Privacy Policy

Calmside helps you keep a record of your migraines and understand the patterns around them. You can log attacks, daily context such as sleep and mood, medications and relief, hormonal health, and notes, by tapping through screens or by talking or typing to Lumi, the in-app assistant. The App turns your record into trends and hedged observations, and into a report you can share with your doctor.

Calmside is not a medical device. It is not approved or cleared by the Central Drugs Standard Control Organisation (CDSCO) or any other regulator, does not diagnose or treat any condition, and is not a substitute for medical care. Lumi is a software assistant, not a clinician. If you are in pain that worries you, contact a doctor or emergency services.

Most of what the App holds is health data you choose to record. The App works with as little as you give it. Every field in the record is optional unless marked.

3.1 Account and profile

Sign-in is passwordless. We never hold a password for you. A sign-in by email uses a one-time code sent to your inbox.

3.2 Your migraine record

3.3 Conversations with Lumi

When you type to Lumi, the text of the conversation is processed and stored with your account.

When you talk to Lumi, the App records your voice only while a call is live and streams it to our Lumi service for speech recognition and response. The transcript and Lumi’s replies are stored with your account as part of the conversation. The audio itself is processed in real time and is not retained as a recording.

Whatever you tell Lumi about your health is treated as health data under this policy.

3.4 Data read from your device, with your permission

Each of the following is off by default, switched on by you, and can be switched off at any time in Settings → Data Center or in Android settings.

3.5 Information collected automatically

The App sends technical data needed to run the service: a device identifier for your session, app version, operating system version, timestamps, and error reports. Our hosting providers keep server and security logs (IP address, request timestamps) for the time needed to operate and protect the service.

The App uses product analytics to understand which features are used and where the App fails, so we can improve it. Analytics events carry a pseudonymous identifier and describe actions such as “attack logged” or “report opened”. They never carry the content of your record, your conversations, or your health data. We do not use advertising identifiers and we show no advertising.

3.6 What we do not collect

Government ID numbers, card or bank details, biometric identifiers, contacts, photos, files, background location, or the content of other apps.

3.7 Payments

Calmside has a free plan and a paid plan. If you subscribe, the purchase is made through Google Play Billing. Google processes your payment and holds your payment details; we never see them. We receive from Google only what we need to run your plan: the product you bought, when it started and when it renews or ends, and an order identifier for support. Subscriptions are managed, cancelled and refunded through Google Play.

We process your personal data on the basis of your consent, given when you create an account, when you switch on each optional feature in 3.4, and separately for research contribution (section 7). You can withdraw any of these at any time.

We do not sell your personal data. We do not share it with advertisers. We do not use it to train publicly available AI models.

Your data is handled by a small set of service providers, each engaged as a Data Processor under contract, acting only on our instructions and barred from using your data for their own purposes.

Your doctor receives your clinician report only when you export and share it yourself. We do not send it to anyone.

We disclose personal data to government authorities or courts only where required by law.

Your account and health record are stored in India (Mumbai). Lumi processing, including speech recognition, takes place in India. Two providers process limited data outside India: Open-Meteo receives coordinates and time, and PostHog receives analytics events, both in the European Union. Google Sign-In and Google Play Billing use Google’s global infrastructure. Where data leaves India we require contractual protections and rely on providers operating under recognised security standards. We do not transfer personal data to any country or territory restricted by the Central Government under Section 16 of the DPDP Act.

A copy of your record is also kept on your phone, so the App works offline. It is stored in the App’s private storage and your session is protected by the Android Keystore. Uninstalling the App removes that copy; it does not delete your account (see section 9).

Calmside supports migraine research. You can contribute your record, in de-identified form, to help researchers understand how migraine behaves across many people.

• Opt-in, and off by default. Nothing is contributed unless you switch on Help Migraine Research, offered during onboarding and in Settings → Data Center. When you do, the App shows you a consent notice that states what is contributed and how it is used, and asks you to agree before anything leaves your account.
• What is contributed. Your attacks, daily logs, medications, hormonal health entries and the context the App adds to them, such as sleep and weather, together with your age range and gender.
• What is removed. Your name, email address, the name Lumi calls you, the notes you give Lumi, your conversations with Lumi, your location, and every device and account identifier. Each contribution carries a random research code that cannot be traced back to your account.
• Where it goes. A separate research store, apart from your account and record, held in India. It is used only for migraine research, by Modner and by research partners we engage under confidentiality and the same restrictions.
• How it is used. Findings are published or shared only in aggregated form. No one is ever identified, quoted or singled out.
• Withdrawing. Switch Help Migraine Research off at any time. Contribution stops at once. Data already contributed carries no identifier that links it to you, so it cannot be located and removed; it remains in the research store under the restrictions above.

De-identified data can in some circumstances still be linked back to a person, so we continue to treat it carefully rather than calling it anonymous.

You can delete everything yourself, from inside the App, at any time.

• Delete Account (Settings, in the Danger Zone at the bottom) permanently deletes your login, your entire record, your Lumi conversations and profile, and your settings, from our servers and from the phone. The App returns to the sign-in screen. This cannot be undone.
• Reset My Data (same place) deletes your record, conversations and Lumi profile but keeps your account and settings, so you can start again.
• Deleting a single attack, log or note removes it from your record and from the insights computed from it.

To request deletion without the App, email connect@modnertech.com from the address you signed up with, with the line “please delete my Calmside account”. We will verify it is you, delete the account and everything in it, and confirm within 30 days. Backups holding your data are overwritten within 30 days after that. See Delete your account for the step-by-step.

The App is for people 18 years of age and over. The DPDP Act treats anyone under 18 as a child and requires verifiable parental consent before their data is processed. The App does not provide that mechanism, so people under 18 must not create an account. If we learn that we hold a person’s data without that consent, we will delete it. A parent or guardian may write to connect@modnertech.com at any time.

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correction, completion, updating and erasure. Most of this you can do directly in the App.
• Withdraw consent at any time, as easily as you gave it: switch off a feature in Data Center, or delete your account. Withdrawal does not affect processing already carried out lawfully.
• Grievance redressal. Complain to us first and receive a response.
• Nominate someone to exercise your rights if you die or become incapacitated.
• Complain to the Data Protection Board of India if you are not satisfied with our response.

You also have a duty under the Act to provide authentic information and not to file false or frivolous grievances.

To exercise a right, email connect@modnertech.com from the address on your account. We will verify it is you and respond within 30 days.

Name

Abhinav TV

Designation

Grievance Officer, Modner Technologies Private Limited

Email

connect@modnertech.com

Postal address

Incubation Center IIT Patna, Bihta, Patna 801106, Bihar, India

Response time

Within 30 days of receipt

If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India.

• Your record is stored in a managed database in India with row-level security, so each row is reachable only by the account that owns it.
• Encryption in transit (HTTPS/TLS, and encrypted WebRTC for voice) and at rest, as provided by our infrastructure providers.
• On the phone, your session token is held in the Android Keystore and the local record in the App’s private storage.
• Sign-in is passwordless, so there is no password of yours to be stolen.
• Reminders and home-screen widgets show generic text only, so nothing on a locked screen reveals a medicine or a condition.
• Access to production data is limited to the Modner team members who need it, and logged.

No system is perfectly secure. If a personal data breach occurs, we will notify each affected person and the Data Protection Board of India in the manner and within the timelines the DPDP Rules require.

Refusing any permission leaves the rest of the App working.

The DPDP Act, 2023 and the DPDP Rules, 2025 are being brought into force in phases, with the substantive obligations on notice, consent, children’s data, security safeguards and breach reporting applying from 13 May 2027. We align with those requirements now, because we are asking you to trust us with information about your health.

If we make a material change, such as a new purpose, a new provider, or a new category of data, we will update this page, change the version and effective date, and notify you in the App before it takes effect. Where the law requires fresh consent, we will ask for it.

Modner Technologies Private Limited
Ward No. 4, Rosera, Prabhu Thakur Mohalla, Rosera, Samastipur 848210, Bihar, India
General: connect@modnertech.com
Privacy and data rights: connect@modnertech.com