JUURIHARJA CONSULTING OY — PRIVACY POLICY

Last updated: 15 September 2026

1. CONTROLLER

The controller of your personal data is Juuriharja Consulting Oy (Business ID: 3592931-1), Runeberginkatu 61 C, 00260 Helsinki, Finland ("we", "us", "AuGo").

For questions about this privacy policy or the processing of your personal data, please contact us at: compliance@juuriharja.fi.

2. SCOPE OF THIS POLICY

This privacy policy describes how Juuriharja Consulting Oy collects, uses, stores, and protects your personal data when you (i) use the AuGo wellbeing and AI coaching application (the "Service"), (ii) interact with our website, waitlist, or pilot application, (iii) receive marketing or business-to-business communications from us, or (iv) are otherwise recorded in our customer and marketing database. AuGo is a B2B and B2C AI coaching application for founders and senior executives. The Service connects wearable data, calendar signals, and your self-reported state into daily wellbeing scores and personalised AI coaching.

We comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection legislation. We are committed to processing your personal data in a transparent and lawful manner and to protecting your privacy.

3. PERSONAL DATA WE COLLECT AND SOURCES

We collect and process personal data directly from you and, for business-to-business outreach, from publicly available sources and third-party data providers. When you use the AuGo application, no health-related data is collected before you complete our per-stream consent flow. We collect the following categories of personal data:

Identity data: your email address and password, used for account registration and authentication.

Usage Information: log data, device details, and location (if applicable).

Financial Data: bank account details and purchase history.

Relationship Information: contract information, payment details, and billing information.

Wearable health data: physiological data from your wearable device, including sleep duration and quality, heart-rate variability (HRV), resting heart rate, and physical activity. This data constitutes data concerning your health under GDPR Article 9(1).

Check-in data: your daily self-reported energy level and cognitive sharpness, entered through two multiple-choice questions each morning. This data constitutes data concerning your health under GDPR Article 9(1).

Calendar data: the timing of events from your device’s calendar (start time, end time, all-day flag) and your device time zone.

Coaching conversation data: the text of your conversations with the AuGo AI coach, including your messages and the coach’s responses. Because coaching conversations may include descriptions of your physical and mental state, this data constitutes data concerning your health under GDPR Article 9(1).

Derived data: computed personal baselines, three category wellbeing scores, and a combined daily score derived from the data streams above. These constitute data concerning your health under GDPR Article 9(1).

Waitlist and pilot application data: your email address, name, company details, and answers you provide in the optional pilot application questionnaire (such as pilot interest, primary device, wearable devices, work-life challenges, age range, gender, country of residence, professional role, and organisation size), together with your consent records, application status, and communication preferences.

Marketing and customer relationship data: first and last name, email address, phone number, company name, title or profession, marketing preferences and restrictions, and data related to website usage (such as form submission details).

Business-to-business outreach data: professional contact data such as name, work email address, job title, company, and professional profile details, obtained from service providers and publicly available business sources.

Technical and campaign data: IP address, browser information, campaign attribution identifiers (referral source, campaign, page, language, and submission time), and advertising interaction data from campaigns.

For the AuGo application, all personal data is collected directly from you. For marketing and business-to-business outreach, we may also collect professional contact data from publicly available business sources, professional networks, and third-party data providers such.

4. SPECIAL CATEGORIES OF PERSONAL DATA

AuGo processes data concerning your health within the meaning of GDPR Article 9(1). This includes your wearable-derived physiological data, check-in answers, computed wellbeing scores, coach memory, and coaching conversation text. These data categories may reveal information about your physical or mental health status and are classified as special categories of personal data under the GDPR. We process these data only based on your explicit consent (see Section 5 below).

5. PURPOSES AND LEGAL BASES FOR PROCESSING

We process your personal data for the following purposes and on the following legal bases:

Offering the Service: wellbeing scoring - computing your personal baselines, category scores, and combined daily wellbeing score. Data categories: wearable health data, check-in data, and derived data. Legal basis: your explicit consent under GDPR Article 9(2)(a), paired with Article 6(1)(a).

Offering the Service: AI coaching - generating personalised AI coaching responses, maintaining coach memory, and providing science-based recommendations. Data categories: coaching conversation data, derived wellbeing signals (in pseudonymous form), and coach memory. Legal basis: your explicit consent under GDPR Article 9(2)(a), paired with Article 6(1)(a).

Offering the Service: Schedule analysis - understanding your daily schedule patterns to inform coaching recommendations. Data categories: calendar data. Legal basis: your consent under GDPR Article 6(1)(a).

Offering the Service: identity data - for account registration, authentication, and billing. Legal basis: performance of a contract under GDPR Article 6(1)(b).

Offering the Service: account management - account registration, authentication, and login. Data categories: identity data (email address and password). Legal basis: performance of a contract under GDPR Article 6(1)(b).

Service improvement and analytics: analysing aggregated and anonymised usage patterns to improve the Service. Data categories: anonymised or aggregated usage data and technical logs. Legal basis: our legitimate interest under GDPR Article 6(1)(f) in improving our products and services. We have assessed that this interest is not overridden by your rights and freedoms.

Security and fraud prevention: maintaining the security and integrity of the Service, detecting unauthorised access, and preventing abuse. Data categories: technical log data, session tokens, and IP addresses. Legal basis: our legitimate interest under GDPR Article 6(1)(f) in maintaining a secure service.

Legal compliance: meeting legal obligations applicable to us and responding to lawful requests. Data categories: all categories as necessary. Legal basis: compliance with a legal obligation under GDPR Article 6(1)(c).

Marketing communications: sending you newsletters, service updates, beta invitations, and other marketing content you have signed up to receive, and managing your waitlist registration and optional pilot application. Data categories: waitlist and pilot application data, identity data (email address). Legal basis: your consent under GDPR Article 6(1)(a). You may withdraw consent at any time.

Business-to-business outreach: contacting relevant business professionals about AuGo and managing their responses and opt-out requests. Data categories: business-to-business outreach data. Legal basis: our legitimate interest under GDPR Article 6(1)(f) in conducting relevant B2B direct marketing, after assessing those interests against your rights and freedoms. Where consent is required for a particular marketing channel or recipient, we obtain it before contacting you. You can object to direct marketing at any time.

Advertising measurement: measuring the effectiveness of our advertising campaigns and supporting relevant advertising, including retargeting. Data categories: technical and campaign data, advertising interaction data. Legal basis: your consent under GDPR Article 6(1)(a).

For the application, your consent is collected separately for each data stream (wearables, check-in, calendar, coaching) before any data from that stream is collected. Each consent is individually revocable at any time. The Service may function with reduced features if you do not grant consent for a particular data stream.

AuGo does not perform automated decision-making that produces legal effects or similarly significantly affects you (GDPR Article 22). Your wellbeing scores inform coaching suggestions only.

AuGo is not intended to be used for medical purposes, is not a medical device and does not provide medical advice, diagnosis, or treatment.

You are not required to provide personal data for any particular app data stream. The Service functions with reduced features if you do not grant consent for a given stream. However, identity data (email and password) is required to create an account, and without it the Service cannot be provided.

6. HOW THE AI COACH WORKS

The AuGo AI coach is powered by an AI language model When the coach generates a response, it receives: a) your chat message and recent conversation turns; b) derived wellbeing signals in pseudonymous form; c) whitelisted coach-memory facts that you can view and delete; and
d) excerpts of published scientific research.

The AI model never receives your name, email address, any identifier, raw wearable measurement streams, or calendar events. The AI model does not store your prompts or responses after processing and does not use them for model training. EU-only processing is enforced in software.

7. COOKIES AND TRACKING

With your consent, we may use the cookies and tracking pixels on our website to measure the effectiveness of our advertising and support relevant advertising, including retargeting. The pixel may collect information about your device and browser, the pages you visit and actions you take on our website, together with cookie and advertising identifiers, and share this information with service providers. We activate the pixel only after you consent to advertising cookies. You can reject these cookies or withdraw your consent at any time through our cookie settings. We do not send your questionnaire answers or personal application continuation links to service providers.

Website analytics: we use Google Analytics 4, provided by Google Ireland Limited, on our public landing pages with advanced Consent Mode. Before you choose, or when you decline analytics cookies, Google receives cookieless measurement signals, including page and campaign information, browser/device information and consent status. These signals can support aggregate modelling; they do not provide a complete record of individual visits. With your separate analytics consent, Google also uses analytics cookies and receives successful waitlist signup events. We do not send email addresses, questionnaire answers or personal application continuation links to Google Analytics, and do not load it on the personal application page. Google advertising features and automatic enhanced measurement are disabled. The legal basis for cookie-based analytics and signup measurement is your consent under GDPR Article 6(1)(a). You can reject analytics or withdraw your consent using Cookie settings. Analytics cookies (_ga and _ga_…) last up to 180 days. Google may process website analytics data outside the EU/EEA under the safeguards described in Section 9. Google Privacy Policy.

8. DATA SHARING AND RECIPIENTS

We do not sell, share for advertising purposes, or otherwise transfer your personal data to third parties for their own purposes. No employer, advertiser, or other third party receives your individual data.

We may share your personal data with the following categories of recipients:

(a) Identification service providers.

(b) Cloud and AI solution service providers.

(d) Banking and financial service providers

(e) Professional service providers

(g) Website and marketing infrastructure providers

We may disclose your personal data where required by law or to protect our legal interests.

9. INTERNATIONAL TRANSFERS

Personal data processed through the AuGo application is stored and processed entirely within the European Union. No AuGo application data is transferred outside the EU/EEA.

In connection with our website, marketing activities, and business-to-business outreach, some of our service providers may process data outside the EU/EEA, including in the United States. Where this happens, we rely on an applicable adequacy decision (such as the EU-US Data Privacy Framework) or appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, as required by applicable law. You can contact compliance@juuriharja.fi for information about the safeguards in place and how to obtain a copy.

10. DATA RETENTION

We retain your personal data only for as long as necessary for the purposes described in this policy. The following retention rules and periods apply:

(a) Coaching conversation text is automatically and permanently erased when the conversation closes. Only the short factual coach memory summary is retained.

(b) Coach memory items are retained while your account is active and are individually deletable at any time. You can also clear all coach memory at once.

(c) Wearable data, check-in data, calendar data, and computed wellbeing scores are retained while your account is active.

(d) If you withdraw consent for a specific data stream, you will be asked whether to delete or keep the stored data for that stream. Deletion is the default.

(e) If you delete your account, all personal data is removed from the Service, including your identity record at the identity service.

(f) Waitlist and pilot application data is retained until beta launch invitations are complete, or until you ask us to delete it, whichever is sooner.

(g) Marketing and customer relationship data is retained for the duration of the customer relationship and for a reasonable period thereafter for follow-up communications and legal compliance, or until you object to processing or withdraw consent.

(h) If you opt out of marketing, we may retain the minimum information needed to honour your opt-out request and prevent further marketing contact.

When personal data is no longer needed for any of the above purposes, it is deleted or anonymised within a reasonable timeframe.

11. YOUR RIGHTS

Under the GDPR, you have the following rights regarding your personal data:

(a) Right of access: you can request a copy of the personal data we hold about you.

(b) Right to rectification: you can request correction of inaccurate or incomplete personal data.

(d) Right to restriction of processing: you can request that we restrict the processing of your personal data in specific situations.

(e) Right to data portability: you can receive everything the Service holds about you in one machine-readable file.

(f) Right to withdraw consent: you can withdraw your consent for any data stream at any time in the app settings, without affecting the lawfulness of processing carried out before withdrawal.

(g) Right to object: you have the right to object at any time to the processing of your personal data for direct marketing purposes, including related profiling. If you object, we will stop using your data for that purpose. You can use the unsubscribe option in our emails or contact compliance@juuriharja.fi.

We respond to data subject rights requests without undue delay and in any event within one (1) month of receipt.

12. RIGHT TO FILE A COMPLAINT

If you consider that your personal data has been processed in violation of applicable data protection legislation, you have the right to file a complaint with the competent supervisory authority. In Finland, the competent authority is the Office of the Data Protection Ombudsman (tietosuojavaltuutetun toimisto), www.tietosuoja.fi. You may also lodge a complaint with the supervisory authority of your habitual residence or place of work.

13. DATA SECURITY

We take appropriate technical, physical, electronic, and procedural measures to protect your personal data from loss, destruction, unauthorised access, disclosure, or other misuse, in compliance with applicable legal requirements. We limit access to personal data to those authorised employees and service providers who need to know the information in the course of their duties. They will only process your personal data based on our instructions and are subject to a duty of confidentiality. We regularly test our systems to ensure they remain secure.

Personal data is stored in an encrypted database. Data is always encrypted at rest. Our databases are not directly accessible from the public internet and can only be reached via privileged application servers. Our application servers, database servers, and other infrastructure are located in a highly secured environment to prevent direct access from the outside world.

Although we make every effort to store your data in a secure operating environment, no data transmission or storage is 100% risk free. You provide your personal data at your own risk and we cannot guarantee the absolute security of your data. In the event of a security breach that endangers your privacy or personal data, we will inform you and the relevant supervisory authorities as required by law. We may also temporarily shut down services to protect personal data where necessary.

In case of a personal data breach, we will notify both the relevant supervisory authority and affected individuals where required by applicable law.

14. CHANGES TO THIS PRIVACY POLICY

We may update this privacy policy from time to time to reflect changes in our processing activities, legal requirements, or our services. We will notify you of significant changes through the AuGo application, our website, or by other appropriate means. We encourage you to review this privacy policy periodically.

15. CHILDREN’S DATA

The Service is not intended for persons under the age of 16. A self-asserted age verification is performed at sign-up. We do not knowingly collect personal data from persons under 16. If you believe we have inadvertently collected data from a person under 16, please contact us immediately at the address in Section 15 below, and we will take prompt steps to delete such data.

16. CONTACT

If you have any questions about this privacy policy or the processing of your personal data, or if you wish to exercise your data subject rights, please contact us at:

Juuriharja Consulting Oy
Business ID: 3592931-1
Runeberginkatu 61 C, 00260 Helsinki, Finland
compliance@juuriharja.fi