This document is the English translation of the Ukrainian Privacy Policy. In the event of any discrepancy between the two language versions, the Ukrainian version prevails.
1. Who processes your data
The data controller is Limited Liability Company «Koba Korp» (registration number 45669702), address: Ukraine, 33023, Rivne region, Rivne district, city of Rivne (the «Company», «we»).
For any question about the processing of personal data: au.oc.abok%40troppus
2. What this Policy covers
This Policy applies to:
— the koba.co.ua website and its language versions;
— the Vatra mobile application for iOS and Android.
This Policy does not apply to third-party services you may reach through links on our website or in the Application.
3. What data we process
3.1 Website
Contact form. Full name, phone number, email address, message text.
Alongside this we record the fact that consent to data processing was given and the time it was given. This is not a form field but a technical record that allows us to demonstrate that consent exists, should such proof be required.
Protection against automated submissions. To verify that the form is being completed by a person, we use Cloudflare Turnstile, which processes your IP address and technical characteristics of your browser.
Analytics. We use Google Analytics 4 to understand how visitors use the website: page views, referral source, device type, approximate location at city level, truncated IP address. Analytics is enabled only after you give consent in the cookie banner.
3.2 Application
Account data. Email address and nickname. If you sign in with Apple or Google, we receive an identifier and email address from them; we have no access to your Apple or Google account password.
Wellbeing and health data. Depending on which features you use: pain level, existing injuries and mobility limitations, sleep quality, anxiety level, answers to questionnaires about emotional state and symptoms associated with psychological trauma, weight, cognitive test results, completed sessions and progress.
This data belongs to a special category of personal data (Article 9 GDPR). We process it solely on the basis of your separate explicit consent, which you give before entering such data for the first time and which you may withdraw at any time in the Application settings.
Data from wearable devices. If you separately grant access to Apple Health or Google Fit, we can read the metrics you select, for example activity or sleep. Access can be revoked in your device settings at any time. This feature is optional.
Technical data. Device model, operating system version, Application version, interface language, crash and error data.
3.3 What we do not collect
We do not ask about military or veteran status, unit name, or the circumstances of an injury. We do not collect photos, video or voice recordings. We do not collect payment card data — payment is handled entirely by the App Store and Google Play.
4. The legal grounds we rely on
— Contact form. Purpose: replying to your enquiry. Grounds: your consent and our legitimate interest in communication.
— Account data. Purpose: creating an account, signing in, support. Grounds: performance of our agreement with you.
— Health data. Purpose: building and adapting your personal programme. Grounds: separate explicit consent, Article 9(2)(a) GDPR.
— Technical and crash data. Purpose: the Application's functioning and stability. Grounds: legitimate interest.
— Website analytics. Purpose: understanding the website's effectiveness. Grounds: your consent.
— Anonymised statistics. Purpose: improving our methodology and product. Once anonymised, such data is no longer personal data.
If you do not consent to the processing of health data, you can still use the Application, but without a personalised programme.
5. Who we share data with
We do not sell personal data and do not share it for advertising purposes. Data is processed only by service providers necessary for the product to work:
— Supabase: database and authentication. European Union.
— DigitalOcean: server infrastructure. European Union.
— Cloudflare: website hosting and bot protection. Global network, processed at the nearest node.
— Google Analytics: website analytics. Google Ireland and the United States.
— Apple and Google: account sign-in, payment processing, application delivery. Under their own policies.
In addition to the above, we use email delivery and team notification services. They process only what you send us yourself, through the form or by email.
Specifically about form submissions. So that our team can respond quickly, the content of your enquiry together with your name, phone number and email address is duplicated into our internal Telegram chat. This means the data passes through Telegram's servers and is subject to Telegram's privacy policy. If you would prefer to avoid this, write to us directly at .au.oc.abok%40troppus
Artificial intelligence. As at the date of this version, the AI consultant feature is not operational. When we launch it, we will update this Policy and notify you of the change before you are able to use the feature. We undertake not to pass your health data to third-party model providers for the training of their systems.
We may also disclose data at the request of competent state authorities where such a request is lawful and properly issued.
6. Where data is stored
Primary storage is in data centres located within the European Union. We do not transfer data to countries outside Ukraine and the EU, except as necessary for the operation of the services listed above. Some of those providers are companies based in the United States: in such cases, transfers take place on the basis of the European Commission's standard contractual clauses and the corresponding data processing agreements.
7. How long we keep data
— Account data and health data: until the account is deleted.
— After account deletion: destroyed within 24 hours.
— Backups: 7 days, after which they are overwritten.
— Contact form enquiries: 24 months. If the correspondence develops into a contractual relationship, the retention period is determined by that relationship.
— Anonymised statistics: indefinitely, in a form that does not allow you to be identified.
Anonymisation means the irreversible removal of all identifiers: afterwards, the data cannot be linked back to you, including by us.
8. Deleting your account
You can delete your account:
— in the Application: Profile → Settings → Privacy → Delete account;
— through the contact form on our website (https://koba.co.ua/en/#contacts), without signing in to the Application;
— by writing to .au.oc.abok%40troppus
Deleting the account also deletes all health data, session history and test results. Anonymised usage statistics are retained.
9. Your rights
You have the right to:
— find out what data of yours we process and receive a copy of it;
— have inaccurate data corrected;
— have your data erased, that is, exercise the right to be forgotten;
— restrict processing;
— receive your data in a machine-readable format and transfer it to another service;
— object to processing based on legitimate interest;
— withdraw consent at any time, which does not affect the lawfulness of processing carried out before withdrawal;
— not be subject to decisions taken solely by automated means that have a significant effect on you.
To exercise these rights, write to .au.oc.abok%40troppus We respond within 30 days. We may ask you to confirm your identity so that we do not disclose your data to someone else.
Complaints. If you believe we have infringed your rights, you may contact the Ukrainian Parliament Commissioner for Human Rights, or, if you are located in the EU, the data protection supervisory authority of your country.
10. Age of users
The Application is intended for persons aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a child has created an account, write to us and we will delete the data.
11. Security
Data is transmitted over an encrypted connection. Access to user data is limited to those team members who need it for their work. We maintain access records and update our infrastructure regularly.
No system is completely secure. In the event of a breach posing a high risk to your rights, we will notify you and the supervisory authority within 72 hours of becoming aware of it.
12. Cookies
The website uses:
— necessary cookies: for bot protection and to remember your chosen language. These operate without consent, as the website does not function without them.
— analytics cookies: Google Analytics. These are enabled only after you give consent.
You can change your choice at any time via the «Cookie settings» link at the bottom of the website.
13. Changes to this Policy
We may update this Policy. The effective date and version number are shown at the top. We will give notice of material changes — in particular the appearance of new categories of data or new providers — in the Application or by email before those changes take effect.
14. Contact details
Limited Liability Company «Koba Korp»
Registration number (ЄДРПОУ): 45669702
Ukraine, 33023, Rivne region, Rivne district, city of Rivne
Email: au.oc.abok%40troppus
Website: koba.co.ua