Last updated: March 2026
Somana is a therapy-adjacent mental wellness application designed to support your meditation practice, mood tracking, and connection with healthcare professionals. We are committed to handling your personal information with the highest level of care and transparency.
For the purposes of the General Data Protection Regulation (GDPR) and the UK GDPR, Somana is the data controller responsible for your personal data. Our jurisdiction is Ireland / European Union.
Contact: info@somanaapp.com | Website: somanaapp.com | Supervisory authority: Data Protection Commission (Ireland)
Somana is a wellness and treatment-support application. Please read the following carefully:
Journal entries, including any text you write and any voice recordings you make, are stored exclusively on your device. They are never transmitted to our servers, never stored in our database, and never shared with anyone, including your healthcare provider.
This is a deliberate architectural decision, not just a policy. No server-side database table exists that could store journal content. Even in the unlikely event of a data breach affecting our servers, your journal content could not be exposed because it has never left your device.
Some of the data Somana processes, including mood check-in values, clinical assessment scores (PHQ-9, GAD-7, WHO-5), and wellness activity patterns, constitutes special category data (health data) under Article 9 of the GDPR.
When you create an account, we collect your email address and a securely hashed version of your password (we never store your actual password). Healthcare professionals also provide their name, profession, and licence number for verification.
We do not sell your personal data. We share information only in these circumstances:
If you have linked your account to a healthcare professional using their linking code, they can view your wellness metadata (mood trends, meditation stats, assessment scores). They cannot view your journal content. You can remove this link at any time in Settings.
We may disclose information if required by law, court order, or to protect the safety of users or others.
Somana is developed and operated from Ireland and the United States. Our database is configured to store your primary data in the European Union on Neon's managed infrastructure. When your data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework as required by GDPR Article 46.
When you delete your account, your personal content and wellness data are permanently deleted from our servers. Audit logs are retained for up to 7 years to meet regulatory requirements.
| Data Category | Retention Period | On Deletion |
|---|---|---|
| Account data | While account is active | Permanently deleted |
| Wellness metadata | While account is active | Permanently deleted |
| Clinical assessments (PHQ-9, GAD-7, WHO-5) | While account is active | Permanently deleted |
| Audit logs | 7 years | Retained for regulatory compliance |
| Technical performance data | 90 days | Auto-deleted |
| Journal content and voice recordings | Device-only (your control) | Removed when you clear data or delete the app |
You have the right to: access the personal data we hold about you; correct inaccurate data; request deletion ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests; withdraw consent for health data processing; and lodge a complaint with the Data Protection Commission (Ireland).
You can export or delete your account directly in the app under Settings. For other requests, contact: info@somanaapp.com
Somana does not use automated decision-making or profiling that produces legal or similarly significant effects on users (GDPR Article 22). Wellness alerts and clinical assessment scores are generated using simple, rule-based logic, not AI or machine learning. These outputs are informational only.
Somana uses strictly necessary cookies for authentication (JWT session cookies and CSRF protection tokens). We do not use advertising cookies, cross-site tracking cookies, or analytics cookies that identify individual users.
Somana is not directed at children under 18 years of age. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected data from a person under 18, we will delete it promptly.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the app or by email and update the "Last updated" date. Your continued use of Somana after changes take effect constitutes acceptance of the updated policy.
If you have any questions about this Privacy Policy or how we handle your data, please contact us at: info@somanaapp.com