PRIVACY POLICY OF THE KOLOK.APP APPLICATION AND WEBSITE

Date of last update: 9 September 2026

§ 1. DATA CONTROLLER

1. The controller of the personal data of Users of the Portal and the KOLOK.app Mobile Application is KOLOK SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (a Polish limited liability company) with its registered office in Rzeszów, ul. Podkarpacka 1a, 35-082 Rzeszów, entered in the register of entrepreneurs of the National Court Register under KRS number 0001099190, NIP: 8133910381, REGON: 5282903530 (hereinafter: the “Controller” or “KOLOK”).
2. In matters relating to the protection of personal data and the exercise of the rights granted under the GDPR, the User may contact the Controller at the e-mail address: info@kolok.app.

§ 2. IMPORTANT LEGAL DISCLAIMER (STATUS OF THE APPLICATION)

1. The KOLOK.app application is purely organisational and lifestyle-oriented in nature and is intended to support the performance of regular myofunctional exercises.
2. The Application IS NOT a medical device within the meaning of Regulation (EU) 2017/745 (MDR) and does not provide therapeutic / healthcare services.
3. The Controller provides only the technological infrastructure. The therapeutic or instructional relationship takes place directly between the User (Patient) and the Specialist chosen by the User, who acts in their own name and on their own responsibility. The Specialist independently decides on the selection of routines and the course of recommendations.

§ 3. PURPOSES, LEGAL BASES AND SCOPE OF DATA PROCESSING

The Controller processes personal data for the following purposes, on the basis of the relevant legal grounds (GDPR):

1. Registration and maintenance of the Account in the Application

• Scope of data:
  • Specialist: First name, surname, e-mail address, telephone number, hashed password, application language, documents / data verifying professional qualifications (scan of diploma/certificate/professional licence number (PWZ) or work e-mail).
  • Patient (independent – aged 13 and over): First name / nickname, year of birth / age, e-mail address, hashed password, application language.
• Legal basis: Art. 6(1)(b) GDPR (necessity for the performance of a contract for the provision of services by electronic means).

2. Children under 13 years of age (Accounts under parental supervision)

• Scope of data: Child’s first name/nickname, year of birth, e-mail address of the parent/legal guardian, parent’s telephone number, digital parental consent statements, data from the consent register (timestamp, IP).
• Legal basis: Art. 6(1)(a) GDPR in conjunction with Art. 8 GDPR (consent of the parent/legal guardian given through the Double Opt-In process).

3. Provision of Application functionalities (Routines, Statistics, Messenger)

• Scope of data:
  • For the Patient: Assigned routines, history of completed exercises, statistics (number of minutes, streak days – the so-called “streak”, gamification badges), inactivity status (at risk), notes and message history in the messenger with the Specialist.
  • For the Specialist: Templates created, notes, progress summaries of connected Patients.
• Legal basis: Art. 6(1)(b) GDPR (performance of the services agreement).

4. Purchases in the online Shop and comments

• Scope of data: First name, surname, billing/delivery address, e-mail, telephone number, order history, content of the comment under the product and the nickname provided.
• Legal basis: Art. 6(1)(b) GDPR (performance of the sales contract) and Art. 6(1)(c) GDPR (fulfilment of tax and accounting obligations).

5. Analytics, product optimisation and reliability

• Scope of data: Pseudonymised User identifier (User ID), events in the application (clicks, completed exercises), technical parameters of the device, anonymous error logs (stack trace, device model, OS version).
• Product development: Only anonymised and aggregated summary statistics (Art. 6(1)(f) GDPR – the Controller’s legitimate interest).
• Analytical measurements: Art. 6(1)(a) GDPR (consent given in the privacy panel).

6. Marketing, PUSH notifications and Newsletter

• Scope of data: E-mail address, device identifier (Push Token).
• PUSH notifications concerning exercises: Can be switched off in the settings (Art. 6(1)(b) GDPR).
• Marketing and e-mail communications: Art. 6(1)(a) GDPR (voluntary consent of the User).

§ 4. PROFILING AND AUTOMATED DECISIONS (“AT RISK” STATUS)

1. The Application applies an automatic rule for assigning the “at risk” status to a Patient.
2. Mechanism: This status is assigned solely on the basis of the Patient’s lack of activity in the Application for a specified period of time (no marking of completed exercises). The Application does not analyse the medical background or the correctness of the exercises performed.
3. Effect: Assignment of the status automatically moves the Patient’s profile to the “at risk” tab in the dashboard of the connected Specialist, informing them of a break in exercising.
4. Right to intervene: Both the Specialist and the Patient have the right to manually correct, verify or remove the status from within the Application panel.

§ 5. SAFETY OF MINORS (UNDER 13 YEARS OF AGE)

1. The Application does not allow independent registration by persons who have not reached the age of 13.
2. In the case of persons under 13 years of age, creating an account requires the involvement of a parent or legal guardian:
   • Verification takes place through the Double Opt-In procedure (a link sent to the parent’s e-mail / an SMS code) combined with acceptance of a digital Parental Statement.
   • The parent holds a full parent account (or a linked account), providing insight into the child’s progress, the account settings and the content of messages exchanged with the Specialist.

§ 6. EXTERNAL SERVICES AND ENTRUSTING THE PROCESSING OF DATA

To ensure the proper functioning of the Application, the Controller uses the services of verified external providers. Data is transferred only to the extent necessary:

§ 7. DATA RETENTION (STORAGE PERIOD)

1. Account data (Specialist / Patient): Stored for the period of provision of the service (holding the Account) and, after its deletion, for a period of 5 years (limitation period for civil-law claims and legal and tax requirements).
2. History of routines, progress and exercises: Due to the nature of long-term tracking of exercise history – stored for up to 20 years or until definitively deleted / anonymised at the User’s request.
3. Messages in the messenger and notes: Stored for the duration of the account + 5 years from the moment the account is deleted.
4. Shop customer data and comments: 5 years from the purchase or from the posting of the review.
5. Analytics data (Amplitude) and security logs: Stored for a period of 2 years.
6. Error reports (Sentry): 90 days (automatic rotation).
7. Inactivity procedure: After 24 months of uninterrupted inactivity (no logins), the User receives an e-mail notification. If there is no response within 30 days, the account is deactivated and the data is anonymised or archived.
8. Backups: Deleted data may remain in encrypted backups for a rotation period of up to 90 days, after which it is permanently overwritten.

§ 8. USER RIGHTS

Every User has the following rights arising from the provisions of the GDPR:

1. The right to access data and to receive a copy of it.
2. The right to rectification (correction) of one’s data.
3. The right to erasure of data (“right to be forgotten”) – an account can be deleted independently from within the Application or by contacting us by e-mail. Removal of a connected Patient by a Specialist results in the irreversible disconnection of the link and of the history view on that Specialist’s side.
4. The right to restriction of data processing.
5. The right to data portability.
6. The right to object to the processing of data based on a legitimate interest.
7. The right to withdraw consent at any time (e.g. with regard to analytics or marketing) without affecting the lawfulness of processing carried out before its withdrawal.
8. The right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.

§ 9. COOKIES AND TRACKING TECHNOLOGIES

1. Website

• Necessary: Session cookies that maintain login and the shopping cart, and that remember the choice of privacy consents (e.g. a consent script).
• Analytics and Marketing (Optional): Google Analytics 4 (GA4), Meta Pixel, Google Ads. Activated only after explicit consent is given in the cookie banner.

2. Mobile Application

• Necessary SDKs: Firebase Auth (maintaining a secure JWT session), Firebase Crashlytics (crash reporting).
• Analytics SDKs (Optional): Amplitude / Firebase Analytics – activated only after consent is given on the privacy settings screen in the Application.

The User may change their preferences regarding cookies and tracking technologies at any time using the “Privacy / cookie settings” button available in the website footer and in the profile panel of the Application.

§ 10. PROTECTION OF THE DOCUMENT’S INTELLECTUAL PROPERTY

1. This Privacy Policy (as well as the Terms and Conditions of the Website and the KOLOK.app Application) constitutes a work within the meaning of the Act of 4 February 1994 on Copyright and Related Rights and is subject to full legal protection.
2. The economic and moral copyrights to the content of the document belong to the company KOLOK Sp. z o.o.
3. Copying, reproducing, distributing, modifying or using the content of this document, in whole or in part, for commercial purposes without the prior written consent of KOLOK Sp. z o.o. is prohibited and constitutes an infringement of copyright.