Privacy Policy

1. Who we are

MDMS GROUP LLC ("we," "us," "our"), a company registered in Florida, United States, operates Keel by Orykas ("Keel"), a guided pelvic-floor training program for men available at keel.orykas.com. You can contact us about privacy at contact@orykas.com.

2. Scope

This policy explains how we handle personal information when you visit our website, create an account, answer our assessment, use the Keel program, or subscribe to a paid plan. It covers both our marketing site and the Keel application.

3. Information we collect

Information you provide:

• Account information — your email address and a password (stored in hashed form by our authentication provider; we never see or store your password in plain text).
• Assessment (quiz) answers — your situation (for example, whether you have had or are scheduled for prostate surgery), how long you have experienced leaks, how much protection you use on a typical day, when leaks happen, how well you can engage your pelvic-floor muscle, your goals (which may include supporting erectile recovery), and how much time you can train each day.
• Training activity — the guided sessions you complete (date, duration, position) and the milestones you reach.
• Evening check-ins — the number of leaks, pads or liners used, and how in control you felt each day, plus the weekly summaries built from them.
• Reminder preferences — whether reminders are on and at what time, and, if you enable browser notifications, the push subscription your browser creates for this purpose.
• Messages you send us — through the contact form or by email.

Information collected automatically:

• Basic technical and usage data such as IP address, browser and device type, and pages viewed. We use our own first-party analytics, stored in our own database, together with Amplitude product analytics (see Service providers below). Usage data is never shared with advertising networks, and we do not use third-party advertising trackers on Keel.
• Session recordings, on our public pages only. On our marketing and account pages — the home page, information pages, the article library, our legal pages, and the sign-in and sign-up pages — Amplitude records how the page is used (pages viewed, mouse movement, clicks, and scrolling) so we can see where the site is confusing. On-screen text is masked in these recordings, and what you type is never captured. Recording stops the moment you enter the Keel application: your assessment, your training sessions, your daily check-ins, your progress, and your Keel Coach conversations are never recorded.
• Essential cookies that keep you signed in (authentication session). You can control cookies in your browser settings; without the essential ones, sign-in does not work.

Payment information: payments are processed by Stripe. Your card details are entered on Stripe's payment page and never touch our servers. We store only your subscription status, plan, billing period dates, and Stripe customer/subscription identifiers.

4. Health information (consumer health data) — and how we protect it

Some of the information above — your assessment answers, leak and pad counts, and training activity — relates to your health. We treat it as sensitive ("consumer health data" under certain state laws, including the Washington My Health My Data Act):

• We collect it only with your consent, when you choose to answer the assessment and log your progress, and only to provide the Keel program: personalizing your training plan, showing your progress, and adjusting your program over time.
• We never sell it, rent it, or share it with advertisers or data brokers.
• We do not use it for third-party advertising and we do not allow third-party ad trackers on the app.
• It is stored with our database provider under access controls that restrict every account to its own rows (row-level security), and it is encrypted in transit.
• Only the service providers listed in section 5 process it, strictly on our behalf, to run the service.
• You can export it or delete it yourself at any time from Settings (see section 9), or email us and we will do it for you.

5. Service providers we share data with

We share personal data only with providers who process it on our behalf to run Keel:

• Supabase — database, authentication, and file storage.
• Vercel — website and application hosting.
• Stripe — payment and subscription processing.
• Resend — delivery of transactional account emails such as email confirmation and password reset.
• Browser push services (such as those operated by Apple, Google, or Mozilla) — delivery of the reminders you enable, through the push subscription your own browser creates.
• Klaviyo — email marketing, only where you have agreed to receive it.
• Amplitude — product usage analytics (which screens are used, where members drop off), so we can improve Keel. We send usage events and a pseudonymous identifier — never the content of your check-ins, assessments, or coach conversations. Amplitude also records screen activity on our public marketing and sign-in pages only, with on-screen text masked; recording is switched off throughout the Keel application.
• Anthropic — AI processing for the Keel Coach chat (Complete and Annual plans). When you send a question to Keel Coach, your message, the recent messages of that conversation, and a few non-identifying facts about your program (such as your situation and current program week) are sent to Anthropic to generate the answer. We do not send your name, email address, or account identifiers. Anthropic processes this data on our behalf and does not use it to train its models.

These providers act as our processors and may not use your data for their own purposes. Some may process data in the United States or other countries.

Keel Coach conversations: Keel Coach is an AI assistant, not a medical professional, and its answers are general wellness guidance — it never provides diagnosis or treatment. Your conversations are stored only on your own device (in your browser); we do not keep a server-side copy of your chat history. Clearing the conversation in the app, clearing your browser data, or deleting your account removes it.

6. How we use your information

• To provide the Keel program: build and adapt your personal training plan, guide your sessions, track your progress, and show your reviews.
• To manage your account and subscription, including billing through Stripe.
• To send service communications (email confirmation, password reset, payment and subscription notices) and the reminders you turn on.
• To send marketing communications where you have agreed to receive them, with a working unsubscribe link in every email; you can withdraw consent at any time. The box is selected for you at sign-up and you may clear it at any time, including from any email. It is never required to create an account, and it never affects service emails such as your login code, a password reset, or a payment receipt — those are sent because you have an account with us.
• To operate, secure, debug, and improve Keel, using first-party usage analytics and Amplitude product analytics (see Service providers above).
• To respond to your messages.

We do not use your personal information for automated decisions with legal or similarly significant effects, and we do not sell or rent it to anyone.

7. Data retention

• Account, program, and health data: kept while your account exists. Deleting your account (Settings → Delete my account) permanently removes your profile, assessment answers, sessions, check-ins, reviews, milestones, reminders, and push subscriptions.
• Billing records: kept as required for tax, accounting, and fraud-prevention purposes even after account deletion.
• Contact messages: kept as long as needed to handle your request.
• Usage analytics and technical logs: kept for a limited period for security and service improvement, then deleted or aggregated.

8. Security

We use encryption in transit (HTTPS everywhere), row-level security so each account can only read its own data, restricted administrative access, security headers, and rate limiting. No system is perfectly secure; if a breach affects your personal data, we will notify you as required by law.

9. Your rights and choices

Directly in the app (Settings):

• Export your data — download a copy of everything Keel stores about you as a JSON file.
• Delete your account — permanent, immediate, self-service.
• Change your email or password, and turn reminders on or off.

By email (contact@orykas.com), depending on where you live, you may also exercise rights to access, correct, or delete your personal information, to withdraw consent for health data, to opt out of marketing, and to receive a copy of your data. We do not discriminate against you for exercising these rights, and we will respond within the timeframe your local law requires.

• California residents (CCPA/CPRA): you have the right to know, correct, and delete, and to opt out of "sale" or "sharing" of personal information — we do not sell or share personal information as defined by the CPRA, and we use sensitive personal information only to provide the service you asked for.
• Washington residents (My Health My Data Act) and residents of states with consumer-health-data laws: you may withdraw consent for the collection of consumer health data and request its deletion; we do not sell consumer health data and never have.
• EEA / UK visitors: Keel is directed at the United States, but if the GDPR/UK GDPR applies to you, you have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority.

10. Children

Keel is intended for adults (18+) and is not directed at children. We do not knowingly collect personal data from minors; if you believe a minor has given us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The effective date above reflects the latest version; for material changes affecting health data we will notify you in the app or by email before they take effect.

12. Contact

Questions about this policy or your data: contact@orykas.com

Data controller: MDMS GROUP LLC, Florida, United States.