Privacy Policy

IMPORTANT MEDICAL DISCLAIMER

Exzema is a tracking and journaling tool, NOT a medical device. The information, insights, and data provided by the Exzema website and mobile application are for informational purposes only and do not constitute professional medical advice, diagnosis, treatment, or recommendations of any kind. You should always seek the advice of a qualified healthcare provider or dermatologist with any questions regarding a medical condition, skin condition, or changes to your diet, lifestyle, or treatment plan. Never disregard professional medical advice or delay seeking it because of something you have read on this website or app. In the case of a medical emergency, call your doctor or emergency services immediately.

1. Identity & Contact

This Privacy Policy applies to the Exzema mobile application ("App") and the website located at https://exzema.app ("Website"), including our web-based 7-Day Baseline Tracker, collectively referred to as the "Service", operated by Martin Mojžíš.

Data Controller: Martin Mojžíš

Contact Email: support@exzema.app

2. What Data We Collect

We collect different types of data depending on how you interact with our Service across both the mobile application and website:

A. Data You Provide

• First Name: Collected during app onboarding to personalize your interface experience.
• Email Address: Collected if you join our product waitlist, link an email to your app account for backup/recovery, or initiate our web-based 7-Day Baseline Tracker (required to deliver passwordless magic login links, daily logging reminders, and cross-device session synchronization).
• Goals: Your selected goals during onboarding for product personalization.
• Allergy/Sensitivity Preferences: Selections regarding pollen allergy, sun sensitivity, and air pollution sensitivity to filter environment data.
• Daily Health Logs (Mobile App): Data regarding your flare status, flare severity (1-10 scale), active triggers, active routines, and elimination experiment compliance.
• Trigger & Routine Selections: Triggers and routines you pin for your personalized tracking grid.
• Elimination Experiment Data: Scientific experiment tracking and post-experiment questionnaire answers.
• Bug Report Text & Screenshot: Provided voluntarily for customer support and debugging.
• Medical Disclaimer Acceptance: Acknowledgment of our medical disclaimer.
• 7-Day Web Baseline Health Data (Special Category Data under GDPR Art. 9): When using our website 7-Day Baseline Tracker, you voluntarily record self-reported skin flare severity (1-10 scale), optional qualitative symptom notes, dietary triggers consumed (food tags such as dairy, gluten, nightshades, sugar, alcohol, and custom entries), and basic daily skin routine compliance (moisturizer and prescribed/topical medication usage).

B. Automatically Collected Data

• Anonymous User ID (UUID): Created automatically upon first launch for account identity and data isolation.
• Device Location (Approximate): Sent to our backend in real-time when the mobile app is in use to fetch environmental APIs. This location data is NOT stored persistently.
• Environment Data: UV index, temperature, humidity, AQI, and pollen levels derived from your location using Apple WeatherKit and Google APIs.
• App & Website Usage Analytics: Events, session recordings, and funnel metrics collected via PostHog to improve usability and diagnose performance issues. On the website, your email is associated with analytics solely to measure baseline onboarding completion rates.
• Subscription Status: Purchase data and entitlement verification collected via RevenueCat in the mobile app.
• Push Notification Token: Device push tokens for delivering mobile reminders and alerts.
• Website Session Credentials & Local Storage: A unique session token (UUID) stored in browser localStorage to allow passwordless resumption of your 7-day baseline, along with cached email and day progress for site-wide navigation.

C. Data We Do NOT Collect

• No precise medical diagnoses.
• No photos of skin.
• No biometric data (Face ID, fingerprint, heart rate).
• No contacts or address book.
• No browsing history or cross-app tracking.
• No advertising identifiers (IDFA).
• No sale of personal data to any third party.
• No sharing of health data with any third party for their own purposes.

3. How We Use Your Data & Legal Bases

Under the EU General Data Protection Regulation (GDPR) and UK GDPR, we process your data strictly based on lawful legal grounds:

• Health logs, triggers, routines, and environment data (App): Processed based on your explicit consent (GDPR Art. 9(2)(a)) given during onboarding.
• Web 7-Day Baseline Health Data (Website): Processed based on your explicit consent (GDPR Art. 9(2)(a)) provided when voluntarily submitting daily logs. You may withdraw consent at any time.
• Email & Transactional Delivery (Magic Links & Reminders): Processed based on service performance / contract (GDPR Art. 6(1)(b)) to fulfill your request for baseline tracking access links and check-in reminders.
• Waitlist Email: Processed based on your consent (GDPR Art. 6(1)(a)) to receive launch updates and product announcements.
• Product Analytics (PostHog): Processed based on our legitimate interest (GDPR Art. 6(1)(f)) to understand feature adoption and fix bugs.
• Transient Location (App): Processed based on your explicit consent via OS dialog to fetch local environmental conditions.
• Bug Reports: Processed based on your consent when voluntarily submitted.

4. Third-Party Sub-processors

We do not sell, rent, or trade your personal data. Health data is never shared with advertisers. Statistical calculations run exclusively for your personal insights.

We use the following vetted sub-processors:

• Supabase: Cloud database, authentication, row-level security (RLS), edge functions, and file storage (USA; Standard Contractual Clauses).
• Resend (Resend, Inc.): Transactional email infrastructure used to deliver passwordless magic login links, daily tracker reminders, and waitlist confirmations (USA; Standard Contractual Clauses).
• Cloudflare (Cloudflare, Inc.): Reverse proxy, CDN, DDoS defense, and SSL/TLS encryption (USA/Global).
• PostHog: Product analytics, error tracking, and session recording (USA; Standard Contractual Clauses).
• RevenueCat: Subscription management for the iOS app.
• Apple WeatherKit & Google APIs: Fetching environmental UV, weather, and air quality metrics.
• Apple APNS & Google FCM: Push notification delivery.
• Expo: App development and over-the-air updates.
• Hugging Face: Hosts the backend statistical correlation engine.

We may also disclose your data if legally required (e.g., court order or lawful governmental request).

5. Data Retention

• Account & Health Data: Retained until you request account deletion or delete your data.
• Web 7-Day Baseline Logs: Retained for active baseline tracking and handoff to the mobile application, or until you request deletion via support@exzema.app.
• Bug Reports: Deleted after resolution or upon request.
• Analytics Data: Retained according to PostHog's standard policy (typically 1 year).
• Subscription Data: Retained per RevenueCat and Apple App Store policies.

6. Data Security

All communication occurs over HTTPS/TLS encryption. Databases are secured using Row Level Security (RLS) enforcing strict tenant isolation. Authentication is passwordless via cryptographic session tokens or magic links. Passwords are never stored on our servers.

7. Your Rights (GDPR & CCPA)

For all users: You have the right to access, rectify, export, or delete your personal and health data at any time, as well as withdraw previously granted consent.

For EU/EEA users (GDPR): You also have the right to restrict processing, object to legitimate interest processing, and lodge a complaint with your local Data Protection Authority (e.g., ÚOOÚ in Czechia).

For California residents (CCPA/CPRA): You have the right to know what personal information is collected, request its deletion, and be free from discrimination. We do not sell or share personal information.

8. International Data Transfers

User data may be processed on servers in the United States (via Supabase, Resend, PostHog, RevenueCat, Cloudflare). For EU/EEA users, international transfers are safeguarded under Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework where certified.

9. Children's Privacy

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal or health information from children under 16. If we become aware of such collection, we will immediately delete the data.

10. Cookies & Local Storage

The mobile app uses local storage for offline state. The website uses standard browser localStorage to maintain your 7-day baseline session (exzema_baseline_session), display your email and progress in the header (exzema_user_email, exzema_baseline_day), store your chosen language (exzema_lang), and remember A/B test variations (exzema_hero_variant). We do not use third-party advertising or tracking cookies across other websites.

11. Push Notifications

In the mobile app, we request permission for daily check-in reminders and environmental alerts. You can disable push notifications at any time in device settings. Push tokens are not tied to commercial advertising.

12. Changes to This Policy

We may update this policy periodically. We will notify you of material changes via email or prominent notices on the Website. Continued use of our Service indicates acceptance of the revised policy.

13. Contact & Exercising Your Rights

To exercise your privacy rights, request complete erasure of your email and tracking logs, or ask questions, email: support@exzema.app. You can also immediately clear your local browser session by clicking 'Log out' in the website header or tracker dashboard. We respond to all verified requests within 30 days.