Consumer Health Data Privacy Policy
The whole document comes down to one fact: we do not collect your consumer health data. It stays on your iPhone, and we have no copy.
1. What counts as consumer health data here
Those laws define consumer health data broadly: anything that identifies your past, present or future physical or mental health, including what an app infers from what you enter. In this app that would be:
- Periods and bleeding — start and end days, flow, spotting, clots, products used.
- Symptoms and the trackers you make yourself, with the rating or number you gave.
- Mood, sleep, anxiety, day tags and your written notes.
- Medications and supplements, doses and dose changes, doses taken or skipped, side effects, injection sites.
- Clinician visits: what you want to ask, and what was said.
- Lab results, check-up dates, and readings from home tests.
- Photographs you add to the skin and hair diary.
- What you say about yourself in onboarding — whether a clinician told you that you have PCOS or PMOS, how long since your first period, and any state you are in, such as being on hormonal contraception or pregnant.
- Reproductive and sexual health data, which those laws call out specifically: the bleeding and cycle entries above fall under it.
2. How it is collected, and by whom
You type it into the app, or you import it from Apple Health after allowing that. It is written to your iPhone’s own storage.
We do not collect it. The app has no account, sends nothing to us, and there is no server of ours that receives or stores it. We do not obtain it from any other source — not from data brokers, not from advertising networks, not from other apps.
3. What it is used for
Only to show you your own log and what you asked the app to make from it: your calendar, your counts and ranges, the comparison of what you logged before and after a medication, and the summary you can hand to a clinician. There is no other purpose, because the data never reaches us.
All of that processing happens on your iPhone, by the app itself. Nothing is computed on a server, and there is no artificial-intelligence service, no analytics and no advertising system involved at any point.
No third party can follow you over time or across services. The app contains no third-party code of any kind — no SDK, no analytics, no crash reporter, no advertising identifier — and this website sets no cookies and loads nothing from anyone else’s server.
4. Who it is shared with
Nobody. We share consumer health data with no affiliate, no processor, no contractor, no advertiser, no analytics company, no data broker, no researcher and no third party of any kind. There is no category of recipient to list, because there are no recipients.
We do not sell it, and we never have. No sale has ever taken place and none is planned; if that ever changed, those laws require your separate, signed authorization first, and we would have to ask you for it rather than announce it.
Three things you can do yourself send data somewhere, and each one is your action, not ours: writing to Apple Health, exporting a file, and sharing the PDF summary. What happens to it afterwards is between you and the place you sent it to.
5. How long it is kept
On your iPhone, for as long as you keep it. “Delete all data” in the app’s settings erases it — the database, the exported files and the settings — immediately and permanently. Apple Health is left alone by that step, and the screen says so: what the app wrote there stays until you remove it in the Health app, and samples written by other apps were never ours to touch.
5a. How it is kept safe
Nobody has access to it but you: there are no employees, no contractors and no processors, because the data never leaves your iPhone. On the phone it sits in the app’s own protected storage, encrypted by iOS along with the rest of your device; the backup file you make yourself is encrypted with a password only you know, and the app can be locked with Face ID. What iOS encryption does and does not protect against is set out plainly on Where your data can be.
6. Your rights
Under Washington’s My Health My Data Act, Nevada SB 370 and similar laws you have the right to know what consumer health data a company has about you, who it was shared or sold to, the right to withdraw consent, and the right to have it deleted.
You can exercise the practical part of all of this yourself, at once and without asking us: the data is on your phone, you can read all of it, export it, and delete every trace of it in one action.
To review or correct an entry you do not need to ask us at all — open the day and change or delete it. There is nothing to correct on our side, because we hold no copy. You never need an account to exercise any of these rights: the app has none, and we will not ask you to make one.
To make a formal request — including a request to confirm that we hold nothing — write to support@cycleally.com with the word “health data” in the subject. We answer within 45 days — and within 30 days for a deletion request from a Nevada resident, as that state’s law requires. We will extend a deadline only when the law allows it and will tell you if we do. We will not charge you, and we will not ask you for more personal information than it takes to answer. An authorized agent may make a request on your behalf with your written permission.
If we have to refuse a request, we will say why. You may then appeal by replying to that answer, or by writing to support@cycleally.com with the word “appeal” in the subject — the same address, deliberately, so there is nothing new to find. We answer an appeal in writing within 45 days and explain the reasons. If the appeal is refused you may complain to your state’s Attorney General: Washington residents at atg.wa.gov, Nevada residents at ag.nv.gov.
7. No geofencing
Washington’s law forbids putting a virtual boundary within 2,000 feet of a place that provides health care, and Nevada’s within 1,750 feet, in order to work out who goes there, to send them advertising, or to collect their health data. We do not do this, and no consent would make it allowed. The app asks for no location permission at all and contains no location code.
8. Changes to this policy
If this document changes, the new effective date appears at the top. We will not apply a material change to data collected earlier without your consent, and we will announce it in the app before it takes effect.
Contact for anything on this page: support@cycleally.com. That address is read by the person who makes the app, and it is the fastest way to reach us about a request under any of these laws.