Personal data policy

1. General

1.1. This policy sets out how Базык Егор Юрьевич (Yahor Bazyk), individual registered as a professional income tax payer (the “Operator”, “we”) processes the personal data of users of the yorix-app.com site (the “Website”), the Yorix mobile app for iPhone and iPad (the “App”), support and related online services (together, the “Service”). It follows the Law of the Republic of Belarus of 7 May 2021 No. 99-З “On personal data protection” (“Law 99-З”).

1.2. It explains what data we process, why and on what basis, who we share it with, how long we keep it and how you can exercise your rights. The policy is not consent and does not need to be “accepted”. Where processing relies on consent, we ask for it separately, when it is needed, and you can withdraw it.

1.3. The Service is for adults — parents and others caring for a child. Information about the child is entered by an adult; children do not use the Service and we do not collect data directly from children.

1.4. The terms “personal data”, “special personal data” (including health information), “processing”, “authorised person” and “cross-border transfer” have the meaning given in Law 99-З.

2. Where the diary is kept

2.1. Diary records — the child’s name or nickname, date of birth, sex; sleep, feeds, diapers, walks, height and weight; health information (temperature, symptoms, medicines, vaccinations, wellbeing); notes and photos — are stored on your device and synced through your private iCloud database (Apple CloudKit). The Operator has no access to that database and cannot read it. Sharing the diary with a second adult works through iCloud at your invitation.

2.2. Sleep forecasts, the day plan and diary analytics are calculated on your device.

2.3. Diary information reaches the Operator only in the cases in section 3: when you use the AI coach, when you send a request from the App, and as analytics events.

3. What we process, why, on what basis and for how long

3.1. Bank card details are entered only on the YooKassa payment page. We never receive or store them.

3.2. We do not sell personal data. The child’s health information is not used for advertising and is not shared with ad networks.

3.3. If you do not give consent where it is needed, only the feature concerned becomes unavailable: the diary, forecasts and buying a subscription work without the AI coach, analytics and ad attribution. The purchase terms are in the public offer.

4. Who we share data with

4.1. We share data with authorised persons (processors) only to the extent needed for the purpose, under contracts or their standard data processing terms, and we are responsible to you for them (Article 7(3), Law 99-З).

4.2. AI providers receive messages and the diary summary without your e-mail, payment details or account identifier. Under their terms, data sent through the API is not used to train models: DeepInfra does not store requests, and OpenAI keeps them for up to 30 days for abuse monitoring.

4.3. Payment details (amount, date, name of the service) go to the Ministry of Taxes and Duties through the “Professional income tax” app. Other authorities receive data only where the law requires it.

5. Cross-border transfers

5.1. Most recipients are in the USA. The USA is not on the list of countries that ensure an adequate level of protection of data subjects’ rights (Order of the National Personal Data Protection Center of 15.11.2021 No. 14). Russia, the EU member states and the UK are on that list.

5.2. Risks. In countries without adequate protection there may be no personal data legislation or data protection authority, a narrower range of information may count as personal data, data subjects’ rights may be limited, and authorities may access the data.

5.3. Bases. Sign-in, purchase and support data are transferred because this is necessary to perform the contract with you (Article 9(1), paragraph 3, Law 99-З). AI coach, analytics and attribution data, and the child’s health information, are transferred with your consent after you are informed of the risks (Article 9(1), paragraph 2).

5.4. Safeguards. We transfer the minimum data, encrypt it in transit and choose providers that have committed to protecting it (for data from the EU and UK — standard contractual clauses or the recipient’s participation in the EU-U.S. Data Privacy Framework).

6. Information about the child and health

6.1. You enter information about the child as their legal representative. Consent to processing the child’s data, including health information, is given by one of the legal representatives (Article 5(9), part 2, Law 99-З). If you are not a legal representative, enter such information only with their consent.

6.2. Health information is special personal data. We process it only for the features you use and protect it with a set of measures (Article 8(3)): minimisation, encryption in transit, access limited to the Operator.

7. AI coach

7.1. When you ask a question, the App sends our server the message and the diary summary needed for the answer: the child’s name and age, recent records and, if any, health and program information. The server passes them to the AI model provider (section 4).

7.2. Answers are generated automatically. The Coach makes no decisions with legal effects for you.

7.3. Using the Coach is optional: the diary and forecasts work without it. If you withdraw consent, the Coach becomes unavailable.

8. Cookies and browser storage

8.1. The Website uses no advertising or analytics cookies, pixels or counters.

8.2. The Website uses only technical means: the yorix-lang cookie with the chosen language and browser storage where Firebase Authentication keeps sign-in data. The Website cannot work without them, so no consent is needed. You can delete them in your browser settings.

9. Deleting data

9.1. You can delete records, Coach history and the account in the App (Settings → Account) or by writing to us.

9.2. After the account is deleted or consent is withdrawn, we delete the data within 15 days, except information we must keep by law (for example, payment records). Backups are cleared within 30 days.

9.3. You delete the data in your private iCloud database yourself — in the App or in iCloud settings.

10. Your rights

10.1. Under Law 99-З a request is made in writing or as an electronic document and states your full name, address of residence (stay), date of birth, identification number (if given with the consent), the substance of the request and your signature (Article 14). For convenience we also handle, within the same times, requests sent through the “Write to us” form on the website that state your account’s e-mail address, and we may ask you to confirm that the request comes from you.

11. Security

11.1. We encrypt data in transit (TLS), restrict access to it, use App attestation, and keep data no longer than necessary.

11.2. We notify the National Personal Data Protection Center of a security breach without delay and within three working days, and you — without undue delay if the breach may affect your rights.

12. Users in other countries

EU, EEA and UK. The controller is the person named in section 14. Legal bases under the GDPR and UK GDPR: performance of a contract (Article 6(1)(b)) — sign-in, purchases, support, diagnostics; legal obligation (Article 6(1)(c)) — income accounting; legitimate interests (Article 6(1)(f)) — security and defending legal claims; consent (Article 6(1)(a)) and explicit consent for health data (Article 9(2)(a)) — the AI coach, information about the child in requests, analytics, attribution. You have the right to access, rectify and erase your data, restrict processing, data portability, object to processing based on legitimate interests, withdraw consent and complain to the supervisory authority where you live. We reply within one month.

Russian Federation. Purchase data is processed to perform the contract (Article 6(1)(5) of the Federal Law “On personal data”); the child’s health information only with your consent. We answer requests about your data within 10 working days.

United States. The child’s health information you enter is consumer health data under the laws of Washington, Nevada and Connecticut. We collect it from you for the features in section 3, share it only with the recipients in section 4, never sell it and never use it for advertising. You may learn what data we have and who received it, delete it and withdraw consent; if we decline a request, write to us with the subject “Appeal” and we will reply within 45 days. The Website does not track visitors across third-party sites, so Do Not Track signals do not change how it works.

13. Changes

13.1. A new edition is published on this page with its date. We announce material changes in advance on this page or in the App. For new purposes we ask for new consent.

14. Operator

Базык Егор Юрьевич (Yahor Bazyk)
Individual registered as a professional income tax payer
Republic of Belarus
Daily, 10:00–20:00 Minsk time

For personal data questions use the “Write to us” form on the support page.