1. Who we are
SC AI COMPANY LIMITED ("we") operates the BaoJai mobile app and the baojai.com website (together, the "Service"). This notice explains what personal data we collect, why, who can see it and how long we keep it. We follow the Thailand Personal Data Protection Act B.E. 2562 (PDPA).
Providers we work with, where your data is stored and exact retention periods are listed on our Who we work with page.
2. What we collect and why
2.1 Your account
- Email address, display name, profile picture, country and date of birth (to confirm you are old enough to use the Service).
- Sign-in: email and password, or your Apple or Google account. From Apple or Google we receive only what you allow them to share, normally your name and email.
- Content you create: meditation recordings, posts, comments, playlists, groups you join, and anything you send us.
2.2 Your body and wellness data
This is the most sensitive data we handle. It is used to show you your own results and trends, and for nothing else unless you choose to share it (2.4).
- From a paired BaoJai ring: heart rate, heart-rate variability (HRV), sleep and sleep stages, steps, blood oxygen (SpO₂), breathing rate, stress level, skin temperature and estimated calories. The App syncs this history from the ring and stores it in your account so your Health screen, trends, reports and groups can use it.
- Measurements you start on rings that support them: estimated blood pressure, blood glucose, uric acid and blood lipids, a single-lead ECG, and body composition. Body composition also uses the sex, height, weight and date of birth in your profile. These readings are estimates for your own reference: the ring is a wellness device, not a medical device, and they are not a diagnosis. Confirm anything unusual with a proper measuring device or a doctor.
- From your phone camera (optional): the App can estimate heart rate and breathing rate from small colour changes in your face. Video frames are analysed on your phone and never leave it. The heart-rate and breathing values may be sent to our servers during the measurement to calculate a stress score; camera measurements are not stored unless they are part of a recording you save.
- During a recording: readings from the ring or camera are saved with the recording as a metrics timeline, so you can see them again when you watch it. With an EEG headband, the raw EEG signal of the recording is kept too, in private storage that only you can read.
- Breathing exercises: each session you finish (pattern, length, breath count, and — with a ring — your heart rate every five seconds and a resonance score) is saved to your account so your history survives a new phone and appears in your data export.
- Other wearables (optional): a supported heart-rate band or EEG headband can be paired the same way. Bluetooth is used only to connect to a device you choose, never to locate you or for advertising.
2.3 Camera, microphone, photos, location
- Camera and microphone: to record meditation videos and for the camera measurement above. Never used in the background.
- Photo library: only when you choose a profile picture or save something to your library.
- Location: only when you choose to tag a place on a post. Your approximate position and what you type are sent to a maps provider to suggest places; we store only the place you pick. We never track your location in the background.
2.4 Sharing with other people (your choice)
- Your public profile, public posts and comments are visible to other users, including people who are not signed in.
- Family groups: in a group you belong to, you can choose what to share with the other members, one category at a time: your meditation activity; sleep (duration, stages, bed and wake times); heart (resting and daily heart rate, HRV, blood oxygen, breathing rate); activity (steps and active energy); stress; and the ring's estimates (blood pressure, glucose and uric acid). Members see only daily summaries of the categories you turn on, never individual readings. Each category is off until you turn it on for that group, and you can change or stop it at any time. Nobody else can turn it on for you. ECG recordings, body composition and raw sensor data are never shared in a group.
- Coaches see the bookings and attendance of their own classes.
2.5 Features that use artificial intelligence
These run only when you ask for them, and the provider may use the data only to produce your result — never for advertising, profiling or training on your data.
- Insights and assistant: a summary of your session metrics (for example heart rate, breathing, calm and stress scores) is sent to an AI provider to write the explanation you see.
- Health report (PDF): generated on our servers from your wellness data; its plain-language summary is written by the same kind of AI provider. The report is stored in your account until you delete your account.
- AI music: the text you type as a prompt, the title and the style you choose are sent to an AI music provider to create your track. Please do not include personal details in a prompt.
2.6 Sensor data contribution (optional, off by default)
If you pair a BaoJai ring, the App may ask whether you are willing to contribute the ring's raw light and motion signal so we can improve how readings are interpreted. Only while this is on: the raw signal, beat intervals, time and firmware version are kept in private storage for up to 12 months — no video, audio or location. Switching it off deletes everything already collected. Declining changes nothing else.
2.7 Usage analytics and screen recordings (optional, off by default)
To learn which features help people, the App and this website can collect which screens you open and which features you use, together with short screen recordings in which your health readings, photos, videos and anything you type are blacked out on your device before being sent. This is off until you turn it on (during onboarding, on the Home card, in Settings → Usage analytics, or in the banner on this website) and you can turn it off at any time. It is linked to your account ID, never used for advertising or to track you across other apps, and never includes your health readings, recordings, messages, contacts, precise location or IP address.
2.8 Collected automatically
- Device type, operating system, app version and a device identifier — to run the Service and deliver push notifications you have allowed.
- Crash and error reports — to find and fix problems. If you have turned on usage analytics, a crash report carries your analytics identifier so we can see which session it happened in.
- Access logs — for security and to keep the Service running.
2.9 Developer access (optional)
At baojai.com/developers you can browse and download everything in 2.1–2.2 that we hold about you, and create personal access tokens that let your own scripts read the same data through our API. A token reads only the data of the account that created it, is read-only, and can be revoked at any time; it also stops working when you change your password or delete your account. Treat tokens like passwords. Data you download or read this way is in your hands: once it has left our systems it is no longer protected by this policy, so store and share it responsibly. Raw sensor files (2.6) are available here only while that contribution is switched on.
3. Who receives your data
We do not sell your personal data. We share it only with:
- Service providers working for us — cloud hosting and database, file delivery, crash reporting, usage analytics (only if you opted in), push-notification delivery, maps, and the AI providers in 2.5. Each may use your data only to provide its service to us, under a data-processing agreement. The current list, with locations, is on Who we work with.
- Apple and Google — when you sign in with them, they handle the sign-in and tell us only what you approve.
- Other users — as described in 2.4.
- Authorities — when the law requires it, or to protect our users' safety and rights.
Some providers are outside Thailand (currently Indonesia, Japan, the European Union and the United States). We transfer data only to providers that give protection comparable to the PDPA, under written agreements.
4. How long we keep it
- Account, content, wellness data and reports: while your account is active. Deleting a recording deletes its metrics with it.
- Contributed raw sensor data: up to 12 months, or immediately when you switch it off.
- Personal access tokens (2.9): until they expire — one year at most — or you revoke them.
- Usage analytics: screen recordings 30 days, events 12 months.
- Crash reports and access logs: up to 90 days.
- After you delete your account: everything is permanently erased within 30 days (see 6).
5. Your rights
Under the PDPA you can access, correct, export or delete your personal data, withdraw any consent you gave, object to processing, and complain to the Personal Data Protection Committee. Most of this you can do in the App, and baojai.com/developers lets you view and download a copy of all your data at any time; for anything else write to info@scai.co.th.
6. Deleting your account
Delete your account in the App (Settings → Account) or on our account deletion page. Your account is deactivated immediately and hidden from other users; all data is permanently deleted within 30 days, during which you can ask us to restore it. If you are a coach with students booked into classes that have not happened yet, we pause the deletion, contact you to settle those classes, then complete it.
7. Children
The Service is not for children under 13 and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.
8. Security
Data is encrypted in transit and at rest, access inside the company is limited to people who need it, and sign-in tokens are stored in your phone's secure keychain. No system is perfectly secure, but we work to keep yours safe.
9. Changes
When this notice changes we update the date above and, for changes that affect how we handle your wellness data, ask for your consent again where the law requires it.
10. Contact
SC AI COMPANY LIMITED — Data Protection Officer: info@scai.co.th
