Privacy Policy

Effective Date: 6th May 2026 · Last Updated: 6th May 2026

This Privacy Policy explains how Kaya AI B.V. ("Kaya", "we", "our", or "us") collects, uses, stores, protects, and shares information when you use the Kaya Health mobile application, website, and related services (collectively, the "Services").

Kaya is a personalised women's health and wellness platform focused on supporting users across areas including skin health, hair and scalp health, nutrition, wellbeing, and perimenopause.

Kaya allows users to track symptoms, upload photos, log routines, speak or write notes, monitor patterns over time, and receive AI-assisted wellness insights and recommendations.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Important Health Disclaimer

Kaya is not a medical provider and does not provide medical diagnosis, emergency care, or treatment.

The Services are designed for informational, educational, wellness, lifestyle, and self-management support purposes only.

Any insights, summaries, recommendations, pattern analysis, or AI-generated outputs provided through Kaya:

• are not medical advice;
• are not intended to diagnose, treat, cure, or prevent disease;
• should not replace consultation with qualified healthcare professionals; and
• should not be relied upon in emergencies.

Users should always seek professional medical advice regarding health concerns.

If you believe you may be experiencing a medical emergency, contact emergency services immediately.

2. Company Information

Kaya AI B.V.
Joop Geesinkweg 601, 1114AB Amsterdam-Duivendrecht
The Netherlands
Email: privacy@mykaya.ai
Website: https://mykaya.ai

For purposes of applicable privacy laws, including the General Data Protection Regulation ("GDPR"), Kaya AI B.V. acts as the Data Controller for personal information processed through the Services.

3. Information We Collect

Because Kaya supports highly personalised wellness experiences, we may collect various categories of information depending on how you use the platform.

3.1 Account Information

When you create an account, we may collect:

• Name or display name
• Email address
• Phone number
• Date of birth or age range
• Country or region
• Login credentials
• Profile information

If you purchase a subscription or paid feature, we may also receive limited transaction and subscription-related information, including:

• Subscription status
• Billing plan
• Purchase confirmations
• Renewal dates
• Payment provider transaction references

Payment processing is handled by third-party payment providers such as Apple App Store, Google Play, Stripe, or similar providers. Kaya does not store full payment card information.

3.2 Health, Wellness, and Lifestyle Information

Users may voluntarily provide sensitive health and wellness information, including:

Skin and Hair Information

• Skin concerns and symptoms
• Acne, irritation, pigmentation, dryness, or inflammation logs
• Hair and scalp concerns
• Hair shedding or thinning information
• Product usage and routines
• Skin and hair photos
• Progress tracking photos

Perimenopause and Hormonal Information

• Menstrual or cycle-related information
• Perimenopause symptoms
• Mood and emotional wellbeing logs
• Sleep information
• Energy levels
• Weight fluctuations
• Hot flashes or hormonal symptoms

Nutrition and Lifestyle Information

• Food logs and dietary habits
• Nutritional preferences
• Allergies or intolerances
• Digestive symptoms
• Exercise and lifestyle information
• Wellness goals
• Habit tracking information

General User Inputs

• Voice notes or audio submissions
• Written notes and journal entries
• Uploaded files or images
• Symptom tracking entries
• User feedback and responses

Providing this information is generally optional, but certain features may not function without it.

3.3 AI-Generated Information

As users interact with Kaya, the platform may generate:

• Wellness summaries
• Pattern analysis
• Personalised recommendations
• Habit suggestions
• Nutrition-related insights
• Skin or hair trend observations
• Organised summaries of user-provided information

These outputs are generated automatically using AI systems and may not always be accurate, complete, or appropriate.

3.4 Technical and Usage Information

We may automatically collect:

• Device type and operating system
• App version
• IP address
• Browser information
• Usage activity within the app
• Session information
• Error and crash reports
• Analytics and performance information
• Diagnostic logs

4. How We Collect Information

We collect information:

• Directly from users;
• Through app interactions and logs;
• Through uploaded content and photos;
• Through voice and text submissions;
• Through analytics and device technologies; and
• Through optional integrations or connected services where applicable.

5. How We Use Information

We use information for the following purposes.

5.1 Providing and Operating the Services

Including:

• Creating and managing accounts
• Delivering app functionality
• Supporting symptom and wellness tracking
• Generating personalised wellness insights
• Supporting progress monitoring over time
• Organising user-provided information
• Improving the user experience
• Managing subscriptions and paid features
• Processing purchases and billing-related operations
• Providing customer support

5.2 AI and Personalisation

Kaya uses artificial intelligence and machine learning systems to analyse information users provide.

This may include:

• Analysing text entries and wellness logs
• Analysing uploaded images
• Identifying patterns over time
• Generating personalised suggestions
• Summarising user activity
• Tailoring recommendations and experiences

AI-generated outputs are probabilistic in nature and may occasionally produce inaccurate, incomplete, or unsuitable responses.

Users should not make important health decisions solely based on AI-generated information.

5.3 Improving Kaya

We may use information to:

• Improve platform functionality
• Improve AI performance and safety
• Develop new features
• Conduct analytics and research
• Improve personalisation systems
• Understand aggregate user behaviour and trends

Where possible, we use anonymised, aggregated, or pseudonymised data.

Where legally required, we will seek additional consent before using sensitive information for model training or research purposes.

5.4 Security, Fraud Prevention, and Compliance

We may use information to:

• Protect platform security
• Prevent abuse or misuse
• Detect suspicious activity
• Enforce legal rights
• Comply with legal obligations
• Maintain platform integrity

6. Legal Basis for Processing

Where GDPR or similar laws apply, we process information based on one or more of the following legal grounds:

• User consent
• Performance of a contract
• Legitimate interests
• Compliance with legal obligations
• Explicit consent for sensitive health-related information where required

Users may withdraw consent at any time, subject to certain legal or operational limitations.

7. How We Share Information

We do not sell personal information.

We may share information only in limited circumstances.

7.1 Service Providers

We may share information with trusted third-party providers who support the operation of the Services, including providers of:

• Cloud hosting
• Analytics
• Authentication
• AI infrastructure
• Data storage
• Customer support
• Security monitoring
• Communications infrastructure
• Subscription billing and payment processing

These providers are contractually required to protect information and process it only for authorised purposes.

7.2 Legal and Regulatory Requirements

We may disclose information where required to:

• Comply with law or regulation
• Respond to lawful requests
• Protect users or the public
• Enforce our agreements
• Protect Kaya's rights, systems, or security

7.3 Business Transfers

If Kaya undergoes a merger, acquisition, financing, restructuring, or sale of assets, information may be transferred as part of that transaction, subject to applicable confidentiality and legal safeguards.

8. International Data Transfers

Kaya may store or process information in countries outside your own.

Where required by law, we implement appropriate safeguards for international transfers, including:

• Standard Contractual Clauses;
• Data Processing Agreements; and
• Appropriate technical and organisational protections.

9. Data Retention

We retain information only for as long as reasonably necessary to:

• Provide the Services;
• Maintain user accounts;
• Comply with legal obligations;
• Resolve disputes;
• Protect platform security; and
• Improve user experiences and functionality.

Users may delete their account and associated information directly within the app through available account settings.

Where a deletion request is submitted through the app or directly to us, we will take reasonable steps to delete or anonymise the associated personal information within a reasonable timeframe, subject to legal, regulatory, security, fraud prevention, backup retention, or operational obligations.

Certain limited information may be retained where required by law, necessary to protect platform integrity or security, resolve disputes, enforce agreements, or comply with legitimate business and regulatory obligations.

When information is no longer required, we delete, anonymise, or securely archive it.

10. Security

We implement reasonable technical, organisational, and administrative safeguards designed to help protect information against unauthorised access, misuse, loss, disclosure, or alteration.

These measures may include:

• Encryption in transit and at rest
• Secure infrastructure providers
• Access controls and authentication
• Monitoring and logging systems
• Internal access restrictions
• Security testing and monitoring

While no platform or transmission method can guarantee absolute security, we take user privacy and security seriously and aim to respond promptly to legitimate security or privacy concerns raised by users.

If you believe your information has been compromised, accessed improperly, or requires urgent attention, you should contact us immediately at privacy@mykaya.ai.

11. User Rights

Depending on applicable law, users may have rights to:

• Access personal information
• Correct inaccurate information
• Delete information
• Restrict or object to processing
• Withdraw consent
• Request portability of information
• Lodge complaints with regulators

Users may manage certain information directly within the app, including deleting their account and associated data.

Where users contact us with privacy-related requests, we will make reasonable efforts to respond and assist within a reasonable timeframe, subject to applicable laws, technical limitations, security requirements, fraud prevention obligations, and legitimate operational needs.

Requests may be submitted to: privacy@mykaya.ai

We may request identity verification before processing certain requests.

12. Children's Privacy

Kaya is not intended for children under the age required by applicable law in the user's jurisdiction.

We do not knowingly collect personal information from children without appropriate consent where required.

If we become aware that we have collected information from a child unlawfully, we will take steps to delete it.

13. Cookies, Analytics, and Tracking Technologies

Kaya may use cookies, SDKs, analytics tools, and similar technologies to:

• Maintain app functionality
• Analyse usage patterns
• Improve performance
• Personalise experiences
• Detect technical issues
• Support security and fraud prevention

Users may manage certain tracking permissions through device settings.

14. Third-Party Services

The Services may integrate with third-party platforms or providers.

These may include:

• Analytics providers
• Cloud infrastructure providers
• Authentication providers
• AI service providers
• Communication services

Third-party services may have their own privacy policies and practices.

15. Research, Analytics, and Product Development

Kaya may conduct internal research and analytics to improve the platform and better understand wellness patterns and user experiences.

Where possible, research activities use anonymised or aggregated data.

Where legally required, explicit consent will be obtained before sensitive information is used for research or AI model improvement purposes.

16. Automated Processing

Kaya uses automated systems and AI-assisted technologies to generate certain outputs and recommendations.

Users acknowledge that:

• AI outputs may contain errors or inaccuracies;
• outputs should be independently evaluated by users;
• the Services are intended for informational and wellness support purposes only.

17. Changes to This Privacy Policy

We may update this Privacy Policy periodically.

When material changes are made, we may notify users through:

• the app;
• email; or
• our website.

Continued use of the Services after updates become effective constitutes acceptance of the revised Privacy Policy.

18. Contact Us

For questions, privacy requests, or complaints, contact:

Kaya AI B.V.
Email: privacy@mykaya.ai
Website: https://mykaya.ai

19. Region-Specific Rights

European Economic Area (EEA), United Kingdom, and Switzerland

Users in these regions may have additional rights under GDPR and related laws.

United States

Certain U.S. states may provide additional privacy rights under applicable consumer privacy laws.

20. Consent

By creating an account, uploading information, or using the Services, users acknowledge and consent to the collection, processing, and use of information as described in this Privacy Policy.

Where required by law, additional consent mechanisms may be presented for specific activities involving sensitive information.