Privacy policy

1. WHO WE ARE AND SCOPE OF THIS POLICY

Ovomind SA, route de la Galaise 34, 1228 Plan-les-Ouates, Switzerland ("Ovomind", "we", "us") operates the Ovomind platform and app, which capture physiological signals from compatible wearable devices to generate real-time emotional-response outputs for use across compatible applications, services and digital experiences.

The processing of your personal data is governed by applicable data protection, privacy and biometric laws, including the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR) where applicable, and any other laws in force at your place of residence that regulate the collection of physiological or biometric data.

We are committed to protecting your privacy and safeguarding your personal data. This Privacy Policy explains what personal data we collect, how and why we process it, the legal bases on which we rely where applicable, and the rights available to you. It also helps you understand how we use the personal data you voluntarily provide when you access our website, use our products or services, or otherwise communicate with us.

Our products are not intended for persons under the age of 16, or any higher age required by applicable law at your place of residence. If you reside in Brazil or India, you must be at least 18 years old to use our products without parental consent. If you are unsure whether you meet the applicable age requirement, please do not use our products and contact us at support@ovomind.com.

2. DATA WE COLLECT

Biosignals (physiological data)

When you use our products, we collect the following physiological signals through sensors embedded in your compatible wearable device: (i) heart rate, (ii) body temperature, (iii) electrodermal activity (micro-sweating), (iv) breathing-related signals and (v) physical movements (“Biosignals”). Biosignals in their raw, session-linked form (“Raw Biosignals”) are sensitive personal data. We collect them only on the basis of your explicit, separate, consent given before the first session. Once Raw Biosignals are irreversibly stripped of all identifiers through our anonymisation protocols so that the resulting data can no longer be linked to any individual, the resulting data ceases to be personal data.

Account and contact data

When you create an account, contact us or subscribe to our newsletter, we collect information you provide directly: name, email address, company name, phone number and postal address.

Technical and usage data

When you visit our website, your browser automatically transmits data including your IP address, browser type, operating system and pages visited. We and our service providers may also use cookies and similar technologies to collect this information.

3. HOW WE USE YOUR DATA

We use your data only for the following purposes:

• Providing the service: Processing your Biosignals to generate emotional-response outputs and provide compatible features and services, and retaining such Biosignals for up to twelve (12) months to enable continued use of the service.

• Attribution and referral tracking: When you use a product or service integrated with Ovomind technology  or utilize a promotional code, we process your pseudonymous session metadata (such as timestamps and game identifiers and referral codes) to determine if your subscription was initiated through a specific partner studio's title or a third-party Creator's Referral Arrangement, and to apply any discount attached to that code. This tracking is performed solely to apply such discounts and to calculate user acquisition incentives and referral commissions and does not involve sharing your personal identity or Raw Biosignals with such partners.

• Product improvement & model training (R&D): 

(a) Raw Biosignals (identifiable or pseudonymised): We retain your Raw Biosignals for up to twelve (12) months after each session to provide the service. We may use your Raw Biosignals for any other purpose, including R&D, only with your separate, explicit consent. Where you give that consent, we may retain your Raw Biosignals for R&D for up to thirty-six (36) months after each session. 

(b) Anonymised Biosignal data: We may irreversibly anonymise your Raw Biosignals so that the resulting data can no longer be linked to or used to identify you. Once anonymised, the data is no longer personal data under applicable data-protection law. We may retain and use this anonymised data for product improvement, research and AI model training, including beyond the retention period applicable to Raw Biosignals, without further consent.

• Account management and support: communicating with you and managing your account.

• Legal compliance: meeting our legal obligations.

We never sell, lease, trade, or profit from your Biosignals. We do not use Biosignals for advertising or for automated individual decision-making.

4. LEGAL BASES FOR PROCESSING

Where applicable law requires a legal basis for processing, we rely on the following:

• Explicit consent: for the collection and processing of Biosignals. You may withdraw consent at any time (see Section 9).

• Contract performance: for data necessary to provide our services to you.

• Legitimate interest: for maintaining the security of our systems, for calculating promotional or technical acquisition incentives and for processing non-sensitive technical and usage data to improve our services, where our interests are not overridden by your rights and interests. We do not rely on legitimate interests for R&D processing of Raw Biosignals.

• Legal obligation: where applicable law requires us to process or retain certain data.

5. HOW LONG WE KEEP YOUR DATA

We apply the following retention periods:

• Raw Biosignals: We retain Raw Biosignals for no more than twelve (12) months after the relevant session for the service-related purposes described in Section 3. Where you have separately consented to R&D use, we may also use the retained Raw Biosignals for that purpose and retain them for that purpose for no more than thirty-six (36) months after the relevant session. At the end of the applicable retention period, Raw Biosignals are deleted or irreversibly anonymised.

• Account, contact, and session metadata: Account profiles, timestamps, and emotional-response outputs are retained while your account is active and, unless you request deletion, for no more than one (1) year after your last interaction with our services, after which they are permanently deleted or irreversibly anonymised.

• Triggered deletion: If you delete your account, all associated personal data will be deleted within thirty (30) days, unless we have another lawful basis or legal obligation to retain them. If you withdraw a specific consent without deleting your account, we will stop the processing based on that consent as described in Section 9.

• Destruction method: Deletion is performed via secure deletion and data-purging protocols designed to prevent recovery; residual backup copies are overwritten in the ordinary backup cycle.

6. SHARING AND DISCLOSURE

We do not sell your personal data. We do not share it for cross-context behavioural advertising. We disclose personal data only in the following circumstances:

• Service providers (processors): We use subcontractors for hosting, infrastructure, analytics and payments. Each is bound by contractual obligations requiring them to process personal data only as instructed by us, protect it appropriately and comply with applicable retention requirements.

• Compatible partners: When you use a compatible application or service, the relevant partner receives only a pseudonymous session identifier, the emotional-response output and your heart rate and breathing rate, as needed for the integration. It does not receive your name, account details or Raw Biosignals, and it receives nothing once the session ends.

• Legal requirements: We may disclose data where required by applicable law, court order or governmental authority.

• Business transfers: If Ovomind is acquired, merges with another entity, or undergoes another corporate transaction, your data may be transferred as part of that transaction. We will ensure that applicable data-protection requirements are respected and provide notice where required by law.

7. INTERNATIONAL DATA TRANSFERS

Our service providers and compatible partners may be located in countries outside Switzerland and the European Economic Area. Where we transfer your personal data to a country that does not provide an adequate level of data protection, we use appropriate safeguards, such as standard contractual clauses recognised by the competent Swiss and EU authorities where applicable. In particular, we use an error-reporting service provider hosted in the United States, which receives only technical error information from which direct identifiers have been removed; this transfer is covered by such safeguards. You may request information about these safeguards by contacting us at the address in Section 11.

8. SECURITY

We apply appropriate technical and organisational measures, including encryption, access controls and secure data storage, to protect your personal data against unauthorised access, loss, destruction or alteration. 

In the event of a personal data breach, we will notify the competent supervisory authority and, where required, inform you directly without undue delay, in accordance with applicable law.

9. YOUR RIGHTS

Subject to applicable law, you have the following rights over your personal data. We will respond to verified requests within one (1) month, or within a shorter period if required by applicable law at your place of residence, with a possible extension of up to two (2) additional months for complex requests (45 days and a further 45 days for California residents under CCPA/CPRA). We will never discriminate against you — in price, service quality or otherwise — for exercising any of these rights.

Right to know and access

You may ask us to confirm whether we process personal data about you, and provide access to that data and related information as provided by applicable law.

Right to correct

You may ask us to correct inaccurate or incomplete personal data.

Right to delete

You may ask us to permanently delete your personal data. We will do so within thirty (30) days, subject to our legal obligations to retain certain data (such as accounting records). We will tell you if an exception applies.

Right to restrict processing

You may ask us to restrict how we use your data, for example while a correction request is being assessed.

Right to portability

You may request a copy of your personal data in a structured, commonly used and machine-readable format, or request its transfer to another service provider where applicable and technically feasible.

Right to object

You may object to processing carried out on the basis of our legitimate interests. We will stop processing unless applicable law permits us to continue.

Right to withdraw consent

Where processing is based on your consent, you may withdraw the relevant consent at any time, free of charge and without giving a reason, through the app or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before we received it. We will stop the processing based on the withdrawn consent. Withdrawal of consent for R&D use does not, by itself, require deletion of Raw Biosignals that we continue to retain and process for the service-related purposes described in Section 3 on another applicable legal basis. Raw Biosignals retained beyond twelve (12) months solely on the basis of that consent are deleted within thirty (30) days. This right does not apply to data that have already been irreversibly anonymised.

Right not to be subject to automated decisions

Where a decision produces legal or similarly significant effects on you, you have the right not to be subject to a decision based solely on automated processing. We do not use your Biosignals for such decisions. 

Right to limit use of sensitive data

You may ask us to limit the use of your Raw Biosignals and other sensitive personal data to purposes strictly necessary to provide the service. We will not use Raw Biosignals for any secondary purpose, including product improvement, unless you have separately consented to that use. This restriction does not apply to Biosignal data that have been irreversibly anonymised so that they can no longer be linked to or used to identify you.

Right to opt out of sale or sharing

We do not sell your personal data or share it for cross-context behavioural advertising.

Right to complain

If you believe we have not handled your data lawfully, you may lodge a complaint with the competent data-protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. The identity of the competent authority in your jurisdiction will be indicated to you on request.

10. COOKIES AND TRACKING

Our website uses cookies and similar tracking technologies. Some are strictly necessary for the site to function; others are used for analytics or marketing and are only placed with your consent. Third-party social plugins are blocked by default and loaded only after you have provided your consent through the cookie consent banner. You can review, change or withdraw your cookie choices at any time through our cookie settings.

We honour browser-level opt-out signals, including the Global Privacy Control (GPC), where required by applicable law.

11. CONTACT AND HOW TO EXERCISE YOUR RIGHTS

To exercise any of the rights described in Section 9, or to ask a question about this Policy, contact us:

• Email: support@ovomind.com

• Post: Ovomind SA, route de la Galaise 34, 1228 Plan-les-Ouates, Switzerland

We may ask you to verify your identity before we process your request. We will respond within one (1) month (or 45 days for California residents), or sooner if legally required at your place of residence.

12. UPDATES TO THIS POLICY

We may update this Policy from time to time. When we make material changes, we will notify you by email or through the app at least thirty (30) days before the change takes effect. For changes that expand the purposes for which we process your Biosignals or other sensitive data, we will seek your explicit consent before the change applies to you. For non-material changes, continued use of our products after notice constitutes acknowledgement of the updated Policy. The date of the most recent update is shown below.

Last updated: 30 September 2026

13. EXPRESS CONSENT TO BIOSIGNAL COLLECTION

Before your first session, you will be asked to provide your explicit, separate, written consent to the collection and processing of your Biosignals strictly for the purposes described in Section 3 of this Policy. This consent is distinct from your acceptance of our Terms of Service and must be given individually. You may withdraw it at any time as described in Section 9. 

14. URL OF OUR SITE

https://ovomind.com