Privacy Policy

Nature Unlock · Version 2026-07-06 · Last updated 6 July 2026

This policy explains how Nature Unlock collects, uses, and protects your personal data, including health-related information you provide during the scoliosis assessment. We process this data only with your explicit consent.

1. Who we are

Nature Unlock ("we", "us") operates naturefitscoliosis.com and provides scoliosis movement assessments, coaching, and educational content. For any privacy request, contact us at naturesweet509@gmail.com.

2. What data we collect

Category	Examples
Identity & contact	Name, email address, Google account (if you sign in with Google)
Health data (special category)	Scoliosis type, Cobb angle range, pain / mobility / confidence ratings, symptoms, goals, and anything you share with the coach
Assessment responses	Your answers to the movement and clinical questions
Payment data	Plan, amount, transaction references (card details are handled by Flutterwave, not stored by us)
Technical	IP address, session identifiers, basic usage/analytics events

3. How and why we use it (lawful basis)

To generate your assessment report and coaching — based on your explicit consent (GDPR Art. 9(2)(a)) for health data.
To provide your account, membership, and access — to perform our contract with you.
To process payments — to perform our contract and meet legal/accounting obligations.
To secure the service and prevent abuse (e.g. audit logs, rate limiting) — our legitimate interests.
To measure our funnel (aggregate analytics) — our legitimate interests.

4. AI processing of your assessment

To generate your report and coach replies, your assessment answers are sent to our AI provider (OpenRouter, routing to the selected model). These requests are de-identified — they contain your answers but not your name or email. We configure no-logging/no-training options where available. By consenting to the assessment you agree to this processing.

5. Who we share data with (processors)

Processor	Purpose
Cloudflare	Hosting, database, and storage (data encrypted at rest)
OpenRouter (+ selected AI model)	Generating your report and coach replies (de-identified)
Flutterwave	Payment processing
Google	Optional sign-in (only if you choose Google)

We do not sell your personal data.

6. International transfers

Some processors are located outside your country. Where data is transferred internationally, we rely on appropriate safeguards and, for AI processing, on de-identification so that health data is not linked to your identity.

7. How long we keep it (retention)

Anonymous assessment (lead) records: up to 12 months.
Analytics events: up to 12 months.
Security audit logs: up to 24 months.
Inactive, unpaid, unclaimed accounts: automatically deleted after 12 months.
Active member data: kept while your account is active; deleted on request or after account closure (payment records may be retained where legally required).

8. Your rights

You have the right to access, export, correct, delete, restrict, or object to the processing of your data, and to withdraw consent at any time. Signed-in members can:

Export all their data from the member area (Account → Export).
Delete their account and data (Account → Delete). This also withdraws consent.

You may also email naturesweet509@gmail.com to exercise any right, and you have the right to lodge a complaint with your local data protection authority.

9. Security

Passwords are stored hashed (PBKDF2). Data is encrypted in transit (HTTPS) and at rest. Access to member data is restricted and audited.

10. Children

The service is not directed to children under 16. If a minor uses it, a parent or guardian should provide consent and supervise use.

11. This is not medical advice

Nature Unlock provides movement education and coaching, not medical diagnosis or treatment. Always consult a qualified professional for medical concerns.

12. Changes

We may update this policy. Material changes will bump the version above and, where required, we will ask you to re-confirm consent.

Operator note (remove before launch): replace the contact email with a dedicated support/privacy address, add your registered legal entity name and address, name your EU/UK representative and DPO if applicable, and have this policy reviewed by a qualified lawyer for your jurisdiction. Sign Data Processing Agreements with Cloudflare, OpenRouter, Flutterwave, and Google.