Spinamic Privacy Policy

Spinamic is a companion application for the Spinamic wearable sensor. It helps wearers and their guardians follow brace wear time, sensor measurements, and device status. We comply with applicable data protection laws, including the Personal Information Protection Act (PIPA) of the Republic of Korea and other relevant regulations. This Policy describes what data we collect, why we collect it, and the choices you have.

We collect the following categories of information when you create an account, use the Service, or pair your Spinamic device.

(1) Account Information

• Email sign-up: name, email address, password (stored as a salted hash)
• Google or Apple sign-in: the account identifier, name, and email address provided by Google or Apple (no password is stored)
• User role (wearer, guardian, or doctor), daily wear goal, time zone, and notification settings

(2) Health-Related Information (Sensitive Information)

• Profile details: date of birth, gender, height, weight, diagnosis name, and notes. These are entered by you or by a doctor you are linked with, and are collected only when entered.
• Brace-wear sensor records: pressure readings measured by the device, wear state, and the time of each measurement

Because this information relates to your health, we treat it as sensitive information under the Personal Information Protection Act. Spinamic records wear time; it does not diagnose, treat, or prescribe.

(3) Spinamic Device Data

• Bluetooth device identifier and pairing information
• Device status: firmware version, connection state, device clock settings

(4) Automatically Collected Information

• App and phone information: platform (iOS / Android), OS version, phone model, app version, time zone
• App state records: app launch, foreground / background transitions, and device connect / disconnect times, used to interpret sensor records
• Push notification token (only if you allow notifications)
• Server access logs: request time and IP address

We do not collect advertising identifiers (IDFA / AAID), we do not use third-party analytics or advertising SDKs, and we do not collect government-issued ID numbers.

We use the information we collect only for the following purposes.

• Creating and managing your account, verifying identity, preventing fraud
• Pairing your Spinamic device and collecting brace-wear time and sensor measurement data
• Providing core features such as wear-time records, reports, and notifications
• Sharing wear records with the guardians and doctors you link with
• Improving the Service, developing new features, and producing aggregate analytics
• Responding to support inquiries and delivering important service announcements
• Complying with legal obligations and resolving disputes

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy or as required by law.

• Account, health-related, wear-time, and device data: until you delete your account. When you delete your account, your account and all data, including wear records, are deleted immediately and cannot be recovered.
• Access logs: 3 months (as required by the Protection of Communications Secrets Act)

We do not sell your personal information. We do not share your personal information with third parties except in the following circumstances. Information is shared with a guardian or doctor only after you link with them in the app, and sharing stops as soon as the link is removed or your account is deleted.

• Guardians you link with: your name, wear time, wear state, and device connection status, so that they can follow your wear records
• Doctors you link with: your name, profile details (date of birth, gender, height, weight, diagnosis name, notes), wear time, wear state, and sensor records, so that they can review your wear records
• When you have given us your explicit prior consent
• When required by law, court order, or a lawful request from a government authority
• To protect our rights, property, or safety, or that of our users or the public

We engage trusted service providers to process personal information on our behalf so that we can operate the Service. We require these providers to handle data in accordance with this Policy and applicable laws.

You have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you
• Correction: request that we correct inaccurate or incomplete information
• Deletion: request that we delete your personal information
• Restriction: request that we suspend processing of your information
• Withdrawal of consent: withdraw any consent you previously provided and close your account

You can exercise these rights through the in-app settings menu or by contacting us at the email address listed below. We will respond to verified requests without undue delay. You can delete your account in the app (Settings → Delete account) or on the account deletion page.

When personal information is no longer needed for the purposes for which it was collected, we destroy it without delay.

• Account deletion: your account and all data, including wear records, daily results, app state records, calibration data, links with guardians and doctors, and the push notification token, are deleted immediately and cannot be recovered
• Information that must be kept by law (such as access logs) is stored separately and destroyed when the legally mandated retention period ends
• Electronic files: permanently deleted using methods that prevent recovery
• Printed materials: shredded or incinerated

The Spinamic app requests the following device permissions. Required permissions are essential for core functionality. Optional permissions can be denied without affecting other features.

Required Permissions

• Bluetooth (BLUETOOTH_SCAN / BLUETOOTH_CONNECT): to discover and connect to your Spinamic device
• Location (Android only, ACCESS_FINE_LOCATION): required by Android to scan for Bluetooth devices. Your location is not collected or stored.
• Foreground Service (FOREGROUND_SERVICE / FOREGROUND_SERVICE_CONNECTED_DEVICE): to maintain a continuous connection with the device
• Background Bluetooth (iOS bluetooth-central background mode): to continue receiving wear data while the app is in the background

Optional Permissions

• Notifications (POST_NOTIFICATIONS): to deliver wear reminders, brace fit alerts, daily goal reminders, and messages from linked guardians or doctors. Notifications are not sent during night-time quiet hours

You can change permission settings at any time through your device's system settings.

We implement administrative, technical, and physical safeguards designed to protect your personal information.

• Administrative: internal data protection policies and regular employee training
• Technical: access control for personal information systems, encryption of passwords and sensitive fields, deployment of security software, and monitoring for unauthorized access
• Physical: restricted access to server rooms and physical storage of records

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

The Spinamic device is commonly used by adolescent wearers. When the user is under 14 years of age, we collect personal information only with verifiable consent from a parent or legal guardian. Parents or legal guardians may review, correct, or request deletion of their child's personal information at any time by contacting us at the address below.

We have designated a Privacy Officer responsible for handling privacy-related questions, requests, and complaints.

If you reside in the Republic of Korea, you may also contact the following authorities for privacy-related complaints:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Korea Internet & Security Agency, Privacy Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office Cybercrime Investigation: 1301 (www.spo.go.kr)
• National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you at least 7 days before the changes take effect, by posting the updated Policy in the app and on our website. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

Published: November 3, 2026 / Effective: November 3, 2026