Last updated 29 September 2026
Somana provides meditation, mood, journal, assessment and provider-linking features. Some account and wellness information is processed on our servers. Journal text and voice recordings are stored on your device and are not uploaded; limited journal-related metadata may be sent to our servers.
For the purposes of the General Data Protection Regulation (GDPR) and the UK GDPR, Somana Limited is the data controller responsible for your personal data. Somana Limited is a private company limited by shares, registered in Ireland (company number 817614). Our jurisdiction is Ireland / European Union.
Data controller: Somana Limited | Company registration number: 817614 | Registered office: Rosemount, Julianstown, Julianstown, Co. Meath, A92 WP70, Ireland
Contact: info@somanaapp.com | Website: somanaapp.com | Supervisory authority: Data Protection Commission (Ireland)
Somana is presented as a wellness application, not as a diagnostic or treatment service. Product claims and regulatory status depend on how the service is designed, offered and used, and require qualified review.
Journal text and voice recordings are stored in your browser or app's local storage on your device. The journal text and audio files are not sent to Somana's servers and are not available to linked providers. This does not mean all journal-related information stays local: when you save an entry, the app can send its date, selected mood and a yes/no entry-made flag to our servers. Those are personal data and may be visible in wellness summaries.
Local journal content is not part of server-side account data. It may be lost if you clear the app or browser data, uninstall the app, or lose your device; account deletion does not erase it for you.
Mood check-ins, assessment responses and scores, and information about wellbeing activity may reveal health information. We treat these as sensitive. The GDPR lawful basis and special-category condition for each use must be confirmed for the particular feature; see the Data Processing Register for our current processing summary.
Somana Limited must identify and document both the Article 6 lawful basis and the Article 9 condition for each health-related purpose. These have not yet been fully confirmed. Acceptance of general Terms, acknowledgement of this Privacy Policy, and meeting the 16+ account-age requirement do not by themselves establish explicit health-data consent.
When you create an account, we collect your email address, date of birth for age eligibility, and a securely hashed version of your password (we never store your actual password). Healthcare professionals also provide their name, profession, and licence number for verification. Optional profile photos and custom app backgrounds that you upload are stored on our servers; these are separate from device-only journal content.
If you connect Apple Health on iOS and permit access, Somana can read daily steps, active calories, exercise minutes, walking/running distance, average and maximum heart rate, resting heart rate, and sleep duration. Health Connect on Android currently supplies daily steps, active calories, average and maximum heart rate, and resting heart rate. The available metrics depend on your permissions and device data.
These daily summaries are sent to Somana's servers and stored with your account to show wellbeing trends and associations. Sync occurs on connection, on manual sync, and on app open or return while connected, with automatic sync attempted no more than once per hour. This information is not device-only.
An approved linked healthcare professional can also access stored health-data summaries. Disconnecting in Settings stops future syncs but does not delete previously synced records or remove existing provider access to those records. You can remove the provider link to stop that access and contact us to request deletion of stored health records.
Some information you type is sent to and stored on our servers. For example, session-preparation drafts are stored on the server; when submitted, preparation text and a generated mood summary may be shown to your linked provider. Providers also create clinical notes and records in their workspace. These are different from the private local journal. Avoid entering information you do not want stored or shared through those features.
Somana is configured to use Sentry for error reports and sampled performance diagnostics. Browser diagnostic user context can include your account ID, email address and account type; server diagnostic user context can include your account ID and username. These reports can be linked to your account. Error reports may contain personal data even when selected fields are redacted.
The browser integration is configured to capture session replay when an error occurs, rather than routinely recording every session. Replay masks text and blocks media. Performance traces are sampled at 20%. These settings describe the configured collection; delivery depends on the running app and its security settings. Masking and selected-field redaction are not a guarantee that every report is anonymous or free of sensitive information. Retention depends on Sentry settings and terms and still requires confirmation.
We do not sell your personal data. We share information only in these circumstances:
If your provider link is approved, it grants access to clinician-visible mood and activity records, assessment data, alerts, synced health summaries and other dashboard information. Submitted session-preparation text and generated mood summaries may also be visible. There is currently no field-by-field sharing selection. They cannot view journal text or voice audio. Some journal-related metadata, such as an entry-made flag or selected mood/date, may be visible in wellness summaries. Removing a link stops future dashboard access through that link but does not remove stored health summaries or information already viewed or separately recorded.
The published database endpoint and application hosting geographies are described below. Other processing and backup locations, contracts and transfer safeguards still need confirmation.
We may disclose information if required by law, court order, or to protect the safety of users or others.
Somana uses third-party hosting, database, payment, email, subscription and error-monitoring services. Its active published database endpoint is in AWS Europe (Frankfurt), Germany, and its published application is hosted in Replit North America. The former database in Oregon, USA retains a temporary copy of pre-migration data for rollback; it is not the active database. Resend stores account data in the US regardless of sending region; Sentry organisation events are stored in the EU, though some metadata may be in the US. Other provider locations, backup and support-access locations and transfer arrangements depend on current configuration and contracts and require confirmation. Where a transfer outside the EU/EEA takes place, the applicable GDPR safeguard should be confirmed against the current contract and configuration.
We keep your account identity and contact information while your account is active. You can delete your account and use Settings to delete supported categories of data. The selected-data controls currently cover mood updates, meditation sessions, clinical assessments and daily summaries, rather than every stored category.
Account deletion removes many account-linked records from the active service through our deletion process, but it does not currently erase every uploaded file, device-local record or service-provider copy. The former Oregon rollback copy may still contain pre-migration records after they are deleted from the active service; its retirement and erasure procedure is being finalised. Separate provider records may also remain. Any retained information must be limited to a specific, necessary purpose with an applicable legal basis and a defined period or retention criteria. There is no single industry-standard retention period for all records; legal obligations and verified provider arrangements must be assessed by record type.
| Data Category | Retention Period | On Deletion |
|---|---|---|
| Account data | While your account is active; post-deletion exceptions require a specific basis and retention criteria | Deletion process applies; legal and operational exceptions require confirmation |
| Wellness metadata and synced health summaries | Record-specific period to be confirmed | Deletion process applies; legal and operational exceptions require confirmation |
| Clinical assessments (PHQ-9, GAD-7, WHO-5) | Record-specific period to be confirmed | Deletion process applies; legal and operational exceptions require confirmation |
| Security and access records | As needed for security and service operations; period under review | Some records may be retained where required by law |
| Technical performance and error-monitoring data | Period to be confirmed; subject to provider settings | Handled under current service retention settings |
| Journal content and voice recordings | Device-only (your control) | Removed when you clear data or delete the app |
You have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; restrict processing; data portability; object to processing based on legitimate interests; withdraw consent where processing is based on consent; and lodge a complaint with the Data Protection Commission (Ireland). These rights are subject to applicable conditions and exceptions.
You can request an export or delete your account through Settings. The export currently includes selected server records such as account details, meditation sessions, daily summaries, assessment responses, activities and mood updates; it does not include local journal text or voice recordings, provider-authored records, or every category of data. Contact us for other access requests: info@somanaapp.com
Somana uses rules to calculate scores, summaries and alerts. We do not intend these outputs to make decisions with legal or similarly significant effects on you. They are informational summaries, not medical diagnoses or treatment recommendations, and may reflect incomplete information.
Somana uses authentication and CSRF-protection cookies. We do not use these for advertising. Any other cookies or local storage used by optional features depend on your device and configuration.
Somana is not directed at children under 16 years of age. We do not knowingly collect personal data from anyone under 16. If we become aware that we have inadvertently collected data from a person under 16, we will delete it promptly.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the app or by email and update the "Last updated" date. Continued use is not treated as a new explicit consent to health-data processing. Where a change requires consent, Somana must obtain the relevant affirmative choice.
If you have any questions about this Privacy Policy or how we handle your data, please contact us at: info@somanaapp.com
Somana Limited | Company registration number: 817614 | Registered office: Rosemount, Julianstown, Julianstown, Co. Meath, A92 WP70, Ireland
Terms and Conditions | Data Processing Register
Somana Limited © 2026. All rights reserved.