FINNELA PRIVACY POLICY

FINNELA LIFE, S.L.U. (en formación) (a single-member limited liability company in formation under Spanish law), tax ID B93966844, registered office at Av. de la República Argentina 218, 08023 Barcelona, Spain; registration with the Mercantile Registry of Barcelona pending. For any question about your data, write to us at hello@finnela.com.

We process different data depending on how you use Finnela:

• ·Mailing list: if you subscribe, we process your email address to send you updates.
• ·The Map and your Corner: if you complete the questionnaire ("the Map") and choose to save your result, we process your email and your answers. Those answers include data about your health (ADHD-related symptoms, mood and hormonal pattern). We use them to generate your result, save it to your Corner and personalize your experience.
• ·Cycle tracking: if you record the date of your last period —a health data point— we use it to show you the approximate window of your cycle. We keep only the latest date; each new one overwrites the previous, and you can edit or delete it anytime.
• ·Access to your Corner: we use your email to send you a single-use sign-in link (no passwords) and a technical cookie to keep your session.
• ·Consent record: we keep a record of when and to what you consented (date, version of this policy and the text accepted) so we can demonstrate it.
• ·La Ruta (paid subscription): if you subscribe to La Ruta, your payment is handled by our payment provider, Stripe. Stripe collects the payment details you enter (such as your card details and billing information) directly; we do not receive or store your full card number. We receive from Stripe the information we need to manage your subscription — for example, that your payment succeeded, your subscription status, and a billing identifier — which we use to give you access to La Ruta and keep it active.

We don't sell or share your data with anyone for their marketing.

If you subscribe to La Ruta, you can talk to Finnela, our AI coach. The coach is an artificial intelligence: she is not a person and will never tell you she is. She does not diagnose, does not treat, and is not a substitute for your doctor or your therapist.

What happens to what you write to her. So that the coach can reply to you, what you write is sent to Anthropic, the company whose technology makes the coach work. Anthropic generates the response on our behalf, as our data processor, and does not use your conversations to train its models: its contract with us expressly prohibits it.

What we keep. We keep two things, and only two:

• ·Your most recent messages, for a maximum of 24 hours, so that the coach does not lose the thread within the same day. After that they are deleted.
• ·A summary memory — your goal, your plan, your practices, your wins and how you have been doing lately — for as long as your account remains active (after 24 months of inactivity it is deleted along with the rest of your data, as explained in section 8). You can see it, change it and delete it whenever you want from your Corner, and you can turn the coach off entirely.

What the provider keeps, and for how long. We want you to know this precisely, because it is not up to us:

• ·As a general rule, Anthropic automatically deletes inputs and outputs within 30 days.
• ·If its automated safety systems flag content as a possible breach of its usage policy, it may keep that content for up to two years, and keep the scores those systems generate for up to seven years. This happens regardless of what we delete, and we cannot prevent it.

This means that, if you ask us to delete your data, we will immediately delete everything that is in our hands — except the little the law requires us to keep, such as billing information — but we cannot guarantee the immediate deletion of content that has been flagged by the provider's safety systems. We would rather tell you now than later.

Legal basis. We process this data with your explicit consent (Art. 9(2)(a) GDPR), which we ask for in two separate checkboxes before your first conversation with the coach: one for us to store your summary memory, and one for your conversations to be sent to the provider. You can withdraw either of them at any time from your Corner.

International transfer. Anthropic is in the United States. The transfer relies on the European Commission's Standard Contractual Clauses, incorporated into its Data Processing Agreement.

Security. The coach has a safety layer reviewed by health professionals: when it recognizes a situation beyond what Finnela can accompany, it shows you professional resources and steps aside. That layer does not assess your risk, does not grade it, and does not diagnose.

Some of the above is data concerning your health, which the GDPR protects with heightened safeguards (special categories, Art. 9). We only process it with your explicit consent, which we request separately and clearly before you save your Map or record your cycle. You can withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

We process your data on the basis of your consent (Art. 6(1)(a)) and, for health data, your explicit consent (Art. 9(2)(a)). Access to your Corner also relies on providing the service you request (Art. 6(1)(b)). We keep the consent record to meet our legal obligations (Art. 6(1)(c)).

To provide the service we work with providers that process data on our behalf:

• ·Supabase — database and sign-in system (United States).
• ·Vercel — website and app hosting (United States).
• ·Resend — sending the email with your sign-in link (United States).
• ·MailerLite — sending the newsletter, only if you subscribe.
• ·Stripe — payment processing for La Ruta subscriptions (United States). Stripe acts as merchant of record for your purchase: it processes your payment and billing data to take the payment, collect applicable taxes, and issue your receipt, and it uses that data as an independent controller for its own legal and tax obligations.
• ·Anthropic — generating the responses of Finnela, our AI coach (United States). Involved only if you subscribe to La Ruta and use the coach. See section 3.

When your data leaves the European Economic Area, the transfer relies on the following safeguards:

• ·Vercel and Resend are certified under the EU-US Data Privacy Framework (DPF).
• ·Supabase and MailerLite rely on the European Commission's Standard Contractual Clauses (SCCs), incorporated into their Data Processing Agreements (Supabase adds the UK Addendum).
• ·Stripe is certified under the EU-US Data Privacy Framework (DPF), and additionally relies on the European Commission’s Standard Contractual Clauses (SCCs) and the UK Addendum incorporated into its Data Processing Agreement.
• ·Anthropic relies on the European Commission's Standard Contractual Clauses (SCCs), incorporated into its Data Processing Agreement.

You can ask us for more information at hello@finnela.com.

• ·Your mailing-list email: until you unsubscribe or withdraw consent.
• ·Your Map and Corner: while your account is active. After 24 months of inactivity we will notify you and delete your data.
• ·Your cycle: only the latest date; it is overwritten and you can delete it.
• ·The consent record: while your account exists and as long as needed to demonstrate it.
• ·Your subscription and billing information: for as long as your subscription is active and afterwards for as long as we must keep it to meet legal, accounting, and tax obligations — typically 4 to 6 years, as required by Spanish tax and commercial law.

You can exercise your rights of access, rectification, erasure, restriction, objection and portability by writing to hello@finnela.com; we will respond within 30 days. You can also unsubscribe from the newsletter using the link in every email. Inside your Corner you can rectify and delete your cycle data yourself. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

We apply measures to protect your data: access restricted to our servers, encryption in transit (HTTPS), passwordless access via single-use links, isolated email, and minimization of what we store (for example, your cycle is shown in windows, never as a specific day, and we keep no history).

We use only technical cookies needed to keep your session. We do not use advertising or tracking cookies, so we do not show a cookie consent banner.

Finnela is not directed at minors. To use your Corner you must confirm that you are at least 18 years old. If we detect an account belonging to a minor, we will delete it.

We may update this policy; the current version and its date appear at the top. We will post the updated version here with its date; if the change is significant, we will notify you by email.

This section applies if you are a resident of the United States. It supplements the information above and describes rights that may be available to you under U.S. state privacy laws, including the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), and the comprehensive privacy laws of Colorado, Connecticut, and other states. The rights available to you depend on the law of your state.

Categories of information we collect. As described in section 2, we collect identifiers (such as your email address) and data about your health (your answers to the Map — ADHD-related symptoms, mood and hormonal pattern — and, if you record it, the date of your last period). We collect this information directly from you, and we use it only for the purposes described in this policy: to generate and save your Map, show you your cycle window, keep you signed in, and, if you subscribe, send you our newsletter.

Sensitive personal information. Under the CPRA and similar laws, data about your health is "sensitive personal information." We use your sensitive personal information only to provide the service you ask us for. We do not use it to infer characteristics about you, to build advertising profiles, or to make automated decisions that produce legal or similarly significant effects about you. You may ask us to limit the use of your sensitive personal information; because we already use it solely to provide the service, this limitation has little practical effect on how we treat your data.

We do not sell or share your information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws. Because we do not engage in these practices, we do not offer a "Do Not Sell or Share My Personal Information" option — there is nothing to opt out of.

Your rights. Depending on your state, you may have the right to know what personal information we hold about you and access it, to correct it, to delete it, and to obtain a portable copy. You may exercise these rights by writing to hello@finnela.com; we will respond within the time your state law requires. Before we act on your request, we may need to verify your identity. We will not discriminate against you for exercising your rights. If your state provides an appeals process and we decline your request, we will tell you how to appeal.

HIPAA does not apply. Based on our current activities, HIPAA does not apply to Finnela. We are not a healthcare provider, a health plan, or a healthcare clearinghouse, and we do not act as a "business associate" of any such entity, so the U.S. Health Insurance Portability and Accountability Act (HIPAA) does not apply to the data we process. The protections for your health data come from the explicit consent and the safeguards described in this policy.

This section is our Consumer Health Data Privacy Policy for the purposes of laws such as Washington's My Health My Data Act (MHMDA), Nevada's Consumer Health Data Privacy Law (SB 370), and the consumer health data provisions of Connecticut's privacy law. It applies to "consumer health data" — information that identifies your past, present, or future physical or mental health status. For Finnela, consumer health data includes the health data in your Map (ADHD-related symptoms and mood), your menstrual-cycle information (the date of your last period and the cycle window we derive from it), and, if you subscribe to La Ruta and choose to use Finnela, our AI coach, what you write in your conversations with the coach and the summary memory we keep for you.

What we collect and how. We collect consumer health data directly from you, when you complete and save your Map and when you record the date of your last period. We do not collect it from other sources, and we do not use tracking technologies to infer it.

Why we use it. We use your consumer health data only to provide the service you request: to generate and save your Map result, to show you the approximate window of your cycle, and to personalize your experience within your Corner. We do not use it for advertising.

Consent. We collect, use, and share your consumer health data only with your separate, explicit consent, which you give before you save your Map and before you record your cycle. You may withdraw your consent at any time by writing to hello@finnela.com, and you can delete your cycle data yourself from within your Corner.

We do not sell your consumer health data. We do not sell your consumer health data, and we will not do so.

Who we share it with. We share your consumer health data only with the service providers listed in section 5, who process it on our behalf under contract and only to help us provide the service. We do not share it with third parties for their own purposes.

The coach and our AI provider. If you use the coach, what you write is sent to Anthropic, our service provider, which generates the reply on our behalf under contract and is contractually prohibited from training its models on it. We ask for your separate, explicit consent for this before your first conversation. We keep your most recent messages for at most 24 hours and your summary memory for as long as your account remains active (see Retention and deletion below); you can view, edit and delete that memory yourself, and turn the coach off entirely. Anthropic deletes inputs and outputs within 30 days; if its automated safety systems flag content, it may retain it for up to two years and the resulting classification scores for up to seven years, which is outside our control.

Retention and deletion. We keep your consumer health data only while your account is active. You can delete your cycle data yourself at any time from your Corner, and you can ask us to delete the rest by writing to hello@finnela.com. After 24 months of inactivity, we notify you and then delete your data. Whenever we delete your consumer health data, we instruct our service providers to do the same.

Your rights. You have the right to withdraw your consent, to access the consumer health data we hold about you, and to have it deleted. To exercise these rights, write to hello@finnela.com; we may need to verify your identity first.