Privacy Policy

1. Who We Are

Junoon Wellness, Inc. ("Junoon," "we," "us," or "our") operates the Junoon mobile application (the "App") and related services (collectively, the "Services"). We are the data controller for personal information collected through the App.

Contact us at: admin@junoonwellness.com

Mailing address: 611 South Dupont Highway, Suite 102, Dover, Delaware

2. Who This Policy Applies To

This Privacy Policy applies to all users of the Junoon App, including users who access the App without creating an account ("Guest Mode"). By using the App, you agree to the collection and use of information in accordance with this Policy.

The App is not directed to children under the age of 13 (or 16 in the European Economic Area). If you are under this age, you may not use the App. See Section 14 (Children's Privacy) for details.

3. Information We Collect

We collect information you provide directly, information generated by your use of the App, and - with your explicit permission - health data from Apple Health.

3.1 Information You Provide

Account and identity information:

• Full name
• Email address
• Password (stored in hashed form; we never store your plaintext password)
• WhatsApp phone number (optional, used for service communications)
• Timezone

Wellness profile (collected during onboarding):

• Gender
• Age band
• Height and weight (optional)
• Wellness goals and focus areas (habits, movement, mental health)
• Stress baseline
• Existing yoga or meditation practice level
• Dietary restrictions or preferences
• Physical considerations or limitations (including postpartum, joint pain, chronic fatigue)
• Available time per day for practice
• Preferred time of day for practice
• 30-day personal goal

Coach interactions:

• Messages you send to the AI coach
• Your responses during weekly check-ins
• Your reactions to coach-proposed content (accepted, swapped, removed)

Profile updates:

• Changes to your name, timezone, or profile settings at any time

3.2 Information Generated by Your Use of the App

Practice activity:

• Videos watched and time spent watching each video
• Videos and articles you save or bookmark
• Teachers you follow
• Weekly plan items you complete, skip, or swap
• Progress snapshots across practice pillars

Technical and device information:

• Session authentication tokens (stored locally on your device)
• App preferences stored locally (saved content, onboarding state)
• Standard server logs (IP address, request timestamps, error reports)

3.3 Health Information from Apple Health (with your permission)

If you grant permission, the App reads the following data types from Apple Health to personalise your coaching experience:

• Step count - to understand your baseline daily activity
• Resting heart rate - to understand cardiovascular recovery
• Heart rate variability (HRV) - to understand stress and recovery signals
• Exercise time - to understand your existing movement habits
• Sleep analysis - to understand your rest and recovery
• Mindful session data - to understand your existing mindfulness practice
• Workout history - to contextualise your overall fitness activity

The App also writes the following data to Apple Health when you complete a practice session:

• Workout records - to log completed Junoon yoga and movement sessions
• Mindful session records - to log completed Junoon meditation and breathwork sessions

4. How We Use Your Information

We use the information we collect for the following purposes, each of which has a lawful basis under applicable law:

We do not currently sell or share your personal information, use it for targeted advertising, or provide it to data brokers. If this ever changes, we will update this Policy and notify you in advance, will never include Apple Health or other health data, and will provide the opt-out or consent choices required by law (including a "Do Not Sell or Share My Personal Information" option) before any such use begins.

5. Artificial Intelligence and Your Coach Conversations

The Junoon coach is powered by a large language model (LLM) provided by Anthropic, PBC. When you send a message to your coach, that message - along with relevant context from your wellness profile and health summary - is transmitted to Anthropic's API to generate a coaching response.

What this means for you:

• Your coach messages are processed by Anthropic's infrastructure in the United States
• Anthropic acts as a data processor on our behalf, bound by a data processing agreement
• Anthropic's use of data sent via API is governed by their API usage policy, which prohibits using API data to train models without consent
• We do not share your name or directly identifying information with Anthropic; messages are associated with an anonymised user identifier
• You should not share sensitive personal information (financial details, government ID numbers, passwords) in coach messages

Anthropic's privacy policy is available at: https://www.anthropic.com/privacy

6. How We Share Your Information

We share personal information only in the following circumstances:

Service providers (data processors): We use Supabase, Inc. as our database and authentication provider. Supabase stores your account data, wellness profile, coach conversation history, and practice activity on our behalf. Supabase acts as a data processor bound by a Data Processing Agreement. For more information: https://supabase.com/privacy

Apple, Inc.: If you use Sign in with Apple or make purchases through the App Store, Apple processes your identity and payment information pursuant to Apple's own Privacy Policy.

Email and waitlist provider (beehiiv): If you join our waitlist or subscribe to updates through our website, we collect your email address and process it using beehiiv, Inc. to manage our waitlist and send newsletters and product updates. beehiiv acts as a data processor on our behalf. You can unsubscribe at any time using the link in any email. For more information: https://www.beehiiv.com/privacy

Legal requirements: We may disclose personal information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of Junoon, our users, or the public.

Business transfers: If Junoon is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via prominent notice in the App or by email before your personal information is transferred and becomes subject to a different Privacy Policy.

We do not currently sell your personal information or share it with third parties for their own marketing purposes. If this ever changes, we will update this Policy, notify you in advance, exclude all health data, and offer the opt-out or consent choices required by law before doing so.

7. Data Retention

We keep personal information only for as long as necessary for the purposes described in this Policy. The actual period depends on the type of information, the purpose for which it was collected, and our legal, security, and operational obligations.

• Account data, coach conversation history, and practice activity: kept while your account is active, then deleted or anonymised after your account is closed, unless we need to retain it longer to meet legal obligations, resolve disputes, or enforce our agreements.
• Health data summaries: kept only as long as needed to generate your coaching responses, and not beyond what is necessary to deliver the Services.
• Server logs: kept for a limited period for security and debugging, then deleted or anonymised.
• Backups: residual copies in backups are removed on our routine backup-rotation cycle.

When you delete your account, we will delete or anonymise your personal information from our active systems without undue delay, subject to legal retention obligations.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction, including:

• All data transmitted between the App and our servers is encrypted using TLS
• Passwords are hashed using industry-standard cryptographic methods; we cannot retrieve your plaintext password
• Authentication tokens are stored securely on-device
• Access to production databases is restricted to authorised personnel only

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law.

9. Your Rights

Depending on where you live, you have certain rights regarding your personal information.

9.1 All Users

Regardless of where you live, you have the following rights with respect to your personal information, which you can exercise within the App or by contacting us at admin@junoonwellness.com:

• Access: Request a copy of the personal information we hold about you, and review your account and wellness profile at any time in the App.
• Correction: Update or correct inaccurate or incomplete information, including your name, timezone, and wellness profile, through your account settings or by contacting us.
• Deletion: Delete your account and associated personal information at any time via Settings > Account > Delete Account, as described in Section 10.
• Withdraw consent: Where processing is based on your consent, withdraw it at any time, for example by revoking Apple Health access in your device settings or turning off push notifications, without affecting the lawfulness of processing before withdrawal.
• Object or restrict: Ask us to stop or limit certain processing of your information by contacting us.
• Complaint: Raise a concern about how we handle your information by contacting us; you may also have the right to complain to your local data protection or consumer protection authority.

9.2 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation (EU) 2016/679 and equivalent UK and Swiss law:

• Right of access (Article 15): obtain confirmation of whether we process your personal data and a copy of that data.
• Right to rectification (Article 16): have inaccurate personal data corrected and incomplete data completed.
• Right to erasure (Article 17): have your personal data deleted in the circumstances provided by law (the "right to be forgotten").
• Right to restriction of processing (Article 18): have the processing of your personal data restricted in certain circumstances.
• Right to data portability (Article 20): receive the personal data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
• Right to object (Article 21): object to processing carried out on the basis of our legitimate interests.
• Rights regarding automated decision-making (Article 22): not be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you.
• Right to withdraw consent (Article 7(3)): withdraw any consent you have given, at any time.
• Right to lodge a complaint (Article 77): lodge a complaint with your local supervisory authority.

We rely on a lawful basis for each processing activity as described in Section 4. The legal basis for transferring personal information from the EEA to the United States is Standard Contractual Clauses.

9.3 California Residents (CCPA/CPRA)

California residents have the following rights under the CCPA as amended by the CPRA:

• Right to know and access (Cal. Civ. Code §§ 1798.100, 1798.110, 1798.115): request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purposes for collecting it, and the categories of third parties with whom we share it.
• Right to delete (Cal. Civ. Code § 1798.105): request deletion of personal information we collected from you, subject to certain exceptions.
• Right to correct (Cal. Civ. Code § 1798.106): request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing (Cal. Civ. Code § 1798.120): we do not currently sell or share your personal information for cross-context behavioral advertising. If we begin to, we will provide a "Do Not Sell or Share My Personal Information" opt-out and honor your request; you retain this right at all times.
• Right to limit use of sensitive personal information (Cal. Civ. Code § 1798.121): direct us to limit the use of your sensitive personal information to what is necessary to provide the Services. We use your health and fitness data only to deliver and personalise your coaching, and not for any other purpose.
• Right to non-discrimination (Cal. Civ. Code § 1798.125): we will not discriminate against you for exercising any of your CCPA rights.

Categories of personal information collected under CCPA: Identifiers (name, email, phone); personal information (account data, wellness profile); sensitive personal information (health and fitness data with your consent); internet/electronic network activity (app usage data); inferences drawn to create a wellness profile.

To exercise any of these rights, contact us at admin@junoonwellness.com or use the in-app account tools. Because Junoon operates exclusively online and interacts with you directly through the App, email and our in-app tools are the designated methods for submitting requests; we do not maintain a toll-free telephone number. We will respond within 45 days (extendable by an additional 45 days where necessary).

To make a request, we may need to verify your identity. We will not require you to create an account solely to exercise your rights.

Authorised agents may submit requests on your behalf with proof of authorisation.

10. Account Deletion

You may request deletion of your Junoon account and associated personal information at any time. To delete your account:

• In-app: Settings > Account > Delete Account

We will process deletion requests without undue delay and within the timeframes required by applicable law. Residual copies may persist in backups until they are removed on our routine backup-rotation cycle, and we may retain information required by law (such as transaction records) for the period required by applicable regulation.

11. International Data Transfers

Junoon is based in the United States. If you access the App from outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses as the appropriate transfer mechanism.

By using the App, you acknowledge and agree to the transfer of your information to the United States as described in this Privacy Policy.

12. Third-Party Links and Services

The App may contain links to third-party websites or services (such as teacher profiles or referenced articles). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through the App.

13. Push Notifications

If you grant permission, we may send push notifications to your device for reminders, plan updates, and coaching prompts. You may opt out of push notifications at any time in your device's Settings > Notifications > Junoon.

14. Children's Privacy

The App is not directed to individuals under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at admin@junoonwellness.com and we will delete that information promptly.

15. Medical and Health Disclaimer

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting a prominent notice in the App and, where required by law, by sending you an email notification at least 7 days before the changes take effect. The "Last updated" date at the top of this Policy reflects the most recent revision. Your continued use of the App after the effective date of a revised Policy constitutes your acceptance of the changes.

17. Contact Us

For privacy-related questions, requests, or complaints:

Email: admin@junoonwellness.com

Mailing address: 611 South Dupont Highway, Suite 102, Dover, Delaware

We will respond to all privacy-related inquiries within 30 days.