Privacy Policy

1. Who We Are

Oku is a mental health companion app operated by Oku ("we", "us", "our"). Our marketing website is located at https://okuwellness.com. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, join our waitlist, or use the Oku app.

For enquiries about this policy, contact us at: privacy@okuwellness.com.

2. What Data We Collect

3. How We Use Your Data

• To provide, maintain, and improve the Oku app and its features
• To send you early access updates and product announcements (waitlist only)
• To personalise your experience, including AI companion responses and mood insights
• To generate anonymised, aggregated insights to improve our services
• To moderate community content and maintain a safe environment
• To comply with legal obligations, including UK GDPR and the Data Protection Act 2018
• To detect, prevent, and address technical issues or abuse

4. Legal Basis for Processing

We process your data under the following lawful bases as defined by UK GDPR:

• Consent: When you join our waitlist, opt in to analytics, or grant access to HealthKit/Health Connect data. You may withdraw consent at any time.
• Contract: When processing is necessary to provide you with the Oku app and its services.
• Legitimate interests: For improving our services, ensuring security, and preventing abuse, where these interests do not override your rights.
• Legal obligation: Where we are required to process data to comply with applicable law.

5. Health & Sensitive Data

Oku processes special category data including mood logs, medication information, mental health journal entries, and AI companion conversations. This data is processed under Article 9(2)(a) of UK GDPR on the basis of your explicit consent, which you provide when creating an account and using these features.

We treat all health and wellbeing data with the highest level of care. AI companion conversations are encrypted and are not read by any human. We do not sell, share, or use your health data for advertising purposes.

6. Data Sharing & Third Parties

We do not sell your personal data. We may share data with the following categories of third parties, only as necessary:

• Hosting providers: For secure storage and delivery of the app and website (e.g. Vercel, cloud infrastructure providers)
• Analytics providers: For anonymised usage analytics to improve our services
• AI service providers: To power the AI companion feature. Conversations are processed in accordance with strict data processing agreements. No third-party AI provider retains your conversations.
• Moderation tools: To help maintain community safety
• Legal authorities: Where required by law, regulation, or valid legal process

All third-party processors are bound by data processing agreements that require them to handle your data securely and only for the purposes we specify.

7. Cookies

Our marketing website uses cookies and similar technologies. These include:

• Strictly necessary cookies: Required for the website to function (e.g. security, load balancing)
• Analytics cookies: To understand how visitors use our site (e.g. page views, traffic sources). These are only set with your consent.

You can manage your cookie preferences through your browser settings. For more information, see our Cookie Banner on first visit.

8. Data Retention

We retain your data for as long as necessary to provide our services and fulfil the purposes described in this policy:

• Waitlist emails: Retained until you unsubscribe or the waitlist is closed
• Account and app data: Retained for the duration of your account. Upon account deletion, your data will be permanently deleted within 30 days, except where retention is required by law.
• AI companion conversations: Encrypted at rest and deleted upon account deletion. Not retained by third-party AI providers.
• Analytics data: Retained in anonymised form for up to 26 months

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS) and at rest
• Access controls limiting who can view personal data
• Regular security assessments and monitoring
• Secure development practices

While we take all reasonable steps to protect your data, no method of electronic storage or transmission is 100% secure.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@okuwellness.com. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your rights have been infringed.

11. International Transfers

Your data may be processed outside the UK where our service providers are located. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO or adequacy decisions, to protect your data in accordance with UK GDPR.

12. Children

Oku is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without appropriate parental consent, we will take steps to delete that data promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where applicable, by email. The date at the top of this policy indicates when it was last updated.

14. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us at:

Email: privacy@okuwellness.com