1. Who we are (Art. 13(1)(a))

Data controller: JawSense Ltd, 86-90 Paul Street, London, EC2A 4NE, United Kingdom. Data Protection Officer contact: info@jawsense.com.

2. What data we collect and why (Art. 13(1)(c))

We collect and process the following categories of personal data:

• Account data (name, email address): to create and manage your account. Legal basis: performance of a contract (Art. 6(1)(b)).
• App profile data (optional: age, gender, condition details): entered by you in the self-management app to personalise your program. Legal basis: performance of a contract (Art. 6(1)(b)).
• Symptom diary and progress data: entries you make in the self-management app (symptom logs, exercise completions, program progress). This may constitute health data under Art. 9. Legal basis: performance of a contract (Art. 6(1)(b)) and explicit consent for health data (Art. 9(2)(a)).
• Biometric sensor data (EMG, EEG, EOG, PPG, accelerometer): collected by the JawSense ONE wearable to deliver biofeedback and generate wellness reports. This is special category data under Art. 9. Legal basis: your explicit consent (Art. 9(2)(a)).
• Biofeedback event logs (timing and type of feedback cues): to provide session summaries. Legal basis: performance of a contract (Art. 6(1)(b)) and explicit consent for special category data (Art. 9(2)(a)).
• Device identifier: to route data between your device and our systems. Legal basis: performance of a contract (Art. 6(1)(b)).
• Website analytics (anonymous, aggregated page views via Vercel Analytics): to improve our website. No personal data is collected. Legal basis: legitimate interest (Art. 6(1)(f)) — improving our service without identifying individuals.
• Advertising cookies (Google Ads conversion tracking): only if you accept non-essential cookies via our cookie banner. Legal basis: consent (Art. 6(1)(a)).

3. Research use of sensor data (Art. 13(1)(c) and (f))

If you use the JawSense ONE wearable, we ask for your separate, explicit consent at account setup to retain your pseudonymised sensor data for product improvement and wellness research. You can withdraw this consent at any time by emailing info@jawsense.com, without affecting your use of the product. Legal basis: explicit consent (Art. 9(2)(a)) and legitimate interest (Art. 6(1)(f)).

4. Who receives your data (Art. 13(1)(e))

Your data is processed by the following recipients:

• Google Cloud Platform (data processor): hosts our cloud storage and processing infrastructure. Data is stored in EU/UK regions. Google processes data only on our instructions under a Data Processing Agreement.
• Vercel (data processor): hosts our website. Anonymous analytics only — no personal data shared.
• We do not sell your data to third parties.

5. How long we keep your data (Art. 13(2)(a))

We retain your data for the following periods:

• Account data: for the duration of your account, plus 30 days after deletion.
• Sensor data and wellness reports: until you request deletion of your account.
• Research datasets (pseudonymised): retained after anonymisation; once anonymised, data can no longer be linked to you.
• Security and audit logs: 12 months rolling.

6. Your rights (Art. 13(2)(b))

Under UK GDPR and EU GDPR, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate data.
• Right to erasure: ask us to delete your data. Submit requests to info@jawsense.com.
• Right to restriction: ask us to pause processing of your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

7. Right to complain (Art. 13(2)(d))

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113. If you are in the Netherlands, you may contact the Autoriteit Persoonsgegevens (AP): autoriteitpersoonsgegevens.nl.

8. Subscriptions and payments

Paid subscriptions to the JawSense self-management app are processed entirely by Apple (App Store) or Google (Google Play). JawSense does not receive or store your payment card details. Subscription management and refunds are handled according to the policies of the relevant app store.

9. Cookies

Our website uses two types of cookies:

• Essential cookies: required for basic site functionality (e.g. remembering your cookie preferences). No consent required.
• Advertising cookies (Google Ads): only set if you accept non-essential cookies via our banner. You can manage Google ad preferences at adssettings.google.com.

You can change your cookie preferences at any time by clearing your browser's local storage and refreshing the page.

10. Automated decision-making (Art. 13(2)(f))

We do not make any automated decisions about you that produce legal or similarly significant effects.

11. Changes to this policy

We will update this policy when our data practices change. The date at the top of this page reflects the most recent revision. Continued use of our services after a material change constitutes acceptance of the updated policy.