Privacy Policy

Privacy Policy

Effective Date: November 4, 2026

1. Data Controller & Swiss Impressum

This Privacy Policy explains how SomaAid ("we," "us," or "our") collects, uses, stores, and protects your information when you use the SomaAid web application, mobile application, and related services (collectively, the "Service").

In accordance with the Swiss Federal Act on Data Protection (revDSG / nLPD), the European Union General Data Protection Regulation (GDPR), and Swiss Unfair Competition Law (UWG Art. 3 para. 1 lit. s), the Data Controller responsible for your personal data is:

  • Legal Entity / Operator: Renata Barradas Gutierrez
  • Registered Address: General-Wille-St 217, 8706, Meilen, Zurich, Switzerland
  • Privacy & Support Contact: support@somaaid.com

2. Our Core Privacy Principle: "Local-First" Architecture

SomaAid is built on a privacy-by-design, Local-First Guest Architecture:

  • Zero Mandatory Registration: You can access and use our frontline somatic stabilization tools, breathing pacers, and grounding exercises without creating an account or providing your name or email address.
  • On-Device Storage (localStorage): When you use SomaAid in Guest Mode, your session history, self-reported mood check-ins, pinned emergency kit tools, daily baseline streaks, and sensory preferences are stored exclusively on your local device. We cannot view, access, or transmit this local data to our servers unless you explicitly choose to create a cloud backup account.

3. Information We Collect (When You Opt In)

We only collect personal data when you voluntarily interact with specific optional features:

A. Account & Cross-Device Sync Data (Optional)

If you choose to create an account to back up your progress across devices (via Email Magic Link, Sign in with Apple, or Sign in with Google), we collect:

  • Your email address (including Apple Private Relay addresses) and authentication identifier (user_id);
  • Your subscription tier status (free or pro) and account creation timestamp.

B. Self-Reported Somatic & Wellness Logs (Sensitive Data)

Because self-reported emotional states and nervous system check-ins may be classified as health-related or Special Category Data under Art. 5 lit. c Swiss revDSG and Art. 9 GDPR, we process this data strictly upon your explicit affirmative consent when you activate Cloud Sync:

  • Somatic Telemetry: Completed exercise IDs, session duration, multi-day pathway progress, pinned favorites, and whether you reported feeling calmer after a session (felt_shift).
  • Strict Data Separation: In our cloud database, your somatic session logs are linked only to an anonymized UUID (user_id) and are kept structurally separated from your direct identity credentials.
  • No Biometric Hardware Harvesting: SomaAid does not read, record, or harvest objective physiological biometrics (such as heart rate variability, ECG, camera pulse readings, or microphone audio) from your device.

C. Educational Guides & Newsletter Opt-Ins

If you request a downloadable somatic cheat sheet ("Send Me This Reset Protocol") or subscribe to our newsletter, we collect your email address and the tag of the protocol requested to deliver the material. You may unsubscribe at any time via the link in every email.

D. Payments, Subscriptions & 1:1 Practitioner Bookings

  • In-App Subscriptions: Digital subscriptions (SomaAid Pro) and community sponsorships purchased through the Apple App Store or Google Play Store are processed directly by Apple or Google. We never receive or store your credit card numbers or banking details.
  • 1:1 Facilitation Sessions: If you book a private 1:1 somatic session, your scheduling details (name, email, selected time slot, and payment) are processed directly through our third-party scheduling and payment partners (Cal.com / Calendly and Stripe).

4. Legal Basis for Processing (Swiss revDSG & EU/UK GDPR)

We process your data under the following legal bases:

  • Explicit Consent (Art. 6(1)(a) & Art. 9(2)(a) GDPR / Art. 31 revDSG): For syncing your self-reported somatic logs to the cloud and sending optional email guides.
  • Performance of a Contract (Art. 6(1)(b) GDPR): To provide cross-device account synchronization, verify Pro subscription entitlements, and fulfill 1:1 session bookings.
  • Legitimate Interests (Art. 6(1)(f) GDPR): To maintain application security, prevent abuse, and deliver static audio/video media files efficiently.

5. Third-Party Service Providers (Sub-Processors) & International Transfers

We do not sell, rent, or trade your personal data to advertisers, data brokers, or third-party AI training models. We share data only with essential infrastructure sub-processors bound by strict data protection agreements:

  • Supabase (Cloud Database & Authentication): Hosts encrypted user authentication and PostgreSQL cloud backup tables.
  • Cloudflare R2 (Content Delivery Network): Streams static audio soundscapes, vocal guides, and video demonstrations.
  • Systeme.io (Email Delivery): Delivers requested PDF/email reset protocols and opt-in newsletters.
  • Apple / Google / Stripe (Payment & Entitlement Processing): Manages subscription billing and 1:1 checkout securely.

Cross-Border Data Transfers: Where data is transferred outside of Switzerland, the European Economic Area (EEA), or the UK (such as to the United States), we ensure protection via adequacy decisions (including the Swiss-U.S. and EU-U.S. Data Privacy Frameworks) and Standard Contractual Clauses (SCCs) approved by the Swiss Federal Data Protection and Information Commissioner (FDPIC) and the European Commission.

6. Children's Privacy (Soma Kids Sanctuary)

SomaAid includes a dedicated Soma Kids section designed for children and parent-child co-regulation.

  • The Soma Kids sanctuary operates 100% locally and offline-capable without user accounts, data collection, behavioral tracking, or external links.
  • In compliance with the U.S. Children's Online Privacy Protection Act (COPPA) and GDPR-K, we do not knowingly collect personal information from children under the age of 13 (or under 16 in applicable European jurisdictions). Account creation and cloud features are intended solely for adults.

7. Your Privacy Rights & Self-Serve Controls

Regardless of whether you reside in Switzerland, the EU/UK, California (CCPA), or elsewhere, we provide direct, in-app self-serve tools to exercise your statutory rights (Settings → Privacy & Data):

  • Right to Erasure ("Right to be Forgotten") & Account Deletion (Apple Guideline 5.1.1):
    • In Guest Mode: Tap "Clear Local Session History & Reset App" in Settings to permanently wipe all local logs from your device.
    • With a Cloud Account: Tap "Delete Account & Purge Data" in Settings to permanently and irreversibly delete your cloud profile, all somatic history records in our database, your email marketing record, and your local device storage.
  • Right to Data Portability & Access: Tap "Export My Somatic Data (.JSON)" in Settings to download a complete, machine-readable copy of your session logs, favorites, and pathway progress at any time.
  • Right to Withdraw Consent: You may log out, disable cloud sync, or unsubscribe from emails at any time without affecting your access to core somatic tools.

If you have questions or wish to exercise your rights via email, contact us at support@somaaid.com. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB) (edoeb.admin.ch) or your local supervisory authority.

8. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect architectural or regulatory updates. The updated version will always be accessible within the app under Settings and at /privacy with a revised Effective Date.

Terms of Use & Medical Disclaimer