The short version
- When you open your SD card, it's read in your browser. Nothing is uploaded unless you're signed in and save nights.
- If you save nights, we store them in your account so you can see them again. Only you can see them.
- We don't sell your data, show ads, or use it to train AI.
- You can delete any saved night, or your whole account and everything in it, at any time from your account settings.
Who we are
CPAPGeeks is run by CPAP Stores, part of the cpapstores.com network ("we", "us"). We are responsible for the personal data described here. You can reach us at jmagz1313@gmail.com.
What we collect
When you open a card without an account
Your browser reads the files on the card and draws the charts on your device. We don't receive the files or the results. If your card holds a file with personal details, such as the patient file some React Health / BMC machines write, CPAPGeeks doesn't open it at all.
When you create an account
- Your name and email address, so you can sign in and so we can send account emails (confirming your email, resetting your password).
- Your password, which is stored only in scrambled (hashed) form by our sign-in provider. We can't see it.
- Where you live (your country or region), so we can offer the reports and information that fit your country's rules, such as DOT and Medicare reports in the US.
- Share links, if you make them: the dates shared, when the link expires, whether it shows your name, and how many times it was opened.
- Supply reminders, if you set them: which CPAP parts you use, when you last replaced them, and whether you want reminder emails.
- A record of your consent: which version of these terms you agreed to, and when.
When you save nights
- A summary of each night: hours used, events per hour, event counts and times, leak and pressure figures, and your machine's settings, model and serial number. The serial number appears on compliance reports you create.
- That night's data files from your card, compressed, so the detailed charts can be drawn again later.
CPAP data is health information. We only store it because you choose to save it, and you agree to this when you create your account.
Technical information
Like any website, our hosting provider sees your IP address and browser type when you visit, and keeps short-lived logs for security and to keep the site running. Your browser keeps a sign-in token so you stay signed in. The site's font is served from our own site, not a third party. We don't use advertising or tracking cookies.
What we don't do
- We don't sell or rent your data.
- We don't use your data for advertising, and there are no ad trackers on the site.
- We don't use your data to train AI models.
- We don't share your nights with your doctor, your insurer, your employer, or a CPAP Stores location. Only you can, by making a share link.
Why we use it
- To run your account: sign-in, saving and showing your nights, and account emails.
- To keep the service secure and working: preventing abuse and fixing problems.
- Because the law requires it, where it does.
We process your health data on the basis of your explicit consent, which you give when you create an account. You can withdraw it at any time by deleting your saved nights or your account. That doesn't affect anything we did before you withdrew it.
Where it's stored
We use a small number of service providers, each bound to protect your data and use it only to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Supabase | Accounts, sign-in and saved nights (database and file storage) | European Union (Ireland) |
| Vercel | Hosting the website | Worldwide network of servers |
This means data you save is stored outside the United Arab Emirates. When you create an account, you agree to this transfer. If that's a problem for you, you can still use CPAPGeeks without an account: nothing leaves your browser.
Share links
If you make a share link, anyone who has it can see a summary of your saved nights between the dates you chose (hours, events per hour, leak, pressure, settings, machine and serial number), and your name if you chose to show it, until the link expires (at most 90 days) or you turn it off. It never includes your SD-card files or your email address. Send it only to people you trust, such as your doctor.
How long we keep it
We keep your account and saved nights until you delete them. When you delete a night or your account, it's removed from our database and file storage straight away. Copies may remain in our providers' backups for a limited period before they're overwritten.
Your choices and rights
- See your data: everything you've saved is on your nights page. Ask us for a copy of anything else we hold about you.
- Correct it: change your name in account settings, or ask us.
- Delete it: delete saved nights or your whole account in account settings, or ask us.
- Withdraw consent: delete your saved nights or account. You can keep using CPAPGeeks without saving anything.
- Complain: if you're unhappy with how we've handled your data, contact us first. You can also contact the data protection authority where you live.
We'll reply to requests within 30 days.
Security
Everything travels over an encrypted connection (HTTPS) and is encrypted when stored by our database provider. The database only ever returns your own nights to your own account, and you're signed out automatically after 30 minutes without activity. No system is perfectly secure; if something goes wrong that affects your data, we'll tell you and the authorities as the law requires.
Laws where you live
Data protection laws differ by country. This table lists the main law where you live and what it requires if personal data is ever exposed in a breach. It's general information, checked November 2026, not legal advice.
| Where you live | Main data law | If there's a breach |
|---|---|---|
| United States | FTC Health Breach Notification Rule | People told within 60 days |
| Canada | PIPEDA | The Privacy Commissioner told as soon as feasible |
| United Kingdom | UK GDPR | The ICO told within 72 hours |
| European Union | GDPR | The authority told within 72 hours |
| Australia | Privacy Act 1988 | The OAIC and people told as soon as practicable |
| New Zealand | Privacy Act 2020 | The Privacy Commissioner told as soon as practicable |
| United Arab Emirates | UAE PDPL and the health data law (Federal Law No. 2 of 2019) | The UAE Data Office told immediately |
| Saudi Arabia | Personal Data Protection Law (PDPL) | SDAIA told within 72 hours |
| Qatar | Law No. 13 of 2016 | Serious breaches reported |
| Kuwait | CITRA data privacy regulations | Reported within 72 hours |
| Bahrain | Law No. 30 of 2018 | Reported within 72 hours |
| Oman | Royal Decree 6/2022 | As set by its regulations |
| India | Digital Personal Data Protection Act 2023 | The Board and people told without delay |
| Singapore | PDPA | The PDPC told within 3 days of assessment |
Wherever you live, if a breach affects your data we'll tell you without undue delay and tell the authorities the law requires us to tell.
Children
CPAPGeeks is for adults aged 18 and over. A parent or guardian can use it to look after a child's therapy data on their own account.
Changes
If we change this policy, we'll update the date at the top. If a change affects how we use data you've already saved, we'll tell you by email or when you next sign in, and ask for your agreement where the law requires it.
Contact
Questions or requests about your data: jmagz1313@gmail.com.