Privacy Policy

1. Who We Are

Zoliora is operated by:

[LEGAL COMPANY NAME]

[SWISS REGISTERED ADDRESS]

Zoliora is expected to be operated from Switzerland.

Zoliora is the controller of personal data processed through the Zoliora service, except where another entity is expressly identified as the controller.

Privacy contact:

[LEGAL / PRIVACY CONTACT EMAIL]

Where required by applicable law, Zoliora will identify an applicable data-protection representative or Data Protection Officer.

2. Information We Collect

Depending on how you use Zoliora, we may collect the following categories of information.

Account information:

• name;
• email address;
• authentication information;
• date of birth or age information where required;
• profile information;
• account role.

Content you provide:

• photos;
• notes;
• reminders;
• calendar information;
• routines;
• events;
• other content you choose to submit.

Cognitive and wellbeing information:

Depending on the features you use:

• cognitive activity results;
• game performance;
• cognitive trends;
• questionnaire responses;
• mood and wellbeing information;
• activity-related information.

GPS and location information:

If you enable location functionality, Zoliora may collect and process GPS/location information.

This may be used to provide features such as:

• displaying a user's location to authorised connected profiles;
• location-based safety features;
• safety zones;
• alerts;
• location history where the relevant feature exists;
• navigation-related functionality;
• analysis of activity, mobility or patterns where enabled and legally permitted.

Location information may be shared with authorised connected Primary peers, Family Carers, and Professional Carers and HCPs where the relevant functionality is available, subject to the relevant permissions and functionality.

GPS/location information may be processed continuously or periodically depending on the functionality, device settings and permissions.

The actual frequency and accuracy of location collection depends on the device, operating system, battery, connectivity, GPS availability, permissions and other technical factors.

Health and activity information:

If you choose to connect Apple Health, an equivalent Android health platform such as Health Connect, or another supported health-data integration, Zoliora may access and process the health and activity measures that you authorise.

Depending on the integration and permissions, this may include information such as:

• steps;
• walking/running activity;
• distance;
• exercise/activity information;
• sleep-related measures;
• weight; and
• other health or activity measurements supported by the relevant platform and authorised by you.

The exact categories depend on the permissions you grant and the capabilities of the relevant platform.

Zoliora does not access health information through Apple Health, Android health platforms or other integrations unless the relevant permission has been granted.

Health and activity information may be used to:

• provide Zoliora features;
• generate analyses and trends;
• support wellbeing and activity insights;
• combine relevant measures with other information within Zoliora;
• improve and develop Zoliora;
• conduct research where legally permitted; and
• share relevant information or analyses with authorised connected Primary peers, Family Carers, and Professional Carers and HCPs where the relevant functionality is available, subject to the relevant permissions and functionality.

Connection information:

We may process information relating to your connections with other Zoliora users, including:

• connection status;
• permissions;
• role relationships;
• information shared between connected users;
• sharing preferences.

This may include direct peer connections between two Primary accounts.

Technical and usage information:

We may collect:

• device type;
• operating system;
• app version;
• IP address;
• identifiers;
• login information;
• error and diagnostic information;
• usage information;
• security-related information.

At present, Zoliora does not use separate third-party analytics or crash-reporting services.

This may change as the service develops.

3. How We Use Information

We may process personal data to:

• create and manage accounts;
• provide Zoliora and its features;
• enable connections between users;
• provide reminders and notifications;
• provide cognitive, wellbeing and other functionality;
• provide GPS/location and safety functionality;
• provide navigation functionality;
• provide health and activity integrations;
• generate analyses, trends and insights;
• provide relevant information to authorised connected Primary peers and Family Carers;
• provide relevant information to Professional Carers and HCPs if and when the relevant functionality becomes available and is authorised;
• provide customer support;
• process payments and subscriptions where applicable;
• maintain security;
• prevent fraud and misuse;
• troubleshoot technical problems;
• analyse usage and performance;
• improve Zoliora;
• develop new features, products and services;
• conduct research and analytics;
• create aggregated, anonymised or appropriately de-identified information;
• comply with legal obligations;
• enforce our Terms; and
• protect the rights, safety and security of Zoliora, users and third parties.

4. Legal Bases for Processing

Depending on the circumstances and applicable law, we may process personal data based on:

• performance of a contract;
• compliance with legal obligations;
• our legitimate interests;
• consent;
• protection of vital interests; or
• another legal basis permitted by applicable law.

For health information, GPS/location information and other sensitive personal data, additional legal requirements may apply.

Where consent is required, we will request it separately and provide appropriate information about the relevant processing.

Where processing is based on consent, consent may be withdrawn where applicable.

Withdrawal of consent does not affect processing carried out lawfully before withdrawal and does not prevent processing based on another valid legal basis where applicable.

5. Sharing Information With Connected Profiles, Family Carers, Professional Carers and HCPs

A central purpose of Zoliora is to allow users to share selected information with people they trust.

Zoliora supports direct connections between Primary accounts and connections between Primary accounts and Family Carers.

Depending on the user's role, permissions and enabled features, information may be shared with:

• connected Primary peers;
• Family Carers; and
• Professional Carers and HCPs, where the relevant functionality is available.

Professional Carer and HCP functionality is not currently available through a standard user-facing connection flow and may be limited, manually enabled or introduced in a later phase.

Information that may be shared can include, depending on the features enabled and permissions granted:

• profile information;
• reminders and calendar information;
• photos and notes;
• cognitive activity results;
• cognitive trends;
• wellbeing information;
• GPS/location information;
• safety-zone information;
• activity and mobility information;
• Apple Health / Android health-platform measures;
• analyses and trends derived from these data; and
• other information explicitly made available through the relevant connection.

The exact information available to each role is controlled by Zoliora's permission model and the settings available to the user.

Connected users do not automatically receive unrestricted access to the entire account.

Users should only connect with people they trust.

6. Service Providers

Zoliora currently uses Supabase for core cloud infrastructure, including database, authentication and related backend/storage functionality.

Supabase may process personal data on behalf of Zoliora in providing these services.

Zoliora may use additional third-party service providers as the service develops, which may include providers of:

• cloud infrastructure;
• communications;
• email;
• push notifications;
• payment processing;
• security;
• customer support;
• health-data integrations; and
• other infrastructure or technology services.

Zoliora does not currently use separate third-party analytics or crash-reporting services.

Zoliora does not use an embedded maps SDK or directions API.

Where navigation functionality is provided, Zoliora may use a system-level link to the user's own native Maps application.

The providers used by Zoliora may change over time.

7. Research, Analytics and Product Development

Zoliora may use information generated through use of the service for research, analytics, product development and service improvement.

This may include:

• cognitive data;
• wellbeing data;
• GPS/location data;
• activity and mobility information;
• health and activity information obtained through supported integrations;
• usage information; and
• other information generated through use of Zoliora.

Zoliora may use information to improve and develop its services and technology.

Where legally permitted, Zoliora may also conduct or support research using aggregated, anonymised or appropriately de-identified information.

Where permitted by applicable law, Zoliora may disclose, license or commercialise aggregated, anonymised or appropriately de-identified information for purposes including:

• scientific research;
• healthcare research;
• academic research;
• pharmaceutical and life-sciences research;
• technology development;
• product development;
• analytics; and
• other lawful commercial or non-commercial purposes.

Potential recipients may include universities, research organisations, healthcare organisations, pharmaceutical and life-sciences companies, technology companies and other partners.

Pseudonymised information is not necessarily anonymous.

Where information remains personal data under applicable law, we will process it only on an appropriate legal basis and subject to applicable data-protection requirements.

Where a particular research activity requires separate consent or another specific legal basis for processing identifiable or sensitive personal data, Zoliora will obtain the required consent or rely on another legally valid basis.

8. International Data Transfers

Zoliora and its service providers may process personal data in Switzerland, the European Economic Area and other countries.

Where personal data is transferred internationally, Zoliora will use the safeguards required by applicable law.

Depending on the circumstances, these may include:

• an adequacy decision;
• approved contractual safeguards;
• other recognised transfer mechanisms; or
• an applicable statutory exception.

Information about relevant international transfers and safeguards can be obtained from Zoliora using the contact details below where required.

9. Data Retention

We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention periods depend on:

• the type of information;
• the purpose for which it is processed;
• the relationship with the user;
• security requirements;
• legal and regulatory obligations;
• dispute resolution; and
• other legitimate requirements.

When personal data is no longer required, we will delete or anonymise it in accordance with our applicable retention practices and legal obligations.

Information that has been irreversibly anonymised or incorporated into aggregated information may continue to be retained and used because it can no longer reasonably be associated with an identifiable individual.

10. Account Deletion

Users may request deletion of their Zoliora account.

For Family Carer, Professional Carer and HCP accounts, we will process the deletion request without unnecessary delay, subject to identity verification, technically necessary processing, legally required retention and other applicable legal obligations.

For a Primary account, the deletion request will first notify all connected Family Carers.

The deletion will then proceed automatically after a short notice period of several days.

This notice period exists to inform connected Family Carers and is not an approval, consent or veto mechanism.

We may need to verify identity before processing a deletion request.

Deleting an account will generally result in deletion or anonymisation of associated personal data, subject to:

• legal retention requirements;
• security requirements;
• dispute resolution;
• fraud prevention;
• legitimate retention requirements; and
• information that has already been irreversibly anonymised or incorporated into aggregated information.

Deletion may also affect connected users and shared information.

11. Your Data Protection Rights

Depending on applicable law, you may have rights including:

• access to your personal data;
• correction of inaccurate information;
• deletion;
• restriction of processing;
• objection to certain processing;
• data portability;
• withdrawal of consent where processing is based on consent; and
• the right to lodge a complaint with the relevant data-protection authority.

Some rights are subject to legal limitations and exceptions.

Requests can be submitted using:

[LEGAL / PRIVACY CONTACT EMAIL]

We may take reasonable steps to verify your identity before processing a request.

12. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include access controls, authentication, encryption, monitoring, secure infrastructure and other safeguards appropriate to the risks involved.

No online service can guarantee absolute security.

We may update our technical and organisational security measures as Zoliora develops.

Where required by applicable law, we will notify relevant authorities and/or affected individuals of qualifying data-security breaches.

Liability for security incidents is addressed in Section 13 of the Zoliora Terms & Conditions.

13. Children

Zoliora is intended for adults and is not designed for children.

We do not knowingly collect personal data from children in violation of applicable law.

If we become aware that personal data has been collected in circumstances where this is not permitted, we will take appropriate steps.

14. Automated Processing and AI

Zoliora may use algorithms, statistical methods or artificial intelligence technologies to analyse information, identify patterns, generate trends, personalise features or support functionality.

This may involve analysing cognitive, wellbeing, location, activity or health-related information.

Where such processing constitutes automated decision-making subject to specific legal requirements, Zoliora will provide the information and safeguards required by applicable law.

Zoliora does not intend to make legally significant decisions about users solely through automated processing unless expressly stated otherwise.

15. Marketing and Communications

We may send service-related communications necessary to operate Zoliora, including account, security, billing and feature notifications.

Where required by law, we will obtain consent for promotional communications.

You may opt out of promotional communications through the available mechanisms.

Service-related communications may continue where necessary for operation or security of your account.

16. Cookies and Similar Technologies

Zoliora and its website may use cookies, device identifiers, analytics technologies and similar technologies.

These technologies may be used for:

• authentication;
• security;
• functionality;
• analytics;
• performance;
• remembering preferences; and
• marketing where permitted.

Where consent is required, we will request it through the appropriate mechanism.

17. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to Zoliora, our services, technology, data-processing activities or legal requirements.

The latest version will be available through Zoliora.

Where required by applicable law, we will provide appropriate notice of material changes.

18. Contact

[LEGAL COMPANY NAME]

Registered address:

[SWISS REGISTERED ADDRESS]

Privacy contact:

[LEGAL / PRIVACY CONTACT EMAIL]

Company registration:

[COMPANY REGISTRATION NUMBER, IF APPLICABLE]

Data Protection Officer / Representative:

[DPO / DATA PROTECTION REPRESENTATIVE, IF APPLICABLE]