somexaPrivacy Policy
Your check-in is personal. Here is how information moves through Somexa.
On this page
Who this policy covers
This policy describes the current Android version of Somexa: Heart Rate Tracker, this website and support provided by the Somexa developer (“Somexa”, “we” or “us”). Somexa is intended for adults aged 18 and over. It does not require a personal account for the core experience. The website and app have different data flows, explained below.
Contact the Somexa developer at yvonneguomm@gmail.com for privacy questions. This policy describes the information handling of the current Android implementation and this website.
Your camera and face images
When you start a scan and grant camera permission, the front camera processes temporary frames and face-region information on your device to guide positioning, assess signal quality and estimate pulse from changes in reflected light. Camera access is part of the scan you start, not an ongoing background monitoring service.
Somexa does not upload face photographs or raw camera video to its AI service. Temporary scan frames are processed on-device, rather than added to your photo library or your saved report history. Face-region processing is used for scanning, not to recognize or verify your identity.
Information used by the app
- Profile details you enter, such as age, sex selection, height, weight, waist information, units and language preferences.
- Saved scan readings, calculated indicators, estimates, source information, report timestamps and history; manual entries that you choose to keep.
- An anonymous device identifier and a secret device credential used to associate AI requests with this installation. The credential is kept using Android secure storage; the server stores a credential digest.
- Messages and attachments you voluntarily send to our support email. Please do not send passwords, full payment-card information or unnecessary health details.
The Android app does not need your contacts or precise location for its core experience. This website does not read your app records or access your camera.
Optional AI processing and consent
Profile information and numerical readings can leave your device when you authorize and request AI functions. These transfers do not contain face images. AI processing can include candidate numerical estimates and a separate plain-language explanation of the final saved readings.
- Scan processing permission controls sharing profile details and scan values for AI-assisted processing. Declining this permission still allows the local scan experience.
- Weekly reports use a separate permission. A report request submits a frozen recent seven-day summary when you tap Generate; simply opening the app does not create a new report request.
- The advisor sends the conversation needed to answer your message. Profile and recent scan context are included only with the separate health-context permission. That context excludes photos and manual entries.
You can change these permissions in the app. Disabling a permission stops new submissions covered by it; a weekly job already submitted may finish. Stopping a chat or leaving its screen cancels the active connection. Withdrawal does not undo processing that has already happened.
Service providers and transfers
Authorized requests pass through the Somexa AI backend to the configured AI processor. The current implementation is configured for the OpenAI API. The API request disables response storage, but this is not a promise that the processor retains no data: separate safety and abuse-monitoring rules can apply.
OpenAI states that API data is not used to train its models by default unless the customer opts in, and that standard abuse-monitoring logs may be kept for up to 30 days, subject to exceptions described in its documentation. See OpenAI’s data controls. The applicable provider settings and terms govern its processing; Somexa’s shorter cache periods do not override them.
Network delivery, infrastructure and email providers also process information necessary to deliver their services. Depending on the provider and your location, processing may take place outside your country. No special data-residency arrangement is promised. We may disclose information when legally required or necessary to protect users and the service. We do not sell personal health information or face data.
Where information is kept and for how long
| Information | Current handling |
|---|---|
| Local profile, reports and preferences | Remain on your device until you remove them using app controls or remove the app’s data. |
| Temporary camera frames | Used transiently on-device during scanning; not saved as report photos or uploaded to the AI service. |
| Pending weekly-report inputs | Cleared after success or terminal failure. Unfinished jobs are terminated and their inputs cleared after at most 24 hours. |
| Server weekly-report results | Available for up to 30 days. A report already saved on your device is separate. |
| Successful chat reply cache | Kept for up to 15 minutes to support short-term retries. This is not a permanent server conversation archive. |
| Device and task metadata | Limited non-health identifiers and revocation or task-status markers may remain for security and duplicate-request prevention. |
| Support correspondence | Kept as reasonably needed to answer and document the request and meet applicable legal requirements. |
The standard backend backup excludes health-input and generated-response content. Provider-side retention, infrastructure security records and support emails are separate from app caches. We do not claim that every operational record has the same expiry period.
This website and technical information
This website does not include advertising, analytics trackers, embedded social feeds, an email collection form or health-data submission. Fonts and visual assets are served locally. Its mobile menus and FAQ work without persistent tracking storage.
A server delivering the site may process ordinary request information, including IP address, browser details and request time, to serve content and protect the service. Following an external link or opening an email application brings you under the relevant service’s privacy practices. The current Android app does not send information to advertising or external analytics services.
Deletion, access and your choices
Use Settings in Somexa to delete this device’s server data and then clear local profiles, reports, manual entries and permissions. A working connection is needed to complete server deletion. If deletion is pending because you are offline, reconnect and retry; uninstalling first can remove the credential needed to identify server records.
See the Data Deletion page for instructions. You can also contact yvonneguomm@gmail.com. Because no personal login connects your email address to an installation, we may need minimal additional information to identify a request. Do not email your device credential, passwords or complete health history.
Depending on your location, you may have rights to access, correct, delete or receive a copy of personal information, object to or restrict processing, withdraw consent, or complain to a data-protection authority. Applicable law determines those rights. We will assess requests and explain any identity-verification or lawful retention needs. Deleting app data does not cancel a Google Play subscription.
Security, age limits and updates
We use HTTPS for app-to-service transfers and device-bound credentials for server operations. These measures reduce risk; they do not guarantee absolute security. Protect your phone and avoid including sensitive third-party information in AI messages.
Somexa is not directed to children under 18. If you believe a child has sent personal information, contact yvonneguomm@gmail.com so we can investigate. We may revise this policy as the service changes, update the version date and provide additional notice where required.