Privacy Policy

Sorora ("Sorora", "we", "us") is the data controller for personal data collected through the sorora.health website and the Sorora mobile app. Sorora is operated by Sorora Limited (Register Number: 817654). Our registered address is Ballsbridge, Dublin, Ireland. Contact for privacy matters: team@sorora.health.

On the Website

• Email address, if you join a waitlist or newsletter.
• Standard technical data (IP address, browser type, device type) via analytics cookies, where consented.

In the App

• Active signal data: onboarding questionnaire answers and periodic check-ins (mood, cognitive patterns, cycle/hormonal phase, sleep, sensory experience, stress, life stage).
• Passive signal data: typing cadence, task-switching latency, and error/backspace rate, captured via on-device keyboard extensions.
• Account data: email, authentication credentials, subscription status.
• Health-adjacent data you choose to enter: PHQ-9/GAD-7 responses, diagnosis status, medication status, and free-text notes.

Some of this data, particularly mood, hormonal phase, mental health screening responses, and neurodivergence status, is considered "special category data" under Article 9 of the GDPR. We only process this data with your explicit, separately captured consent.

Sorora is built on a zero-knowledge architecture principle: raw active and passive signal data is processed on your device wherever possible. Only normalised, non-identifying scaled values (for example, a 0.0–1.0 score) are transmitted to our servers to calculate insights. Sorora cannot reconstruct your raw keystrokes, app usage, or free-text notes from the values received by our servers.

You may withdraw consent at any time. Doing so may limit or disable certain core app features.

• Explicit consent (Art. 9(2)(a)) for special category health, mood, and hormonal data.
• Performance of a contract (Art. 6(1)(b)) to provide core app functionality.
• Legitimate interest (Art. 6(1)(f)) for website analytics and service security, where appropriate.
• Consent (ePrivacy) for non-essential cookies and tracking.

Sorora does not sell personal data.

• Infrastructure providers acting as contracted data processors.
• Clinical or research partners only with your explicit opt-in and generally in aggregated or de-identified form unless you consent otherwise.
• Regulators or authorities where legally required.

Where data is transferred outside the EEA, Sorora relies on Standard Contractual Clauses (SCCs) or another lawful GDPR transfer mechanism.

We retain active and passive signal data while your account remains active to maintain your longitudinal baseline. If you delete your account, your personal data will be deleted or irreversibly anonymised within 90 days unless retention is required by law.

To exercise these rights, contact team@sorora.health.

• Access your personal data.
• Correct inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent.
• Lodge a complaint with the Data Protection Commission (Ireland) at dataprotection.ie.

Sorora is intended only for users aged 18 or over. An age gate is presented before registration, and we do not knowingly collect data from minors.

We use technical and organisational safeguards appropriate to the sensitivity of the data we process, including on-device processing where possible, encryption in transit, and access controls.

Only essential cookies are used by default. Analytics and marketing cookies require your prior consent via the cookie banner. A full cookie list will be published at launch.

We will notify users of material changes by email or in-app notice before they take effect. The published policy will always display the latest revision date.

For questions or requests regarding this policy, contact:

Sorora
Email: team@sorora.health