1. Who We Are

HerCycle is operated by Purity Labs, a technology company registered in Nairobi, Kenya (Business Registration No. BN-DLSZWE6V). We build AI-powered women's health tools for African women.

Contact: support@hercycleapp.org
Website: hercycleapp.org
Address: Nairobi, Kenya

2. Information We Collect

Account Information

• Email address — required to create and manage your account
• Name — optional, used to personalise your experience
• Password — stored as an encrypted hash, never in plain text

Health and Wellness Data

• Menstrual cycle dates, length and flow information
• Symptoms logged daily — mood, energy, pain, physical symptoms
• Pregnancy information — weeks, milestones, ANC appointments
• Postpartum recovery data and healing logs
• Baby care logs — feeding, sleep, diaper, growth measurements
• Perimenopause symptom tracking
• Sleep hours and water intake logs
• Notes and personal journal entries

Usage Data

• Features you use within the app
• AI assistant conversations — processed in real time, not stored on our servers
• Device type and operating system version for technical support

Partner Mode Data

• Partner email or phone number — only if you choose to use partner mode
• Mood updates and messages you choose to share with your partner
• Your partner never sees your full health data — only what you explicitly share

3. How We Use Your Information

• To provide and personalise the HerCycle app experience
• To power the AI health assistant with your cycle and journey context
• To send health reminders and notifications you have opted into
• To sync your data securely across your devices
• To send partner invitations and mood updates when you request them
• To improve the app based on anonymised usage patterns
• To respond to your support requests

4. How We Store and Protect Your Data

Your data is stored on Supabase — a secure cloud database hosted on AWS infrastructure. We implement the following protections:

• Encryption in transit: All data transmitted between your device and our servers uses TLS/HTTPS encryption
• Row Level Security: Database-level policies ensure you can only access your own data — not other users' data
• Encrypted passwords: Passwords are hashed using bcrypt and never stored in plain text
• Secure storage: Sensitive data on your device is stored using expo-secure-store
• AI conversations: Conversations with the AI assistant are processed in real time and are not permanently stored on our servers

5. Data Sharing

We share your data only with the following service providers who help us operate the app:

• Supabase — database and authentication infrastructure
• Anthropic — AI processing for the health assistant (conversation content only, anonymised)
• Firebase (Google) — push notification delivery
• Resend — transactional email delivery (partner invites, account emails)
• Google Play — subscription billing and app distribution

All service providers are contractually bound to use your data only for the specific services they provide to us.

We do not share your data with: advertisers, data brokers, insurance companies, employers, healthcare providers (unless you explicitly request this) or any other third parties.

6. Your Rights

Under the Kenya Data Protection Act 2019 and applicable international privacy laws, you have the right to:

• Access — request a copy of all data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and all associated data
• Portability — export your health data in a readable format
• Restriction — request we stop processing certain data
• Objection — object to specific types of processing
• Withdraw consent — withdraw consent at any time without affecting prior processing

7. Account Deletion

You can delete your account and all associated data at any time:

• In-app: Profile → Settings → Delete account and all data
• By email: Send a request to support@hercycleapp.org
• Online: hercycleapp.org/delete-account

Upon deletion: all personal health data is permanently deleted immediately. Subscription transaction records are retained for 90 days as required by law. Community posts are removed within 30 days.

8. Children's Privacy

HerCycle is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, please contact us at support@hercycleapp.org and we will delete the account immediately.

9. Push Notifications

HerCycle may send you push notifications for period reminders, ovulation alerts, appointment reminders and daily log prompts. You can disable notifications at any time through your device settings or within the app under Profile → Settings → Notifications.

10. Cookies and Tracking

The HerCycle mobile app does not use cookies. Our website (hercycleapp.org) uses essential cookies only for basic functionality. We do not use tracking pixels, advertising cookies or cross-site tracking technologies.

11. International Data Transfers

Your data may be processed on servers located outside Kenya, including in the United States and European Union, by our service providers (Supabase, Anthropic, Firebase, Resend). These transfers are governed by appropriate data protection agreements. By using HerCycle you consent to these transfers.

12. Medical Disclaimer

13. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes through the app or by email. The date at the top of this policy indicates when it was last updated. Continued use of HerCycle after changes constitutes acceptance of the updated policy.

14. Compliance

HerCycle is committed to compliance with:

• Kenya Data Protection Act 2019
• Google Play Developer Programme Policies
• General Data Protection Regulation (GDPR) principles
• California Consumer Privacy Act (CCPA) principles