{"id":1369,"date":"2026-09-15T18:00:58","date_gmt":"2026-09-15T18:00:58","guid":{"rendered":"https:\/\/kolok.app\/privacy-policy\/"},"modified":"2026-10-02T07:55:15","modified_gmt":"2026-10-02T07:55:15","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/kolok.app\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"

PRIVACY POLICY OF THE KOLOK.APP APPLICATION AND WEBSITE<\/span><\/h1>\n

Date of last update: 9 September 2026<\/span><\/p>\n

\u00a7 1. DATA CONTROLLER<\/span><\/h2>\n
    \n
  1. The controller of the personal data of Users of the Portal and the KOLOK.app Mobile Application is KOLOK SP\u00d3\u0141KA Z OGRANICZON\u0104 ODPOWIEDZIALNO\u015aCI\u0104 (a Polish limited liability company) with its registered office in Rzesz\u00f3w, ul. Podkarpacka 1a, 35-082 Rzesz\u00f3w, entered in the register of entrepreneurs of the National Court Register under KRS number 0001099190, NIP: 8133910381, REGON: 5282903530 (hereinafter: the \u201cController\u201d or \u201cKOLOK\u201d).<\/span><\/li>\n
  2. In matters relating to the protection of personal data and the exercise of the rights granted under the GDPR, the User may contact the Controller at the e-mail address: info@kolok.app.<\/span><\/li>\n<\/ol>\n

    \u00a7 2. IMPORTANT LEGAL DISCLAIMER (STATUS OF THE APPLICATION)<\/span><\/h2>\n
      \n
    1. The KOLOK.app application is purely organisational and lifestyle-oriented in nature and is intended to support the performance of regular myofunctional exercises.<\/span><\/li>\n
    2. The Application IS NOT a medical device within the meaning of Regulation (EU) 2017\/745 (MDR) and does not provide therapeutic \/ healthcare services.<\/span><\/li>\n
    3. The Controller provides only the technological infrastructure. The therapeutic or instructional relationship takes place directly between the User (Patient) and the Specialist chosen by the User, who acts in their own name and on their own responsibility. The Specialist independently decides on the selection of routines and the course of recommendations.<\/span><\/li>\n<\/ol>\n

      \u00a7 3. PURPOSES, LEGAL BASES AND SCOPE OF DATA PROCESSING<\/span><\/h2>\n

      The Controller processes personal data for the following purposes, on the basis of the relevant legal grounds (GDPR):<\/span><\/p>\n

      1. Registration and maintenance of the Account in the Application<\/span><\/h3>\n
        \n
      • Scope of data:<\/span>\n
          \n
        • Specialist: First name, surname, e-mail address, telephone number, hashed password, application language, documents \/ data verifying professional qualifications (scan of diploma\/certificate\/professional licence number (PWZ) or work e-mail).<\/span><\/li>\n
        • Patient (independent \u2013 aged 13 and over): First name \/ nickname, year of birth \/ age, e-mail address, hashed password, application language.<\/span><\/li>\n<\/ul>\n<\/li>\n
        • Legal basis: Art. 6(1)(b) GDPR (necessity for the performance of a contract for the provision of services by electronic means).<\/span><\/li>\n<\/ul>\n

          2. Children under 13 years of age (Accounts under parental supervision)<\/span><\/h3>\n
            \n
          • Scope of data: Child\u2019s first name\/nickname, year of birth, e-mail address of the parent\/legal guardian, parent\u2019s telephone number, digital parental consent statements, data from the consent register (timestamp, IP).<\/span><\/li>\n
          • Legal basis: Art. 6(1)(a) GDPR in conjunction with Art. 8 GDPR (consent of the parent\/legal guardian given through the Double Opt-In process).<\/span><\/li>\n<\/ul>\n

            3. Provision of Application functionalities (Routines, Statistics, Messenger)<\/span><\/h3>\n
              \n
            • Scope of data:<\/span>\n
                \n
              • For the Patient: Assigned routines, history of completed exercises, statistics (number of minutes, streak days \u2013 the so-called \u201cstreak\u201d, gamification badges), inactivity status (<\/span>at risk<\/span><\/i>), notes and message history in the messenger with the Specialist.<\/span><\/li>\n
              • For the Specialist: Templates created, notes, progress summaries of connected Patients.<\/span><\/li>\n<\/ul>\n<\/li>\n
              • Legal basis: Art. 6(1)(b) GDPR (performance of the services agreement).<\/span><\/li>\n<\/ul>\n

                4. Purchases in the online Shop and comments<\/span><\/h3>\n
                  \n
                • Scope of data: First name, surname, billing\/delivery address, e-mail, telephone number, order history, content of the comment under the product and the nickname provided.<\/span><\/li>\n
                • Legal basis: Art. 6(1)(b) GDPR (performance of the sales contract) and Art. 6(1)(c) GDPR (fulfilment of tax and accounting obligations).<\/span><\/li>\n<\/ul>\n

                  5. Analytics, product optimisation and reliability<\/span><\/h3>\n
                    \n
                  • Scope of data: Pseudonymised User identifier (User ID), events in the application (clicks, completed exercises), technical parameters of the device, anonymous error logs (<\/span>stack trace<\/span><\/i>, device model, OS version).<\/span><\/li>\n
                  • Product development: Only anonymised and aggregated summary statistics (Art. 6(1)(f) GDPR \u2013 the Controller\u2019s legitimate interest).<\/span><\/li>\n
                  • Analytical measurements: Art. 6(1)(a) GDPR (consent given in the privacy panel).<\/span><\/li>\n<\/ul>\n

                    6. Marketing, PUSH notifications and Newsletter<\/span><\/h3>\n
                      \n
                    • Scope of data: E-mail address, device identifier (Push Token).<\/span><\/li>\n
                    • PUSH notifications concerning exercises: Can be switched off in the settings (Art. 6(1)(b) GDPR).<\/span><\/li>\n
                    • Marketing and e-mail communications: Art. 6(1)(a) GDPR (voluntary consent of the User).<\/span><\/li>\n<\/ul>\n

                      \u00a7 4. PROFILING AND AUTOMATED DECISIONS (\u201cAT RISK\u201d STATUS)<\/span><\/h2>\n
                        \n
                      1. The Application applies an automatic rule for assigning the \u201cat risk\u201d status to a Patient.<\/span><\/li>\n
                      2. Mechanism: This status is assigned solely on the basis of the Patient\u2019s lack of activity in the Application for a specified period of time (no marking of completed exercises). The Application does not analyse the medical background or the correctness of the exercises performed.<\/span><\/li>\n
                      3. Effect: Assignment of the status automatically moves the Patient\u2019s profile to the \u201cat risk\u201d tab in the dashboard of the connected Specialist, informing them of a break in exercising.<\/span><\/li>\n
                      4. Right to intervene: Both the Specialist and the Patient have the right to manually correct, verify or remove the status from within the Application panel.<\/span><\/li>\n<\/ol>\n

                        \u00a7 5. SAFETY OF MINORS (UNDER 13 YEARS OF AGE)<\/span><\/h2>\n
                          \n
                        1. The Application does not allow independent registration by persons who have not reached the age of 13.<\/span><\/li>\n
                        2. In the case of persons under 13 years of age, creating an account requires the involvement of a parent or legal guardian:<\/span>\n
                            \n
                          • Verification takes place through the Double Opt-In procedure (a link sent to the parent\u2019s e-mail \/ an SMS code) combined with acceptance of a digital Parental Statement.<\/span><\/li>\n
                          • The parent holds a full parent account (or a linked account), providing insight into the child\u2019s progress, the account settings and the content of messages exchanged with the Specialist.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n

                            \u00a7 6. EXTERNAL SERVICES AND ENTRUSTING THE PROCESSING OF DATA<\/span><\/h2>\n

                            To ensure the proper functioning of the Application, the Controller uses the services of verified external providers. Data is transferred only to the extent necessary:<\/span><\/p>\n\n\n\n\n\n\n\n\n
                            Name of entity<\/span><\/td>\nPurpose and scope of processing<\/span><\/td>\nLegal framework \/ Data location<\/span><\/td>\n<\/tr>\n
                            Supabase Inc.<\/span><\/td>\nMain database, account authorisation, storage of history and sending of transactional messages<\/span><\/td>\nServers in the European Union (e.g. Frankfurt \/ AWS EU)<\/span><\/td>\n<\/tr>\n
                            Amplitude Inc.<\/span><\/td>\nProduct analytics and user journey research (pseudonymised User ID only)<\/span><\/td>\nEU \/ US region based on the EU-US Data Privacy Framework and a DPA<\/span><\/td>\n<\/tr>\n
                            Sentry (Functional Software, Inc.)<\/span><\/td>\nMonitoring and logging of technical errors (anonymous system logs, without e-mail or chat content)<\/span><\/td>\nEU \/ US region based on a DPA and Standard Contractual Clauses<\/span><\/td>\n<\/tr>\n
                            Apple Inc. \/ Google LLC<\/span><\/td>\nDistribution of the Application, payments for subscriptions (In-App Purchases) and handling of PUSH notifications (APNs \/ FCM)<\/span><\/td>\nDirectly through the Apple\/Google systems<\/span><\/td>\n<\/tr>\n
                            GitHub Inc.<\/span><\/td>\nStorage of the Application\u2019s source code (no access to personal data)<\/span><\/td>\nSecured programming code<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                            \u00a7 7. DATA RETENTION (STORAGE PERIOD)<\/span><\/h2>\n
                              \n
                            1. Account data (Specialist \/ Patient): Stored for the period of provision of the service (holding the Account) and, after its deletion, for a period of 5 years (limitation period for civil-law claims and legal and tax requirements).<\/span><\/li>\n
                            2. History of routines, progress and exercises: Due to the nature of long-term tracking of exercise history \u2013 stored for up to 20 years or until definitively deleted \/ anonymised at the User\u2019s request.<\/span><\/li>\n
                            3. Messages in the messenger and notes: Stored for the duration of the account + 5 years from the moment the account is deleted.<\/span><\/li>\n
                            4. Shop customer data and comments: 5 years from the purchase or from the posting of the review.<\/span><\/li>\n
                            5. Analytics data (Amplitude) and security logs: Stored for a period of 2 years.<\/span><\/li>\n
                            6. Error reports (Sentry): 90 days (automatic rotation).<\/span><\/li>\n
                            7. Inactivity procedure: After 24 months of uninterrupted inactivity (no logins), the User receives an e-mail notification. If there is no response within 30 days, the account is deactivated and the data is anonymised or archived.<\/span><\/li>\n
                            8. Backups: Deleted data may remain in encrypted backups for a rotation period of up to 90 days, after which it is permanently overwritten.<\/span><\/li>\n<\/ol>\n

                              \u00a7 8. USER RIGHTS<\/span><\/h2>\n

                              Every User has the following rights arising from the provisions of the GDPR:<\/span><\/p>\n

                                \n
                              1. The right to access data and to receive a copy of it.<\/span><\/li>\n
                              2. The right to rectification (correction) of one\u2019s data.<\/span><\/li>\n
                              3. The right to erasure of data (\u201cright to be forgotten\u201d) \u2013 an account can be deleted independently from within the Application or by contacting us by e-mail. Removal of a connected Patient by a Specialist results in the irreversible disconnection of the link and of the history view on that Specialist\u2019s side.<\/span><\/li>\n
                              4. The right to restriction of data processing.<\/span><\/li>\n
                              5. The right to data portability.<\/span><\/li>\n
                              6. The right to object to the processing of data based on a legitimate interest.<\/span><\/li>\n
                              7. The right to withdraw consent at any time (e.g. with regard to analytics or marketing) without affecting the lawfulness of processing carried out before its withdrawal.<\/span><\/li>\n
                              8. The right to lodge a complaint with the supervisory authority \u2013 the President of the Personal Data Protection Office (Prezes Urz\u0119du Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.<\/span><\/li>\n<\/ol>\n

                                \u00a7 9. COOKIES AND TRACKING TECHNOLOGIES<\/span><\/h2>\n

                                1. Website<\/span><\/h3>\n
                                  \n
                                • Necessary: Session cookies that maintain login and the shopping cart, and that remember the choice of privacy consents (e.g. a consent script).<\/span><\/li>\n
                                • Analytics and Marketing (Optional): Google Analytics 4 (GA4), Meta Pixel, Google Ads. Activated only after explicit consent is given in the cookie banner.<\/span><\/li>\n<\/ul>\n

                                  2. Mobile Application<\/span><\/h3>\n
                                    \n
                                  • Necessary SDKs: Firebase Auth (maintaining a secure JWT session), Firebase Crashlytics (crash reporting).<\/span><\/li>\n
                                  • Analytics SDKs (Optional): Amplitude \/ Firebase Analytics \u2013 activated only after consent is given on the privacy settings screen in the Application.<\/span><\/li>\n<\/ul>\n

                                    The User may change their preferences regarding cookies and tracking technologies at any time using the \u201cPrivacy \/ cookie settings\u201d button available in the website footer and in the profile panel of the Application.<\/span><\/p>\n

                                    \u00a7 10. PROTECTION OF THE DOCUMENT\u2019S INTELLECTUAL PROPERTY<\/span><\/h1>\n
                                      \n
                                    1. This Privacy Policy (as well as the Terms and Conditions of the Website and the KOLOK.app Application) constitutes a work within the meaning of the Act of 4 February 1994 on Copyright and Related Rights and is subject to full legal protection.<\/span><\/li>\n
                                    2. The economic and moral copyrights to the content of the document belong to the company KOLOK Sp. z o.o.<\/span><\/li>\n
                                    3. Copying, reproducing, distributing, modifying or using the content of this document, in whole or in part, for commercial purposes without the prior written consent of KOLOK Sp. z o.o. is prohibited and constitutes an infringement of copyright.<\/span><\/li>\n<\/ol>\n

                                       <\/p>\n","protected":false},"excerpt":{"rendered":"

                                      PRIVACY POLICY OF THE KOLOK.APP APPLICATION AND WEBSITE Date of last update: 9 September 2026 \u00a7 1. DATA CONTROLLER The controller of the personal data of Users of the Portal and the KOLOK.app Mobile Application is KOLOK SP\u00d3\u0141KA Z OGRANICZON\u0104 ODPOWIEDZIALNO\u015aCI\u0104 (a Polish limited liability company) with its registered office in Rzesz\u00f3w, ul. Podkarpacka 1a, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-1369","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"\nPrivacy Policy - Kolok<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kolok.app\/en\/privacy-policy\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Privacy Policy - Kolok\" \/>\n<meta property=\"og:description\" content=\"PRIVACY POLICY OF THE KOLOK.APP APPLICATION AND WEBSITE Date of last update: 9 September 2026 \u00a7 1. DATA CONTROLLER The controller of the personal data of Users of the Portal and the KOLOK.app Mobile Application is KOLOK SP\u00d3\u0141KA Z OGRANICZON\u0104 ODPOWIEDZIALNO\u015aCI\u0104 (a Polish limited liability company) with its registered office in Rzesz\u00f3w, ul. Podkarpacka 1a, […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kolok.app\/en\/privacy-policy\/\" \/>\n<meta property=\"og:site_name\" content=\"Kolok\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-02T07:55:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kolok.app\/wp-content\/uploads\/2026\/09\/1200x630.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/kolok.app\\\/en\\\/privacy-policy\\\/\",\"url\":\"https:\\\/\\\/kolok.app\\\/en\\\/privacy-policy\\\/\",\"name\":\"Privacy Policy - Kolok\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kolok.app\\\/en\\\/#website\"},\"datePublished\":\"2026-09-15T18:00:58+00:00\",\"dateModified\":\"2026-10-02T07:55:15+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/kolok.app\\\/en\\\/privacy-policy\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/kolok.app\\\/en\\\/privacy-policy\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/kolok.app\\\/en\\\/privacy-policy\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Strona g\u0142\u00f3wna\",\"item\":\"https:\\\/\\\/kolok.app\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Privacy Policy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/kolok.app\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/kolok.app\\\/en\\\/\",\"name\":\"Kolok\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/kolok.app\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Privacy Policy - Kolok","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kolok.app\/en\/privacy-policy\/","og_locale":"en_US","og_type":"article","og_title":"Privacy Policy - Kolok","og_description":"PRIVACY POLICY OF THE KOLOK.APP APPLICATION AND WEBSITE Date of last update: 9 September 2026 \u00a7 1. DATA CONTROLLER The controller of the personal data of Users of the Portal and the KOLOK.app Mobile Application is KOLOK SP\u00d3\u0141KA Z OGRANICZON\u0104 ODPOWIEDZIALNO\u015aCI\u0104 (a Polish limited liability company) with its registered office in Rzesz\u00f3w, ul. Podkarpacka 1a, […]","og_url":"https:\/\/kolok.app\/en\/privacy-policy\/","og_site_name":"Kolok","article_modified_time":"2026-10-02T07:55:15+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/kolok.app\/wp-content\/uploads\/2026\/09\/1200x630.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/kolok.app\/en\/privacy-policy\/","url":"https:\/\/kolok.app\/en\/privacy-policy\/","name":"Privacy Policy - Kolok","isPartOf":{"@id":"https:\/\/kolok.app\/en\/#website"},"datePublished":"2026-09-15T18:00:58+00:00","dateModified":"2026-10-02T07:55:15+00:00","breadcrumb":{"@id":"https:\/\/kolok.app\/en\/privacy-policy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kolok.app\/en\/privacy-policy\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/kolok.app\/en\/privacy-policy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Strona g\u0142\u00f3wna","item":"https:\/\/kolok.app\/en\/"},{"@type":"ListItem","position":2,"name":"Privacy Policy"}]},{"@type":"WebSite","@id":"https:\/\/kolok.app\/en\/#website","url":"https:\/\/kolok.app\/en\/","name":"Kolok","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kolok.app\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/kolok.app\/en\/wp-json\/wp\/v2\/pages\/1369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kolok.app\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/kolok.app\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/kolok.app\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kolok.app\/en\/wp-json\/wp\/v2\/comments?post=1369"}],"version-history":[{"count":1,"href":"https:\/\/kolok.app\/en\/wp-json\/wp\/v2\/pages\/1369\/revisions"}],"predecessor-version":[{"id":1694,"href":"https:\/\/kolok.app\/en\/wp-json\/wp\/v2\/pages\/1369\/revisions\/1694"}],"wp:attachment":[{"href":"https:\/\/kolok.app\/en\/wp-json\/wp\/v2\/media?parent=1369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}