Privacy Policy

1. Who We Are and How to Contact Us

ComonKare is the controller responsible for the personal data processed through the Service. We are a digital-first service and operate online, so the best way to reach us is by email or through our website.

You can reach our privacy team, including for any data protection questions or to exercise your rights, at privacy@comonkare.com, or visit https://comonkare.com.

2. Information We Collect

We collect the following categories of information:

• Account information: your display name, username, email address, phone number (optional, so members can find you in support groups), password (stored only in hashed form by our authentication provider), date of birth or age range, gender, and country.
• Health and wellness data: information you choose to enter into monitoring modules and the onboarding survey, such as menstrual cycle dates, pregnancy details, postpartum and child growth records, blood sugar readings, blood pressure readings, medications, and related notes.
• Community content: posts, replies, and reactions you share in groups, and private direct messages you exchange with other members in the Interact module.
• Media and files: photos, videos, voice notes, and documents you choose to capture or upload. Recording a voice note uses your microphone, and capturing or attaching media uses your camera and photo library, only when you choose to use those features.
• Purchase information: subscription status and transaction identifiers processed by the Apple App Store, Google Play, and our subscription provider. We do not collect or store your full payment card details.
• Device and technical data: app version, device type, operating system, language, IP address, and a device identifier. We also record limited access activity, including your IP address, the approximate country derived from it, and sign-in events, to secure the Service, prevent abuse of sign-in and one-time-code requests, and keep records we may need for fraud prevention, safety, and legal compliance.
• Approximate location: we derive an approximate location (such as your country) from your IP address to select which advertisements may be shown. We do not collect precise or GPS location.
• Cookies and similar technologies: used on our website for authentication, preferences, analytics, and advertising, and mobile advertising identifiers used in our apps, as described below.

3. How We Use Your Information

• To provide, operate, and maintain the Service and your account.
• To generate the educational monitoring summaries, predictions, and content recommendations you request.
• To send transactional messages and, where enabled, reminders and notifications.
• To process and validate subscriptions and manage advertising for non-subscribers.
• To measure and attribute the performance of our advertising campaigns, including app installs and in-app events, so we can understand which campaigns are effective.
• To understand usage, improve features, and ensure security and integrity, including preventing abuse of sign-in and one-time codes.
• To keep security and access records, including sign-in activity, IP address, and approximate country, for fraud prevention, safety, and to comply with legal obligations.
• To send you optional updates about new features and health articles when you subscribe, which you can stop at any time.
• To comply with legal obligations, respond to lawful requests, and enforce our Terms of Service.

4. Marketing Communications

If you opt in, we use your email address and the country you provide to send occasional updates about new features and health articles. Opting in is optional and separate from your account, and choosing not to subscribe does not affect your use of the Service.

You can unsubscribe at any time using the subscribe control in the website footer or by contacting us. In the European Economic Area and the United Kingdom we rely on your consent for these messages, which you may withdraw at any time.

5. Health and Wellness Data

Health and wellness data is sensitive. We process it solely to provide the monitoring and educational features you actively choose to use. We do not sell health data, and we do not use health data to personalize advertising.

Where required by law, we process health data only with your explicit consent, which you may withdraw at any time by deleting the relevant entries or your account.

6. Legal Bases for Processing

For users in the European Economic Area and the United Kingdom, we rely on the following legal bases: performance of a contract to provide the Service; your consent for sensitive health data, for non-essential cookies, and for personalized advertising; our legitimate interests in securing and improving the Service; and compliance with legal obligations. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

7. Cookies and Similar Technologies

On our website we use cookies and similar technologies, and in our mobile apps we use mobile advertising identifiers. We group them as follows:

• Strictly necessary: session cookies set by our authentication provider to keep you signed in and to secure the Service. These are essential and are set without consent.
• Preferences: remember settings such as theme and language.
• Analytics: our analytics provider (PostHog) sets identifiers to measure aggregate usage. Set only with your consent where required.
• Advertising: for non-subscribers, Google AdSense and its partners may set cookies and read identifiers on our website, and Google AdMob may use mobile advertising identifiers in our apps, to serve and measure advertisements. Our apps also include the Meta SDK to measure app installs and app events from our advertising campaigns, using your mobile advertising identifier where permitted. Set only with your consent where required.
• Managing your choices: in the European Economic Area, the United Kingdom, and other regions where consent is required, we present a consent management tool so you can accept or reject non-essential cookies and advertising, and you can change your choice at any time. You can also control cookies through your browser settings and mobile advertising identifiers through your device settings.

8. Advertising and Analytics

For users who are not subscribed to a paid plan, we display advertising through Google AdMob in our mobile applications and Google AdSense on our website. Google, as a third-party vendor, uses cookies and mobile advertising identifiers to serve and measure ads. You can learn how Google uses information from sites and apps that use its services at https://policies.google.com/technologies/partner-sites.

Where required by law, we request your consent through a Google-certified consent tool before showing personalized ads, and we offer non-personalized ads as an alternative. On iOS, we ask your permission through Apple App Tracking Transparency before any tracking that uses your device advertising identifier (IDFA); you can change this in iOS Settings. On Android, you can reset or delete your advertising ID in device settings. You can also manage ad personalization through Google Ads Settings at https://adssettings.google.com. Subscribing to a paid plan removes advertising entirely.

We use PostHog to understand aggregate usage. Analytics events do not include the contents of your health records.

To measure advertising campaigns that promote our app, our mobile applications include the Meta (Facebook) SDK, and we link Google Ads with Google Play. These measure and attribute app installs and app events, such as opening the app after installing it from an advertisement, using your mobile advertising identifier where permitted. This does not use your health data, and you can control it through the consent choices and the device and app-tracking settings described above. Subscribing to a paid plan does not disable install attribution, which relates to advertising we run rather than advertising we show you.

9. How We Share Information

We do not sell your personal information. We share information only as described below:

• Service providers: cloud database and authentication (Supabase), email delivery (SendGrid), push notifications (Firebase Cloud Messaging), product analytics (PostHog), and subscription management (RevenueCat), each acting on our instructions.
• Advertising partners: Google AdMob and Google AdSense serve advertisements to non-subscribing users, as described in the Advertising and Analytics section.
• Advertising measurement partners: when you install our app from one of our advertising campaigns, we share limited app-event and device identifier information with Meta Platforms and Google to measure and attribute those installs and app events, as described in the Advertising and Analytics section.
• Other users: community content you post is visible to members of the relevant group, and direct messages are visible to the members of that conversation.
• Legal and safety: when required by law, regulation, or legal process, to respond to lawful requests from competent authorities or institutions, or to protect rights, safety, and the integrity of the Service.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.

10. International Data Transfers

Our primary data hosting is located in the European Union (Ireland). If you access the Service from outside the European Union, including from countries in Africa, your information is transferred to and processed in the European Union and by the service providers named above.

Where we transfer personal data across borders, we rely on appropriate safeguards, such as an adequacy decision or the European Commission Standard Contractual Clauses and equivalent mechanisms, so that your data receives a comparable level of protection.

11. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. When your account is deleted, whether by you or by us, we follow the schedule below, except where longer retention is required by law or for the establishment, exercise, or defense of legal claims.

• Active accounts: your account, profile, health and wellness entries, and community content are kept until you delete them or your account. You can delete individual entries at any time.
• On account deletion: your account is removed from the live Service and its data becomes inaccessible to you and to other users, and your email address is released so it can be used to register a new account. A copy is moved to a restricted, access-controlled archive so we can meet legal, security, and record-keeping obligations. A new account created with the same email is entirely separate from the archived one.
• Archived personal data (up to 90 days): the archived copy of your profile, health and wellness entries, community content, and direct messages is retained for up to 90 days and is then permanently deleted and de-identified.
• Pseudonymous records (up to 12 months): after de-identification, a limited set of pseudonymous records, such as your IP address, approximate country, and sign-in and activity logs, is kept for up to 12 months for security, fraud-prevention, and legal-compliance purposes, and is then permanently deleted.
• Legal holds: where we are required to preserve information by law, regulation, legal process, or a lawful request from a competent authority or institution, we may retain the relevant records beyond these periods until the obligation ends, after which they are deleted. Access to archived records is limited to authorized personnel and is logged.
• Security logs and backups: retained on a rolling basis for a limited period and then purged or overwritten.

12. Automated Decision-Making

We use automated processing to generate educational summaries, predictions, and content recommendations, and to decide which non-personalized advertisement to show. These do not produce legal or similarly significant effects for you, and we do not make solely automated decisions of that kind. You can contact us for more information about the logic involved.

13. Your Rights and Choices

Depending on your location, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You may also have the right to opt out of the sale or sharing of personal information; we do not sell personal information.

• You can review and update most information directly in your account settings.
• You can delete your account from the account settings in the mobile and web applications. Deletion removes your account from the live Service, frees your email address for reuse, and applies the retention schedule described in Data Retention above. If you cannot access the app, you can request deletion by contacting us.
• You have the right to lodge a complaint with your data protection supervisory authority. See Regional Privacy Rights below for the relevant authorities.
• To exercise any right, contact us at privacy@comonkare.com. We will respond within the timeframe required by applicable law.

14. Regional Privacy Rights

In addition to the rights above, the following apply depending on where you are located:

• European Economic Area and United Kingdom: you may lodge a complaint with your national data protection authority or, in the UK, the Information Commissioner Office. For any data protection questions, you can contact our privacy team at privacy@comonkare.com.
• Nigeria: we process health data as sensitive personal data under the Nigeria Data Protection Act. You have rights of access, rectification, erasure, and objection, and you may lodge a complaint with the Nigeria Data Protection Commission.
• South Africa: under the Protection of Personal Information Act (POPIA) you have rights of access, correction, and deletion, and you may complain to the Information Regulator.
• Kenya and other African jurisdictions: under the Kenya Data Protection Act and comparable local laws, you have equivalent rights and may complain to your national data protection authority, such as the Office of the Data Protection Commissioner in Kenya.

15. Data Security

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, and row-level security on our database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

16. Data Breach Notification

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required by law, affected users without undue delay.

17. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent.

In the European Economic Area, you must be at least 16, or the lower minimum age set by your member state (which may be as low as 13), to consent to the processing of your personal data; below that age a parent or guardian must consent on your behalf. Some monitoring features involve health information; where a minor is permitted to use the Service, a parent or guardian must be involved and provide any required consent. If you believe a child has provided personal information without appropriate consent, contact us and we will delete it.

18. Third-Party Links

The Service may link to third-party websites or resources, including health authority sources cited in educational content. We are not responsible for the privacy practices of those third parties.

19. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, where appropriate, provide additional notice.

20. Contact Us

If you have questions about this Privacy Policy or your information, contact us at privacy@comonkare.com or visit https://comonkare.com.