Privacy Policy

    Last updated: April 7, 2026

    1. Introduction

    Welcome to somarae ("we," "our," or "us"). We are deeply committed to protecting your privacy and the sensitive personal information you share with us. somarae is designed to be privacy-first, security-focused, and trauma-informed—reflecting our belief that you deserve full control over your own wellness data.

    This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our somatic wellness platform and services.

    2. Important Disclosures

    2.1 No Medical or Mental Health Advice

    somarae is a wellness support tool, not a medical device or mental health service. The information and guidance provided through our platform—including AI-generated content—should not be considered a substitute for professional medical advice, diagnosis, or treatment. Always seek the guidance of qualified health professionals with any questions you may have regarding your health.

    2.2 HIPAA Notice

    somarae is not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). While we implement strong privacy and security practices, HIPAA regulations do not apply to our services. We encourage users to be mindful of what personal health information they choose to share.

    3. Information We Collect

    3.1 Account & Profile Information

    • Email address (required for account creation)
    • Full name or chosen alias
    • Age range and gender identity (optional)
    • Location/timezone (optional, used for personalized recommendations)
    • Phone number (optional, for goal reminders)
    • Profile photo (optional)

    3.2 Emotional & Wellness Data

    • Emotional baseline and primary emotions
    • Stress levels and emotional patterns
    • Dysregulation patterns (e.g., anxiety, overwhelm, shutdown)
    • Pre- and post-session "vibe" ratings (1–10 scale)
    • Somatic experience level

    3.3 Session Data

    • Voice session transcripts (conversations with Soma AI)
    • Session duration and mode (e.g., quick relief, deep work)
    • Post-session reflections and notes
    • Session timestamps and frequency

    3.4 Menstrual & Cycle Data (Optional)

    If you choose to enable cycle tracking, we may collect:

    • Last period start date and period history
    • Typical cycle length
    • PMS intensity levels
    • Common symptoms (e.g., cramps, bloating, fatigue)
    • Daily cycle logs including flow level, mood, energy, and notes

    Note: Cycle tracking is entirely optional. You can use somarae without enabling this feature. If you enable it, we collect explicit consent beforehand.

    3.5 Community Content

    • Posts, comments, and reactions you create
    • Whether you choose to post anonymously
    • Event RSVPs and participation

    3.6 Usage & Technical Data

    • App interaction patterns and feature usage
    • Session streaks and progress metrics
    • Referral activity
    • Device type and browser information (for troubleshooting)

    4. How We Use Your Information

    • Personalize your experience: Tailor session recommendations based on your cycle phase, emotional state, and behavioral patterns
    • Provide AI-powered insights: Analyze your wellness data to identify patterns and offer actionable recommendations
    • Enable community features: Allow you to connect with others while respecting your anonymity preferences
    • Improve our services: Understand how users interact with somarae to enhance features and resolve issues
    • Send reminders: If enabled, send goal reminders and important notifications
    • Safety and support: Provide appropriate resources and disclaimers for wellness support

    AI Disclosure: somarae uses automated systems including AI to personalize your experience and generate insights. These systems analyze your wellness data to help you understand patterns and progress. No automated decision-making is used that would have legal or similarly significant effects on you.

    5. Data Sharing

    We do not sell your personal data. We may share limited information only under the following circumstances:

    • Service providers: Third-party vendors who assist in operating our platform (listed below) under strict confidentiality obligations
    • Legal compliance: When required by law, regulation, or valid legal process
    • Safety: To protect the rights, safety, or property of somarae, our users, or the public
    • Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users

    6. Third-Party Services

    We use carefully selected third-party services to operate our platform:

    • Supabase: Database hosting and authentication (data stored on AWS infrastructure with SOC 2 Type II compliance)
    • ElevenLabs: Voice AI processing for Soma AI sessions. Voice data is processed in real-time and not permanently stored by ElevenLabs. Transcripts are stored securely in your account.
    • Resend: Email delivery for account verification and password resets
    • OpenAI: AI processing for personalized wellness insights. Aggregated session data and emotional patterns may be analyzed to generate recommendations. Your data is not used to train AI models. Processing is governed by OpenAI's Privacy Policy.

    We do not share your personal health data (cycle information, emotional data, session transcripts) with any third parties for marketing or advertising purposes.

    7. Data Security

    We take the security of your sensitive personal data extremely seriously:

    • Encryption: All data is encrypted in transit (TLS/SSL) and at rest (AES-256)
    • Row-Level Security: Database policies ensure you can only access your own data—even our team cannot view your personal wellness information without explicit authorization
    • Access controls: Strict internal policies limit who can access user data
    • Secure infrastructure: We use enterprise-grade cloud infrastructure with industry-standard protections

    8. Data Retention

    • Your personal data is retained for as long as your account is active
    • Upon account deletion, all personal data is permanently removed within 30 days
    • Anonymous community posts may be retained but will no longer be linked to your identity
    • Aggregated, anonymized analytics data may be retained for service improvement

    9. Your Rights & Choices

    You have full control over your data:

    • Access: View all your personal data within the app
    • Correction: Update or correct your information in your profile settings
    • Deletion: Request complete account deletion, which permanently removes all your data
    • Disable features: Turn off cycle tracking or other optional features at any time
    • Anonymous posting: Choose to post in the community anonymously
    • Export: Request a copy of your data in a portable format
    • Opt-out: Disable goal reminders and non-essential communications

    9.1 California Privacy Rights

    If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. As noted above, we do not sell personal information.

    10. International Users

    somarae is operated from the United States. If you are accessing our services from the European Union, United Kingdom, or other regions with data protection laws, your data may be transferred to, stored, and processed in the United States. By using our services, you consent to this transfer. We strive to comply with applicable data protection regulations, including the principles of the GDPR.

    10.1 GDPR Legal Basis

    For users in the European Economic Area, our legal bases for processing personal data include:

    • Consent: For optional data collection such as cycle tracking
    • Contract: To provide the services you request
    • Legitimate interests: To improve our platform and ensure security

    11. Children's Privacy

    somarae is not intended for users under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately and we will delete such information.

    12. Data Breach Response

    In the unlikely event of a data breach affecting your personal information, we will:

    • Notify affected users within 72 hours where feasible
    • Report to relevant authorities as required by law
    • Take immediate steps to mitigate harm and prevent future incidents

    13. Changes to This Policy

    We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes—especially those affecting how we handle health data—we will also notify you via email or in-app notification.

    14. Contact Us

    If you have questions about this Privacy Policy, your data, or wish to exercise your privacy rights, please contact us at:

    • Email: support@somarae.co
    • Website: somarae.co