Privacy Policy

1. Scope & who we are

SOMA is provided by SOMA ("SOMA", "we", "us") — [Registered company name and address — fill before launch]. This Privacy Policy explains how we collect, use, and protect information when you use the SOMA app, visit somaintelligence.app, or join our waitlist (together, the "Service").

SOMA is a Training Intelligence platform (also called Adaptive Performance Intelligence). It uses the recovery, sleep, activity, and training data you authorize to generate personalized training recommendations and adaptive training decisions — how much volume to do, how hard to push, when to add load, and when to deload. Because much of what SOMA processes is health-related, we treat it with heightened care and design for data minimization.

SOMA is not a medical device and does not provide medical advice, diagnosis, or treatment. See our Terms of Service for more.

2. Data we collect

We collect only what the Service needs to function:

• Wearable data you authorize — for example heart rate, heart-rate variability (HRV), resting heart rate, sleep (duration and stages), respiratory rate, blood oxygen (SpO2), body temperature, workouts and activity, and readiness/recovery scores. SOMA reads only the specific data types you authorize. Initially we support Apple Health (including Apple Watch) and Oura; other sources (WHOOP, Garmin, Polar, Coros) are planned and would follow the same principles.
• Training data you enter or generate — workouts, sets, reps, loads, effort (reps in reserve / RIR), programs, and derived metrics such as volume, fatigue, training load, and adaptation.
• Account & profile data you provide — such as your name and training preferences, where applicable.
• Waitlist email — if you join the waitlist, the email address you submit.
• Limited technical, usage & analytics data — privacy-respecting and minimized, with reduced identifiers. This is never used to build advertising profiles.

For a plain-language overview of what we collect from each source, see Data Usage & Privacy.

3. How we use your data

We use your data to operate the Service for you:

• To deliver Training Intelligence. From the wearable and training data you authorize, SOMA computes a daily recovery/readiness read, estimates fatigue and training load, learns your adaptation patterns over time, and turns all of that into the day's training decision and personalized recommendations.
• To operate the waitlist — to notify you about early access, launch, and material updates, and to prevent duplicate sign-ups.
• To maintain and improve the Service — to diagnose issues, ensure reliability, and develop features, using minimized, aggregated, or de-identified data wherever feasible.
• To comply with law and to protect the rights, safety, and security of users and the Service.

Wherever possible, this processing happens on your device. Data that must go off-device (for example your waitlist email or any account data) is handled by vetted infrastructure providers under confidentiality and data-protection obligations, encrypted in transit and at rest where supported.

4. Apple Health & HealthKit

On Apple devices, SOMA reads Apple Health data via HealthKit — only the specific data types you authorize in the iOS permission prompt, read on-device. Data from your Apple Watch reaches SOMA through Apple Health using this same permission model. SOMA does not receive HealthKit data unless you grant permission, and you can revoke it at any time (see §11).

In accordance with Apple's rules, HealthKit data is never used for advertising or marketing, and is never sold. It is used solely to provide the app's health and fitness features.

5. Oura

If you connect Oura, SOMA accesses — via Oura's official API and your explicit OAuth authorization — the sleep, readiness, activity, and related metrics you approve, to feed your recovery/readiness model and training decisions. SOMA stores only what it needs, never sells Oura data, and never shares it for advertising. You can disconnect Oura at any time (see §11). For full details, see the Oura Integration Disclosure.

6. Legal bases for processing

Where data-protection laws such as the GDPR apply, we rely on the following legal bases:

• Consent — for reading wearable and health data you authorize (including HealthKit and Oura) and for sending waitlist communications. You can withdraw consent at any time by disconnecting an integration, unsubscribing, or contacting us.
• Contract — to provide the Service you have requested and its core features.
• Legitimate interests — to keep the Service secure and reliable and to improve it, balanced against your rights and using minimized or de-identified data where feasible.

Where required, we treat health and wearable data as a special category and process it only with your explicit consent or another lawful basis.

7. Sharing & disclosure

We share personal data only in limited circumstances:

• Service providers (sub-processors) who host infrastructure, store waitlist or account data, or provide analytics on our behalf, bound by confidentiality and data-protection obligations.
• Legal & safety — when required by law or legal process, or to protect the rights, safety, and security of users and the Service.
• Business transfers — in connection with a merger, acquisition, or asset sale, subject to this policy.

We never sell your personal data, and we never share HealthKit, Oura, or other wearable health data for third-party advertising.

8. International transfers

We aim to process data on your device, but limited data handled by our infrastructure providers may be stored or processed in countries other than your own. Where data is transferred across borders, we use appropriate safeguards — such as standard contractual clauses or equivalent mechanisms — to protect it consistent with this policy and applicable law.

9. Storage, security & retention

SOMA is designed to keep your health and training data on your device wherever possible. Data that must be processed off-device is handled by vetted infrastructure providers using encryption in transit and at rest where supported, under confidentiality and data-protection obligations.

We retain personal data only as long as needed to provide the Service or as required by law. Waitlist emails are retained until you ask us to remove them or the waitlist is retired; account and server-side data are deleted on request as described in §12. No method of storage or transmission is perfectly secure, but we use reasonable technical and organizational measures to protect your information.

10. Your rights & choices

Depending on where you live, you may have rights to access, correct, port, restrict, or delete your personal data, and to object to or withdraw consent for certain processing. You can:

• revoke wearable and HealthKit permissions, and disconnect Oura or other connected sources, at any time (see §11);
• unsubscribe from waitlist or update emails;
• request access to or deletion of your data (see §12); and
• lodge a complaint with your local data-protection authority.

We will not discriminate against you for exercising any of these rights. To make a request, email hello@somaintelligence.app.

11. Disconnecting integrations

You stay in control of every connected source:

• Apple Health. Revoke access in iOS Settings → Privacy & Security → Health → SOMA (toggle off the data types or all of them). SOMA immediately stops reading new HealthKit data.
• Oura. Disconnect inside SOMA → Settings → Integrations → Oura (Disconnect), which revokes SOMA's access token so SOMA stops accessing Oura data. You can also revoke access in your Oura account (cloud.ouraring.com → account / connections).

12. Data deletion

You can delete your account and data at any time, either in-app: Settings → Account → Delete Account, or by emailing hello@somaintelligence.app from your account email.

On deletion, your SOMA account and associated server-side data are deleted, and integration access tokens (for example, Oura) are revoked. On-device data is removed when you delete the app or via the in-app delete. We action verified requests promptly — within 30 days, and sooner where required by law. We may retain a minimal amount of data where required by law (for example, a record of a deletion request). Full details live on the Account Deletion page.

13. Children

SOMA is not directed to children under 16 (or the age of digital consent in your jurisdiction), and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy as the Service evolves — for example, when we add a new wearable integration. We will revise the effective date and, for material changes, provide additional notice where appropriate. This policy is effective as of 2026-06-22. Your continued use of the Service after an update means you accept the revised policy.

15. Contact

Questions, requests, or privacy concerns? Email us at hello@somaintelligence.app. This policy is governed by [Governing-law jurisdiction, e.g. England & Wales — fill before launch]. See also our Terms of Service, Data Usage & Privacy, and Account Deletion pages.