Privacy Policy

1. Who we are

Upstanding is an app and website run by SoMa Inc., a company registered in the Republic of Korea, at Yiseong Bldg., 298, Dongho-ro, Jung-gu, Seoul 04617, Republic of Korea ("we", "us", "our"). We decide how your personal information is used and are responsible for it as described in this policy.

This policy covers the Upstanding mobile apps, this website, and any support you get from us (together, the "Service").

2. What we collect

We don't collect your precise location, your contacts, or audio. The app doesn't use your microphone, and form check clips are kept without sound. We don't use face recognition, and we don't create a face template from your photos. The app has no analytics, advertising or crash-reporting tools.

Body points found on your phone

To measure your posture and place the face blur, the app finds body points in your photos on your phone: with Apple's Vision framework on iPhone and Google's ML Kit pose detection on Android. Your photos aren't sent anywhere for this step. On Android, the ML Kit software may send Google technical information about how it runs, such as device model, operating system, app version and performance data, so Google can maintain and improve ML Kit and detect misuse. It doesn't send your photos or your body points.

3. How we use it

• To run the checks you ask for: create reports, scores and Fix Plans, and show your progress over time.
• To keep your plan safe: if you answer yes to a safety question, we leave harder and balance-heavy moves out of your plan and remind you to check with your doctor.
• To run your account: sign-in, subscription, check-in balance, purchase checks, and limiting the free first scan to one per person.
• To keep the Service safe and working: security, fixing bugs, preventing fraud and abuse, and tracking the processing cost of each check.
• To talk to you: service messages, reminders you turn on, subscription reminders, and notices about changes to our terms or policies.
• To help you when you contact support.
• To follow the law and protect our rights and the rights of others.

We don't use your photos, clips, meal photos or reports to train AI models, and we don't use them for advertising. If we ever want to use your content for anything beyond providing the Service to you, we'll ask for your separate permission first.

4. How your reports are made

When you run a check, we send the content that check needs to the Gemini API, an artificial intelligence (AI) service run by Google LLC. It looks at your photos, clips or meal photos together with the profile details that matter for that check (such as your goal, height, weight, age range and equipment) and any measurements from your phone, and sends back written findings. Our own software then turns those findings into your score, so the same input always gives the same score.

• Only what's needed. We send only the content for the check you started. We don't include your name or email address. We don't send your safety answers either: if any of them was yes, we only say that, so the advice stays gentle.
• What Google does with it. Google processes it to send the result back to us, under Google's terms for paid API customers. Under those terms Google does not use it to improve its products or train its models. Google may keep it for a limited time to detect abuse, as its terms allow.
• No person reviews your report. Not a trainer, not a clinician. Reports can be wrong, and estimates are labelled as estimates.
• We ask first. Before your first check, the app asks for your clear permission to process your content this way. You can withdraw it at any time in the app (You → Privacy → Data & processing consent). Without it we can't run checks, but you can still see your past reports, download your data, or delete it.

5. Who we share it with

We use a small number of service providers. They may use your information only to provide their service to us, under contracts that require them to protect it.

Apple and Google handle in-app purchases, subscriptions and (if you choose them) Sign in with Apple and Google sign-in. They act under their own privacy policies. We receive only what we need, such as purchase status and a sign-in ID.

We may also share information:

• when the law requires it, for example a valid court order;
• to protect the safety, rights or property of you, other people, or us;
• as part of a merger, acquisition or sale of assets, where the new owner must keep protecting it as this policy says (and we'll get your consent first where the law requires it, including for consumer health data);
• with your permission.

We don't sell your personal information or your consumer health data. We don't share it for targeted advertising. The app has no advertising or ad-tracking tools.

6. Consumer health data

Much of what you give us, such as body photos, measurements, pain answers, meals, and the reports we create, may count as "consumer health data" under laws like Washington's My Health My Data Act. Our Consumer Health Data Privacy Policy explains exactly what we collect, why, who receives it, and how to use your rights. We apply it to every user, wherever you live.

7. How long we keep it

When you delete your account, we delete your data within 30 days, except records we must keep by law. See Delete your account.

8. Your rights and choices

Wherever you live, you can:

• Know and access what we have about you, and who we've shared it with.
• Download a copy of your data. In the app, tap You → Privacy → Export my data to email us the request. We send your copy within 30 days.
• Correct your profile and safety answers at any time in the app (You → Profile), or ask us to fix anything else.
• Delete your whole account in the app (You → Privacy → Delete account), or ask us to delete single items.
• Withdraw consent to processing, at any time.
• Appeal if we turn down your request.

How to ask. Use the app, or email support@getupstanding.com from the email address on your account. We may need to confirm it's you before we act. You can also use an authorized agent where your state's law allows it; we'll ask for proof they can act for you.

When we'll answer. Within 45 days. If we need more time, we'll tell you why and may take up to 45 more days. Requests are free.

Appeals. If we deny your request, reply to our decision or email support@getupstanding.com with the subject "Appeal". We'll answer in writing within 45 days. If we deny your appeal, you can contact your state attorney general. Washington residents can file a complaint at atg.wa.gov/file-complaint.

We will never charge you more, give you a worse service, or refuse service because you used your privacy rights.

9. Security

We protect your data with encryption in transit and at rest, private storage that is opened only through short-lived links, access rules that keep each account to its own data, and access for our staff only when their job needs it. No system is perfectly secure. If a breach affects your information, we'll notify you and the authorities as the law requires, including the FTC Health Breach Notification Rule.

10. Where your data is processed

Our service providers store and process your data in the United States (and Google may process check content in other locations where it operates). Our company is based in the Republic of Korea, and our team may access data from Korea to run and support the Service, with the same protections described in this policy.

11. Adults only

Upstanding is only for people 18 and older. We don't knowingly collect information from anyone under 18. If we learn that someone under 18 has an account, we'll delete the account and its data. If you think this has happened, email support@getupstanding.com.

12. Do Not Track and Global Privacy Control

We don't sell your data or use it for targeted advertising, so there is nothing extra to opt out of. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of any sale or sharing anyway.

13. State privacy notices

Washington, Nevada and other consumer health data laws

See our Consumer Health Data Privacy Policy.

California

If the California Consumer Privacy Act applies to us, California residents have the right to know, access, correct and delete personal information, to limit the use of sensitive personal information, and to opt out of its sale or sharing. We collect sensitive personal information (such as health-related information and photos of your body) only to provide the Service you ask for. We don't sell or share it, and we don't use it to infer things about you beyond your coaching. The categories we collect, their sources and purposes are listed in sections 2 to 5. We don't disclose personal information to third parties for their own direct marketing.

Other states

Residents of states with consumer privacy laws (for example Colorado, Connecticut, Oregon, Texas and Virginia) have similar rights. Use the same steps in section 8. We offer these rights to all users.

14. Changes to this policy

When we change this policy, we'll post the new version here with a new date. If a change is important, we'll tell you in the app or by email before it takes effect. If the law requires your consent for a change, such as a new use of consumer health data, we'll ask for it first.

15. Contact us

SoMa Inc.
Yiseong Bldg., 298, Dongho-ro, Jung-gu, Seoul 04617, Republic of Korea
Privacy questions: support@getupstanding.com
Everything else: Support