Consumer Health Data Privacy Policy

1. About this policy

This policy is from Neurova AI, Heideveldstraat 6, Eindhoven, the Netherlands, the company that makes FemNote. It covers consumer health data as defined by the Washington My Health My Data Act, Nevada Senate Bill 370 and the Connecticut Data Privacy Act. Our privacy policy describes all the other ways we handle personal data.

Effective date: [Effective date]. Last updated: 13 October 2026.

2. Consumer health data we collect, and why

Most of FemNote's health features work entirely on your iPhone. This data is stored only on your phone, in an encrypted database, and we never receive it:

• check-ins: bloating, energy, mood, skin, pain and sleep
• your cycle: period dates, flow and symptoms, cycle length, and your situation, such as hormonal birth control or perimenopause
• your goals and age group
• meals and meal photos, scans of food and skincare, your watch list, experiments and lists
• patterns and signals that the app works out from your log
• sleep and menstrual flow from Apple Health, if you allow it: shown in the app, never saved by FemNote or sent anywhere

The app uses this data only to show you your log, cycle, patterns, experiments and reports.

From the app, only one kind of health-related data reaches us, and only when you use the feature: photos of meals, your fridge or ingredient labels, or label text, that you send for recognition. They can reveal what you eat. We use them only to recognise items for you to confirm, and they are processed and then discarded, not stored.

Washington's law defines consumer health data very broadly. To be careful, we also treat these as consumer health data: the fact that you have a FemNote account or subscription or joined the waitlist, together with your email address, sign-in method, subscription status and your app's anonymous install ID. We use them only to run your account, your subscription, the waitlist and the limits on recognition.

Barcode lookups go from your phone straight to Open Food Facts or Open Beauty Facts and contain only the product's barcode number.

Apart from that, health details reach us only if you put them in a message to our support team, which we ask you not to do. If you do, we use them only to answer you, and delete the message after 12 months.

3. Where it comes from

• from you, when you log, take photos or sign up
• from your iPhone and Apple Health, when you allow it
• from Apple or Google, when you sign in with them
• from Apple, through our subscription service, for your subscription status

4. Who receives it

We don't sell consumer health data, and we don't share it with third parties or affiliates.

Service providers (processors) handle it only on our instructions, to provide FemNote: Supabase (our servers and recognition service), Amazon Web Services (the AI model for recognition), RevenueCat (subscription status), Resend (emails), Cloudflare (website, forms and email forwarding), and TelemetryDeck and Sentry (app statistics and crash reports, only if you turn them on).

When you choose to, the app also shares data on your behalf: if you send a PDF report or an export to someone, or write your periods to Apple Health.

No third party collects consumer health data about you over time and across different websites or apps through FemNote.

We would disclose data to authorities only if the law requires it. We hold none of your logged health data on our servers.

5. No selling, no geofencing

We never sell consumer health data. We don't use geofencing around health care facilities or anywhere else, and FemNote doesn't ask for access to your location.

6. Your consent

We ask for your consent in the app before you start logging health data, and you decide each time whether to send a photo for recognition. Because we don't share consumer health data, we never ask for consent to share it.

You can withdraw your consent at any time: stop sending photos, and use Delete my account and data in the app or delete the app.

7. Your rights and how to use them

You have the right to:

• confirm whether we collect, share or sell your consumer health data, and access it
• get a list of all third parties and affiliates we have shared it with or sold it to, with their contact details: there are none
• review and correct it
• withdraw your consent
• have it deleted, including by our service providers

The quickest way: in the app, under You, then Privacy and data, you can see, export and delete everything on your phone, and you can edit your log in the app. Delete my account and data also deletes your data on our servers and with our service providers.

Or email andreas.chitos@neurova-ai.com or use the contact form. We may confirm the request with the email address we have, so we know it's you. We answer within 45 days, or tell you why we need up to 45 more. Requests are free.

If we decline your request, you can appeal: reply to our answer, or email andreas.chitos@neurova-ai.com with the subject Appeal. We answer within 45 days and explain our decision in writing. If we turn down your appeal, you can complain to your state attorney general: Washington (atg.wa.gov), Nevada (ag.nv.gov) or Connecticut (portal.ct.gov/ag).

8. Changes

If we change this policy in an important way, we tell you in the app and on this page before the change takes effect, and ask for your consent again where the law requires it.

9. Contact

Neurova AI, Heideveldstraat 6, Eindhoven, the Netherlands. Email andreas.chitos@neurova-ai.com or use the contact form.