CycleSyncAI — Eat, Train & Live by Your Cycle

1. Information We Collect

a) Health Data You Provide

We collect personal health information that you voluntarily input into the application, including but not limited to: menstrual cycle data (cycle length, period start dates, period duration), symptom tracking data (bloating, cramps, mood, energy levels, skin conditions, hair health, sleep quality, cravings, anxiety, headaches), dietary preferences and restrictions, exercise habits and activity levels, health conditions you self-report (such as PCOS, Endometriosis, Thyroid conditions, Perimenopause), supplement and medication usage, and lab test results that you choose to upload for AI analysis.

b) Account Information

We collect your name, email address, and optionally your country of residence when you create an account. Passwords are encrypted using bcrypt hashing and are never stored in plaintext.

c) Usage Data

We automatically collect certain information when you use our Service, including: device information (browser type, operating system, device type), log data (IP address, access times, pages viewed, features used), and anonymized analytics data to improve our AI models and user experience. We do not track your location beyond the country you provide during onboarding.

d) Wearable Device Data

If you connect a wearable device (Apple Watch, Garmin, Oura Ring, Fitbit, Whoop), we collect: basal body temperature (BBT), heart rate variability (HRV), resting heart rate, sleep stage data, skin temperature, and activity metrics. This data is used solely to improve AI cycle phase detection and health insights. You can disconnect your wearable at any time.

2. How We Protect Your Data

We implement industry-leading security measures to protect your sensitive health information:

AES-256 Encryption: All data is encrypted at rest using AES-256-bit encryption and in transit using TLS 1.3.
HIPAA Compliance: Our infrastructure is designed to meet Health Insurance Portability and Accountability Act (HIPAA) standards for protecting Protected Health Information (PHI).
SOC 2 Type II: We maintain SOC 2 Type II certification, ensuring rigorous security controls and procedures are in place.
Access Controls: Strict role-based access control (RBAC) limits employee access to user data. Only authorized personnel with a legitimate business need can access user data.
Secure Infrastructure: Data is hosted on SOC 2 and HIPAA-compliant cloud infrastructure with automated backups, disaster recovery, and 99.9% uptime SLA.
Vulnerability Testing: Regular third-party penetration testing and security audits are conducted to identify and remediate vulnerabilities.
GDPR Compliance: Full compliance with the EU General Data Protection Regulation, including data minimization, purpose limitation, and the right to erasure.

3. How We Use Your Data

Your data is used exclusively for the following purposes:

Providing personalized AI-powered cycle syncing, meal planning, exercise recommendations, and supplement guidance.
Generating AI insights based on your tracked symptoms, cycle patterns, and health data.
Improving our AI models and algorithms (using anonymized, aggregated data only).
Generating Doctor Communication Reports for you to share with your healthcare providers.
Providing customer support and responding to your inquiries.
Complying with legal obligations and regulatory requirements.

We will NEVER sell, rent, or share your personal health data with third parties for marketing or advertising purposes.

4. Data Sharing & Third Parties

We may share your data only in the following limited circumstances:

Healthcare Providers (with your consent): Doctor Communication Reports are generated for you to voluntarily share with your doctors. We do not send data directly to healthcare providers without your explicit consent.
Telehealth Partners: If you use our Telehealth feature, your relevant health data will be shared with the partner clinic you select, subject to a separate telehealth consent form and Business Associate Agreement (BAA).
Service Providers: We use vetted third-party services (cloud hosting, payment processing via Stripe) that process data under strict Data Processing Agreements (DPAs).
Legal Requirements: We may disclose data if required by law, court order, or regulatory authority, after exhausting all legal challenges.

5. AI Content Disclaimer

HormoneSync AI utilizes artificial intelligence and machine learning models to generate personalized health recommendations. You must understand and agree that:

All AI-generated content (meal plans, exercise recommendations, supplement suggestions, symptom insights, cycle predictions, lab result interpretations, and coach chat responses) is provided for informational and educational purposes only.
AI-generated content does NOT constitute medical advice, diagnosis, treatment, or a doctor-patient relationship.
AI predictions and recommendations may contain inaccuracies or may not apply to your specific medical situation.
You should always consult a qualified healthcare professional (endocrinologist, gynecologist, registered dietitian, or your primary care physician) before making any changes to your diet, exercise routine, supplement intake, or treatment plan.
HormoneSync AI is not a medical device and has not been evaluated or approved by the FDA, EMA, or any other medical regulatory authority.
If you are experiencing a medical emergency, contact your local emergency services immediately.

6. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

Right to Access: Request a copy of all personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure (Right to be Forgotten): Request permanent deletion of your account and all associated data.
Right to Data Portability: Request your data in a structured, machine-readable format.
Right to Restrict Processing: Request that we limit how we process your data.
Right to Object: Object to the processing of your data for specific purposes.
Right to Withdraw Consent: Withdraw your consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@cyclesyncai.com. We will respond within 30 days as required by applicable law.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account, we will permanently erase all personal data within 30 days, except where retention is required by law (e.g., for tax or regulatory compliance, up to 7 years). Anonymized, aggregated data that cannot be linked back to you may be retained indefinitely for research and AI improvement purposes.

8. Cookies & Tracking

We use essential cookies for authentication and session management. We use analytics cookies (anonymized) to understand how users interact with our platform and improve our AI models. We do not use advertising cookies or sell data to ad networks. You can manage your cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Service.

9. Children's Privacy

HormoneSync AI is not intended for use by children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will take immediate steps to delete such information. Parents or guardians who believe their child has provided us with personal information should contact us immediately.

10. International Data Transfers

If you use our Service from outside the United States, your data may be transferred to and processed in the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, and compliance with applicable data protection laws. By using our Service, you consent to such international transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes that affect your rights, we will provide additional notice (such as an email notification or in-app banner) at least 30 days before the changes take effect. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: privacy@cyclesyncai.com
Data Protection Officer: dpo@cyclesyncai.com