Privacy Policy

1. Introduction

This Privacy Policy describes how RootCalm ("we," "us," or "our") collects, uses, discloses, and safeguards your personal information when you use our anger assessment application (the "Service").

We respect your privacy and are committed to protecting it through our compliance with this policy. Please read this Privacy Policy carefully to understand our practices regarding your personal data and how we will treat it.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience:

• Essential cookies: Required for authentication and basic Service functionality
• Functional cookies: Remember your preferences and settings
• Analytics cookies: Help us understand how the Service is used
• Local storage: Stores session information and user preferences locally

3. How We Use Your Information

We use the information we collect for the following purposes:

4. Email Communications

4.1 Types of Emails

4.2 Managing Email Preferences

You can manage your email preferences in your account settings. Note that even if you opt out of optional emails, we will still send critical transactional and security-related emails that are necessary for account management.

5. Data Security

We implement comprehensive technical and organizational security measures to protect your personal information:

6. Data Sharing and Disclosure

6.1 When We May Share Your Information

We may share your information only in the following limited circumstances:

6A. Identity Verification and Biometric Data (Court-Mandated Programmes)

6A.1 Why We Verify Identity

Courts, probation officers, and attorneys must be able to rely on the fact that the person named on a completion certificate is the person who actually completed the work. To make our certificates defensible, participants in court-mandated programmes complete a one-time identity check at enrolment and short facial re-match checks before key assessments.

6A.2 What Is Collected

• An image of a government-issued identity document (ID card, passport, or driving licence)
• A live selfie / short liveness capture
• A biometric facial template derived from those images, used to confirm a match
• Verification metadata: date and time, result (approved / rejected), document country and type, and the number of re-match checks passed

6A.3 Who Processes It

Identity and biometric processing is carried out by Sumsub (Sum and Substance Ltd), a specialist identity verification provider, acting as our Operator (POPIA) / Processor (GDPR) under a data processing agreement. Your identity document images and biometric templates are held by Sumsub on their secure infrastructure. RootCalm does not store your ID document images or your biometric facial template. We store only the verification outcome and metadata listed in 6A.2, linked to your account.

6A.4 Lawful Basis and Consent

Biometric information is special personal information under section 26 of POPIA and a special category of personal data under Article 9 of the GDPR. We process it only on the basis of your explicit, informed and voluntary consent, which is requested on a dedicated screen before any capture begins, and additionally for the establishment, exercise or defence of a legal claim where a certificate is submitted to a court. You may withdraw consent at any time by contacting us; withdrawal means we can no longer issue or maintain a court-verifiable certificate, and you may instead complete the programme on an unverified basis.

6A.5 Retention

• ID images and biometric templates: retained by Sumsub for the period required for audit and re-match purposes, and deleted at the end of that period or on verified deletion request
• Verification outcome and metadata held by RootCalm: retained for 5 years after certificate issue, so that a court, probation officer, or attorney can verify a certificate after the fact
• If you never complete enrolment, incomplete verification records are deleted within 30 days

6A.6 Who Can See the Result

Only you, our authorised administrators, and — where you choose to share a certificate or report — the court, probation officer, or attorney you share it with. They see the outcome (verified / not verified, date, method), never your document images or biometric data.

6A.7 Your Rights

You may request access to your verification records, correction of inaccurate details, withdrawal of consent, or deletion of your biometric data by emailing us using the details in section 16. We will action verified requests within 30 days. Automated matching decisions are always reviewable by a human on request.

7. Data Retention

7.1 Active Accounts

We retain your personal information for as long as your account is active and as necessary to provide you with the Service. This includes:

• Account information: Retained while your account is active
• Assessment data: Retained indefinitely for progress tracking unless you request deletion
• Feedback: Retained indefinitely to improve the Service

7.2 Account Deletion

When you delete your account:

• Your account information and assessment data will be permanently deleted within 30 days
• Some information may be retained for legal, security, or administrative purposes as required by law
• Anonymized, aggregated data may be retained for analytics purposes
• Backup copies may exist for up to 90 days before being permanently purged

7.3 Inactive Accounts

If your account is inactive for an extended period (typically 3+ years), we may contact you to confirm whether you want to keep your account. If we cannot reach you or you do not respond, we may delete your account and associated data after providing notice.

8. Your Privacy Rights

You have the following rights regarding your personal information:

To exercise any of these rights, please contact us through the feedback mechanisms in the Service or use the data management tools in your account settings. We will respond to your request within 30 days.

9. Special Privacy Rights (POPIA, GDPR, CCPA)

9.1 South African Users (POPIA)

Under POPIA, you have the following rights as a data subject:

• Right to be notified. You have the right to be informed when your personal information is collected and how it will be used
• Right to access, You can request confirmation of whether we hold your personal information and request access to it
• Right to correction; You can request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading or unlawfully obtained personal information
• Right to deletion, You can request the destruction or deletion of your personal information
• Right to object. You can object to the processing of your personal information for direct marketing purposes
• Right to submit a complaint, You have the right to lodge a complaint with the Information Regulator

Lawful Basis for Processing (POPIA Section 11): We process your personal information based on: (1) your consent, (2) necessity for performing a contract with you, (3) compliance with legal obligations, (4) protection of your legitimate interests, and (5) pursuing our legitimate interests where your rights are not unduly affected.

9.2 European Union Users (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Right to lodge a complaint with your local data protection authority
• Right to restrict processing in certain circumstances
• Right to data portability in a machine-readable format
• Right to object to automated decision-making

Legal Basis for Processing: We process your data based on: (1) your consent, (2) performance of a contract with you, (3) compliance with legal obligations, and (4) our legitimate interests in providing and improving the Service.

9.3 California Users (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by us
• Right to opt-out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your CCPA rights

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Data processing agreements with third-party providers
• Compliance with applicable data protection frameworks

11. Third-Party Services and Links

11.1 OAuth Providers

When you use third-party authentication services (e.g., Google OAuth), we receive limited information from these providers according to your privacy settings with them. We encourage you to review the privacy policies of any third-party authentication providers you use:

• Google Privacy Policy: policies.google.com/privacy

11.2 External Links

The Service may contain links to external websites (e.g., crisis resources, mental health organizations). We are not responsible for the privacy practices or content of these external sites. We encourage you to read the privacy policies of any website you visit.

12. Children's Privacy (Under 18)

Permitted minor pathways. A person aged 13–17 may use the following only where a parent or legal guardian is involved, consents, and (for paid programmes) creates or supervises the account:

• the Teen Anger Quiz and other teen-facing free screening tools;
• the Teen anger management track, purchased and supervised by the parent or guardian; and
• the court-directed programme, only where the referring court or officer permits a minor to enrol and the parent or guardian consents.

What we collect for minors. We collect only the information needed to deliver and document the programme or screening — account details, responses, progress and, where a court report is requested, completion records. We do not use a minor's information for advertising or profiling, and we do not sell it. Identity verification involving biometric comparison (section 6A) is not applied to minors without written guardian consent.

Guardian rights. A parent or legal guardian may request access to, correction of, or deletion of a minor's information at any time, and may withdraw consent, which ends the minor's use of the Service. If a minor has used the Service outside these pathways, or without the required consent, please contact us and we will delete that information as quickly as possible.

13. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users within 72 hours of discovering the breach (when required by law)
• Provide details about what information was compromised
• Explain the steps we are taking to address the breach
• Offer guidance on steps you can take to protect yourself
• Notify relevant data protection authorities as required by law

14. Do Not Track Signals

Some web browsers have "Do Not Track" features that signal websites you visit that you do not want your online activity tracked. Currently, there is no universally accepted standard for how to respond to Do Not Track signals. As such, we do not currently respond to Do Not Track browser signals.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Last updated" date at the top of this policy
• For material changes, we will provide prominent notice (e.g., email notification)
• Your continued use of the Service after changes constitutes acceptance of the updated policy

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

17. Acknowledgment