SOMA Privacy Policy
This policy explains what SOMA does with your information. SOMA is a wellness and health-rhythm companion app for iPhone and Android. It is not a medical device and does not provide medical advice.
We have written this in plain language on purpose. You should not need a law degree to understand what happens to your health data.
If you live in Washington State and want to know specifically about your health data, please also read our separate document: "Consumer Health Data Privacy Policy" — https://somahealth.fit/health-data-privacy. It is a separate document, as Washington law requires.
1. Who we are
SOMA is operated by Goodsbuy365 LLC, registered at 30 N Gould St, Ste N, Sheridan, Wyoming, United States ("we", "us", "SOMA"). For the purposes of the EU/UK GDPR we are the data controller; for Washington's My Health My Data Act we are the regulated entity that determines why and how your consumer health data is processed.
You can reach us at admin@somahealth.fit.
2. The short version
- Your raw health data mostly stays on your phone. Your symptom diary, your health profile, your cycle plans, your chat history with the coach, and your voice recordings are stored only on your device. We have no cloud database table for your chat history.
- We read health data from Apple Health or Health Connect only after you allow it. We never write data back into Apple Health. We never use iCloud.
- Some things do leave your phone. Your account details, your profile photo, your profile and cycle settings, health *conclusions* (not raw biometrics) that you choose to share through the "Harmony" feature, your voice audio when you start a voice interaction, and your chat text when you talk to the coach. Sections 3 and 6 explain each one.
- If you use Harmony, a real person you invited can see your health conclusions. This is you sharing with them on purpose. It is described in section 3.7.
- We do not advertise. We do not sell your health data. We do not track you across other apps or websites.
3. What we collect, and how we collect it
3.1 Account and sign-in information
How we get it: you type it, or you choose "Sign in with Google" / "Sign in with Apple".
- Your email address, if you sign up with email and password.
- Your user ID, created by our backend (Supabase).
- If you use Google or Apple sign-in, the identity information those services return to us. With Apple you may choose to hide your real email address; in that case we only ever see the Apple private relay address.
Where it goes: our own backend, Supabase. Your password (if you use one) is handled by Supabase Auth and is not readable by us.
3.2 Profile information stored in your account
How we get it: you enter it during onboarding or in Settings. It is saved to your SOMA account on our backend, so it follows you to a new phone.
- Display name
- Date of birth
- Gender
- Life stage (for example: menstruating, or menopausal)
- Cycle pattern
- Last period start date and your average cycle length (a default of 28 days is stored)
- Whether you have finished onboarding
- Profile photo (see 3.3)
- Your plan name and trial end date
This matters, so we will say it plainly: your last period date and your life stage are stored on our servers, not only on your phone. This is reproductive and menstrual health information. We treat it as the most sensitive category of data we hold. It is covered in detail in the separate Consumer Health Data Privacy Policy.
3.3 Profile photo
How we get it: you pick a photo from your device.
Where it goes: our backend storage bucket named avatars, under a path built from your user ID. Your photo is not health data, and the only party that receives it is our hosting provider — see section 6.
3.4 Health data read from your device
How we get it: only after you grant the health permission in Apple Health (iOS) or Health Connect (Android). If you refuse, the app works without it and we simply read nothing.
With your permission we read these 11 types:
- Active energy burned
- Basal energy burned
- Blood oxygen
- Body temperature
- Heart rate
- Heart rate variability (RMSSD and SDNN)
- Resting heart rate
- Respiratory rate
- Sleep sessions
- Steps
- Menstrual flow
Two types we ask permission for but do not use. The iOS permission sheet also lists Workouts and Mindfulness. We ask for them because we plan to add support for workouts and mindfulness sessions, and iOS shows that sheet only once for each type — asking later would mean a prompt you may never see again. We do not read either one today, and nothing from them is collected, used or stored. If we ever start reading them, we will say so here first.
We read. We never write. SOMA never writes any data back into Apple Health or Health Connect. We do not use iCloud.
Menstrual and reproductive data is treated as our most sensitive category. It is used only to build your own cycle picture and your daily guidance. It is never used for advertising, and never used for use-based data mining.
3.5 Voice and audio
How we get it: only when you actively start a voice interaction. There is no always-on listening, no background recording, and no wake word. Recording begins when you press and hold (or tap) the microphone control, and stops when you release it.
Where it goes:
- While you are recording, the audio is written to a temporary file on your own device. See section 4.
- When you finish, the audio is used for two purposes, and they do not go to the same place:
- Speech-to-text — turning what you said into words the coach can answer. This runs on our own transcription service, and the audio is not sent to a third party for it. If that service is temporarily unavailable, we fall back to a third-party AI provider so the feature still works.
- Tone analysis — reading the emotional tone of your voice. For this the audio is sent to a third-party emotion-analysis AI service.
All transmission is over an encrypted connection.
- What an AI service does with that data is governed by its own terms and by OpenRouter's default handling. We explain it in full, including what we can and cannot promise, under "What happens to the data we send to AI services" in section 6.
On the device, the recording is deleted after processing. If a recording is ever left behind, it is deleted when you delete your account (see section 12).
3.6 Chat with the coach
How we get it: you type or dictate a message.
Where it goes:
- The conversation text is stored on your device only. We have no chat table in our cloud.
- When you send a message, the text is sent to third-party AI inference providers to generate a reply. Along with your message we send the health context needed to make the answer relevant — for example your recent sleep, steps, heart rate variability, resting heart rate, and your cycle phase. See section 6.
- The AI's reply text is sent to a third-party text-to-speech provider so it can be read aloud. If text-to-speech fails, the app falls back to your phone's built-in voice, and nothing is sent.
3.7 Harmony: the one place another person can see your data
Harmony lets you invite a partner, family member, or friend to see a summary of how you are doing.
How it works:
- Nothing is shared until you create an invitation link and another person accepts it. The link is valid for 7 days and can be used once.
- You choose how much they can see, on a three-level scale: level 1 is your status signal only; level 2 adds your action tips; level 3 adds your 7-day rhythm forecast, which includes your cycle phase.
- You can revoke the connection at any time in the app. After you revoke it, the other person stops receiving updates.
- Inviting someone also stores their display name next to the connection record.
What is actually stored on our backend for this:
- A connection record in a table called
supporter_connections. It holds your user ID, the invited person's user ID, the access level you chose, the invite token, the connection status, your display name and an expiry time. - A row in a table called
user_status_signals. This is health-derived information: your status colour (red / amber / green), a status title, a short action suggestion, a list of action tips, a written explanation of the physiology behind your state, and a 7-day forecast that includes your cycle phase name.
The partner account you invited can read that row. That is the whole point of the feature — but it is real health information about you sitting on a server that a second person can open, so we are telling you directly.
Important limit: we designed Harmony so that your raw biometrics — your actual HRV numbers, your resting heart rate, your sleep hours — are never uploaded. Only the plain-language conclusions are. But we want to be honest with you: a conclusion like "she is in her luteal phase" is still health information about you, and we treat it that way.
We upload your status signal only when you have an active, accepted Harmony connection. If you never set one up, no status signal is uploaded.
3.8 Health report export
You can export a PDF summary of your cycle diary from inside the app. That file is written to your device's temporary storage and is shared only when you actively choose to share it.
4. What stays on your device and never goes to our cloud
All of the following is stored locally, on your phone, and is not uploaded by SOMA:
- Chat history with the coach
- Symptom / cycle diary entries
- Wellness profile data used by the app
- Cached cycle plans generated for you
- Protocol / task completion state and history
- Your chosen voice settings
- Voice recordings while they are being processed (temporary files)
- AI text-to-speech audio files generated for playback
- Your exported cycle health report PDF
- App preferences such as theme and language
We do not add our own encryption layer on top of this local data. It is protected by your device's built-in protections — your passcode, and the operating system's file encryption. We do not claim encryption at rest beyond that.
One device-level setting, your chosen app language, is deliberately kept out of account deletion because it is a device preference and has nothing to do with your account.
5. How we use your information — every use
We use your information only for the purposes below:
- To create your account and let you sign in, and to keep it secure.
- To build your personal rhythm picture — your daily status, your cycle phase, and your 7-day forecast.
- To generate your coaching replies, action tips and daily protocols from your health context.
- To read the coaching replies out loud, when you ask for audio.
- To show you your own metrics, diary and dashboard, and to produce the PDF summary when you export it.
- To show your status summary to a supporter you personally invited, at the access level you chose (section 3.7).
- To keep the service running — diagnosing faults, preventing abuse and misuse, and maintaining security.
- To comply with the law, including responding to lawful requests.
- To tell you about changes to the app, this policy, or your account.
We do not use your information for advertising, for building advertising profiles, for behavioural tracking, or for use-based data mining.
6. Who we share your information with
We do not sell your personal information or your health data. We share only as described here.
Categories of recipients
| Category | What they receive | Why |
|---|---|---|
| Our own backend provider (Supabase) | Account identity, profile and cycle fields, profile photo, Harmony connection and status-signal rows | Hosting our backend, authentication, storage and database |
| Third-party AI inference providers, and the routing or intermediary services used to reach them | Your chat text together with the health context needed to answer; and your voice audio for tone analysis | Generating coaching replies and analysing voice emotion |
| Third-party text-to-speech providers | The text of an AI reply | Reading replies aloud |
| Sign-in providers (Google, Apple) | Nothing from us — they authenticate you and return an identity to us | Only if you choose Google or Apple to sign in |
| A supporter you personally invited | Your status signal, and your action tips and rhythm forecast if you allowed those levels | The Harmony feature you switched on (section 3.7) |
| Legal and regulatory authorities | The specific information lawfully requested | Only where we are legally required to respond |
We deliberately describe the AI recipients by category rather than by company name. We use leading AI model providers and the routing or intermediary services needed to reach them, and this may change as our technology changes. The category of recipient — third-party AI services — will not change, and your data will always be disclosed as being shared with third-party AI services.
What happens to the data we send to AI services
Before anything is sent to an AI service, we strip identifying details from what we send. The app turns your exact age into an age band (for example "30s") and replaces your name, your email address and your user ID with placeholders, so what leaves your phone is a health profile rather than an identity. That stripping is applied at every point in the app where a prompt is built, not only at some of them.
Requests are routed through OpenRouter, a large multi-model gateway that forwards them to the model provider that produces the answer. We rely on OpenRouter's published terms, and we point you to them rather than paraphrasing them into a promise of our own:
- Under OpenRouter's data-collection documentation, it does not store your prompts or responses by default. Both of its storage options — private input/output logging, and OpenRouter's own use of inputs and outputs to improve its product — are opt-in and off by default.
- OpenRouter states in its privacy policy that it does not use your inputs or outputs for model training, and in its provider-logging documentation that it works with model providers so that prompts are not trained on wherever the provider allows it.
- OpenRouter also states that each model provider has its own data practices, that some providers may use inputs and outputs for model training or improvement, and that it is not responsible for how a model provider handles your data. A provider's own published model terms are the place to check what that provider does.
Our account configuration. The settings in our OpenRouter account decide where our requests can go, and we have set them this way: all four switches in OpenRouter's Data Training section are off, so our requests are excluded from endpoints that train on request data, and all five switches in its Zero Data Retention section are on, so our requests are routed only to provider endpoints that do not store them. Identifying details are stripped before anything is sent. These settings live in our account, so they can be checked and changed, and we will keep them this way. That is a control, not a guarantee: a model provider's own published terms still govern what that provider does. We have no enterprise agreements with the model providers, and we are not able to promise that a model provider will never train on what you send; where a provider's terms permit training, they govern, and we cannot override them.
Equal protection
Any third party that receives your data from us must protect it under its own published terms and under the law that applies to it, and we expect the same or an equal level of protection for your data as we provide. We want to be straightforward about how that works in practice: we do not have bespoke data-processing agreements with each AI provider; we rely on each provider's published terms and we point you to the ones that matter. Where the law requires us to put a written data-processing agreement in place, we do so. We do not claim a contractual ban on model training that a provider's own published terms do not contain; "What happens to the data we send to AI services", below, sets out exactly what is and is not promised.
For sub-processors we do not maintain a list of our own: each provider publishes its own sub-processor page, and we refer you to those published pages.
App Store disclosure
Consistent with Apple's App Store Review Guideline 5.1.2(i), we disclose that data collected by SOMA is shared with third-party AI services, as set out above.
7. International transfers
Our backend and the AI services we use may process your information in countries other than the one you live in, including the United States. Your account data, and the health conclusions we upload, are stored with our backend provider Supabase in AWS us-west-2 (Oregon, United States), and everything we send to it travels over TLS. For the transfers this involves we rely on our providers' published terms and the safeguards those terms contain; we do not claim safeguards we cannot point you to.
8. How we protect your information
- Data in transit between the app and our backend, and between the app and AI providers, is sent over encrypted connections.
- We never put backend administrative keys inside the app. Administrative operations, such as deleting an account, happen on our server, using your own signed-in credential to prove who you are.
- Health access is read-only. We never ask for permission to write to Apple Health or Health Connect, and section 3.4 lists every type the app reads.
- Where a partner can read your data, access is enforced at the database level rather than in the app, so an app change alone cannot widen it.
- We keep the amount of data we upload deliberately small — Harmony uploads conclusions rather than raw biometrics.
- When we log for troubleshooting, we record an anonymised reference rather than your identity.
No system is perfectly secure. If a breach ever affects your information, we will notify you and the relevant authorities as the law requires.
9. How long we keep your information
- On your device: until you clear it in the app, delete your account, or uninstall the app.
- In your SOMA account: for as long as your account exists, and we delete it within 30 days after you delete your account.
- Harmony status signals: kept for as long as your account exists, and deleted within 30 days of account deletion. If you revoke a Harmony connection, sharing stops immediately and the supporter stops receiving your updates.
- AI provider logs: we do not control these; each provider's own published policy sets them — see "What happens to the data we send to AI services" in section 6.
- Server and security logs: 90 days.
When you delete your account, we delete your account record, your profile and cycle fields, your profile photo, your Harmony connection records and your uploaded status signals.
10. Your rights
Subject to your local law, you can:
- See what we hold about you, and get a copy.
- Correct anything that is wrong. Most of it you can edit yourself in Settings or in your profile.
- Delete your data. You can clear your chat history, or delete your whole account, inside the app (section 12).
- Withdraw your consent at any time (section 11).
- Ask whether we are collecting your data at all.
- Object to, or restrict, certain processing.
- Complain to your local data protection authority.
To make a request, email admin@somahealth.fit and we will respond within the time your law allows. We may need to verify that it is really you before we act. If you live in Washington State, use the same address with the subject line "WA Privacy Request" and we will treat it as a formal privacy request under Washington law; if we deny a request, you can appeal by replying to that same address, and we will respond to your appeal within 45 days. You do not need the app installed, and you do not need an account with us, to make a request or to ask whether we are collecting your data.
11. How to withdraw consent or turn things off
You are in control, and you can change your mind at any time:
- Health data: turn off SOMA's health access in your phone settings (Apple Health or Health Connect). SOMA will simply stop reading.
- Voice and audio: simply do not start a voice interaction. There is no background listening to switch off.
- Harmony sharing: revoke the connection in the app. The other person stops receiving your updates.
- Heart rate monitoring: real-time heart rate monitoring can be turned off in Settings.
- Chat history: clear it in the app under Data & Privacy.
- Everything: delete your account (section 12).
If you would rather ask us to do it, email admin@somahealth.fit.
12. Deleting your account
You can delete your SOMA account from inside the app, at Settings → Data & Privacy Shield → Delete Account. We do not make you email us, and we do not hide the button.
When you confirm deletion:
- We delete the rows of data your account owns on our backend — your harmony connection records and your uploaded status signals — and your profile photo.
- We delete your account itself, including your sign-in identity and your profile and cycle fields.
- We erase everything SOMA has stored on that device: your conversations, your symptom diary, your health profile, your cycle plans, your voice recordings and any generated audio or exported report.
This is permanent and cannot be undone. If any single step fails, we will tell you rather than leave you thinking your data is gone.
13. Children's privacy
SOMA is not intended for children. We do not knowingly collect information from anyone under the age of 18. If you believe a child has given us their information, contact us at admin@somahealth.fit and we will delete it.
14. Changes to this policy
When we change this policy we will update the "Last updated" date at the top, and we will tell you in the app before the change takes effect where the change is significant. If we ever intend to use your health data for a new purpose, we will ask you first — we will not treat your continued use of the app as your agreement to a new use of your health data.
15. How to contact us
Goodsbuy365 LLC 30 N Gould St, Ste N, Sheridan, Wyoming, United States Email: admin@somahealth.fit Privacy contact: YINGHUI ZHANG
This policy is governed by the laws of the State of Wyoming, United States.
Where to find our policies:
- General privacy policy (this document): https://somahealth.fit/privacy
- Consumer Health Data Privacy Policy: https://somahealth.fit/health-data-privacy