Beyond Mood Journal Privacy Policy

This policy explains how Beyond Mood Journal (“Beyond Mood Journal,” “we,” or “us”) handles your personal data. Here’s a quick summary first, with key takeaways. It is not a substitute for reading the full policy, along with our Terms of Use.

Safeguarding Your Data: Beyond Mood Journal’s dedication to Privacy and Security

When you use Beyond Mood Journal, you are trusting us with your personal data. We are committed to being transparent, protecting your rights, and respecting your data. We implement technical and organizational measures in an effort to protect personal data from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction, taking into account the nature of the personal data that we process.

Introduction

Beyond Mood Journal is dedicated to building a transformative self-help tool focused on emotional well-being and personal growth. Our vision is to empower individuals through insightful self-reflection, leading to a more fulfilling and harmonious life. We are developing an innovative AI-powered self-healing tool designed to help users understand their emotions and experiences by converting emotional patterns into actionable insights. This aims to enhance self-awareness, foster personal development, and improve overall quality of life.

This Privacy Policy explains how Beyond Mood Journal collects, stores, uses, transfers, and shares personal data from our users (“you”) in connection with the Beyond Mood Journal mobile application (the “App”) and the related website and services (all collectively, the “Services”). We have successfully launched a beta version of our app on both iOS and Android.

We may change this Privacy Policy from time to time. If the changes are material, we will notify you by email or through the App. Your continued use of the Services after this policy has been updated indicates your acceptance of changes made.

Personal data we collect from you

We collect personal data about you when you interact with the Services. This can be directly from you or, in some cases, automatically as you use the App.

Personal data you provide to us directly:

When you sign up to use the Services, we may collect general information such as your name, email address, year and month of birth, password, and location information including time zone and language. You may also choose to input your first name or a preferred name.

When you use the Services, you can choose to input personal data about your well-being, such as:

• Your journal entries, including text, written, drawn, voice, or uploaded content.
• Your mood and emotions.
• Dream content for analysis.
• Thoughts and experiences.
• Information related to decision-making.
• Data related to physical and mental well-being, such as water intake and sleep duration, or other general symptoms.

Personal data we collect automatically:

When you access or use the Services, we may automatically collect the following information:

• Device information: device model, operating system and its version, unique device identifiers, mobile operator and network information.
• Location information: IP address for an approximate location, time zone.
• Data about your use of the Services: frequency of use, areas and features of the Services that you access or use, payment transaction information (excluding full payment card details), or engagement with particular features.
• To collect this and other information, we may use cookies and other similar technologies.

How we use your personal data

Depending on which features of the Services you use, we will process your personal data based on one or more of the following legal bases: your consent, to fulfill our contractual obligations to you in order to provide the Services to you, our legitimate interest in managing and improving our Services, or to comply with a legal obligation.

We process your personal data for the following purposes:

• To support the existing functions of the App: This includes providing tailored content, insights, and materials you see when you use the App based on the data you provide. This involves improving and training our AI articulations for better analytic results, which helps convert emotional patterns into actionable insights. This also supports features like dream analysis and decision-making support.
  ◦ Legal Basis: Consent.
• To process transactions and send you related information for account management and other administrative purposes.
• To enhance Clinical Data Utilization: Collaborate with mental health professionals to use aggregated user data for clinical research and outcome studies, ultimately improving treatment methodologies and contributing to the advancement of mental health practices.
  ◦ Legal Basis: Contract.
• To respond to your comments, questions, requests, and to provide customer service.
  ◦ Legal Basis: Legitimate interest.
• To review App content, feedback, and complaints to ensure the effectiveness and user-centricity of the App. We are engaging with mental health professionals and educators to gather feedback for this purpose.
• To send you technical notices and updates, security alerts, support and administrative messages, and customer satisfaction surveys.
• To monitor and analyze trends, usage, and activities in connection with our App to identify and fix bugs, ensure genuine user interaction, and improve performance and reliability. This includes implementing user feedback for app updates and improvements.
• For promotional communications regarding our Services.

Principles of processing

Data minimization and purpose limitation: We will not process personal data in a way that is incompatible with the purposes for which it has been collected or authorized by you, or collect any personal data that is not needed for the mentioned purposes. No sale of personal data: We will not sell or rent your personal data for monetary gain. We will not disclose your personal data except as otherwise described in this Privacy Policy.

Your privacy rights

It does not matter what country, state, or region you come from; we are committed to providing you with individual privacy rights in accordance with the GDPR (General Data Protection Regulation) and any other applicable data protection laws and regulations.

You have the following rights:

• Correction of your personal data: If you believe that your personal data is inaccurate, you have the right to contact us and ask us to correct such personal data.
• Restriction of processing: You have the right to request that the processing of your personal data be restricted in some circumstances.
• Access to your personal data: You have the right to request information about what personal data we process about you, to access all your personal data, and to receive a copy of it, including in a structured and portable form.
• Right to data portability: You have the right to request your personal data in a portable form which enables you to move, copy, or transfer personal data from Beyond Mood Journal in a safe and secure way.
• Erasure of your personal data: You have the right to request that we erase your personal data at any time. Please be aware that erasing some personal data may affect your experience using certain features of the Services that rely on historical data.
• Objection to the processing of your personal data: You have the right to object to the processing of your personal data, for example, if we process it for direct marketing purposes.

How to exercise your privacy rights: Please email us at hello@beyondmood.com to exercise your privacy rights. We will address your request within one month after receipt. It can take us up to 90 days in some cases, for example, for full erasure of your personal data stored in our backup systems. We will let you know if we need more time and explain the reasons for the delay. We may require you to prove your identity to ensure the request is legitimate.

Third parties processing your personal data

We will not share your personal data with third parties except as specified within this Privacy Policy.

Promoting our Services:

With your consent, we may share some of your non-health personal data with third parties (like mobile marketing platforms similar to AppsFlyer) to promote the Services. This helps us reach you and people like you on various platforms and spread the word about Beyond Mood Journal.

Processing to make the App run:

We engage other companies to process your personal data on our behalf (“processors”). These processors help us run the Services, support our communication with you, or perform other App-related activities. They process certain personal data on our behalf to accomplish the goals related to the App functions and deliver the Services. We remain responsible for any acts or omissions of our processors, and we enter into data processing contracts with them to the extent required by applicable law.

Our core technology stack includes Flutter (Mobile), NestJS (Backend), Next.js (Web), Python (AI Agent), Prisma ORM, Firebase, Mongo, and Google Vertex AI. This implies the use of:

• Cloud Infrastructure and Security providers (e.g., similar to Amazon Web Services, Cloudflare) for storage of personal data and security of the App and content delivery.
• Authentication and Authorization services (e.g., similar to Auth0).
• Email communications services (e.g., similar to SendGrid) for newsletters, surveys, and notifications.
• Analytical tools (e.g., similar to Google LLC for Website/App usage data, Looker, Databricks) to understand how you use the App and engage with features.
• Customer support platforms (e.g., similar to Zendesk) to process emails and obtain feedback.
• AI Development Platforms (e.g., Google Vertex AI Agent Builder, Tecton) for AI model training, predictions, and App functionality, incurring fees for compute resources, agent memory usage, and model usage (e.g., Gemini models like Gemini 2.5 Flash). The Agent Development Kit (ADK) is used for designing agents and multi-agent systems in Python, optimized for Gemini and Vertex AI.
• Payment processing services (e.g., similar to Apple, Google, Stripe, PayPal) to collect and process payments for subscriptions.
• User onboarding and data integration services (e.g., similar to AppsFlyer).

Aggregated information:

We may aggregate, anonymize, or de-identify your personal data so that it cannot reasonably be used to identify you. We may share such data with third parties such as academic research institutions or mental health professionals or use the data for statistical purposes and clinical research. For example, we may share or use general age and demographic information and aggregate statistics about certain activities or symptoms from data collected to help identify patterns across users in articles, blog posts, and scientific publications, contributing to the advancement of scientific research on emotional health. For certain targeted academic or user research studies, we will contact you and rely on your consent.

Information posted by you:

The App may feature community areas (if implemented, similar to Flo’s Secret Chats or guided groups) where users can share information. Any information you share in any online community area or online discussion is by its nature open to the community. Please think carefully before posting anything that may identify you in any public forum.

Security of your personal data

We implement technical and organizational measures to protect personal data from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. This includes:

• Encryption of your personal data in transit and at rest.
• Systematic vulnerability scanning and penetration testing.
• Protection of data integrity.
• Organizational and legal measures, such as imposing strict responsibility on our employees for any disclosure, unauthorized access, alteration, destruction, or misuse of your personal data. Our employees have different levels of access to your personal data and only access it for limited and necessary purposes required for the operation of the Services.
• Conducting periodical data protection impact assessments to ensure the Services adhere to principles of privacy by design and privacy by default.

We encourage you to protect your password and not share it with others. You may also wish to add a passcode or enable face ID to access the App for an added layer of protection.

No security system is perfect, and therefore, we cannot guarantee the absolute security of the Services or that your information will not be intercepted while being transmitted to us.

Security breaches:

If we learn of a security systems breach, we may either post a notice or attempt to notify you by email and will take reasonable steps to remedy the breach as specified in applicable law and this Privacy Policy.

Children’s privacy

The Services are not intended for children, and we do not knowingly collect personal information from children under 16 years old through the Services. If you are aware of anyone under these age limits using the Services, please email us at sky@beyondmood.com, and we will take the required steps to delete such information and/or delete the child’s account.

Communication with you

We may contact you from time to time via email or through other means (like pop-ups or push notifications) to communicate with you about Services, offers, promotions, rewards, and events offered by us, and to provide news and information that we think will be of interest to you.

Opt-out options:

You can always opt out of receiving marketing emails by unsubscribing via the “Unsubscribe” link contained in the email. Opting out of these marketing emails or notifications will not end the transmission of service-related emails that are necessary to your use of the Services. You may also opt out of receiving push notifications by adjusting your settings in your device.

Storage and international personal data transfers

Beyond Mood Journal operates in multiple markets including Hong Kong, Canada, and the United Kingdom. Personal data we collect may be transferred to and processed in various countries where our service providers operate. These transfers are usually cloud-based and are subject to our retention policies. The laws of other countries may not offer the same protections as the laws of your jurisdiction.

When transferring personal data outside of the EEA and the UK, we will always apply appropriate safeguards in accordance with the law to ensure your personal data is protected. For example, we enter into data transfer agreements that incorporate the European Commission approved Standard Contractual Clauses and carry out transfer risk assessments.

Retention of your personal data

We will retain your personal data for as long as needed to provide you with the Services or otherwise fulfill the purposes for which it was collected.

Impact of account deactivation/requests to erase personal data:

At any time, you can deactivate your account. We will address your deletion request within one month after receipt. It will take us up to 90 days in some cases to complete full erasure of your personal data stored in our backup systems. If you choose to deactivate your account, Beyond Mood Journal will generally delete all your personal data, and it will not be recoverable should you later create another account.

Impact of App deletion or inactivity:

If you choose to delete the App from your device or your account becomes inactive, we will retain your personal data for a period of three years in case you decide to reactivate the Services or reinstall the App. After three years of inactivity, we will delete your personal information.

We may retain certain personal data and other information after your account has been terminated or deleted as required and permitted by applicable law, such as to comply with legal obligations, for the establishment, exercise, or defense of legal claims, and for archiving purposes in the public interest, scientific or historical research, or statistical purposes.

Contact us

If you have any questions or concerns about your privacy, you may contact us by emailing us at hello@beyondmood.com.