Draft — not yet legally reviewed.
Highlighted [items in brackets] must be completed by the platform operator before this page is relied on.
Delete your account
For study participants using mH² (mh2research.com and the mH² mobile app). Researcher and administrator accounts are closed by a platform administrator on request, after their studies have been handed over. Last updated: 24 September 2026.
You can delete your account at any time, and we never refuse to delete an account. Deletion cannot be undone. It does not require you to withdraw from a study first.
1. Delete your account yourself
- Web: sign in at mh2research.com, open your Profile, choose Delete my account, enter your password (and your authentication code if you use two-factor authentication) and confirm. Your account is deleted at once and you are signed out on every device.
- Mobile app: open Settings, scroll to Danger zone, tap Delete my account and data and confirm. In the current version of the app this sends a deletion request that our team completes: your account is deleted, and the decision on your study data is made, at the latest within one month. Updated versions of the app delete the account at once, as on the web.
Uninstalling the app on its own does not delete your account.
2. Delete your account without the app
If you no longer have the app or cannot sign in, e-mail contact@mh2research.com from the address registered with your account, with the subject “Delete my account”. We reply to that address to confirm the request before acting on it, so that nobody else can delete your account. Never send us your password or recovery phrase.
3. What is deleted
- Your e-mail address, your name and your password hint.
- Your password and every active session: you, or anyone holding an old sign-in, can no longer sign in.
- Your encrypted key backup and recovery-phrase data, and your two-factor authentication setup.
- The phones and browsers registered for notifications, and any notifications not yet delivered.
- Pending password-reset and e-mail-verification links.
4. What happens to the study data you contributed
Study data (for example sensor recordings, heart-rate and ECG data, questionnaire answers or audio) is handled in one of two ways. A platform administrator records the decision for each study, on the instruction of the study's principal investigator:
- Erased. Your data is removed from all research use and exports immediately, and the encrypted files are destroyed 30 days later.
- Kept for scientific research. Where erasing data that has already been collected would make the study's research impossible or seriously impair it, the data may be kept under the scientific-research provisions of the GDPR: Article 9(2)(j) together with Article 17(3)(d), with the safeguards of Article 89(1). It is then kept in pseudonymised form: the account it belongs to no longer holds your name, e-mail address or any other contact detail, so the data can be re-identified only through access-restricted security records (see section 5). It stays end-to-end encrypted, and only the study's research team can read it.
Either way, no new data is collected after your account is deleted. To find out which applies to your data, write to contact@mh2research.com.
5. What we must keep
- Consent records — which consent text you accepted and when — for the retention period the study's ethics approval requires, as evidence of informed consent.
- Security audit records of actions on the platform, including the deletion itself, for 6 years — the period needed to demonstrate compliance (GDPR Article 5(2)) and to answer legal claims within the general limitation period (Polish Civil Code, article 118). The record of your deletion contains an internal account number only — no e-mail address, name or IP address. Records of earlier actions can include the e-mail and IP address used at the time; once your account is deleted these are masked whenever the records are read, so a deleted account cannot be looked up by e-mail address in normal operation. An administrator can see an unmasked record only for a stated reason, such as a security investigation or a legal claim, and that access is itself recorded.
6. How long it takes
| What | When |
|---|---|
| Your account, sign-in and the devices linked to it | Immediately when you delete it on the web (or in an updated app); for a request sent from the current app or by e-mail, when we process it, at the latest within one month |
| Decision whether your study data is erased or kept for research | Without undue delay, and at the latest within one month of your request |
| Study data that is erased | Removed from all research use immediately; the encrypted files are destroyed 30 days later |
| Copies in our encrypted backups | Kept for up to 90 days, rolling. If we ever restore a backup, we re-apply every deletion made since, before the service reopens |
| Server request logs and application logs | Up to 7 days and 21 days respectively |
| Security audit records | 6 years, masked for deleted accounts (section 5) |
7. Questions and complaints
Write to contact@mh2research.com. You also have the right to lodge a complaint with a data protection supervisory authority; see section 6 of the Privacy notice.
See also the Privacy notice, the Terms of use and the Imprint.