UK Privacy Addendum

This UK Privacy Addendum applies when Norena offers or provides its Services to people in the United Kingdom. It supplements the Privacy Policy. If the documents conflict, this Addendum takes priority to the extent required by UK data protection law.

1. Who is responsible for your information

The controller is:

Norena Technologies AG
Wadsack Zug AG
Bahnhofstrasse 7, 6300 Zug, Switzerland
CHE-202.093.568
Email: privacy@norena.ai

Norena is established in Switzerland. Questions about UK representation, privacy rights or this Addendum may be sent to the privacy address above.

2. What Norena is—and is not

Norena is an AI-powered everyday companionship, reminder and family-story service. It is not a medical device, healthcare app, diagnostic or treatment service, emergency service, safety-monitoring system, or professional care service. It does not monitor whether a person has taken medication and must not be relied on for medical or safety-critical decisions.

3. The people covered by this Addendum

This Addendum covers account owners, older adults for whom a profile is prepared, invited family members, and website or App users in the UK.

An account owner may prepare a profile as a gift, but that does not give them authority to make every privacy decision for the older adult. Before the older adult begins using Norena, we provide them with a clear notice and choices appropriate to the information being processed. If another person is acting for them, we may ask for evidence of authority or an appropriate capacity and best-interests decision.

4. Information and lawful bases

We use the following UK GDPR lawful bases:

• Provide and administer the service: account, contact, profile, subscription, reminders, conversations and chosen sharing settings—necessary to perform our contract or take requested pre-contract steps.
• Keep the service safe and reliable: security logs, fraud prevention, fault diagnosis and limited service analytics—our legitimate interests, balanced against your rights.
• Meet legal duties: payment, tax, accounting, rights requests and regulatory records—compliance with legal obligations.
• Optional communications or research: where required, your consent.

Information about health, religion, ethnicity or another special category may arise in a profile or conversation. In addition to an Article 6 basis, we use an appropriate Article 9 condition. For optional special-category features or research, this will normally be explicit consent, presented separately and capable of being withdrawn.

A voice recording is personal data. We do not treat it as biometric special-category data unless it is technically processed to uniquely identify a person. Norena does not use voice recordings for unique identification unless we first provide a specific notice and establish a lawful basis and Article 9 condition.

5. AI processing and model training

AI is used to generate conversational responses, organise stories and operate requested features. AI output may be inaccurate and must not be used for medical, emergency or safety-critical decisions.

Personal conversations, voice recordings or special-category data are not required to be used to train general AI models in order to receive the paid core service. Any optional model-training or research use that relies on consent will be presented as a separate, specific choice. Refusing or withdrawing that optional consent will not remove access to the core paid service. Withdrawal does not affect processing that was lawful before withdrawal.

6. Information provided by a purchaser

When a purchaser gives us an older adult's name, relationship information, preferences or a starting memory, we receive that information from the purchaser rather than directly from the older adult. We use it only to prepare the requested private profile and invitation. We provide the older adult with this Addendum and relevant choices when they redeem the private code, and in any event within the period required by Article 14 UK GDPR unless a lawful exception applies.

The purchaser should provide only what is needed, avoid entering medical details, and tell the older adult that a profile is being prepared unless doing so would be inappropriate or unsafe.

7. Sharing and processors

We share information only as needed with contracted providers supporting hosting, payments, communications and AI processing; people the older adult chooses to connect with; professional advisers; and public authorities where legally required. We do not sell personal information.

Family members do not automatically receive access to conversations or stories. Sharing is controlled through the user's settings or by an appropriately authorised representative.

8. International transfers

Information is hosted in Switzerland, which is recognised by the UK as providing adequate protection. If a provider processes information in another country, we use a valid UK transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, together with an appropriate transfer-risk assessment.

9. Retention

We keep personal information only for a defined purpose and period:

• active account and service information: while the account is active;
• personal conversations, voice recordings and stories: until the user deletes them or the account is deleted, subject to a short technical backup cycle of up to 90 days;
• an account scheduled for deletion: removed from active systems within 30 days after identity verification, unless a legal hold applies;
• payment, contract and tax records: for the period required by applicable law, which may be up to 10 years;
• optional research or model-training data that remains identifiable: for the period stated when consent is requested, no longer than necessary, and subject to withdrawal rights.

Data that has been irreversibly anonymised so nobody can reasonably be identified is no longer personal data. Pseudonymised data remains personal data and is protected accordingly.

10. Your UK rights

Depending on the circumstances, you may ask us to provide access, correct information, erase it, restrict processing, transfer it, stop direct marketing, or consider an objection. You may withdraw consent at any time. You also have safeguards relating to solely automated decisions that produce legal or similarly significant effects. Norena does not currently make such decisions about users.

Email privacy@norena.ai to exercise a right. We may request proportionate information to confirm identity. We normally respond within one month.

11. Privacy complaints

Send a complaint to privacy@norena.ai with enough detail for us to investigate. We will acknowledge a data protection complaint within 30 days, investigate it without undue delay, keep you informed where appropriate, and explain the outcome.

You may also complain to the UK Information Commissioner's Office through ico.org.uk/make-a-complaint. We would appreciate the opportunity to address the concern first, but you are not required to contact us before the ICO.

12. Security incidents

We use proportionate technical and organisational safeguards. Where a personal-data breach is likely to create a risk to people, we notify the ICO without undue delay and, where feasible, within 72 hours after becoming aware of it. Where the breach is likely to create a high risk, we also notify affected people without undue delay.

13. Marketing and cookies

An invitation sent to a family member is a service message and will not contain promotional marketing. We seek the recipient's own permission before sending marketing where required. Non-essential cookies or similar technologies are not set until the required choice has been made.

14. Related documents

See the Privacy Policy, Terms of Service, UK Consumer Terms, Cancellation & Refund Policy, and account deletion page.