Privacy Policy
Effective: December 1, 2026 · Last updated: November 2026
Pomocura, Inc. ("Pomocura," "we," "us"), a company based in California, USA, operates pomocura.com and the Velio: Eye Knows You mobile app (together, the "Service"). This Policy explains what personal information we collect, why, how long we keep it, who we share it with, and the rights you have. Washington residents should also read our Consumer Health Data Privacy Policy.
1. Information We Collect
- •Contact information: name, email address, and the content of messages you send through our website form or by email.
- •Account information (app): email address or sign-in identifier, display name, and app settings.
- •Iris and eye images you choose to capture in Velio, and data derived from them (for example, iris pattern features). These are biometric information and sensitive personal information.
- •Wellness information: the wellness scores, insights, and any optional details you enter (such as age range, lifestyle or diet preferences). This may be consumer health data under some state laws.
- •Device and usage data: device model, operating system, app version, crash logs, and in-app activity, collected automatically to run and secure the Service.
- •We do not collect precise location, contacts, or payment card numbers (app store purchases are processed by Apple or Google).
2. How We Use Information
- •To provide Velio features you request, including iris analysis and wellness insights.
- •To respond to inquiries and, only if you agree, to send launch news and product updates. You can unsubscribe at any time.
- •To improve our AI models — only with images and data you have separately and expressly agreed to contribute, and in de-identified form.
- •To maintain security, prevent fraud and abuse, fix errors, and comply with legal obligations.
- •We do not use your information for targeted advertising, and we do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
3. Biometric Information
- •Before capturing any iris image, we tell you in the app what is collected and why, and ask for your express consent. You can use the website without providing biometric information.
- •We never sell, lease, trade, or otherwise profit from your biometric information, and we do not disclose it to third parties except service providers processing it on our behalf, or where required by law or valid legal process.
- •Retention: we keep biometric information only as long as needed for the purpose you consented to. We permanently destroy it when that purpose is fulfilled, when you withdraw consent or delete your account, or within 1 year after your last use of Velio — whichever comes first — unless a law requires us to keep it longer.
- •Biometric information is encrypted in transit and at rest and handled with at least the same care we use for our most sensitive business information.
4. How Long We Keep Information
- •Contact form messages: up to 3 years after our last communication, then deleted.
- •Account and wellness data: while your account is active; deleted within 30 days after you delete your account, except backups, which are overwritten within 90 days.
- •Device and usage logs: up to 12 months.
- •Information we must keep by law (for example, tax or dispute records) is kept only for the required period.
5. Sharing and Service Providers
- •We use service providers to operate the Service, such as cloud hosting and database services, email delivery, analytics and crash reporting, and our software development partner. They may use your information only to provide services to us, under written contracts requiring confidentiality and security.
- •Our research and clinical partner may receive de-identified data only for model development you have consented to.
- •We may disclose information if required by law, to protect rights and safety, or as part of a merger or acquisition, in which case this Policy will continue to apply to your information.
- •We do not sell personal information and do not "share" it for cross-context behavioral advertising, as those terms are defined under California law.
6. International Transfers
- •Pomocura is based in the United States, and our development and clinical partners are located in the Republic of Korea. Your information may be stored or processed in the United States and Korea. Where required, we transfer data only with appropriate safeguards and with your consent.
7. Your Privacy Rights
- •Depending on where you live — including California (CCPA/CPRA), Washington, Texas, Colorado, Virginia, Korea, and other jurisdictions — you may have the right to: know what personal information we hold and how we use it; access or receive a copy of it; correct it; delete it; withdraw consent; and limit our use of sensitive personal information.
- •To exercise a right, email ceo@pomocura.com with the subject "Privacy Request." We will verify your identity, respond within 45 days (or the shorter period required by local law), and will not discriminate against you for exercising your rights. You may use an authorized agent.
- •If we deny your request, you may appeal by replying to our decision. If you are not satisfied, you may contact your state Attorney General or local data protection authority.
8. Children
- •The Service is not directed to children under 14, and we do not knowingly collect personal information from children under 14. Users aged 14–17 should use Velio only with a parent or guardian's involvement. If you believe a child has provided us information, contact us and we will delete it.
9. Security and Breach Notification
- •We use administrative, technical, and physical safeguards, including encryption, access controls, and least-privilege access for staff and partners. No system is perfectly secure.
- •If a breach affects your personal or health information, we will notify you and the appropriate authorities as required by applicable law, including the FTC Health Breach Notification Rule where it applies.
10. Cookies and Similar Technologies
- •Our website uses only cookies and local storage needed for it to work (for example, language preference and sign-in). We do not use advertising cookies. If we add analytics, we will update this Policy and honor Global Privacy Control signals.
11. Changes and Contact
- •We will post any changes here and update the date above. If changes are material, we will notify you in the app or by email before they take effect.
- •Privacy contact: Ivy Kim, CEO (Privacy Officer), Pomocura, Inc., California, USA — ceo@pomocura.com
