Privacy Policy

This Privacy Policy explains how Kali Rising ("Kali Rising", "we", "our", or "us") collects, uses, discloses, and protects your personal data when you use the PawPhysio mobile application and related services (the "App" or "Service"). We are committed to handling your personal data in accordance with Singapore's Personal Data Protection Act 2012 ("PDPA") and, where applicable, the EU/UK General Data Protection Regulation ("GDPR") and other data protection laws.

By using the App, you acknowledge you have read and understood this Policy.

1. Who We Are & Our Data Protection Officer

Kali Rising is the organisation responsible for your personal data. In accordance with the PDPA, we have appointed a Data Protection Officer ("DPO") who can be contacted regarding any questions, requests, or complaints about your personal data:

• Data Protection Officer — pawphysio@kali-rising.com

2. Information We Collect

We collect the following categories of personal data:

Category	Examples
Account & authentication	Email address; Google account identifier if you sign in with Google. We never receive your Google password.
Dog profile	Your dog's name, breed, date of birth, microchip number, photo, and vet contact details you choose to add.
Health & rehabilitation data	Exercise and session logs, sets/reps, training programs, activity records, session notes, mood/energy ratings, and physical measurements such as weight, limb circumference, and pain/mobility scores.
Videos	Videos you record of your dog's exercises. These are stored locally on your device only and are not uploaded to our servers.
Subscription	Your subscription and trial status. Payments are processed by Apple; we never receive or store your payment card details.
Technical & usage	App diagnostics, device information, and usage data used to keep the App secure and working.

3. How We Use Your Information & Legal Basis

We use your personal data to:

• Provide the Service — display your dog's profile, programs, and history, and track rehabilitation progress (performance of our contract with you).
• Authenticate your account and keep your data secure (contract and our legitimate interests).
• Manage your subscription and free trial (contract).
• Respond to your enquiries and provide support (legitimate interests).
• Improve and maintain the App (legitimate interests).
• Comply with legal obligations.

Under the PDPA, we collect, use, and disclose your personal data only for purposes that a reasonable person would consider appropriate and which we have notified to you. Where we rely on your consent, you may withdraw it at any time (see Section 8). We do not use your data for advertising, and we do not sell your personal data.

4. Disclosure & Third-Party Service Providers

We share personal data only with trusted service providers who help us operate the App, and only to the extent necessary. Each is bound by a data-processing agreement and provides a standard of protection comparable to the PDPA:

• Supabase — cloud database and authentication, hosted on Amazon Web Services (AWS). (privacy policy)
• Google — sign-in via Google OAuth, if you choose it. (privacy policy)
• Apple — subscription and in-app purchase processing. (privacy policy)

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

5. International Transfers of Data

Your account and app data (excluding videos, which stay on your device) are stored in the cloud using Supabase infrastructure hosted on AWS, and may be processed on servers located outside Singapore, the EEA, or your country of residence. Where personal data is transferred across borders, we rely on our providers' safeguards — including Standard Contractual Clauses and equivalent measures — to ensure your data continues to receive a comparable standard of protection, consistent with the PDPA Transfer Limitation Obligation and Chapter V of the GDPR.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we will delete or anonymise your associated data within 30 days, except where we are required to retain it to comply with legal obligations.

7. Security

We apply reasonable technical and organisational measures to protect your data, including encryption in transit and at rest and access controls. Storing exercise videos locally on your device — rather than uploading them — is a deliberate privacy-protective design choice. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Everyone

• Access the personal data we hold about you and how it has been used or disclosed.
• Correct inaccurate or incomplete data.
• Withdraw consent to our collection, use, or disclosure of your data, on reasonable notice. We will inform you of the likely consequences, and this may mean we can no longer provide parts of the Service.
• Delete your account and associated data from within the App.

We will respond to access or correction requests within 30 days where practicable; if we cannot, we will tell you when we will respond.

Singapore (PDPA)

You may contact our DPO to exercise your rights. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

European Economic Area & United Kingdom (GDPR / UK GDPR)

If you are in the EEA or UK, you also have the rights to erasure, restriction of processing, data portability, and to object to processing. You have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk).

California (CCPA/CPRA)

If you are a California resident, you have the right to know, delete, and correct your personal information, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information.

9. Data Breach Notification

In the event of a data breach that is likely to result in significant harm to affected individuals or that meets applicable notification thresholds, we will notify the relevant authority (including the PDPC where required) and affected individuals in accordance with the PDPA and other applicable laws.

10. Account & Data Deletion

You can delete your account at any time directly within the App (via Profile settings). Deleting your account permanently removes your dog profiles, session history, measurements, reminders, and associated data from our systems, subject to the retention period in Section 6.

11. Children's Privacy

PawPhysio is intended for adult dog owners and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact our DPO and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you within the App. Your continued use of the App after changes take effect constitutes acceptance of the revised Policy.

13. Contact Us

For any questions or requests regarding this Policy or your personal data, contact our Data Protection Officer at pawphysio@kali-rising.com.