Privacy Policy

1. Overview and Data Controller

⚠️ This legal document is currently only available in English. A localised translation is being prepared. / Tämän oikeudellisen asiakirjan lokalisoitu käännös on valmisteluvaiheessa. ⚠️ This legal document is currently only available in English. A localised translation is being prepared. / Tämän oikeudellisen asiakirjan lokalisoitu käännös on valmisteluvaiheessa. Kaiku ("Service", kaiku.live and the Kaiku mobile app) is an AI-assisted wellness application — couple guidance, self-reflection, and a wellness companion. This privacy policy describes, in accordance with GDPR (EU 2016/679) Articles 13 and 14, what personal data we process, for what purposes, and on what legal basis. Data Controller: Tomi Ansamaa, Mannerheimintie 12 A, 00100 Helsinki, Finland, tomi.ansamaa@gmail.com. Privacy contact: team@kaiku.live. With your consent the Service may process GDPR Article 9 special category personal data (for example mood and stress self-check-ins, and health data from wearables), so those parts of the processing are based on your explicit consent (Art. 9(2)(a)); other processing is based on contract performance (Art. 6(1)(b)). Consent is requested separately for each processing purpose and may be withdrawn at any time in Settings without affecting processing carried out before withdrawal. A GDPR Art. 35 Data Protection Impact Assessment (DPIA) has been completed and is available on request.

2. Data Categories We Collect

Account and Authentication

When you register we collect your email address, optionally a display name, year of birth (for age verification), language preference and time zone. If you sign in with Google or Apple (OAuth), we receive your name, email and a stable identifier from the provider. Passwords are not stored — authentication is handled by Supabase Auth. Legal basis: Art. 6(1)(b) contract performance.

Conversations, Voice Input and Memories

All chat messages (text and voice) are stored AES-256-GCM encrypted. Kaiku learns from your conversations and stores 7 memory types: emotion patterns, needs, triggers, relationship dynamics, strengths, goals and insights. In real-time voice your microphone input is processed near-real-time (Voice Activity Detection) and converted to text — raw audio is not retained beyond the session unless you explicitly save it to Moments. Legal basis: Art. 6(1)(b) + Art. 9(2)(a) where content concerns health/mental data.

Check-ins, Life Wheel and Clinical Self-Assessments

Daily check-ins: mood, connection and stress scores (1–10), free-text gratitude and concern. The Life Wheel assesses 8 life areas. Kaiku also offers self-assessments based on validated clinical instruments: PHQ-9 (depression load), GAD-7 (anxiety load), ECR-R (attachment style), Columbia protocol safety screen, and other guided reflection tools. These are not diagnoses and do not replace a professional assessment — see Disclaimers. All of this is Art. 9(2)(a) special category data, processed only with your explicit consent.

Health, Fitness and Medication Data

You may optionally connect wearable devices and health platforms: Apple Health, Google Health Connect, Oura, Whoop, Polar, Suunto, Withings, Strava. Synced data may include: steps, heart rate, HRV, sleep duration/quality, weight, active calories, workouts (including GPS route polylines), menstrual cycle. You may also log medications, medication reminders, pain and nutrition. Medication reminders are not a medical device or automated dispenser — you decide your medication. You can choose which data types to sync and disconnect at any time. Legal basis: Art. 9(2)(a) explicit consent.

Technical Data and Application Telemetry

IP addresses are stored only as SHA-256 hashes in audit logs for security purposes (retention 12 months). We additionally process: device type (mobile/desktop), OS version, app version, language, session ID, push token (if you opt in to notifications) and crash reports (Sentry, content pseudonymised). We provide analytics via PostHog (EU-hosted) based on your consent to improve the product — you may decline without affecting service availability. Legal basis: Art. 6(1)(f) legitimate interest (security), Art. 6(1)(a) consent (analytics).

4. Processing Purposes and Legal Bases

We use your data for: (1) Service provision: AI conversations, memories, daily summaries, Couple Mode — Art. 6(1)(b) + 9(2)(a); (2) Personalisation and Knowledge Graph building — Art. 9(2)(a) consent; (3) Wellness notifications (push, email) — Art. 6(1)(a) consent, withdrawable at any time; (4) Security and abuse prevention: crisis detection, rate limiting, audit logs — Art. 6(1)(f) legitimate interest, which outweighs your privacy because lives may be at stake and the service must remain trustworthy; (5) Legal obligations (accounting, supervisory authority requests) — Art. 6(1)(c). **We do not use your data for advertising, marketing profiling, and we do not sell it to third parties.** AI providers do not use your data to train models — this is part of the standard terms of Anthropic, OpenAI and Groq under which Kaiku operates (see the AI section).

3. Special Category Personal Data (GDPR Art. 9)

We process the following Art. 9 special categories solely on the basis of your explicit consent (Art. 9(2)(a)): (a) health data — heart rate zones, HRV, sleep, weight, menstrual cycle, workouts, pain entries, medication; (b) mental-health-related data — mood, stress, journal entries, crisis indicators, load assessments (PHQ-9/GAD-7/ECR-R as reflection tools); (c) data concerning sex life and intimate relationship in Couple Mode — libido conversations, intimate reflections. You may withdraw consent for an individual category or all of them in Settings → Consents. Withdrawal does not affect processing carried out before withdrawal. **In the Knowledge Graph feature** you may input identifiable information about other individuals (partner, children, colleagues). Kaiku processes this data only under your authorisation, as a personal reflection aid; you are responsible for informing those individuals as required by GDPR Art. 14, unless the household exception under Art. 2(2)(c) applies. **Coming in a later version (Q4/2026 estimated):** biometric emotion recognition from voice (Hume AI). This feature will be released only with a separate opt-in consent and will not be used in workplace or educational contexts in line with the EU AI Act prohibition.

4. Processing Purposes and Legal Bases

We use your data for: (1) Service provision: AI conversations, memories, daily summaries, Couple Mode — Art. 6(1)(b) + 9(2)(a); (2) Personalisation and Knowledge Graph building — Art. 9(2)(a) consent; (3) Wellness notifications (push, email) — Art. 6(1)(a) consent, withdrawable at any time; (4) Security and abuse prevention: crisis detection, rate limiting, audit logs — Art. 6(1)(f) legitimate interest, which outweighs your privacy because lives may be at stake and the service must remain trustworthy; (5) Legal obligations (accounting, supervisory authority requests) — Art. 6(1)(c). **We do not use your data for advertising, marketing profiling, and we do not sell it to third parties.** AI providers do not use your data to train models — this is part of the standard terms of Anthropic, OpenAI and Groq under which Kaiku operates (see the AI section).

5. Artificial Intelligence and AI Transparency

**You are interacting with artificial intelligence.** Kaiku uses generative AI models (EU AI Act Art. 50 disclosure). We use: (a) Anthropic Claude (Sonnet, Haiku) — conversations and analyses; (b) OpenAI Whisper (speech-to-text for Secretary and Couple modes), TTS (text-to-speech), Realtime API (real-time conversation); (c) Groq Whisper — fast speech recognition for the chat voice button and Quick-Log; (d) Anthropic Claude Vision — image analysis (food, workouts, Moments). Contractually, **none of these providers uses your data to train models.** Anthropic and OpenAI retain API data for at most 30 days for abuse monitoring, after which it is deleted. AI may sometimes produce inaccurate or incomplete content — use your own judgement, especially for medical or otherwise important decisions. Kaiku is a wellness application and a reflection tool, not a medical device, and does not replace a professional. We do not make decisions about you that have legal or similarly significant effects (GDPR Art. 22) — AI suggests, you decide. Future features (e.g. biometric voice emotion recognition, Hume AI) will not be enabled without your separate opt-in consent and an updated privacy policy.

6. Automated Decision-Making and Profiling (Art. 22)

Kaiku does not make decisions about you with legal or similarly significant consequences. AI models produce suggestions, insights and summaries — all decisions (e.g. contacting a therapist, changing medication, seeing a doctor, leaving a partner) are yours. We profile your data only to improve personal coaching quality (which life areas you want to work on, what to recall in conversation, the Couple Mode communication analysis) — never for marketing or classification. The Couple Mode communication analysis (communication-pattern detection) identifies communication patterns and may surface escalation risk — this is **decision support**, not an automated intervention. You may request human review or restriction of automated processing: team@kaiku.live.

7. Couple Mode — Special Rules

Couple Mode lets two adult users share conversations, daily questions and communication analyses. Important: (a) Joining is always voluntary — the invited party gives a separate consent before any shared data processing; (b) Shared content is visible to both; **your individual conversations with Kaiku are not shared with your partner**; (c) Communication analyses (detection of harmful communication patterns, scorecard) are derived data from both partners' messages — we do not share raw analyses with third parties; (d) You can dissolve Couple Mode unilaterally at any time. A normal dissolution stops new sharing immediately; previously shared history remains visible to both parties — you can request deletion separately at team@kaiku.live. **Emergency Delete Couple Mode** (Settings → Emergency Delete Couple Mode) is intended for IPV contexts and removes shared data from both sides immediately without notifying the partner. **Safety in the context of intimate partner violence**: if your consent is not voluntary or you fear your partner, you can (1) dissolve Couple Mode without notifying the other party, (2) use the 'Escape Delete' (Settings → Escape Delete couple mode) which removes shared data entirely, (3) contact a national domestic-violence helpline. The app shows the helpline appropriate to your locale.

8. Data Sharing and Third-Party Transfers

We do not sell or rent your personal data. We use the following data processors. A GDPR Art. 28 data processing agreement is in place with every provider — either as a standalone contract (Supabase, Stripe, Apple, Google) or as part of their standard terms (Anthropic ToS, OpenAI Business Terms, Groq, Tavily, Expo, Vercel, Upstash, PostHog, Sentry). Current list available from team@kaiku.live. **EU-based:** Supabase (database, EU/Ireland), PostHog EU (analytics), Upstash Redis (rate limit). **United States with SCC + EU-US Data Privacy Framework checks:** Vercel (hosting), Anthropic (Claude AI), OpenAI (voice & chat), Groq (Whisper STT), Tavily (web search — search queries only, no personal data), Sentry (crash reports, content scrubbed), Stripe (payments, PCI DSS Level 1), Apple (App Store + IAP), Google (Play Store + Billing + Calendar OAuth), Expo (push notifications), Web Push providers (browser push, VAPID). **Wearable integrations** (Oura, Whoop, Polar, Suunto, Withings, Strava, Apple Health, Google Health Connect, Spotify) — processed only at your request via per-user OAuth tokens; you can disconnect them at any time. We may disclose data to law enforcement under official requests to the extent required by Finnish or applicable EU member state law — and we will inform you unless prohibited by law.

9. International Data Transfers

Some of our processors are located in the United States. Transfers use the European Commission's Standard Contractual Clauses (SCC) — Implementing Decision EU 2021/914 — and where appropriate additional safeguards (encryption at rest and in transit, principle of least access). We also rely on the EU-US Data Privacy Framework where the processor is certified. You can request a copy of the safeguards used: team@kaiku.live.

10. Data Retention Periods

We retain data per category as follows: **Account and core profile:** for the duration of the account + 30 days after deletion request. **Chat messages and sessions:** for the duration of the account; you can enable auto-deletion after 90 days or 1 year. **Wearable and health data:** 24 months or until you withdraw consent. **PHQ-9/GAD-7/ECR-R assessments:** for the duration of the account (for trend tracking on your behalf). **Audit logs (IP hash, no content):** 12 months. **Stripe payment data (invoices):** 6 years per Finnish accounting law. **AI provider API caches:** Anthropic and OpenAI 30 days, Groq no persistent storage. **Push tokens:** only while the device is active. **Knowledge Graph:** until you delete the entity or your account. **Crisis indicators and Safety Plan:** for the duration of the account for safety reasons; can be removed on request.

11. Your Rights Under GDPR

As an EU/EEA user you have the right to: (1) **Access your data (Art. 15)** — Settings → Export my data, JSON format; (2) **Rectify your data (Art. 16)** — Profile view; (3) **Request erasure (Art. 17, 'right to be forgotten')** — Settings → Delete my account, processed within 30 days; (4) **Restrict processing (Art. 18)** — write to team@kaiku.live; (5) **Receive your data in a portable format (Art. 20)** — same JSON export; (6) **Object to processing (Art. 21)** — you can turn off notifications, analytics, AI suggestions; (7) **Withdraw consent (Art. 7(3))** — Settings → Consents, withdrawal does not affect processing carried out before withdrawal; (8) **Request human review of automated decisions (Art. 22)** — team@kaiku.live; (9) **Lodge a complaint with a supervisory authority**: in Finland, the Office of the Data Protection Ombudsman, tietosuoja@om.fi, www.tietosuoja.fi. We respond to requests without undue delay, and at the latest within 30 days (Art. 12(3)). Responses are free of charge except for manifestly unfounded or excessive repeated requests.

12. Data Breaches

If a personal data breach is likely to result in a risk to your rights, we will notify the Office of the Data Protection Ombudsman without undue delay and, where feasible, within 72 hours of becoming aware (Art. 33), and — if the breach is likely to result in a high risk to your rights — you without undue delay (Art. 34) — in plain language, describing the nature of the breach, possible consequences, measures taken and a contact person. Our internal incident response process is documented in a separate Incident Response Playbook.

13. Cookies

On the web service we use strictly necessary cookies (authentication, language, CSRF) and, with your consent, analytics and functional cookies. For a detailed list, see our separate Cookie Policy. The mobile app does not use browser cookies; equivalent local state is stored securely on the device (Keychain on iOS, EncryptedSharedPreferences on Android).

14. Children Under 16

Kaiku is intended for users **aged 16 or older** (the GDPR child consent age in Finland). We do not knowingly collect personal data from users under 16. Couple Mode and social features are available only to **adults (18+)**. We verify age at registration — if we become aware of underage accounts, we will close them and delete the data.

15. Not a Medical Device

Kaiku is a wellness application — couple guidance, self-reflection, and a wellness companion. It is not a medical device under the Medical Device Regulation (EU 2017/745), and it does not diagnose, treat or prevent any disease. Kaiku does not replace a doctor, therapist, physiotherapist, dietitian or psychiatrist. The self-reflection tools included (PHQ-9, GAD-7 etc.) are wellness check-ins rather than diagnoses — the same pattern used by other wellness apps such as Headspace, Calm and Woebot. In acute health or mental health situations, contact your local emergency number, mental health crisis line, or domestic violence helpline (the app surfaces locale-appropriate numbers).

16. Changes to This Policy

We may update this policy. We will notify you of material changes (e.g. new processing purposes, new sub-processors, longer retention) within the app and by email at least 30 days in advance, and request a new consent if needed. Previous versions are available on request. **Version 3.2 (25 April 2026):** terminology aligned with Kaiku's brand voice — no changes to the substance of processing, legal bases, or retention periods.

17. Contact and Right to Complain

Data Controller: Tomi Ansamaa, Mannerheimintie 12 A, 00100 Helsinki, Finland, tomi.ansamaa@gmail.com. Privacy contact: team@kaiku.live. Data subject requests: team@kaiku.live (we respond within 30 days). Supervisory authority in Finland: Office of the Data Protection Ombudsman, PO Box 800, 00531 Helsinki, tietosuoja@om.fi, www.tietosuoja.fi. EU/EEA users have the right to lodge a complaint with the supervisory authority of their country of residence.