Klara

Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:
Boris Nuhu Kaara, Auenweg 17, 94032 Passau, Germany — see Legal Notice.

2. Data Collected and Legal Basis

We process the following personal data:

  • Account data (email address): legal basis Art. 6(1)(b) GDPR (performance of a contract)
  • Care diary entries and assessment answers (health-related data): legal basis Art. 9(2)(a) GDPR (explicit consent)
  • Payment data: processed directly by Stripe and not stored on our servers
  • Technical data (IP address, browser): legal basis Art. 6(1)(f) GDPR (legitimate interest)

2a. Special Note: Trial Version of the Care Diary and Full Assessment

During the current trial phase, a different type of processing applies to the care diary and the full assessment (all 6 NBA modules):

  • Your entries (diary entries, assessment answers) are processed exclusively locally in your browser (e.g., in sessionStorage) and are not transmitted to, or stored on, our servers or our database (Supabase).
  • If you close the browser tab or clear your browser history, these entries will be lost. We have no access to them and cannot restore them.
  • An exception applies if you actively request the paid PDF report: in this case, the answers present in your browser at that time are transmitted once to our servers (Supabase Edge Function) in order to generate the report. The transmitted answers themselves are not permanently stored in a database after the PDF is created. Only the payment process via Stripe is processed as described above.
  • This different processing applies only to the trial version. The later, regular version with a user account will function as described in Sections 2 and 3 and will require the explicit consent mentioned there.

3. Storage

Your data is stored in Supabase's database (EU region Frankfurt, AWS eu-central-1). The connection is TLS-encrypted. Data is removed upon request when you delete your account. This does not apply to the care diary and the full assessment in the current trial version — see Section 2a.

4. Data Processors

  • Supabase Inc. — database hosting (Data Processing Agreement in place)
  • Stripe Inc. — payment processing (Data Processing Agreement in place)
  • Vercel Inc. — web application hosting (Data Processing Agreement in place)

5. Your Rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20) under the GDPR. To exercise these rights, please contact: kaaraboris@gmail.com

6. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

7. Cookies

We use only technically necessary cookies (session management) as well as optional analytics cookies, for which we obtain your consent. You can change your cookie settings at any time via the banner at the bottom of the screen.