Privacy policy

We respect your privacy and are committed to protecting it through compliance with this privacy policy (“Policy”). This Policy describes the categories of Personal Data we collect through the NatureQuant mobile application and related Services, why we collect it, the legal bases for processing under the EU General Data Protection Regulation (GDPR), your rights, how long we keep data, how we protect it, and how to contact us.

Controller and contact details

• Data controller: NatureQuant, LLC (doing business as NatureQuant).
• Contact email: info@naturequant.com.
• Data protection officer or privacy contact: For questions about this Policy or to exercise your rights, contact info@naturequant.com.

Scope and applicability

This Policy applies to Personal Data collected through the NatureQuant mobile application and any related products and services (collectively, “Services”). If you are acting on behalf of a business or other legal entity you confirm you have authority to bind that entity. This Policy does not apply to third-party sites, services, or apps that we do not own or control.

Categories of Personal Data we collect

• Account and identity data: username, password.
• Contact data: email address.
• Device and technical data: IP address, device model, operating system and version, language settings, device identifiers.
• Location data: geolocation (latitude/longitude) where explicitly enabled by the user.
• Motion and Fitness data: physical activity and movement when explicitly enabled by the user.
• Usage and analytics data: access times, pages/screens used, searches and queries within the app, features used, crash logs, cookies and similar technologies.
• Content and user-provided data: Cohort code for a study, nature prescription, or partner program.

We do not collect special categories of personal data (sensitive data).

Legal bases for processing (GDPR)

We process Personal Data on one or more of the following lawful bases, as applicable to the processing activity:

• Performance of a contract: to create and manage your account and provide Services you request.
• Consent: where you have given clear, informed consent. You may withdraw consent at any time without affecting the lawfulness of processing already carried out.
• Legitimate interests: to operate, secure, and improve the Services, detect and prevent fraud and abuse, and protect rights and property, provided such legitimate interests are not overridden by your fundamental rights and freedoms. We document and balance legitimate interest use cases.
• Legal obligation: where we must process data to comply with applicable law.
• Vital interests/public interest: in exceptional circumstances where necessary to protect life or carry out tasks in the public interest.

Purposes of Processing

We use Personal Data for the following purposes:

• To create and manage user accounts and authenticate users.
• To provide, operate, maintain, and improve the Services.
• To deliver features and communicate with you about the Services.
• To send service-related notices, security alerts, and administrative messages.
• To provide personalized features and, where you consent, personalized notifications.
• To perform analytics, usage monitoring, performance measurement, and product development.
• To comply with legal obligations, resolve disputes, enforce agreements, and protect rights, property, or safety.
• To administer promotions, prize draws, or surveys when you opt in.

Cookies, tracking and analytics

We and our authorized service providers use cookies and similar technologies for essential functionality, analytics, performance, and, where permitted, marketing. You will be given the opportunity to accept or decline non-essential cookies where required by law. You can manage cookie and tracking preferences via device or browser settings as well as in-app controls.

Sharing and recipients of Personal Data

We share Personal Data only as necessary for the purposes described and as permitted by law:

• Service Providers, research partners, program partners, and subprocessors: hosting, analytics, push notifications, and email delivery, with vendors who perform services for us and act under contract and instructions. Research partners who have obtained explicit consent to receive data.
• Legal and safety disclosures: where required by law, legal process, or to protect rights, safety, or property.
• Business transfers: in connection with a merger, sale, reorganization, or acquisition; in such event we will require the acquirer to honor the terms of this Policy.

We do not sell or share Personal Data for monetary consideration. We require third-party processors to implement appropriate safeguards and to process data only on our documented instructions.

International transfers and safeguards

Personal Data may be transferred to and processed in countries outside the EEA. Where transfers occur, we put in place appropriate safeguards such as EU Standard Contractual Clauses (SCCs), rely on an adequacy decision where applicable, or obtain your explicit consent where required. To request information about the safeguards that apply to a specific transfer, contact info@naturequant.com.

Data retention

We retain Personal Data only as long as necessary for the purposes stated in this Policy and to comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data category and purpose; examples:

• Account data: retained for the life of the account plus a limited period after account closure to comply with legal obligations and for fraud prevention.
• Analytics and aggregated data: retained in anonymized or aggregated form, which may be retained indefinitely.

You may request specific retention details or request deletion in accordance with your rights below.

Your rights under GDPR

If you are in the European Economic Area (EEA) or the UK, you have the following rights with respect to your Personal Data, subject to legal limitations:

• Right to access: obtain confirmation whether we process your Personal Data and receive a copy of that data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure (right to be forgotten): request deletion of Personal Data where there is no overriding reason to retain it.
• Right to restriction of processing: request restriction of processing in certain circumstances.
• Right to data portability: receive your Personal Data in a structured, commonly used, machine-readable format and transmit it to another controller where applicable.
• Right to object: object to processing carried out on the basis of legitimate interests or for direct marketing.
• Right to withdraw consent: where processing is based on consent, withdraw consent at any time without affecting processing done before withdrawal.
• Right not to be subject to automated individual decision-making: request human intervention if automated decisions produce legal or similarly significant effects, unless otherwise permitted by law.

To exercise these rights, contact info@naturequant.com. We will verify your identity before responding and will respond within the timeframes required by applicable law. You also have the right to lodge a complaint with your local supervisory authority.

Processing for children

Where applicable law requires parental consent for minors, we will obtain verifiable parental consent before collecting Personal Data from children below the applicable age (commonly 16, unless lower national ages apply). We do not knowingly collect more Personal Data from children than necessary. Parents and guardians may review, delete, or request the removal of their child’s data by contacting info@naturequant.com.

Security measures

We implement reasonable technical, administrative, and physical safeguards designed to protect Personal Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include access controls, encryption where appropriate, regular security assessments, and contractual security requirements for processors. No method of transmission or storage is 100% secure. You should protect your account credentials and device.

Data breach notification

If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify affected individuals and the relevant supervisory authority in accordance with GDPR timeframes unless a legal exception applies.

Automated decision-making and profiling

We may use aggregated analytics and automated processing to improve the Service. We do not perform automated decision-making that produces legal or similarly significant effects about you without offering appropriate safeguards, including the ability to obtain human review, express your point of view, and contest the decision, where required by law.

Data protection impact assessments and safeguards

For high-risk processing activities, we carry out Data Protection Impact Assessments (DPIAs) and implement risk-reduction measures where required by GDPR.

Third-party links and social features

Our Services may contain links to third-party sites. This Policy does not cover third-party practices. Review their privacy policies before providing Personal Data.

Changes to this Policy

We may update this Policy to reflect changes in our practices or legal requirements. We will post the updated Policy with the revised “last updated” date. Where a change is material and required by law, we will notify you and, if necessary, obtain your consent.

How to exercise rights, complaints, or ask questions

Contact: info@naturequant.com.

You may also lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or where an alleged infringement occurred.

Additional information for California residents

California residents have additional rights under the California Consumer Privacy Act (CCPA) and related laws. See the “California privacy rights” section below for details and how to request information or deletion.

California privacy rights

California residents may request (once per 12 months) the categories and specific pieces of Personal Data we have collected, the sources, purposes of processing, categories of third parties with whom we shared data, and deletion of Personal Data subject to exemptions. To make a request, contact info@naturequant.com. We will verify your identity before responding.