Privacy Policy & Health Data Protection Notice

1. Data Controller & Privacy Officer

The Data Controller responsible for personal data processed through Matryz is Barnasoba ("Barnasoba" or "Matryz"). For any inquiry regarding privacy, encryption standards, or the exercise of your statutory rights, you may directly contact our privacy team at:

2. Nature of Data Processed and Legal Basis

Matryz collects and processes only the data strictly necessary to provide psychometric tracking and clinician report preparation:

• Account and Authentication Credentials: Email address and a unique user identifier assigned by the authentication engine (User ID / UUID). Sessions may be initiated anonymously or via authenticated sign-in (Apple Sign-In, Google OAuth, Magic Links). Plaintext passwords are never stored.
• Special Category Data (Health and Emotional Wellbeing - GDPR Art. 9):
  • Answers to standardized psychometric batteries (PHQ-9, GAD-7, OASIS, ODSIS, BDI-II, BAI, HDRS, DASS-21, STAI, SCL-90-R, MMPI-2-RF), calculated numerical scores, and subscales.
  • Daily emotional micro-check-ins: mood rating on a 1-to-5 scale, sleep hours and rest quality, contextual tags (#work, #exercise), and personal reflections in the emotional catharsis venting field.
  • Personal clinical notes and optional biomarker logs (cortisol, thyroid TSH/T3/T4, glucose) entered voluntarily for longitudinal consultation overlay.
  • Automated Sentinel Alerts: internal flags on critical risk items (such as PHQ-9 Item 9 suicide ideation or acute panic surges) to display preventive emergency prompts.
• Legal Basis for Processing: The processing of sensitive health data is grounded exclusively on the user's explicit, freely given, specific, and informed consent (Article 9.2.a of EU GDPR and analogous state legislation), granted unequivocally upon account creation and enablement of emotional and psychometric tracking.

3. Infrastructure Providers, Sub-processors & International Transfers

To deliver enterprise-grade availability, security, and cryptographic resilience, we partner with specialized sub-processors governed by strict Data Processing Agreements (DPA):

4. Cryptographic Storage, RLS and 100% Local Notifications

To neutralize breach risks, intimate journal entries and sensitive qualitative inputs are protected using PostgreSQL pgcrypto (AES-256) algorithms stored as raw BYTEA binary data.

Furthermore, all database tables implement strict Row Level Security (RLS) enforced at the engine kernel. No user can read, write, or infer records belonging to another account:

-- PostgreSQL Kernel Isolation Policy
CREATE POLICY "Users can manage own health records"
    ON public.check_ins FOR ALL
    USING (auth.uid() = user_id)
    WITH CHECK (auth.uid() = user_id);

5. International User Rights (EU, US & Global)

We recognize and guarantee comprehensive sovereignty over personal data to every user worldwide:

6. Data Retention & Irreversible Erasure

We retain your personal and health records solely while your Matryz account remains active or until you request its deletion.

When an account deletion is initiated, a database-level cascade (`ON DELETE CASCADE`) triggers immediately. This permanently and irrevocably destroys: authentication credentials, micro-check-in logs, psychometric evaluations, sentinel flags, biomarkers, and catharsis notes. No identifiable residual backups are retained.

7. Zero Data Brokers & No Advertising SDKs

Matryz does not embed advertising SDKs such as Google AdMob, Meta Audience Network, or behavioural tracking pixels. We never sell, rent, monetize, or disclose your clinical scores or emotional journals to insurance carriers, pharmaceutical companies, or third-party data brokers under any circumstances.