Public summary of processing activities (GDPR Article 30 information)
Last updated 29 September 2026
Controller name: Somana Limited
Company registration number: 817614
Registered office: Rosemount, Julianstown, Julianstown, Co. Meath, A92 WP70, Ireland
Contact email: info@somanaapp.com
Website: somanaapp.com
Jurisdiction: Ireland / European Union
Nature of service: Wellness application; regulatory classification and claims require qualified review
This is a public summary, not a complete internal record or legal determination. Lawful bases, roles, regions, safeguards and retention details need qualified review.
Purpose: Create and maintain user accounts; authenticate users; manage preferences
Lawful Basis: Article 6 basis is to be confirmed for each purpose; this public summary is not a legal determination
Data Subjects: Standard users, healthcare professionals
Categories of Personal Data: Name, email address, date of birth, optional uploaded profile photos/backgrounds, hashed password, account type, MFA secrets (encrypted)
Recipients: Neon (published database endpoint)
International Transfers: Published database endpoint: Neon AWS Europe (Frankfurt), Germany; applicable transfer safeguards unverified. Replit application hosting: North America
Retention Period: Account identity/contact information is kept while the account is active; any post-deletion retention needs a specific purpose, legal basis and documented period or criteria. Uploaded-file erasure is not yet complete
Security Measures: bcrypt password hashing, httpOnly JWT cookies, CSRF protection, encrypted MFA secrets
Purpose: Track mood, meditation sessions, breathing exercises, daily wellness summaries and optional synced device-health summaries to show wellbeing trends
Lawful Basis: Article 6 basis and GDPR Article 9 condition require feature-level confirmation and qualified legal review
Data Subjects: Standard users
Categories of Personal Data: Identifiable mood values, intensity, energy, optional notes, meditation duration/type, breathing/activity records, daily summary values, and journal date/mood/entry-made metadata. Optional Apple Health: daily steps, active calories, exercise minutes, distance, average/max heart rate, resting heart rate and sleep duration. Health Connect: steps, active calories, average/max heart rate and resting heart rate. These may reveal health information
Recipients: Neon (published database endpoint); linked healthcare professional may access permitted records
International Transfers: Published database endpoint: Neon AWS Europe (Frankfurt), Germany; applicable transfer safeguards unverified. Replit application hosting: North America
Retention Period: While needed for the account and service; disconnecting a health source stops sync but retains previously synced records. Deletion and any legally required exceptions depend on record type
Security Measures: TLS in transit; an approved provider-owned link grants clinician-visible dashboard access; no field-by-field sharing selection
Purpose: Record questionnaire responses and scores for user self-monitoring
Lawful Basis: Article 6 basis and GDPR Article 9 condition require feature-level confirmation and qualified legal review
Data Subjects: Standard users
Categories of Personal Data: Assessment responses, scores, and dates; may reveal health information
Recipients: Neon (published database endpoint); healthcare professional (if linked by user)
International Transfers: Published database endpoint: Neon AWS Europe (Frankfurt), Germany; applicable transfer safeguards unverified. Replit application hosting: North America
Retention Period: While needed for the account and service; deletion and any legally required exceptions depend on record type
Security Measures: TLS in transit; an approved provider-owned link grants clinician-visible dashboard access; no field-by-field sharing selection
Purpose: Enable healthcare professionals to view permitted linked account information
Lawful Basis: Lawful basis, special-category condition, and controller/processor roles require qualified legal review; account linking enables access
Data Subjects: Standard users (as patients), healthcare professionals
Categories of Personal Data: Mood and activity records, assessment data, alerts, optional synced device-health summaries, and submitted session-preparation text or mood summaries; not local journal text or audio
Recipients: Linked healthcare professional; their legal role and handling of data require case-specific review
International Transfers: Exact region and transfer safeguards require confirmation against current configuration and contracts
Retention Period: Somana link removal stops future access through that link; provider-held copies or separate records may remain
Security Measures: Account linking and access controls; MFA for healthcare accounts; encryption of selected sensitive fields; access logging
Purpose: Process subscription payments for premium features
Lawful Basis: Article 6 basis and controller/processor roles should be confirmed against the current payment flow and provider contracts
Data Subjects: Subscribing users
Categories of Personal Data: Payment card details, billing address, transaction history (handled entirely by Stripe - Somana does not store card numbers)
Recipients: Stripe; contractual role to be confirmed
International Transfers: Provider locations and transfer safeguards require confirmation against current configuration and contracts
Retention Period: Stripe handles payment details; Somana also stores subscription status and related billing identifiers
Security Measures: Payment handling is provided through Stripe; confirm current card-data flow and applicable provider controls
Purpose: Send password reset links and account-related notifications
Lawful Basis: Article 6 basis and controller/processor roles should be confirmed against current email flows and provider contracts
Data Subjects: All users
Categories of Personal Data: Email address, subject and message content (including reset links, account and professional-verification notices; some user-supplied support text may be included)
Recipients: Resend; contractual role to be confirmed
International Transfers: Provider locations and transfer safeguards require confirmation against current configuration and contracts
Retention Period: Provider retention applies; Somana may retain related account or delivery records
Security Measures: TLS and time-limited reset tokens; email content and destinations depend on the account workflow
Purpose: Detect and resolve application errors; monitor performance to ensure service reliability
Lawful Basis: The lawful basis and scope of diagnostic collection require confirmation against the deployed configuration
Data Subjects: Users whose devices or requests generate diagnostic data
Categories of Personal Data: Error reports, technical/device metadata, sampled performance traces and masked, media-blocked browser replay on errors. Browser account ID/email/account type and server account ID/username may link diagnostics to an account; selected-field redaction does not guarantee anonymity
Recipients: Sentry; contractual role to be confirmed
International Transfers: Provider locations and transfer safeguards require confirmation against current configuration and contracts
Retention Period: Per current Sentry configuration and provider terms; verify period
Security Measures: Configured sensitive-field redaction; not a guarantee diagnostic data contains no personal data
Purpose: Protect user accounts and support authorised access
Lawful Basis: Article 6 basis and retention period for each security record require confirmation
Data Subjects: All users
Categories of Personal Data: Login/session records, IP addresses and request metadata where collected, MFA verification records, and data access audit logs
Recipients: Neon (published database endpoint)
International Transfers: Published database endpoint: Neon AWS Europe (Frankfurt), Germany; applicable transfer safeguards unverified. Replit application hosting: North America
Retention Period: Session and access-log retention periods require confirmation; no fixed seven-year legal period is stated here
Security Measures: JWT with httpOnly cookies, SameSite cookie policy, CSRF double-submit pattern, TOTP-based MFA, bcrypt hashing, encrypted credentials
Purpose: Let users prepare for appointments and let healthcare professionals record care-related information in their workspace
Lawful Basis: Purposes, lawful bases, and provider controller/processor roles require qualified legal review
Data Subjects: Users and healthcare professionals
Categories of Personal Data: User-entered session-preparation text and generated mood summaries; provider-entered clinical notes and related care records
Recipients: Somana database; submitted preparation may be available to the linked provider; provider workspace users according to access permissions
International Transfers: Published database endpoint: Neon AWS Europe (Frankfurt), Germany; linked provider locations and transfer safeguards require confirmation
Retention Period: Record-specific retention and deletion behavior require confirmation; account deletion and link removal may not erase provider-held records
Security Measures: Selected sensitive fields are encrypted; access controls and logging apply
Journal text and voice recordings are stored on the user's device and are not transmitted to Somana's servers. Journal-related metadata, such as entry date, selected mood or an entry-made flag, can be transmitted and is personal data. Mood check-ins, assessments, session activity, and server-based preparation notes are separate server-side records.
| Provider | Role | Data Region | Transfer Safeguard |
|---|---|---|---|
| Neon | Published database endpoint; development connection is external but its provider and region are unverified | Active published database: AWS Europe (Frankfurt), Germany. Former Oregon, USA database temporarily retains pre-migration data for rollback and does not receive new app data; backup and access locations unverified | Neon publishes a DPA with SCCs; verify Somana's applicable agreement and transfer safeguards |
| Stripe | Payment processing | Account-specific locations unverified; cross-border processing possible | Stripe publishes a transfers addendum (DPF/SCCs); verify applicable terms |
| Replit | Application hosting | Published application: North America; other data locations unverified | Replit publishes a DPA with SCCs; verify applicable agreement |
| Resend | Email delivery | Account data in US; sending region does not change storage | Provided DPA includes SCCs and DPF terms; verify account acceptance and current status |
| Sentry | Error monitoring | Organisation event storage: EU; some metadata may reside in US | Sentry publishes a DPA with DPF/SCCs; verify applicable agreement |
| RevenueCat | Mobile subscription management | Account-specific storage and access locations unverified | RevenueCat publishes a DPA with SCCs; verify applicable agreement |
These are observed settings and published provider terms, not confirmation that every agreement applies to Somana. The temporary Oregon rollback copy will be retired after an independent Frankfurt backup is verified and a retirement decision is made; no deletion date is yet confirmed. Development database identity, backup and access locations, other provider locations, subprocessors and contractual coverage still require account-level verification. Hosting providers process application traffic.
Privacy Policy | somanaapp.com
Somana Limited © 2026. All rights reserved.