Where your data can be
The app's own screen lists eight places, and this page walks through them: on your iPhone; in Apple Health if you switched that on; in a file you exported yourself; in this iPhone's backup; in attachments; in the photographs of your skin and hair diary; in an email you chose to send us; and, for a subscription bought through Family Sharing, in Apple's own records. That is the complete list — if a place is not here, your entries are not there.
On your iPhone
Everything you log lives in the app's own storage, encrypted by iOS. Only this app opens it. With the app lock on, it also needs Face ID or your passcode.
In Apple Health
Only if you allowed it, and only facts you entered: period days, spotting and nine symptom types. Never anything the app worked out, and never a date you marked approximate. See Apple Health.
In files you made
The backup, the spreadsheet and the summary PDF — each created only when you ask. After you send one somewhere, it lives by that place's rules.
In your iCloud device backup
The app itself uses no iCloud. But if you back your whole iPhone up to iCloud, iOS includes this app's storage in that backup, as it does every app's. That copy is Apple's backup of your phone under Apple's terms; under standard protection Apple holds the keys, and Advanced Data Protection makes it end-to-end encrypted. You can exclude the app's own store from the device backup in Settings → Privacy → Include in this iPhone's backup. That switch covers the database; attachments, diary photographs and summaries you saved are not excluded by it.
Not on our servers
There are none. No account, no sign-up, no profile, no sync. If somebody asks us to hand over your log — a company, a court, a data broker — there is nothing to give them. That is not a promise about how carefully we would guard a copy. There is no copy.
About HIPAA
HIPAA covers doctors, hospitals and insurers, not an app you installed yourself. Any tracker calling itself “HIPAA compliant” is saying something that does not mean what it sounds like. What protects your entries here is that they stay on your phone.