Privacy Policy

This Privacy Policy explains how Kali Rising ("Kali Rising", "we", "our", or "us") collects, uses, discloses, and protects your personal data when you use the PawPhysio mobile application and related services (the "App" or "Service"). We are committed to handling your personal data in accordance with Singapore's Personal Data Protection Act 2012 ("PDPA") and, where applicable, the EU/UK General Data Protection Regulation ("GDPR") and other data protection laws.

By using the App, you acknowledge you have read and understood this Policy.

1. Who We Are & Our Data Protection Officer

Kali Rising is the organisation responsible for your personal data. In accordance with the PDPA, we have appointed a Data Protection Officer ("DPO") who can be contacted regarding any questions, requests, or complaints about your personal data:

• Data Protection Officer — pawphysio@kali-rising.com

2. Information We Collect

We collect the following categories of personal data:

Category	Examples
Account & authentication	Email address; your name and Google account identifier if you sign in with Google. We never receive your Google password.
Dog profile	Your dog's name, breed, date of birth, weight, microchip number, known allergies, photo, and vet contact details (vet name, clinic, address, and phone) you choose to add.
Health & rehabilitation data	Exercise and session logs, sets/reps/hold times, training programs, activity records, session notes, mood/energy ratings, supplements, vaccinations, medical history, and physical measurements such as weight and limb circumference.
Photos	Any photo you upload for your dog's profile. Photos are resized and stripped of embedded metadata (including any location information your camera may have recorded) before being stored in our cloud storage.
Program text you import	If you use the program import feature, the text you paste (for example, instructions from your physiotherapist) is sent to our AI provider to be converted into a structured program. See Section 4.
Subscription	Your subscription and trial status. Payments are processed by Apple or Google; we never receive or store your payment card details.
Technical & usage	App diagnostics, device information, and usage data used to keep the App secure and working.

3. How We Use Your Information & Legal Basis

We use your personal data to:

• Provide the Service — display your dog's profile, programs, and history, and track rehabilitation progress (performance of our contract with you).
• Authenticate your account and keep your data secure (contract and our legitimate interests).
• Manage your subscription and free trial (contract).
• Respond to your enquiries and provide support (legitimate interests).
• Improve and maintain the App (legitimate interests).
• Comply with legal obligations.

Under the PDPA, we collect, use, and disclose your personal data only for purposes that a reasonable person would consider appropriate and which we have notified to you. Where we rely on your consent, you may withdraw it at any time (see Section 8). We do not use your data for advertising, and we do not sell your personal data.

4. Disclosure & Third-Party Service Providers

We share personal data only with trusted service providers who help us operate the App, and only to the extent necessary. Each is bound by a data-processing agreement and provides a standard of protection comparable to the PDPA:

• Supabase — cloud database, authentication, and file storage, hosted on Amazon Web Services (AWS). (privacy policy)
• Google — sign-in via Google OAuth, if you choose it; and subscription processing via Google Play on Android. (privacy policy)
• Apple — subscription and in-app purchase processing on iOS. (privacy policy)
• RevenueCat — manages and verifies your subscription status across devices. (privacy policy)
• Anthropic — provides the AI used for the features described below. (privacy policy)

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

Our use of artificial intelligence

Two features of the App use AI provided by Anthropic:

• Program import — when you paste exercise instructions (for example, a message from your physiotherapist), that text is sent to Anthropic's API and converted into a structured program. Only the text you paste is sent.
• Progress insights — summaries of your dog's training progress may be generated from the session data you have logged.

In both cases the data sent is limited to what is needed to produce the result, the output is shown only to you, and it is not used to train AI models. Both features are optional: the App is fully usable without them, and you can build programs manually instead of importing them.

5. International Transfers of Data

Your account and app data are stored in the cloud using Supabase infrastructure hosted on AWS, and may be processed on servers located outside Singapore, the EEA, or your country of residence. Where personal data is transferred across borders, we rely on our providers' safeguards — including Standard Contractual Clauses and equivalent measures — to ensure your data continues to receive a comparable standard of protection, consistent with the PDPA Transfer Limitation Obligation and Chapter V of the GDPR.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we will delete or anonymise your associated data within 30 days, except where we are required to retain it to comply with legal obligations.

7. Security

We apply reasonable technical and organisational measures to protect your data, including encryption in transit and at rest, and access controls that restrict your records to your own account.

Photos you upload are stored at unique, randomly generated web addresses. These addresses cannot be guessed or listed, but anyone you share a photo link with will be able to view that photo without signing in. Location information is removed from photos before they are uploaded. Please treat photo links as you would any private link.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Everyone

• Access the personal data we hold about you and how it has been used or disclosed.
• Correct inaccurate or incomplete data.
• Withdraw consent to our collection, use, or disclosure of your data, on reasonable notice. We will inform you of the likely consequences, and this may mean we can no longer provide parts of the Service.
• Delete your account and associated data from within the App.

We will respond to access or correction requests within 30 days where practicable; if we cannot, we will tell you when we will respond.

Singapore (PDPA)

You may contact our DPO to exercise your rights. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

European Economic Area & United Kingdom (GDPR / UK GDPR)

If you are in the EEA or UK, you also have the rights to erasure, restriction of processing, data portability, and to object to processing. You have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk).

California (CCPA/CPRA)

If you are a California resident, you have the right to know, delete, and correct your personal information, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information.

9. Data Breach Notification

In the event of a data breach that is likely to result in significant harm to affected individuals or that meets applicable notification thresholds, we will notify the relevant authority (including the PDPC where required) and affected individuals in accordance with the PDPA and other applicable laws.

10. Account & Data Deletion

You can delete your account at any time directly within the App (via Profile settings). Deleting your account permanently removes your dog profiles, session history, measurements, reminders, photos, and associated data from our systems, subject to the retention period in Section 6. Full step-by-step instructions are available on our Account Deletion page.

11. Children's Privacy

PawPhysio is intended for adult dog owners and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact our DPO and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you within the App. Your continued use of the App after changes take effect constitutes acceptance of the revised Policy.

13. Contact Us

For any questions or requests regarding this Policy or your personal data, contact our Data Protection Officer at pawphysio@kali-rising.com.