Our Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you create an account or use the Viaduco app, you may provide us with:

• Account information: Name, email address, date of birth, and gender.

• Mental health information: Interests or focus areas (such as stress, anxiety, or sleep), questionnaire responses (such as intake or screening questions), and any content you enter while using the app's mental health features.

• Communications: Messages you send to our support team or feedback you submit through the app.

1.2 Information Collected Automatically

When you use the app, we automatically collect:

• User ID: A unique identifier assigned to your account.

• Usage data: How you interact with the app, including features accessed, session duration, and navigation patterns.

• Device and technical data: Device type, operating system, app version, language settings, and general location (country or region level, not precise GPS location).

• Log data: Error reports, crash logs, and performance data used to maintain and improve the app.

1.3 Sensitive Personal Information

Under applicable privacy laws, certain information we collect — including your mental health focus areas and questionnaire responses — is classified as sensitive personal information. We treat all mental health-related data with heightened protections and only process it with your explicit consent or as otherwise permitted by law.

2. How We Use Your Information

We use your information for the following purposes:

• Providing the service: Delivering personalized, evidence-based mental health support, adapting recommendations and exercises to your needs, and maintaining your account.

• Improving the app: Analyzing aggregated, de-identified usage patterns to improve functionality, user experience, and the effectiveness of our tools.

• Communications: Sending you service-related messages, security alerts, and important updates about the app. We will not send marketing communications without your separate opt-in consent.

• Safety and security: Detecting, preventing, and responding to fraud, abuse, security incidents, or other harmful activity.

• Legal compliance: Meeting our obligations under applicable laws and regulations, and responding to lawful requests from authorities.

We do not use your information for advertising. We do not sell or rent your personal information to third parties. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you without your explicit consent.

3. Legal Bases for Processing (for EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data based on the following legal grounds:

• Consent: For processing sensitive personal information (mental health data), we rely on your explicit consent, which you provide when you create an account and complete intake questionnaires. You may withdraw consent at any time (see Section 7).

• Performance of a contract: To provide you with the services you have requested through the app.

• Legitimate interests: To improve and secure the app, provided these interests do not override your rights and freedoms.

• Legal obligation: To comply with applicable laws and regulations.

4. How We Share Your Information

We share your information only in the following limited circumstances:

• Service providers: We work with trusted third-party providers who assist us in operating the app (such as cloud infrastructure and analytics services). These providers are bound by contractual obligations to protect your data, process it only on our instructions, and not use it for their own purposes.

• Legal requirements: We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

• Business transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

• With your consent: We may share information for purposes not described in this policy if we have obtained your explicit consent.

We do not share your mental health data with employers, insurers, or data brokers under any circumstances.

5. Data Security

We implement robust technical, administrative, and physical safeguards to protect your personal data, including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.3.

• Encryption at rest: Sensitive personal information, including mental health data, is encrypted at rest using AES-256 encryption.

• Access controls: Access to personal data is restricted to authorized personnel on a need-to-know basis, with multi-factor authentication and role-based permissions.

• Monitoring and auditing: We maintain logging and monitoring systems to detect unauthorized access or anomalous activity.

• Incident response: We maintain an incident response plan and will notify you and applicable authorities of any data breach in accordance with legal requirements.

While we take every reasonable measure to protect your data, no system is completely secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security issues that arise.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

• Active accounts: We retain your data for as long as your account is active and you continue to use the app.

• After account deletion: When you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required by law to retain certain records (such as for tax, legal, or regulatory purposes), in which case retention will not exceed the legally required period.

• Anonymized data: We may retain fully anonymized, aggregated data indefinitely for research and product improvement purposes. This data cannot be used to identify you.

7. Your Rights

Depending on your location, you may have some or all of the following rights regarding your personal data:

7.1 Rights Under GDPR (EEA/UK Users)

• Access: Request a copy of the personal data we hold about you.

• Rectification: Request correction of inaccurate or incomplete data.

• Erasure ("Right to be Forgotten"): Request deletion of your personal data.

• Restriction: Request that we limit how we process your data.

• Data portability: Receive your data in a structured, commonly used, machine-readable format.

• Objection: Object to processing based on legitimate interests.

• Withdraw consent: Withdraw your consent to processing at any time, without affecting the lawfulness of processing that occurred before withdrawal.

• Lodge a complaint: File a complaint with your local data protection authority.

7.2 Rights Under CCPA/CPRA (California Residents)

• Right to Know: Request details about the categories and specific pieces of personal information we have collected about you.

• Right to Delete: Request deletion of your personal information.

• Right to Correct: Request correction of inaccurate personal information.

• Right to Limit Use of Sensitive Personal Information: Direct us to limit the use and disclosure of your sensitive personal information (including mental health data) to what is necessary to provide the service.

• Right to Opt-Out: Opt out of the sale or sharing of your personal information. Note: We do not sell or share your personal information for cross-context behavioral advertising.

• Right to Non-Discrimination: You will not be discriminated against for exercising your privacy rights. We will not deny you services, charge different prices, or provide a different quality of service because you exercised your rights.

7.3 How to Exercise Your Rights

To exercise any of these rights, contact us at support@viadu.co. We will respond to your request within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request.

8. International Data Transfers

If you are located outside the United States, your data will be transferred to and processed in the United States, where our servers are located. When we transfer data internationally, we use appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, to ensure your data receives an adequate level of protection.

9. Children's Privacy

Viaduco is not intended for children under the age of 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children below these ages. If we become aware that we have collected data from a child without appropriate parental consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at support@viadu.co.

10. Cookies and Analytics

Viaduco may use analytics tools and local storage mechanisms (similar to cookies) to understand how the app is used and improve performance. These tools collect technical and usage data as described in Section 1.2 and do not collect additional personally identifiable information. You can manage your device's storage settings through your device's operating system.

11. Third-Party Links

The app may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services before providing them with your information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will revise the "Last Updated" date at the top of this page. If we make material changes that affect how we handle your sensitive personal information, we will notify you through the app or via email before the changes take effect, giving you an opportunity to review the updated policy.

13. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:

Engly Inc.

Email: support@viadu.co

Address: 2261 Market Street, STE 22533, San Francisco, CA 94114, USA

For EEA/UK users, if you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

14. Summary of Key Commitments

• We never sell your personal data.

• We never share your mental health data with employers, insurers, or data brokers.

• We never use your data for advertising.

• We encrypt your data in transit and at rest.

• We delete your data within 30 days of account deletion.

• We respect your rights to access, correct, delete, and port your data.

• We will notify you of any material changes to this policy before they take effect..