Privacy Policy

Sorella is built on a simple promise: you can talk about your health without giving up your identity. This policy explains what data we collect, why we collect it, how long we keep it, and the choices you have. We wrote it to be read: if anything is unclear, write to us at privacy@sorella-app.com.

1. Who we are

Sorella ("we", "us") is the publisher of the Sorella mobile application and of sorella-app.com. We operate from France and act as the data controller for the personal data described in this policy. For any privacy matter, you can reach us at privacy@sorella-app.com.

2. What we collect

We deliberately collect as little as the service needs to work:

• Account data. An email address and authentication credentials. Your email is never shown to other members.
• Profile data. A username you choose and an avatar (a color, a symbol, or an image if you decide to upload one). We never ask for your real name.
• Health context. The condition(s) you tell us you are navigating (for example endometriosis, PCOS, menopause). This is health data and we treat it with the protections described in section 4.
• Your story. If you use "tell it in your own words", the short free-text note you write to be matched on lived experience. Contact details and identifying numbers (email addresses, phone numbers, web links, social media handles, street addresses and postal codes, bank and ID numbers) are removed automatically before it is sent to our AI provider, and personal names, facility names and place names before storage. The note is visible only to you, and only the experience facets you explicitly confirm on screen are used for matching. A matched member only ever sees what you both share, never your words.
• Health journal. The private entries you log (mood, energy, pain, sleep, symptoms, notes, period tracking). Your journal is yours alone by default: nothing in it is shown to anyone or used for matching, except the specific summaries you explicitly choose to share with a match or generate for your doctor.
• Consultation notes. What came out of a medical appointment, in your words (outcomes, a short note, the next appointment date). Visible only to you, never used for matching. If you fill one in from a photo or PDF of a medical document (Sister+), the file is sent once to our AI provider to read its text and deleted right after; we keep only the note you confirm on screen.
• Treatments. The treatments you track in your journal. Only if you turn on "meet sisters on this treatment" for one of them, its name is reduced to a match key (for example the molecule) so you can be matched with a sister on the same treatment. She only sees it once you are matched, and you can turn it off at any time.
• Apple Health / Health Connect (optional, read-only). If you turn it on, the app reads your sleep and period days on your phone to pre-fill your journal form. Nothing is written to Health, and nothing read there reaches us unless you save the entry it pre-filled.
• Messages. The content of your 1:1 conversations and circle posts, kept only for the retention periods in section 6.
• Safety data. Reports you make or that are made about you, blocks, and, when a conversation signals a risk of self-harm, the signals needed to surface crisis resources and alert a safety operator.
• Subscription data. If you subscribe to Sister+, the purchase is processed by Apple or Google. We receive a subscription status, never your payment card details.
• Technical data. Device type, app version, language, and diagnostic logs needed to keep the service running and secure.

We do not collect your real name, phone contacts, precise location, or advertising identifiers. There is no ad tracking in Sorella.

3. How we use your data

• To provide the service: creating your account, matching you 1:1 with a peer, and running condition-specific circles (performance of our contract with you).
• To match by condition: using the health context you give us, based on your explicit consent, which you can withdraw at any time by removing conditions from your profile or deleting your account.
• To keep the community safe: reviewing reports (triaged by a human, not an algorithm), enforcing our guidelines, and preventing abuse (our legitimate interest in a safe service, and our legal obligations).
• To understand your story: when you submit a story, an AI provider helps us derive neutral experience facets from it (like "recent surgery"), and only the facets you confirm are used. If your words suggest you may be in immediate danger, the app shows crisis resources instead of matching; this check is fully automated, nothing is stored beyond your own draft, and no alert is sent to anyone.
• To respond to crisis situations: surfacing localized hotlines and alerting a safety operator when a conversation signals self-harm (protection of vital interests).
• To operate and improve the app: diagnostics, security, and aggregate, non-identifying usage statistics (legitimate interest).

We never use the content of your conversations for advertising, and we never sell your data to anyone.

4. Health data

The conditions you share with Sorella are special-category data under the GDPR. We process them only with your explicit consent, only to match you with peers and circles, and never for advertising, profiling beyond matching, or resale. You can remove a condition from your profile at any time; matching based on it stops immediately.

5. Who can see what

Other members see your username and avatar, never your email, and never your real name unless you choose to share it yourself in a conversation. Sorella staff access message content only when required to review a report, investigate abuse, or respond to a crisis signal, and that access is logged.

6. How long we keep your data

• Messages. Free tier: 30 days. Sister+: 365 days. After that they are deleted from our systems.
• Account and profile data. Kept while your account is active. If you delete your account, your profile, conditions, and remaining messages are deleted.
• Story and journal. Your story and confirmed facets stay until you rewrite or clear them. Journal entries stay until you delete them. An AI notes summary, if you generate one, is kept only in its latest version and replaced when you regenerate. Consultation notes stay until you delete them; a document photo used to fill one in is not kept at all, it is deleted right after its text is read. All of it is deleted with your account.
• Safety records. Reports and enforcement records may be kept longer where we need them to prevent repeat abuse or to comply with legal obligations.

7. Who we share data with

We share data only with service providers who process it on our behalf and under contract (hosting, email delivery, push notification delivery, and crash diagnostics), and with Apple and Google, which process Sister+ payments under their own terms. RevenueCat keeps your Sister+ plan in sync with your store purchase: it receives a random account identifier (not your email or username) and your purchase status, never your health data or messages. Push notifications are delivered through Expo's service and carry deliberately opaque text: never a message body, a username, or a circle name. When you use a feature that relies on AI, the relevant text is processed under no-training API terms: the message you choose to translate goes to the active translation provider (DeepL, Google, or OpenAI); the story you submit (with contact details and identifying numbers already removed) and, if you request a notes summary for your doctor, your journal notes and their dates go to OpenAI; if you photograph or pick a medical document for a consultation note, that photo or PDF goes to OpenAI to be read once, nothing else. Each of these is triggered by your own action, never in the background. We may disclose data where the law requires it, or where strictly necessary to protect someone's life or safety. We do not sell personal data and we do not share it with advertisers.

Links in messages: when a message contains a link, our servers (never your phone, nor the reader's) open the page once to build a preview: its title, a short description and, in 1:1 chats, its image, copied into our storage and deleted with the message. The site sees a request from our servers, never your IP address or who reads the conversation. Accounts less than 24 hours old get no preview. The same pass checks the link against a copy of Google Web Risk's list of dangerous-site fingerprints kept on our servers; only when a link matches one does Google receive the first 4 bytes of a SHA-256 hash of it, to confirm, never the link itself, the message, or anything about you. A listed link gets a warning for the reader instead of a preview, and the message is never blocked.

8. International transfers

Our database is hosted in the European Union. Some providers, including our AI provider and our database provider's US-based company, may process data in the United States. Where a provider processes data outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

9. Your rights

You can access, correct, export, or delete your data, restrict or object to certain processing, and withdraw consent at any time. Most of this you can do directly in the app, including deleting your account, which removes your data as described in section 6, and exporting it: Profile, then Export my data, builds a copy of your profile, journal, chats, circle posts and saved messages on your device, as a PDF or JSON file, without uploading anything to us. To delete your account and its associated data, from the app or by request, see sorella-app.com/delete-account. For anything else, email privacy@sorella-app.com. You also have the right to lodge a complaint with your supervisory authority; in France, the CNIL (cnil.fr).

10. Children

Sorella is not directed to children. You must be at least 18 years old to use the service, as stated in our Terms of Service, and the app verifies your date of birth at sign-up. If we learn that an account belongs to someone under 18, we will delete it.

11. Security

Data is encrypted in transit, access to production systems is restricted and logged, and we design features so that the most sensitive data (your conversations) expires by default. No system is perfectly secure, but minimizing what we hold and how long we hold it is our first line of defense.

12. Changes to this policy

If we change this policy in a meaningful way, we will notify you in the app before the change takes effect and update the date at the top of this page.

13. Contact

Questions, concerns, or requests: privacy@sorella-app.com.