At My Soma Track, we take your medical privacy with the utmost seriousness. Your symptom logs, biometric streams, and voice recordings belong strictly to you. This policy explains what we collect, how we use it, who we share it with, and the rights available to you, including under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).
1. Data We Collect
- Audio & Voice Recordings: Processed to transcribe your spoken symptom entries. Audio files are not sold or utilized for advertising purposes.
- Health & Symptom Entries: Pain ratings, symptom categories, medication dosages, clinical observations, and any photos you attach to a symptom entry.
- Wearable & CGM Telemetry: Heart rate, step count, active calories, blood oxygen, respiratory rate, and sleep data synchronized from Google Fit and Fitbit accounts connected through Google Health Connect, and continuous glucose readings synchronized from your connected Dexcom account.
- Emergency Medical Information: If you choose to complete your Emergency Info profile, we store your full name, date of birth, blood type, allergies, medical conditions, current medications, organ-donor status, physician and hospital preferences, and emergency contact details, so this information is available to you — and to any caregiver you grant access to — in an emergency.
- Caregiver Data: If you invite a caregiver, we collect their email address, name, and relationship to you, along with messages exchanged through the in-app caregiver messaging channel.
- Account & Subscription Information: Your email address and authentication credentials, managed through Firebase Authentication, plus your subscription plan and billing status. We do not receive or store your full payment card number — that is handled directly by Stripe or Google Play Billing (see Section 4).
2. How We Use Artificial Intelligence
To transcribe your spoken symptom entries and identify clinical details such as severity, body location, and possible triggers, your voice recordings and transcripts are processed using OpenAI's speech-to-text and language models (OpenAI). This data is sent to OpenAI solely to return the requested clinical analysis to My Soma Track, governed by OpenAI's API terms of use, and is not used by us to serve advertising.
3. How Your Data Is Secured
All data transmitted between your device and our servers (Google Cloud Firestore and Firebase Authentication) is encrypted in transit using Transport Layer Security (TLS/SSL) and encrypted at rest by Google Cloud. We do not sell or monetize personal health data under any circumstances.
4. Third-Party Data Processors & Sharing
We use the following third-party service providers to operate My Soma Track. Each processes only the data necessary to perform its function, and none may use your health data for its own advertising purposes:
- Google Firebase (Google LLC) — authentication and database hosting.
- OpenAI API (OpenAI) — voice transcription and symptom analysis.
- Google Fitness API / Google Health Connect (Google LLC) — Google Fit and Fitbit telemetry sync.
- Dexcom, Inc. — continuous glucose monitor data, when you connect a Dexcom account.
- Stripe, Inc. — payment processing for subscriptions purchased on the web.
- Google Play Billing (Google LLC) — payment processing for subscriptions purchased through the Google Play Store on Android.
We do not sell your personal data, and we do not share your health data with third parties for advertising or marketing purposes.
5. Google User Data (Google Health, Including Fitbit and Pixel Devices)
If you choose to connect Google Health, or a Fitbit or Pixel Watch device that shares data through your Google account, My Soma Track requests read-only access to the following data: steps and active calories, resting heart rate, heart rate variability, blood oxygen saturation, breathing rate, and sleep. We access this data only after you give permission on Google's consent screen, and you can withdraw it at any time by disconnecting the device in the app or by removing My Soma Track from your Google Account permissions.
We use this data only to provide the features you see in the app: showing your activity, heart, blood oxygen, breathing and sleep information on your personal dashboard and trend charts next to the symptoms, medications and other entries you log. We do not use it for advertising, we do not sell it, and we do not use it to build profiles or to determine creditworthiness or eligibility for insurance or employment. We do not transfer it to third parties except when needed to provide these features, to comply with law, or with your consent.
Your Google user data is sent over encrypted connections and stored in your private account. Our staff cannot read it unless you give consent, it is needed to investigate abuse or a security issue, or the law requires it. If you delete your account in the app, your stored Google-sourced data is deleted with it.
My Soma Track's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. Your Privacy Rights & Legal Basis for Processing
We process your account and usage data to perform our contract with you (providing the Service), and we process your health data — a "special category" of data under GDPR Article 9 — on the basis of your explicit consent, given when you record a symptom entry or connect a wearable/CGM account.
- If you are in the EEA, UK, or Switzerland: you have the right to access, correct, delete, restrict, or port your data, and to object to our processing of it. Contact us at the address below to exercise these rights, or lodge a complaint with your local data protection authority.
- If you are a California resident: you have the right to know what personal information we hold, to request its deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. We will not discriminate against you for exercising these rights.
7. International Data Transfers
My Soma Track's infrastructure runs on Google Cloud Platform / Firebase. Depending on your region, your data may be stored or processed in the United States or other countries where Google Cloud operates. Where required, we rely on standard contractual clauses and other approved transfer mechanisms to protect data transferred internationally.
8. Data Retention & Deletion
We retain your health and account data for as long as your account remains active. When you delete your account (see the Account Deletion page), we permanently delete your symptom entries, care schedule, caregiver data, wearable and CGM telemetry, emergency medical information, and account profile from our production database. This also removes any stored record of connected third-party services; if you want to fully revoke My Soma Track's access on the provider's end as well, you may separately do so from your Google or Dexcom account settings. Some information may persist briefly in encrypted backups, or longer where we are required by law to retain it (for example, transaction records for tax purposes).
9. Children's Privacy
My Soma Track is not directed to children, and we do not knowingly collect personal information from anyone under the age of 18. If you believe a child has provided us with personal information, contact us at the address below and we will delete it.
11. Medical Disclaimer & HIPAA Notice
My Soma Track is a symptom logging and tracking tool for personal documentation and clinical reporting. It does not provide medical diagnoses or replace emergency medical care. If you experience a medical emergency, call 911 or your local emergency services immediately. My Soma Track is not a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA), and data you enter is not subject to HIPAA's protections — we nonetheless apply the security safeguards described in Section 3.
12. Data Breach Notification
In the event of a data breach affecting your personal information, we will notify affected users and relevant authorities in accordance with applicable law, including GDPR's 72-hour notification requirement where it applies.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where required by law, we will provide additional notice — such as an in-app notification or email — before the changes take effect.
14. Contact Us
Questions about this Privacy Policy or your data can be directed to support@mysomatrack.com.