Privacy Policy

1. Who We Are and Scope

Colibri Innovation LLC, doing business as MyNana, operating out of Texas, United States (“MyNana,” “we,” “us,” or “our”), provides home safety assessment technologies designed to help families and older adults identify living space hazards.

This Privacy Policy explains how we collect, use, protect, and handle information when you use the MyNana mobile application (“App”), visit our website (mynana.com), or communicate with our support team (collectively, the “Services”).

When visiting our public website (mynana.com), we collect standard server access logs and basic technical telemetry necessary to deliver, maintain, and protect our web pages. We do not use third-party behavioral advertising cookies or marketing tracking pixels.

If you have questions about our data practices or this policy, contact us anytime at privacy@mynana.com.

2. Information We Collect

We collect information provided directly by you, information provided on behalf of family members, and technical device identifiers necessary for operational integrity:

• Room Photographs: Photographs you capture or select for an assessment (such as doorways, tub and shower entries, grab bar locations, flooring, and walkways) to identify visible hazards and pinpoint suggested safety modifications.

• Health, Mobility, and Daily Living Profile: Information you enter regarding the individual using the home, including mobility aid usage (e.g., cane, walker, wheelchair), history of falls, eyesight, age group, daily living factors, and living arrangements (such as living alone or with family).

• Residential Context: Home type and residential tenure (whether the home is owned or rented, used to determine whether suggested modifications require landlord permission).

• Optional First Name and ZIP Code: If provided, a first name or nickname is used to personalize report greetings and assessment context. ZIP code is not currently used for assessment or eligibility decisions; an exact street address is never required, and ZIP codes are never transmitted to third-party AI models.

• Technical Device Identifiers: A random installation identifier (transmitted as X-Device-ID) and application version and build string (transmitted as X-App-Version) generated on-device and sent with assessment requests for API rate-limiting, operational integrity, and error diagnosis.

We do not ask you to provide government identification numbers, financial account details, health insurance identifiers, or full electronic medical records.

3. How Information Moves and AI Processing

When you initiate a safety assessment:

1. On-Device Preparation: The App prepares your selected photos and profile responses locally on your iPhone.

2. Metadata Stripping: Before transmission, the App automatically strips embedded EXIF metadata (including GPS geolocation, camera hardware serials, and capture timestamps) from your photos.

3. Photo Review Step: Before submitting an assessment, the App presents a review screen displaying your captured photos, allowing you to review, retake, or remove photos before analysis begins.

4. Encrypted Analysis: Data is transmitted via HTTPS encryption in transit to our backend API, which queries Google Gemini Developer API endpoints to evaluate room photographs and relevant profile details solely to identify physical fall hazards and generate tailored safety recommendations.

5. Assessment Results: Identified hazards, risk flags, and prioritized modification suggestions are returned to your App and stored directly within your device’s local sandbox storage.

4. Third-Party Service Providers and Data Processing

We work with trusted third-party service providers who process limited data under strict confidentiality and contractual data-protection terms:

• Artificial Intelligence Inference (Google LLC): We utilize the Google Gemini Developer API under Google’s Paid Services terms (gated behind commercial API billing) to evaluate uploaded room photos alongside relevant profile answers (including room type, mobility factors, fall history, eyesight, age group, living situation, home tenure, and first name if entered). Under Google’s Paid Services terms, prompt inputs, room photographs, and generated assessment outputs are not used to train or fine-tune models, except for models specifically used for safety and policy enforcement.

• Backend Cloud Infrastructure (Google LLC): We use Firebase and Google Cloud backend functions located within the United States to authenticate requests, enforce rate limits, and proxy assessment calls securely without storing raw photo databases.

• Web Hosting (Vercel Inc.): Our public informational website (mynana.com) is hosted by Vercel. Vercel processes standard web requests to deliver site pages and does not process, receive, or store room photographs or mobile app safety assessments.

• Processing Locations: Although our assessment backend infrastructure is hosted in the United States, Google and other service providers may process information in other countries where they or their facilities operate.

• Customer Support Communications (Loops): Secure email communications infrastructure (provided by Loops) used to receive, respond to, and resolve user inquiries sent to support@mynana.com or privacy@mynana.com.

We do not sell, rent, or trade your personal information, home photographs, or survey responses to data brokers, advertising networks, or third-party marketing aggregators.

5. AI Model Training and Privacy Commitments

Protecting family privacy inside private living spaces is our foundational commitment:

• Zero AI Foundation Model Training on User Data: Because MyNana operates under Google’s commercial Paid Services API tier, neither MyNana nor Google LLC uses your uploaded private home photographs, questionnaire answers, or assessment outputs to train, retrain, or fine-tune artificial intelligence foundation models (with exceptions strictly limited to safety and policy enforcement models under Google's documented terms).

• Assessment Confidentiality: We do not publish your assessment content or make it available to other users. You may choose to export or share it.

6. Data Retention, AI Provider Retention, and Storage

• On Your iPhone (Local App Sandbox): Your assessment reports, room photos, and survey responses are saved locally within the App’s private sandbox storage on your device. They remain on your device until deleted through the App or until the App is removed.

• User Exports and Device Backups: Copies of reports that you choose to export (such as PDF files saved to the iOS Files app, shared via AirDrop, or emailed) and standard iCloud device backups are managed directly by you under your Apple ID and personal device settings.

• Backend Processing: Assessment requests, photographs, and questionnaire answers are processed in-memory during inference. We do not store raw home photographs in permanent backend databases.

• AI Provider Retention (Google LLC): Google’s published abuse-monitoring policy for the Gemini API specifies a retention period of up to fifty-five (55) days for prompts, contextual inputs, uploaded photos, and generated responses. Authorized Google personnel may review flagged content. This data is not used to train or fine-tune models except those specifically used for policy enforcement.

• Technical Operational Logs: Standard server and infrastructure access logs (containing random request identifiers, IP addresses, HTTP status codes, and payload sizes) are retained under our configured retention policies for up to thirty (30) days for rate-limiting, fraud detection, and cybersecurity defense.

• Customer Support Correspondence: Communications sent to support@mynana.com or privacy@mynana.com are retained under our customer support records retention schedule for up to twelve (12) months to maintain communication history and legal compliance.

7. Your Choices and In-App Data Management

You can manage information stored in the App and contact us to exercise applicable privacy rights:

• In-App Data Deletion: In the App, navigate to Profile › Settings › tap “Delete all my data”. Upon successful completion, this action deletes assessment data stored within the MyNana application sandbox on that device. This action does not recall or delete reports you previously exported, shared outside the App, or stored in personal device backups, nor does it immediately erase records retained by service providers for abuse monitoring and operational security under their respective terms.

• Device Permissions: You can revoke MyNana’s camera access at any time through your iPhone’s native Settings app.

• Optional Profile Fields: You may decline to provide optional details such as a first name or ZIP code.

8. State Privacy Rights and Texas Appeal Process

Depending on your state of residence and applicable state privacy laws (such as the Texas Data Privacy and Security Act / TDPSA, California Consumer Privacy Act / CCPA, and similar statutes), you may have specific rights regarding your personal information:

• Right to Know and Access: You may request confirmation of whether we process your personal data and obtain a copy of that data.

• Right to Correct: You may request correction of inaccurate personal data.

• Right to Delete: You may request deletion of personal data provided by or obtained about you.

• Right to Non-Discrimination: We will not discriminate against you, alter service pricing, or deny functionality for exercising your legal privacy rights.

• Request Verification and Timeline: To exercise these rights, email privacy@mynana.com. We will respond to verifiable consumer requests within forty-five (45) days of receipt. If an extension is reasonably necessary (up to an additional 45 days where permitted by law), we will notify you within the initial period explaining the reason. We may take reasonable steps to verify your identity before fulfilling the request. Authorized agents may submit requests on your behalf with appropriate written authorization.

• Right to Appeal (Texas TDPSA): If we decline to take action regarding your privacy request, you have the right to appeal our decision within a reasonable time. To submit an appeal, email privacy@mynana.com with the subject line “Privacy Appeal.” We will review your request and respond in writing within forty-five (45) days explaining the reasons for our determination. If your appeal is denied, you may contact the Office of the Texas Attorney General (https://www.texasattorneygeneral.gov) to submit a complaint.

9. Information Submitted on Behalf of an Aging Parent

If you are an adult child or caregiver assessing a living space on behalf of an aging parent or relative, you must ensure you have their informed consent or other valid legal authority (such as legal guardianship, healthcare proxy, or durable power of attorney, where that authority covers this disclosure) to photograph their living space and provide their mobility details.

If you are an older adult and believe an assessment was conducted in your home without your authorization, please contact privacy@mynana.com. While our backend does not maintain persistent photo databases, we will assist you in resolving your inquiry and ensuring your privacy is respected.

10. Supplemental Consumer Health Data Notice (Washington MHMDA & State Laws)

This section applies to personal information defined as “consumer health data” under applicable state health privacy regulations, including the Washington My Health My Data Act (MHMDA), Nevada Senate Bill 370, and Connecticut Data Privacy Act (CTDPA):

• Sources of Data: Consumer health data is provided directly by you during the questionnaire, provided by an authorized family caregiver on your behalf, or inferred from assessment photographs to evaluate physical fall hazards.

• Categories Collected: Physical mobility limitations, use of mobility assistive devices, history and risk of falls, eyesight and sensory factors, and daily physical bathroom routines.

• Purpose and Disclosures: Collected and disclosed strictly to necessary technical service providers (specifically Google LLC for AI inference) solely to identify environmental fall hazards and formulate requested home safety recommendations. MyNana does NOT sell, license, or monetize consumer health data, nor do we disclose health data to third-party ad networks or data brokers.

• Health Data Rights: Eligible consumers have the right to confirm processing, access, withdraw consent for future processing, and request deletion of their consumer health data by emailing privacy@mynana.com. Denials of requests may be appealed through the process described in Section 8.

11. Security and Protection of Children

We implement industry-standard administrative, physical, and technical safeguards, including HTTPS encryption in transit, photo metadata stripping, and restricted backend access, to protect your information against unauthorized access, loss, or misuse.

Our Services are strictly intended for adults (18 years of age or older) assessing residential accessibility. We do not knowingly solicit or collect information from children under 18 years of age, or under 13 for purposes of the Children’s Online Privacy Protection Act (COPPA). If you believe a minor has submitted information, contact us immediately for prompt deletion.

12. Policy Updates and Contact Information

We may update this Privacy Policy as our technology and features evolve. When changes are made, we will update the effective date at the top of this page. For significant changes, we will provide additional notice through the App or website.