Privacy Policy

1. Introduction

Allo ("we," "our," or "us") is committed to protecting the privacy of our users and their children. This Privacy Policy explains how we collect, use, share, and protect information when you use our service.

3. Information We Collect

Information About Your Child

• Name (first name only)
• Date of birth
• Assessment responses and scores
• Developmental milestone data
• Chat conversation history with our AI assistant

Information About You (Parent/Guardian)

• Email address
• Name (optional)
• Account credentials (encrypted password)
• IP address and device information
• Usage data and analytics

4. How We Use Information

We use collected information to:

• Provide assessment results and developmental guidance
• Enable the AI chat assistant to provide personalized information
• Track your child's developmental progress over time
• Improve the Service and develop new features
• Respond to your support requests
• Send important service updates and notifications
• Conduct research using de-identified, anonymized data
• Comply with legal obligations

5. Information Sharing

Third-Party Service Providers

We share information with trusted service providers who help us operate the Service:

• Supabase: Database and authentication services (data storage and security)
• OpenAI: AI chat functionality (chat messages are sent to OpenAI for processing)
• Analytics providers: Usage analytics to improve the Service

All service providers are required to protect your information and use it only for the purposes we specify.

What We DO NOT Do

• We do NOT sell your personal information or your child's information
• We do NOT share identifiable information for marketing purposes
• We do NOT allow third parties to track users on our Service

Legal Requirements

We may disclose information if required by law, court order, or government request, or to protect the rights, property, or safety of Allo, our users, or others.

6. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All data is encrypted in transit (HTTPS/TLS) and at rest
• Access Controls: Strict access controls limit who can view your data
• Authentication: Secure password requirements and authentication
• Regular Audits: Security assessments and vulnerability testing
• HIPAA Alignment: Following HIPAA-aligned security practices for health data

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide services. You may request deletion of your data at any time by contacting us.

After deletion requests, we will:

• Acknowledge your request within 30 days
• Complete deletion of personal information within 30 days of acknowledgment
• Retain anonymized data for research and service improvement
• Retain information as required by law or for legal compliance

8. Your Rights and Choices

You have the right to:

• Access: Request a copy of your data
• Correct: Request correction of inaccurate data
• Delete: Request deletion of your data
• Export: Request a portable copy of your data
• Opt-out: Unsubscribe from marketing emails
• Withdraw consent: Withdraw consent for data processing (may limit Service functionality)

To exercise these rights, contact us at privacy@allogrow.com. We will respond within 30 days.

9. Cookies and Tracking

We use:

• Essential cookies: Required for authentication and basic functionality
• Analytics cookies: To understand how users interact with the Service

You can disable cookies in your browser settings, but this may limit functionality.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. The "Last Updated" date at the top indicates when the policy was last revised.

11. Contact Us

For questions, concerns, or to exercise your privacy rights, contact us at:

Email: privacy@allogrow.com

We will respond to privacy inquiries within 30 days.