Privacy Policy

Data we collect

Guest account identifier, first name and profile; self-reported wellness and health data depending on your choices (energy, sleep, mood, comfort, pregnancy, postpartum, cycle, nutrition and recovery); check-ins, scores, preferences, completed sessions, notification token and technical data required for the service.

An email address is processed only if you later secure the account, contact support, join the waitlist or request a partner invitation email.

If you enable optional usage measurement, we keep at most one daily app open and onboarding completion, linked to the date, app version and your account. No score, symptom, message or health content is attached.

Why we use it

To provide the application, personalize support, compute the recovery score, manage subscriptions, send requested notifications, provide support and protect the platform. We never sell your data or use it for targeted advertising.

Legal basis and consent

Health and wellness data relies on your explicit consent. Categories remain separate and can be withdrawn from Data & privacy. The core service relies on performance of the contract; security on our legitimate interest; billing obligations on applicable law.

The AI Coach requires separate permission before the first message. Without it, no conversation is sent to the AI provider.

Retention measurement also requires separate permission, is off by default and can be withdrawn from Data & privacy.

Providers and AI Coach

Supabase provides the account, main database and server functions. Anthropic provides AI Coach replies, only after permission. RevenueCat and Apple verify subscriptions. Firebase / Google and Apple provide notifications. Resend processes requested emails such as partner invitations.

For the AI Coach, the message, up to the latest 8 exchanges and, if you allowed it, limited context (first name, situation, score, cycle phase, energy and sleep) may be sent to Anthropic to generate the reply.

Hosting, transfers and security

The main Supabase database is configured in the European Union. Some providers may process data outside the European Union; transfers must be covered by an adequacy decision, standard contractual clauses or another recognized mechanism depending on the provider.

We use encryption in transit, per-user access rules, server-side secrets and backups configured with our providers.

Your rights (GDPR)

You have rights including access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Export and deletion are available in the application. You may also email privacy@vysoma.app or visit /en/delete-account.

Retention

Account data is kept while the account is used. Deletion in the app removes the VYSOMA account, linked data and RevenueCat customer profile without undue delay. Only data required by law or needed for legal claims may be retained for the strictly necessary period. Records held by Apple follow Apple's rules.