KoroCRM ("we", "our", or "us") respects your privacy. This Privacy Policy explains how we collect, use, store, and protect information when you use our CRM platform for wellness resorts and hospitality.

By using KoroCRM, you agree to the practices described in this policy.

We may collect and process the following types of data:

• Name, email, phone number
   
• Organization details
   
• Login credentials (securely stored)
   

• Guest profiles (name, preferences, booking history)
   
• Feedback, service logs, visit details
   
• Loyalty program participation
   

• Vitals, allergies, conditions, goals
   
• Treatment records (if entered by staff)
   
• Health data from connected wearables (e.g., Whoop)
   

Note: This data is encrypted and only collected if enabled by your organization.
 

• IP address, device type, OS
   
• Session logs, crash reports
   
• Feature usage for analytics and support
   

We use collected data to:

• Deliver CRM features and personalized guest services
   
• Analyze performance and improve functionality
   
• Enable health tracking and AI recommendations
   
• Ensure security, compliance, and proper access control
   
• Provide user support and respond to inquiries
   

We do not sell your personal data.

We may share data with:

• Internal team members (e.g., resort staff and admins)
   
• Third-party services (e.g., cloud storage, analytics) under strict confidentiality
   
• Authorities when legally required
   

We use industry-standard practices including:

• AES-256 encryption (data at rest and in transit)
   
• Role-based access controls
   
• Regular security reviews
   

Sensitive health and guest data is handled with heightened protection.

• KoroCRM offers features aligned with HIPAA principles for storing medical information.
   
• Under GDPR, you may:
   
  • Request access, correction, or deletion of your data
     
  • Withdraw consent
     
  • File complaints with your data protection authority
     

We retain data only for as long as necessary to fulfill the app's functions and meet legal or organizational obligations.

Data can be deleted or anonymized upon request by the account administrator.

KoroCRM is not intended for direct use by individuals under the age of 16 without supervision by a licensed wellness provider or guardian.

If you connect third-party platforms (e.g., Whoop, external calendars), their data handling is governed by their own privacy policies.

If you have questions or concerns about this Privacy Policy, please contact us:

Email: support@korotek.com
Company: Korotek International OOD
Address: Varna, Bulgaria

• v1.0 – July 24, 2025 – Initial Release