AuraZenAuraZen is a wellness companion, not a medical device. We do not sell personal or health-related information, use it for advertising, or share it with employers or insurers.
01Who we are
AuraZen is provided by Lucas De Marchi Dreger, trading as Brasa Solutions, Fritz-Reuter-Weg 1a, 27607 Geestland, Germany. Lucas De Marchi Dreger is the controller for personal data processed through the AuraZen mobile app.
For privacy requests, contact [email protected]. For general support, contact [email protected].
02Information we process
Depending on the choices you make, AuraZen may process account information such as your email address and first name; wellbeing check-ins; optional notes, journal entries, sleep-diary entries and personal insights; recovery records; consent records; and limited technical information needed to operate and secure the app. These records are stored in the app's protected local store. Records are uploaded only where the relevant feature expressly says so and you have given the required consent.
If you allow it, AuraZen reads on your device the Apple Health data types you approve in Apple's permission sheet: sleep, steps, workouts, exercise minutes, time in daylight, mindful minutes, resting heart rate and heart-rate variability, caffeine, alcoholic beverages, State of Mind (mood) logs, menstrual flow and medication dose logs. For medications, Apple lets you choose each medication AuraZen may see; AuraZen reads only whether a dose was logged as taken or skipped, not the medication's name or dose. Raw Apple Health samples are not uploaded to AuraZen servers, sent to an AI provider, or shared with anyone else.
AuraZen may calculate descriptive personal patterns deterministically on your device from your check-ins, sleep diary and that Apple Health data. A pattern only compares days in your own records (for example, the days before a period with the other days of your cycle). It does not explain causes, diagnose, or recommend treatment. You decide whether a suggested pattern fits, should remain under observation, or should be dismissed. If you keep a pattern, it is stored with your other records and, if you use backup, included in your end-to-end encrypted backup, which we cannot read.
If you turn it on, AuraZen writes to Apple Health on your device: finished breathing practices as Mindful Minutes and, on supported iOS versions, the moments you record as State of Mind (how pleasant it felt and the feeling you chose). Apple then holds that data under its own terms. You can turn this off in AuraZen or in the Health app at any time.
If you opt in to product analytics, AuraZen stores a closed set of feature-completion events linked to your account. Each record contains only the event and server receipt times, event name, app version and build, and platform. It does not contain journal or check-in content, emotion, intensity, crisis actions, location, Apple Health data, contacts, voice, or arbitrary event properties.
When you use AuraZen Plus, we verify and retain the App Store product, transaction, purchase, expiry, and revocation status linked to your AuraZen account. Payment-card and Apple Account payment details remain with Apple and are not received by Brasa Solutions.
Where an optional voice check-in is available, audio is processed only for the active request after you accept the separate voice disclosure. AuraZen sends it to OpenRouter, which is instructed to use only a zero-data-retention speech provider and to deny provider data collection. AuraZen does not store the raw audio or returned transcript, and the client deletes its temporary recording after the request. Limited request metadata, such as account identifier, provider, model, time, and success or failure, may be retained for security and reliability without the audio or transcript. Some wellbeing information may be sensitive personal data under applicable law; we request explicit consent where required.
Where an optional AI summary of a wellbeing brief is available, only the brief text you have already reviewed and kept is processed, and only for the active request after you accept the separate AI summary disclosure. AuraZen sends that text to OpenRouter, which is instructed to use only a zero-data-retention model provider and to deny provider data collection. AuraZen does not store the brief text sent or the summary returned. Limited request metadata, such as account identifier, provider, model, time, and success or failure, may be retained for security and reliability without the brief text or summary.
If you select a trusted contact, the name and phone number you choose are stored on your device. AuraZen uses the system contact picker and does not read or upload your full address book. If you use location to choose a crisis-support region, AuraZen requests one current location, derives the country or region, and does not retain the coordinates. If you choose to add a location link to a trusted-contact message, AuraZen uses an approximate, neighborhood-sized coordinate by default and requires a separate explicit choice before using the device's more precise coordinate. The link is added to a message you review and is shared with the recipient and messaging or maps providers only when you send or share it; those parties may retain or forward it. AuraZen does not track your location in the background.
Apple Watch crisis resources are available without an account. Personal Watch records are transferred to the paired iPhone only after setup and are handled under the same storage, consent, export, and deletion choices as iPhone records. Apple Health samples are read on device only after you grant access; AuraZen displays aggregates for the period you choose and does not upload raw samples or add them to a wellbeing brief.
If the therapist companion is available and you activate a relationship, AuraZen stores the relationship, exercises, responses and only the wellbeing-item snapshots you explicitly choose to share. A therapist receives no blanket access to your account. You can revoke shared items or the relationship. A professional profile is not presented as credential-verified unless AuraZen has separately verified it.
03Why we use information
- To create and secure your account and provide the app.
- To provide the check-ins and wellbeing exercises you request.
- To support account recovery, customer support, fraud prevention, and service security.
- To comply with legal obligations and manage store purchases.
- To improve reliability and usability only when you opt in to limited analytics.
04Legal bases
Where the GDPR applies, we process personal data to perform our contract with you, comply with legal obligations, pursue legitimate interests such as security and reliability, or with your consent. Wellbeing, mood, menstrual and medication information are special-category personal data under Article 9 GDPR. AuraZen processes them only with your explicit consent (Article 9(2)(a) GDPR), given on AuraZen's privacy screen and again in Apple's own permission sheet for each Apple Health type, and you can withdraw it at any time in AuraZen or in the Health app, without affecting processing before withdrawal.
05Sharing and service providers
Supabase provides account authentication, database hosting, server functions and, where you activate the therapist companion, relationship-scoped storage. Apple and Google provide the sign-in method you choose. Apple also processes Apple Health, Watch, Siri, Messages, Maps, and store interactions under its own terms when you choose those system features. For an optional voice check-in, OpenRouter routes the request to a speech transcription provider configured for zero data retention and no provider data collection; the eligible provider may change according to availability. For an optional AI summary of a reviewed wellbeing brief, OpenRouter likewise routes the request to a language-model provider configured for zero data retention and no provider data collection. These providers process information only to deliver the requested service and under applicable contractual and transfer safeguards.
We do not sell your data. We do not use wellbeing information for advertising. We do not share individual wellbeing information with employers or insurers. A therapist can see only items you explicitly share within an active relationship, and voice or brief content is not used to train a shared model.
Google Workspace processes correspondence sent to our support, privacy, and legal mailboxes so that we can answer requests.
06Retention and deletion
Records kept only on your device, including trusted contacts, remain there until you delete them, reset local data, or remove the app. One-time locations used for region selection or a reviewed message are not retained by AuraZen. Raw voice audio and returned transcripts are not retained by AuraZen. Brief text sent for an AI summary, and the summary returned, are not retained by AuraZen. Limited voice-request metadata and limited brief-summary-request metadata each expire after 30 days, daily anti-abuse usage counters are deleted after 35 days, and opted-in product-interaction events are automatically deleted after 180 days. Temporary export files on the device are removed after sharing and stale files are deleted after one hour.
Account-linked wellbeing data, consent history, and verified subscription records are kept while your account is active. When account deletion is completed, these account-linked records are deleted, except for the minimum information that must be restricted and retained to meet a legal, billing, fraud-prevention, security, or legal-claims obligation. Any such exception is kept only for the applicable statutory or limitation period and is then deleted or irreversibly anonymized.
You can request access, export, correction, or deletion in the app or by emailing [email protected]. We aim to complete rights requests within one month, subject to legally permitted extensions and required retention.
07Your choices and rights
Depending on your location, you may have rights to access, correct, export, restrict, object to processing, withdraw consent, and delete personal data. You can review or withdraw consent in the app and can contact [email protected] for any rights request. Withdrawing analytics consent stops future analytics collection; deleting the account removes existing account-linked analytics records. You can also change microphone, Apple Health, and location permissions in your device settings.
You may lodge a complaint with your local data protection authority. For Brasa Solutions in Lower Saxony, this is the State Commissioner for Data Protection of Lower Saxony (LfD Niedersachsen).
08Safety
AuraZen is not an emergency service and does not monitor you. It never places a call, sends a trusted-contact message, or shares a location automatically. In an immediate emergency, contact local emergency services or a qualified crisis resource.
09Children
AuraZen is not intended for people under 16, or the minimum age required in their jurisdiction. We do not knowingly collect personal data from children.
10Changes to this policy
We may update this policy as the app or legal requirements change. We will post the updated version here and, where appropriate, provide notice in the app or by email.
11Website and correspondence
Website notice revised: September 28, 2026. This supplement describes website visits and correspondence; it does not change the app consent version above.
Our web server and Cloudflare process connection and security information, including IP address, requested URL, request time, browser information and response status, to deliver the site and prevent abuse. This serves our legitimate interests in a reliable, secure website (Article 6(1)(f) GDPR). Technical records are retained only as needed for operation, incident investigation and applicable legal requirements.
The site remembers an explicitly selected language in your browser’s localStorage under aurazen-lang, until you clear site data or select another language. Without a selection, it uses your browser language. The language preference is not used for advertising. Country selection for crisis information and demo ratings stay in page memory and are not submitted to an account. The site does not infer your country from your language. Self-hosted fonts and videos do not require external media requests; videos load when you choose to play them.
Google Workspace handles messages sent to [email protected], [email protected] and [email protected]. This includes your email address, message, attachments and delivery metadata. We use them to answer you, handle your request and maintain necessary records: Article 6(1)(b) GDPR for contractual enquiries, Article 6(1)(c) for statutory requests and obligations, or Article 6(1)(f) for other correspondence. Do not send health records, passwords or recovery keys by email. Correspondence is kept until the request is resolved and any applicable legal retention or claims period expires; access is restricted when it must be retained solely for those purposes.
Using Google Workspace for delivery does not mean that emails are generated by AI. It is an email-processing provider, separate from optional OpenRouter processing in the app. Google and Cloudflare may process data outside the EEA, including in the United States. Where required, transfers need an applicable adequacy decision or safeguards such as the European Commission’s standard contractual clauses (Articles 44–46 GDPR). Contact [email protected] for information about the safeguards applicable to your data and how to obtain a copy. The rights and complaint channels above also apply to website and correspondence data.