Privacy Policy

Last Updated: February 26, 2026
Effective Date: January 18, 2026

1. Introduction

Welcome to POMWELL. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service").

POMWELL is designed as a general wellness application to help you track your mood, journal your thoughts, and gain insights into your well-being. By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Email address, name, and authentication credentials when you create an account
• Journal Entries: Written reflections, thoughts, and personal narratives you enter
• Mood and Wellness Data: Mood ratings, energy levels, sleep quality assessments, and meditation minutes you log
• Task and Planning Data: Tasks, goals, intentions, and daily planning information
• Voice Data: Audio recordings when you use voice features (processed and transcribed, then deleted)
• Substance Tracking: Optional tracking of substances like nicotine or cannabis use (if you choose to log this)
• Gratitude and Affirmations: Personal notes of gratitude and affirmations

2.2 Health Data (Optional)

POMWELL offers optional integration with Apple HealthKit and Google Health Connect to read health data such as sleep duration, step count, and physical activity. This integration requires your explicit permission and you can revoke access at any time through your device settings. Health data is used solely to enrich your Body pillar insights and is never shared with third parties beyond what is described in Section 4.

2.3 Nutrition Data (Optional)

If you use our nutrition tracking feature, POMWELL may collect food intake information you log manually or through AI-assisted food recognition. This data is processed to provide nutritional insights and is stored alongside your other wellness data.

2.4 Relationship Data (Optional)

If you use couples or relationship features, POMWELL may collect communication patterns and relationship check-in data you voluntarily provide. This data is used to generate relationship insights and is never shared with other users without your explicit consent.

2.5 Data Generated by AI Analysis

When you submit journal entries or other content, our AI systems analyze this to provide insights:

• Sentiment Analysis: Overall emotional tone of your entries
• Emotion Detection: Specific emotions identified (e.g., anxiety, joy, frustration)
• Pattern Recognition: Cognitive patterns, coping mechanisms, and behavioral trends
• Stressor Identification: Potential stressors and their severity
• Personalized Insights: AI-generated reflections and suggestions based on your data

2.6 Technical and Usage Data

• Device Information: Device type, operating system version, unique device identifiers
• Usage Analytics: Features used, session duration, interaction patterns
• Crash Reports: Technical information about app crashes or errors

2.7 Anonymous Public Survey Data

POMWELL offers free, public well-being assessments that do not require an account. This is currently the WHO-5 Well-Being Check-In. When you complete a public survey:

• What We Collect: Your anonymous survey responses, completion time, and browser metadata (user agent, referrer). No IP addresses are stored.
• No PII Required: You are not required to provide any personally identifiable information. If you optionally provide your email address, it is stored separately from your survey responses.
• Research Use: Anonymous survey data may be used in aggregate for research into well-being patterns. Individual responses are never published or shared.
• Consent: You must explicitly consent before submitting survey responses. Consent is collected via an in-survey checkbox.
• Data Governance: Anonymous survey data is stored in isolated collections accessible only to POMWELL administrators via server-side credentials. Data is retained indefinitely for research purposes. Since no PII is collected in the anonymous dataset, individual deletion requests do not apply to these records.

3. How We Use Your Information

We use your information for the following purposes:

• Provide Core Services: Display your wellness data, generate insights, and track your progress
• AI-Powered Analysis: Analyze journal entries and correlate health metrics to provide personalized insights
• Improve the Service: Understand usage patterns to enhance features and fix issues
• Communicate: Send service-related notifications and updates
• Security: Detect and prevent fraud, abuse, and security incidents

3.1 Legal Basis for Processing (GDPR)

If you are located in the European Economic Area or the United Kingdom, we process your data on the following legal bases:

• Contract (Art. 6(1)(b)): Processing necessary to provide the core POMWELL service, including data storage, display, and basic analytics
• Consent (Art. 6(1)(a)): AI-powered analysis of your journal entries and wellness data. You must explicitly opt-in before any data is sent to AI services, and you may withdraw consent at any time
• Legitimate Interest (Art. 6(1)(f)): Crash reporting, performance monitoring, and security measures to maintain service reliability

4. Third-Party Services and Data Sharing

We work with the following third-party service providers:

4.1 Google Firebase

• Purpose: User authentication, data storage, and app hosting
• Data Shared: All user data is stored in Firebase Firestore
• Location: Data is stored in Google Cloud data centers
• Privacy Policy: firebase.google.com/support/privacy

4.2 AI Services (Third-Party)

Google Vertex AI (Gemini)

• Purpose: AI analysis of journal entries, mood patterns, and generation of personalized wellness insights
• Data Shared: Journal text, mood data, and contextual information for analysis (only with your consent)
• PII Redaction: Before your text is sent to AI services, personally identifiable information (email addresses, phone numbers, SSNs, URLs, and known names) is automatically redacted. The original text remains unchanged in your private data store
• Data Retention: Google processes data to provide responses and does not use your data to train AI models. We access Vertex AI through a service account agreement that contractually prohibits model training on customer data
• Privacy Policy: cloud.google.com/terms/cloud-privacy-notice

Hume AI (Voice Emotion Analysis)

• Purpose: Analyzing vocal biomarkers and emotional tone from voice recordings
• Data Shared: Voice audio during emotion analysis features (only when you initiate voice features)
• Data Retention: Hume AI processes voice in real-time; audio is not stored after analysis completes
• Privacy Policy: hume.ai/privacy

OpenAI (Voice Coaching Sessions)

• Purpose: Real-time voice conversations for coaching and relationship analysis features
• Data Shared: Voice audio during active coaching sessions (only when you initiate voice features)
• Data Retention: OpenAI processes voice in real-time; audio is not stored after session ends
• Privacy Policy: openai.com/policies/privacy-policy

Your Control Over AI Features

• You must explicitly opt-in before any data is sent to AI services
• You can use POMWELL without AI features if you prefer
• You can withdraw consent at any time in Settings → Privacy → AI Features
• Withdrawing consent stops all future AI data sharing immediately

4.3 What We Do NOT Do

• We do NOT sell your personal data to third parties
• We do NOT share your data with advertisers
• We do NOT use your health data for marketing purposes
• We do NOT send your HealthKit or Health Connect data to any service other than our secure servers

5. Data Security

We implement reasonable security measures including:

• Encryption at Rest: All data stored in our cloud infrastructure is encrypted at rest using the default encryption provided by Google Cloud / Firebase
• Encryption in Transit: All data transmitted between your device and our servers uses HTTPS/TLS encryption
• PII Redaction: Personally identifiable information is automatically stripped from text before it is sent to external AI services
• Authentication: Secure authentication through Firebase Auth
• Access Controls: Your data is only accessible to your authenticated account
• Firestore Security Rules: Database-level rules prevent unauthorized access
• Audit Logging: All transmissions of user data to external AI services are logged for accountability

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

6. Data Retention

• Account Data: Retained as long as your account is active
• Daily Logs: Retained indefinitely to provide historical insights and trends
• Voice Recordings: Processed immediately and deleted after transcription
• Analytics Data: Retained for up to 24 months

You may request deletion of your data at any time (see "Your Rights" section).

7. Your Rights

Depending on your location, you may have the following rights:

7.1 Access and Portability

You have the right to request a copy of all personal data we hold about you. Contact us to request a data export.

7.2 Deletion

You have the right to request deletion of your personal data. You can delete your account and all associated data through the app's Settings menu, or by contacting us directly.

7.3 Correction

You can update most of your personal information directly within the app. For other corrections, please contact us.

7.4 California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what data we collect, the right to delete, and the right to opt-out of sales (note: we do not sell personal data).

7.5 European Residents (GDPR)

If you are located in the European Economic Area, you have additional rights under GDPR including data portability, the right to restrict processing, and the right to lodge a complaint with a supervisory authority.

8. Children's Privacy

POMWELL is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from your country. By using POMWELL, you consent to the transfer of your information to these countries.

10. Automated Decision-Making (GDPR Art. 22)

POMWELL uses AI to generate wellness insights, detect emotional patterns, and suggest actions based on your journal entries and logged data. These AI-generated outputs are strictly informational and educational -- they are not diagnostic, clinical, or prescriptive.

No decisions with legal or similarly significant effects are made solely by automated processing. All AI insights are presented as suggestions that you may choose to act on or ignore. You can disable AI features at any time in Settings.

11. Research Data Program

POMWELL offers an optional research data program (Tier 3 consent) that allows you to contribute de-identified, aggregated data to wellbeing research. If you opt in:

• De-identification: All personally identifiable information is removed before aggregation. Individual records are never shared.
• k-Anonymity: Data is only included in research datasets when it cannot be distinguished from at least k-1 other records
• Transparency: You can view exactly what data has been shared via Settings and the Data Sharing Log
• Withdrawal: You can opt out at any time. Previously shared aggregate data cannot be individually removed from published research, but no new data will be contributed

Research consent is entirely separate from AI consent. You can use AI features without participating in research, and vice versa.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Significant changes will be communicated through the app or via email.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

• Email: privacy@pomwell.app
• Subject Line: Privacy Policy Inquiry

14. Wellness Disclaimer

POMWELL is a clinician-guided general wellness app designed to help you understand your inner world across Mind, Body, and Soul. It is NOT a medical device, diagnostic tool, or substitute for professional advice.

If you are experiencing a mental health crisis, please contact emergency services (911) or the Suicide & Crisis Lifeline (988) immediately.