Global Privacy Policy

BipolarSocial is built according to Privacy by Design and Privacy by Default principles under GDPR Article 25 and Swiss FADP/nDSG Article 7.

Pseudonymous usernames are encouraged. Real legal names are never required. Disclosure of a clinical diagnosis is NEVER mandatory. Medication regimens, doctor details, or medical records are never requested in profiles.

A. Account Credentials: Email address (strictly confidential, never published on public profile), salted bcrypt password hash.

B. Voluntary Profile Data: Display pseudonym, avatar image, broad country/city (no granular GPS location), short bio.

C. Special Category Health Data: Voluntary lived experience posts, comments, or mood reflections shared by the user (processed under GDPR Art. 9(2)(a) explicit consent).

Account maintenance and community features: Performance of contract (Terms of Service, GDPR Art. 6(1)(b)).

Voluntary health reflections and lived experiences: Explicit Consent (GDPR Art. 9(2)(a) & 6(1)(a); Swiss nDSG Art. 6(7)). Consent can be withdrawn at any time.

Technical security and abuse prevention: Legitimate interest (GDPR Art. 6(1)(f); Swiss nDSG Art. 31(1)).

Application containers and managed PostgreSQL databases are hosted in isolated cloud infrastructure. Data is protected with TLS 1.3 in transit and AES-256 encryption at rest.

Cross-border transfers outside the EEA or Switzerland rely on Standard Contractual Clauses (SCCs) and Swiss FDPIC addenda. Zero personal data is transferred to advertising networks or data brokers.