Privacy Policy (GDPR Compliant)

Effective Date: August 4, 2025

Introduction

At NuraCove, we are committed to protecting the privacy and personal data of women using our AI-powered wellness platform. This Privacy Policy explains how we collect, use, store, and protect your personal information in compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

Who We Are

NuraCove is an AI-powered women's wellness platform specializing in midlife health and wellness solutions. We are the data controller for the personal information we collect from you.

What Personal Data We Collect

Information You Provide Directly:

• Account Information: Name, email address, date of birth, location
• Health & Wellness Data: Wellness goals, health concerns, lifestyle preferences, menstrual/menopause information
• Communication Data: Messages, support inquiries, newsletter subscriptions
• Payment Information: Billing details (processed securely by third-party payment processors)

Information We Collect Automatically:

• Usage Data: How you interact with our AI tools and wellness content
• Device Information: IP address, browser type, device identifiers
• Cookies and Tracking: As described in our Cookie Policy

How We Use Your Personal Data

We process your personal data for the following purposes:

Service Delivery (Legal Basis: Contract Performance)

• Providing personalized AI-powered wellness recommendations
• Creating customized midlife wellness plans
• Delivering wellness content and resources
• Processing payments and managing your account

Legitimate Interests

• Improving our AI algorithms and wellness recommendations
• Analyzing usage patterns to enhance user experience
• Preventing fraud and ensuring platform security
• Conducting research to better serve midlife women's wellness needs

Consent-Based Processing

• Sending marketing communications about wellness tips and services
• Sharing success stories and testimonials (with your explicit consent)
• Participating in wellness surveys and research studies

Legal Compliance

• Complying with healthcare regulations and data protection laws
• Responding to legal requests and protecting our rights

Data Sharing and Third Parties

We may share your personal data with:

• Service Providers: Cloud hosting, payment processing, analytics (all under strict data processing agreements)
• Healthcare Partners: Only with your explicit consent and for your direct benefit
• Legal Authorities: When required by law or to protect rights and safety

We never sell your personal data to third parties.

International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). When this occurs, we ensure adequate protection through:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs)
• Other legally recognized transfer mechanisms

Your Rights Under GDPR

As a data subject, you have the following rights:

Access and Portability

• Right of Access: Request a copy of your personal data
• Data Portability: Receive your data in a machine-readable format

Correction and Deletion

• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data

Processing Control

• Right to Restrict Processing: Limit how we use your data
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for consent-based processing

Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Account Data: Until you delete your account plus 30 days
• Health/Wellness Data: 7 years after account closure (for health record purposes)
• Marketing Data: Until you unsubscribe plus 2 years
• Legal Requirements: As required by applicable laws

Data Security

We implement comprehensive security measures to protect your personal data:

• End-to-end encryption for sensitive health data
• Regular security audits and penetration testing
• Staff training on data protection and privacy
• Secure cloud infrastructure with access controls
• Regular backups and disaster recovery procedures

Children's Privacy

Our services are designed for women aged 18 and older. We do not knowingly collect personal data from children under 16 without parental consent.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Significant changes will be communicated via email or prominent website notice.

Complaints and Supervisory Authority

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with your local data protection supervisory authority.