diff --git a/android/gatt.c b/android/gatt.c
index 3bac0fe..ff5b0de 100644
--- a/android/gatt.c
+++ b/android/gatt.c
@@ -85,6 +85,8 @@ struct characteristic {
 struct service {
 	struct element_id id;
 	struct gatt_primary prim;
+	struct gatt_included incl;
+
 	bool primary;
 
 	struct queue *chars;
@@ -1186,8 +1188,13 @@ static bool match_service_by_uuid(const void *data, const void *user_data)
 	const struct service *service = data;
 	const bt_uuid_t *uuid = user_data;
 	bt_uuid_t service_uuid;
+	int res;
 
-	if (bt_string_to_uuid(&service_uuid, service->prim.uuid) < 0)
+	if (service->primary)
+		res = bt_string_to_uuid(&service_uuid, service->prim.uuid);
+	else
+		res = bt_string_to_uuid(&service_uuid, service->incl.uuid);
+	if (res < 0)
 		return false;
 
 	return !bt_uuid_cmp(uuid, &service_uuid);
@@ -1453,6 +1460,8 @@ static void handle_client_get_characteristic(const void *buf, uint16_t len)
 
 	/* Discover all characteristics for services if not cached yet */
 	if (queue_isempty(srvc->chars)) {
+		struct att_range range;
+
 		struct discover_char_data *cb_data =
 					new0(struct discover_char_data, 1);
 
@@ -1465,9 +1474,11 @@ static void handle_client_get_characteristic(const void *buf, uint16_t len)
 		cb_data->service = srvc;
 		cb_data->conn_id = dev->conn_id;
 
-		if (!gatt_discover_char(dev->attrib, srvc->prim.range.start,
-					srvc->prim.range.end, NULL,
-					discover_char_cb, cb_data)) {
+		range = srvc->primary ? srvc->prim.range : srvc->incl.range;
+
+		if (!gatt_discover_char(dev->attrib, range.start, range.end,
+							NULL, discover_char_cb,
+							cb_data)) {
 			free(cb_data);
 
 			status = HAL_STATUS_FAILED;