Privacy Policy & Data Agreement

1. Who is responsible for your information

Endorphonics Inc. ("endorphonics", "we", "us") is the enterprise responsible for the personal information collected through the endorphonics iOS app.

Under Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), the person in charge of the protection of personal information is:

Lucas Gomez Person in charge of the protection of personal information info@endorphonics.com

Contact them with any question, access request, or complaint about your personal information. We aim to respond within 30 days, as Quebec and federal law require.

2. No account, no name, just a random ID

endorphonics has no sign-up and no login. When you first open the App it generates a random identifier (a UUID) and stores it in your device's Keychain. Every record we hold is keyed to that random ID.

It is not Apple's device identifier, not an advertising identifier, and not a fingerprint of your device. It is a random number that means nothing outside our service. Because it survives deleting and reinstalling the App, your library and history come back if you reinstall on the same device.

We still treat everything linked to that ID as your personal information, including your health answers, and we give you all the rights described in section 10. We do not claim this data is anonymous just because we never learn your name.

3. What we collect, and why

We collect only what the App needs for the purposes listed here. Every questionnaire answer is optional; you can skip any question and still use the App.

Health and pain information (sensitive personal information).

• What: the conditions and pain areas you select, your typical pain intensity, any notes you write in your own words, how long you have been managing pain, the pain rating you give before and after a session, and, if your pain was worse afterwards, your answer to what you think made it worse.
• Why: so the App can show you your own before-and-after history in the "You" tab, and so it can learn which music actually helps you.
• Special handling: this information is stored on our own servers and is never sent to any outside artificial-intelligence company. It does train our own models inside our own systems, which section 11 explains. See sections 5 and 11.

Music taste.

• What: the genres and artists you tell us you like.
• Why: this is what the music is designed from. Genres, and descriptive tags derived from the artists you name, are sent to the AI services that design and generate your music (section 5).

How you listen, and what helped.

• What: which tracks you played, how many seconds you listened, plays, skips and how far into a track you skipped, tracks you star as favourites, and each "did this help?" tap you make on the −2 to +2 scale while a song plays, with the position in the song at which you tapped.
• Why: to work out which music helps you, to shape future playlists, and to power the statistics in the "You" tab.

Demographic information.

• What: your age range and gender, if you choose to give them.
• Why: to research what helps whom. These fields are never sent to any outside artificial-intelligence company and are not used to generate your music; they may be used to train our own models inside our own systems (section 11).

The music itself.

• What: the audio files generated for you, their cover art, and the musical brief (style tags and prompt) used to generate them.
• Why: so your library keeps working after the generating provider's temporary links expire, and so we can connect what was generated to whether it helped.

Technical information.

• What: timestamps, generation and playback status, error and diagnostic logs, and, only if you allow notifications, the push token Apple issues for your device.
• Why: to operate the service, notify you when a playlist is ready, and diagnose failures.

How you use the App, only if you allow it.

• What: when you open the App, which screens you open, which setup steps you finish or skip, when you set or change your session times and whether that was the first time you set them (never the times you chose), when a listening session starts and ends, roughly how long it lasted (a band such as under a minute or over fifteen minutes, never the exact time), whether it was a guided session or a replay from your library, when the first playlist we make for you starts and whether it succeeded, or failed with a rough reason why, when you turn this setting on under "Settings", and your app version and device model. Each of these carries a random analytics ID that is separate from the ID the rest of your records are kept under.
• Why: to find where the App confuses people or breaks, so we can fix it. It is not used to choose your music and it tells us nothing about your pain.
• Special handling: this is the one thing in this policy you can say no to and still use the App exactly as normal. It is off unless you turn it on, it goes to a company outside our systems (section 7), and you can turn it off again at any time under "Settings" in the "You" tab. Your pain, health, condition and demographic answers, the notes you write, and your helpfulness ratings are never included in it.

4. What we never collect

• Your name, email address, phone number, or postal address.
• Any password. There is no account to protect.
• Your precise location, your contacts, your photos, your calendar, or your microphone.
• Anything from Apple Health / HealthKit. We do not read from or write to it.
• Any advertising identifier (IDFA). The App contains no advertising and no social-media SDK. It does include one analytics tool, described in sections 3 and 7, and we have set it up so that it cannot collect an advertising identifier.

We do not track you across other apps or websites, and we do not build or buy profiles of you from anyone else. The analytics tool is configured so that it cannot do either of those things either. There is nothing here for us to ask you for tracking permission about.

5. Outside AI services, and what they never see

Your music is designed and generated by third-party AI services run by other companies. We deliberately send them as little as possible. More than one company may generate your audio, and the App decides on its own which one makes each of your songs, based on which has helped you more (section 6).

Your pain, health, condition and demographic information is never sent to any outside AI company, for any purpose. Not to the service that designs your music, not to the ones that generate the audio, and not to the one that writes your taste summary. This is enforced in our code, not merely as a policy. Those services receive only your music taste, which can include the names of artists you told us you like, and, where noted, how you responded to previous music.

Specifically:

• The service that designs each musical brief receives your stated genres, a summary of the sonic qualities that have helped you before, and either descriptive tags derived from the artists you named or those artists' names themselves, depending on which service will generate that song. It does not receive pain data or demographics.
• That same service also corrects the spelling of artist names you typed, in a separate request that receives only those names. It is not told who asked, and it receives nothing else about you.
• The services that generate the audio receive the style tags and musical description for each track. One of them also receives the names of artists you told us you like, so it can write music in that vein; the other never does, because it refuses them. Neither receives your identifier, your pain data, or even the track's title.
• The service that writes your taste summary (see section 6) receives your music taste, which can include the names of artists you named, and your listening outcomes: ratings, skips, favourites and completion, together with the style that generated each track. It does not receive your pain, condition or demographic answers.
• Where we use a music-metadata service to turn the artists you list into descriptive genre tags, it receives only those names. It is not told who asked.

We do not permit these providers to use your information to train their own models where their terms allow us to say so, and we do not send them anything that identifies you personally.

Separately from all of the above, we use your own feedback, with identifying details removed, to train and improve our own models inside our own systems. That is a different activity from sending data to the outside services described here, and it never involves handing your pain or health information to another company. Section 11 explains it in full, including why that consent is required.

6. Automated personalization and profiling

So the music gets better for you over time, the App automatically builds a short written summary of your musical taste (a "persona") from your questionnaire answers and your listening behaviour, automatically reduces how often it serves genres you have skipped or rated negatively, and automatically chooses which AI music service generates each of your songs, based on which of them has helped you more. All three are automated; no person reads your data to make these adjustments.

This profiling is used only to choose what music to generate for you. It is never used to make any decision about your health, your treatment, or your eligibility for anything, and never to share conclusions about you with anyone, including any insurer or employer.

You have the right to know what is in your persona, to have it corrected, and to ask us to stop profiling you. Email info@endorphonics.com and we will send you your persona, delete it, or stop generating it. Deleting all your data (section 9) also deletes it.

The profiling described here is about choosing music for you, and it is part of running the App. Training the underlying models is described separately in section 11.

7. Who we share your information with

We do not sell your personal information, we do not share it for advertising or marketing, and we do not disclose it for anyone else's commercial purposes.

We share only with service providers who process information on our behalf, under contract, for the purposes below and nothing else:

• Music and cover-art generation: receives the style tags and musical description for each track, and, at one of the two music services, the names of artists you listed, as limited in section 5.
• Musical-brief design: receives your music taste, as limited in section 5.
• Taste-summary writing: receives your music taste and listening outcomes, as limited in section 5.
• Artist-to-genre lookup: receives only artist names.
• Database hosting: stores your records.
• File storage: stores your generated audio, cover art and taste summary.
• Application hosting: runs our server.
• Product analytics: receives a record of how you move through the App, and nothing beyond it: when you open the App, which screens you open, which setup steps you finish or skip, when you set or change your session times and whether that was the first time you set them (never the times you chose), when a listening session starts and ends, roughly how long it lasted (a band, never the exact time), whether it was a guided session or a replay from your library, when the first playlist we make for you starts and whether it succeeded, or failed with a rough reason why, when you turn this setting on under "Settings", and your app version and device model. All of it is labelled with a random analytics ID separate from the one your other records use. This is Amplitude, in the United States, and only if you turned it on. It never receives your pain, health, condition or demographic answers, the notes you write, or your helpfulness ratings.
• Apple Push Notification service: delivers the notification that your playlist is ready. Apple receives your push token and the notification text, not your health data.

We may also disclose information if the law requires it, for example under a valid court order, or to establish or defend a legal claim, or to protect someone's safety. If we are ever involved in a merger or sale, your information may transfer to the successor, who would remain bound by this policy or give you notice of a new one.

8. Your information is processed outside Quebec

Our servers and the service providers listed in section 7 operate outside Quebec, including in the United States. Your information, including your health answers, is stored and processed there.

This means your information may be subject to the laws of those places, including lawful access requests by their courts and authorities, which may offer protections different from Quebec's.

As Law 25 requires, before entrusting your personal information to a provider outside Quebec we assess whether it would receive adequate protection there, taking into account the sensitivity of the information, the purpose, the protections the provider offers, and the legal framework that applies to it. We record that assessment, and we require each provider to protect your information by contract.

By accepting this agreement you consent to your information being communicated outside Quebec for the purposes described here.

9. How long we keep it, and deleting it

We keep your information for as long as you keep using the App, because its whole purpose is to learn over time whether music helps you. We delete it when the purposes above are fulfilled, or when you ask us to. Where we keep a record past that point, we remove what ties it to you wherever we can, and the two limitations below tell you plainly where we cannot yet. We will not call what is left anonymous, and section 11 explains why.

You can erase your data yourself at any time: open the "You" tab, tap "Settings", and tap "Delete all my data". This permanently deletes, from our servers, your questionnaire answers, your pain ratings and session history, your listening history and helpfulness taps, your favourites, your track records, and your taste summary. If you turned on usage analytics, we also ask our analytics provider to delete what they hold for you, which they carry out on their own systems and on their own schedule. The App then returns to a first launch, beginning with the language choice and then the welcome screen. Deleting the App from your device alone does not delete your data from our servers.

Two honest limitations. First, the audio files and cover-art images already generated for you remain in our file storage as orphaned files. Deletion removes every record that links them to your device, so they can no longer be connected to you or to your health answers, and nothing in the App can retrieve them, but the files themselves are not yet erased from storage. Second, we periodically build a research snapshot of the data as a set of spreadsheet files, and a snapshot built before you deleted can still contain your answers and your ratings until it is next rebuilt, at which point you are no longer in it. We are working on erasing both automatically. If you need confirmation that a specific file has been erased, email info@endorphonics.com and we will erase it and confirm.

Separately, our database provider keeps encrypted backups for a limited period for disaster recovery. Deleted records may persist in those backups until they expire, after which they are gone.

10. Your rights

Under Quebec's Law 25 and the federal Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access: get a copy of the personal information we hold about you, and know how we use it and who receives it.
• Rectification: have inaccurate, incomplete or out-of-date information corrected. You can edit your own answers any time under "Edit your answers", behind "Settings" in the "You" tab.
• Deletion: have your information deleted, as described in section 9.
• Portability: receive the computerized personal information you gave us in a structured, commonly used technological format.
• Withdraw consent: change your mind. The consents the App depends on, including the learning described in section 11, are required to use it, so withdrawing them means you can no longer use the App. Tap "Delete all my data", behind "Settings" in the "You" tab, and remove the App, which erases your records as described in section 9. The usage-analytics consent is the exception: it is optional, so you can turn it off at any time under "Settings" in the "You" tab and carry on using the App exactly as before.
• Object to profiling: ask us to stop building your taste persona, as described in section 6.
• Complain: see section 13.

To exercise any of these, email info@endorphonics.com. We will respond within 30 days. We may need to verify that the request comes from the device the data belongs to. Since we hold no name or email, that device identifier is the only way we can tell whose data is whose, and we will not hand your data to someone who cannot show they control it.

11. How the App learns, and why this consent is required

Every time you rate a song while it plays, and tell us your pain before and after a session, that feedback teaches the system what eases your pain. It shapes what gets made for you next. Session over session, the music is meant to fit you better, and the only way it can is by learning from what you reported last time.

On the welcome screen you consent to exactly that: using your information to develop, train, test and improve endorphonics' own artificial-intelligence models, the systems that decide what music to design for someone in pain.

Unlike most of what is described in this policy, this consent is required to use endorphonics. We would rather explain why than present it as a choice it is not.

endorphonics is not a music player with a questionnaire attached. Its whole function is to work out which music reduces your pain and then make more of what works, and that learning is the model training described here. Without it the App would generate songs and forget what happened to you, which is the opposite of what it is for. The main beneficiary is you: your next session is shaped by your own last one. What other listeners report also helps us start somewhere sensible for you on day one, before you have rated anything, and your feedback does the same for them.

So if you are not comfortable with this, we would rather you did not use the App than use it without understanding what it does. You can stop at any time and delete everything we hold, as described below and in section 9.

A word on "anonymous". Your records carry no name, email or account, only a random ID, and before your data is used for training we strip that ID and other identifying details. We will not, though, tell you the data is fully anonymous, because it is not: Quebec law reserves that word for information that can never be linked back to a person, and since the App has to recognise you between sessions in order to learn from you, yours can be. In law, what we do is called using de-identified information rather than anonymized information. We would rather say that plainly than overstate it.

The information that may be used for this is:

• Your music taste (the genres and artists you listed) and the musical briefs generated from it.
• How you listened: plays, skips, how far into a track you skipped, completion, and favourites.
• Your helpfulness ratings on the −2 to +2 scale, including the point in the song at which you gave them.
• Your session pain readings before and after listening, the conditions and pain areas you chose to share, and your age range and gender if you gave them. "Which music helped which kind of pain, for whom" is precisely what such a system has to learn.

This is the only purpose for which your pain and health information is used beyond your own personalization and your own statistics, and it happens only inside our own systems. Your pain and health information is never sent to an outside AI company, and is never used to train anyone else's models.

Because this consent is a condition of using the App, we hold ourselves to firm limits on it. We will not:

• Sell your information, or share it for advertising or marketing.
• Publish anything that could identify you.
• Use it to make any decision about you as an individual, about your health, your treatment, or your eligibility for anything, or disclose conclusions about you to an insurer, an employer, or anyone else.
• Let another company train its own models on it.
• Include the free-text notes you write in your own words. Those are removed before training data is built.
• Use the app-usage records described in section 7 for any of this. Those exist to find problems in the App, they are optional, and they are kept out of training data.
• Use more of your information than the learning actually needs.

What gets trained describes patterns across many people. It is not a record of you, and it is not designed to reproduce anything you wrote or reported.

Withdrawing, and one honest limit. Because this consent is required to use the App, withdrawing it means stopping: tap "Delete all my data", behind "Settings" in the "You" tab, and remove the App. That deletes the records described in section 9 and stops your information being used in any future training. But we have to be straightforward with you. A model that has already been trained cannot practically have one person's contribution extracted from it again. Deleting your data stops future use; it does not un-train a model that already exists.

12. Keeping your information safe

• Everything travels between the App and our servers over encrypted HTTPS/TLS connections.
• Your device identifier is held in the iOS Keychain, not in ordinary app storage.
• Your audio, cover art and taste summary sit in private storage that is not publicly listable; the App reaches them through short-lived expiring links.
• Access to our production database and storage is limited to those who need it to operate the service.

No system is perfectly secure, and we cannot guarantee absolute security. If a confidentiality incident involving your personal information presents a risk of serious injury to you, we will notify you and the Commission d'accès à l'information du Québec promptly, as Law 25 requires, and we keep a register of such incidents.

13. Complaints

If you are unhappy with how we handle your personal information, please contact info@endorphonics.com first. We would like the chance to put it right.

You can also complain to a regulator. In Quebec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) oversees Law 25. Federally, the Office of the Privacy Commissioner of Canada (priv.gc.ca) oversees PIPEDA.

14. Children

The App is for adults 18 and older, and we do not knowingly collect information from anyone younger. If you believe we have, email info@endorphonics.com and we will delete it.

15. Changes to this policy

If we change how we handle your information in a way that matters, we will ask you to review and accept the updated policy in the App before you continue, and, where the law requires it, we will ask for fresh consent rather than assume the old one still covers a new purpose. The version and effective date are shown at the top of this document.

16. Contact us

Lucas Gomez Person in charge of the protection of personal information Endorphonics Inc. info@endorphonics.com