1. Data controller
Alarmia acts as the data controller for personal data collected through the App. We are committed to protecting your data in accordance with applicable data protection regulations including GDPR and CCPA.
2. Legal basis for processing
We process your data based on: a) Consent — when you create an account and agree to our terms b) Legitimate Interest — to improve app functionality and user experience c) Contractual Necessity — to provide the services you requested
3. Data minimization and purpose limitation
We limit processing to data needed for the features you choose. Alarm configurations and accessibility preferences can remain in local browser storage. Signed-in social, notification, accountability, and safety features require related records on our servers. Live-location coordinates are accepted only for an active authorized tracking session, and authorized recipients receive only the incident information needed for that relationship. Browser and device permissions remain under your control.
4. Data security measures
We implement the following security measures: a) Encryption in transit (TLS 1.3) b) Encryption at rest for stored data c) Row-level security policies ensuring users can only access their own data d) Regular security audits e) Secure authentication with hashed passwords
5. Data retention
We retain account data while your account is active and keep operational records only as long as needed for service delivery, security, dispute handling, and legal obligations. Safety incidents include expiry and review states so recipients can identify missed alerts; location tracking stops when the session stops or the incident expires or is resolved. Local preferences remain in a browser until you clear site data. Valid account-deletion requests are completed within 30 days unless limited records must be retained by law or for security.
6. Relationship and care-data boundaries
Capability grants identify the data owner, the recipient, the allowed capability, and revocation state. Care-summary access excludes free-text wellness notes; medication, mood, notes, and other detailed care records require separate detailed-care consent. We retain invitation, revocation, block, and audit records only for service integrity, abuse prevention, disputes, and legal obligations, then delete or de-identify them under the applicable retention schedule.
7. International data transfers
Your data may be processed in data centers located in various regions. We ensure adequate data protection measures are in place for all international transfers, including standard contractual clauses where required.
8. Your GDPR rights
If you are in the EU/EEA, you have the right to: a) Access your data b) Rectification of inaccurate data c) Erasure ("right to be forgotten") d) Restrict processing e) Data portability f) Object to processing g) Lodge a complaint with a supervisory authority
9. Data breach notification
In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users within 72 hours and report to the relevant supervisory authority as required by law.
10. Data protection officer
For data protection inquiries, contact our DPO at dpo@alarmia.app.