points in the direct vicinity of your smartphone recording the MAC address of said access points and the signal strength in relation to these devices.
• Application usage: when your phone is in use, in other words if your display is on, we continuously check which app currently resides on the foreground of your phone recording the name of the app and the number of seconds the app was in use.
• Screen state: we record when the screen of your phone turns on and off.
• Accelerometer and general motion: we continuously monitor the accelerometer sensor of the device recording the expression of motion as vectors along an x, y and z axis. We also record your step count and the motion state recognised by your phone (for example still, walking or in a vehicle).
• Ambient light: we regularly take samples through the ambient light sensor of the phone recording the current light (lux) value found.
• Questionnaire data: depending on your study we may send you questionnaires on a fixed schedule. Some studies use questionnaires that ask you to answer by speaking; these spoken answers are recorded only when you choose to answer, never in the background. Rest assured, speech data follows the same encryption and data security practices as all other data that is collected.
• Device Information: we store information describing the type of device you use such as the OS version, brand, model etc. for quality control purposes.

Lastly when the app contacts our systems to send over data collected from your smartphone this event by itself is logged including IP address information of the location from where a network connection was made. This information is stored separately from the personal and smartphone collected data mentioned before and only retained for a maximum of 400 days after being logged.

How will your information be used?

Your smartphone collected data and personal information will be used to support the research goals of the study in which you are involved, for example but not limited to:

• Reporting on movement / explorative efforts of participants
• Deriving various types of patterns of social and communicative behaviour of a participant (for example: amount, frequency and time of calls or social media app use)
• Building a classification model / composite scores tied to different participant groups

Next, depending on terms of consent and the design of your study, your data may also be used to support research goals of Behapp wide analytical endeavours by aggregating participant groups. Aggregated participant groups are classes of participants e.g. with a specific mental health issue such as a depression or dementia which are grouped together for analysis regardless of their study. Concrete analytical operations remain similar to those mentioned above.

Lastly, IP address information will be used to diagnose / troubleshoot the Behapp service itself. It will play no part in formal research efforts of our study partners and our own research projects. The data will therefore only be accessible to system administrators and thus not to researchers.

Withdrawal of informed consent & Data deletion

At any time during your participation in a scientific study you are allowed to withdraw your consent and stop participating. Upon removal of the Behapp app from your smartphone, data collection will stop immediately.

Depending on the study that you participate in, you may also request the deletion of your data. However, the degree to which your data can be retracted and deleted depends on your specific study. In general we recommend that you contact your study manager if you have any questions about data deletion in your study.

Note that we cannot process data deletion requests that are made directly to us since we do not store any personal information that will enable us to determine which data belongs to you. Any deletion request will need to go through your study manager. Based on their request we will make sure to purge your data from our systems.

If you have any difficulties in getting hold of your study manager send us a message at info@behapp.com and we will try to contact your study manager for you.

How is your information protected?

We are keenly aware of the privacy sensitive nature of the data that we collect about you and we are committed to ensuring that this data remains well protected and is handled with care.

• As a base principle, no directly identifiable information about any participant is stored within any system that is part of the Behapp service. Participants like yourself are represented by a unique number which can only be traced back to you by the researcher responsible for the study that you participate in.
• We build our systems on top of Google Cloud Platform which provides us with ready made, secure and regularly audited infrastructure components. Participant data is processed and stored within the European Union; data of participants in the United States is stored in the United States and processed in the European Union.
• Our systems undergo independent security audits.
• Both subsystems and researchers interacting with Behapp, especially systems that are connected to the public internet, are consistently provided with the least privileges to ensure that they can do their job and nothing else.
• Smartphone collected data is encrypted on your phone before it is sent over to us, and stays encrypted in transit, at rest and while in use. We rely on carefully audited crypto libraries and key management systems throughout.
• Communications between your smartphone and our systems take place over secured connections only.
• After each successful upload, all of the locally stored data on your smartphone is cleared from the device.
• In the event that your phone is lost / stolen report this to your study manager. Your study manager will reinitialize your account which will cause Behapp to fully reset itself on your lost / stolen phone when it tries to contact us again. This includes wiping of locally stored Behapp data.

Who has access to your information?

Your information will only be directly accessible by the research team responsible for your study and by Behapp staff whose job roles involve the handling and analysis of data. All of them have received instructions to ensure a secure and responsible working environment, as specified in our information security policy.

Who will the information be shared with?

Your data, in other words the raw data, and any subsequent derivatives may be shared with the research team / consortium directly responsible for your study. We will not sell or rent your information to third parties; this includes third parties that may be involved in your study but are otherwise not involved in further analytical handling of the data.

Review of this policy

We keep this policy under regular review as part of a continuous data protection impact assessment (DPIA) cycle mandated by the European General Data Protection Regulation (GDPR) and as such may be updated over time.