Your health data is not a product.

1. Introduction

Endometriosis Companion ("we", "our", "us") is committed to protecting your privacy and handling your personal information with care, transparency and respect.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and what rights you have over it.

We understand that the information you share may include deeply personal health information — including symptoms, menstrual cycle details, medications, food logs, pain levels, emotional wellbeing and other sensitive health-related data. We treat this information accordingly.

By using Endometriosis Companion, you agree to the collection and use of your information as described in this policy. If you do not agree, please do not use the service.

2. Who we are

Endometriosis Companion is currently operated by April Wood, an individual based in Victoria, Australia. This policy will be updated when the business is incorporated as a company. The current data controller for your personal information is:

References to "we", "our" and "us" throughout this policy refer to April Wood trading as Endometriosis Companion.

3. Information we collect

Account information

When you create an account, we collect:

• Email address
• Login credentials (stored in encrypted, hashed form — we do not have access to your password, but can reset it for you if needed)
• Subscription status and plan type
• Payment-related metadata (we do not store full payment card details — see Section 7)
• Date of account creation

Health and tracking information

You choose what to log. This may include:

• Menstrual cycle information, including cycle day, cycle length and phase
• Pain levels, pain locations and pain descriptions
• Symptoms such as fatigue, bloating, nausea, bowel symptoms, bladder symptoms, brain fog, mood and anxiety
• Food and meal logs
• Exercise type, intensity and duration
• Supplements and medications taken
• Energy and mood ratings
• Free-text notes you choose to enter
• AI questions you submit and the insights generated in response

This is sensitive health information. We collect it only because you choose to log it, and we use it only as described in this policy.

Device and usage information

When you use the service, we may collect limited technical information including:

• Device type and operating system
• Browser type and version
• IP address
• General geographic region (derived from IP address — we do not collect precise location)
• Error logs and crash information
• App feature usage patterns in aggregate, anonymised form

We do not currently use third-party analytics tools that collect health-event data or symptom-level tracking information.

4. Legal basis for processing

We process your personal information on the following legal bases, which vary depending on the type of information and the purpose for which it is processed.

Australian Privacy Act 1988

For users located in Australia, we handle personal information (including sensitive health information) in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We collect sensitive health information only with your consent, and only for the primary purpose of providing the service you have requested.

UK and EU General Data Protection Regulation (GDPR)

For users located in the United Kingdom or European Union, we process your personal information under the following legal bases:

• Contract performance (Article 6(1)(b) GDPR): processing your account information and subscription data to provide the service you have signed up for
• Explicit consent (Article 9(2)(a) GDPR): processing your sensitive health data, including all tracking information you choose to log, on the basis of your explicit consent
• Legitimate interests (Article 6(1)(f) GDPR): processing limited technical and usage data to maintain the security and functionality of the platform, where this does not override your privacy interests

We do not rely on consent as a legal basis for processing where another legal basis applies. Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and interests.

5. How we use your information

We use the information we collect to:

• Provide, operate and maintain the Endometriosis Companion service
• Generate symptom tracking insights and pattern summaries from data you log
• Process your subscription and manage your account
• Send account-related communications, including subscription confirmation, account notices and pre-deletion warnings (see Section 10)
• Respond to support requests
• Detect, prevent and investigate abuse, fraud or security issues
• Maintain and improve the technical functionality of the platform
• Comply with applicable legal obligations

We do not use your health information for advertising purposes. We do not use your health information to build advertising profiles. We do not share your health information with advertising platforms or marketing systems.

6. AI-generated insights

Endometriosis Companion offers an optional AI companion feature that generates observational insights based on the tracking data you choose to log. This feature uses AI services provided by OpenAI, L.L.C., a company based in the United States.

What the AI feature does

When you request an AI-generated insight, selected pattern data from your tracking history is sent to OpenAI's systems for processing. The AI analyses this data and returns an observational summary. The AI is instructed to use cautious, observational language only, and is explicitly prohibited from providing diagnoses, treatment recommendations or certainty-based conclusions.

What information is sent to OpenAI

The information sent is structured pattern data derived from your logs. It may include:

• Aggregated pain scores and phase averages
• Symptom frequency patterns
• Food and symptom correlation summaries
• Exercise and energy pattern summaries
• Cycle phase data
• The specific question you submit to the AI companion

We strip direct identifying information before sending data for AI processing. We do not intentionally send your name, email address or payment information to OpenAI as part of AI insight requests.

The AI feature is optional. If you do not use AI insight features, your logged health data will not be sent to OpenAI.

OpenAI and model training

We configure our OpenAI integration under API terms that are intended to prevent your data from being used to train OpenAI's public models. However, OpenAI's own privacy policy and terms govern their handling of data once received. We recommend you review OpenAI's privacy policy if you have concerns about this.

We do not use information submitted through the AI feature to train any AI models ourselves.

Where AI processing occurs

Information submitted for AI insight processing is sent to and processed on servers operated by OpenAI, which are located in the United States. This constitutes an international transfer of your personal information. See Section 9 for further detail.

7. Payment processing

Subscription payments are processed securely by Stripe, Inc., a third-party payment processor based in the United States. When you subscribe, your payment information is handled directly by Stripe.

We do not store full credit card numbers, security codes or full payment credentials on our systems at any time. Stripe provides us with payment confirmation and subscription status information only.

Stripe does not have access to your health tracking data. The only information Stripe receives is what is necessary to process your payment — your email address, payment card details and billing information.

Stripe's handling of your payment information is governed by Stripe's own Privacy Policy, which we recommend you review. Stripe is certified under the EU-US Data Privacy Framework.

8. Service providers

To operate Endometriosis Companion, we use carefully selected third-party service providers. Each provider is given access only to the information reasonably necessary to perform their specific function. We do not authorise service providers to use your information for their own purposes.

Current service providers include:

Supabase

Supabase provides database storage, user authentication and backend infrastructure. Your health tracking data and account information are stored on Supabase infrastructure. We have selected an Australian data region for our Supabase project, meaning your data is stored on servers located in Australia. Supabase is incorporated in the United States and its parent infrastructure and support operations may involve access from outside Australia.

Stripe

Stripe processes subscription payments and manages subscription status. Stripe is based in the United States. See Section 7 for further detail.

OpenAI

OpenAI provides the AI language model used for the optional AI companion feature. OpenAI is based in the United States. See Section 6 for further detail. Only users who choose to use AI features have their pattern data sent to OpenAI.

Cloudflare

Cloudflare provides website hosting, security infrastructure and content delivery for the Endometriosis Companion web application. Cloudflare operates a global network of edge nodes across more than 120 countries. When you access the app, your request may be routed through and temporarily cached at a Cloudflare data centre in your geographic region, which may be located outside Australia. Cloudflare does not have access to your stored health data — it handles the delivery of web pages and static assets only.

Google Workspace

We use Google Workspace for support email communications. When you contact us at [email protected], your email and any information you include is processed via Google's email infrastructure. Google is based in the United States.

We do not currently use advertising networks, marketing pixels, behavioural tracking tools or third-party analytics services that collect health-event or symptom-level data.

9. International data transfers

Endometriosis Companion is operated from Australia. However, some of our service providers are located in or operate infrastructure in countries other than Australia, including the United States. This means your personal information may be transferred to, stored in or processed in countries outside Australia.

Specifically:

• OpenAI — United States. Applies when you use AI insight features.
• Stripe — United States. Applies when you subscribe.
• Cloudflare — Global edge network (120+ countries). Applies to all users when accessing the web app.
• Supabase — Australian data region for stored data. Supabase's parent company is US-based and support or infrastructure teams may access systems from outside Australia.
• Google Workspace — United States. Applies when you contact us by email.

For users located in the European Union or United Kingdom, we acknowledge that some of these transfers involve countries that do not have an adequacy decision from the European Commission. Where this is the case, we rely on providers that are certified under the EU-US Data Privacy Framework (where applicable) or that offer Standard Contractual Clauses as a transfer safeguard.

For users located in Australia, we note that the Australian Privacy Act requires that we take reasonable steps to ensure that overseas recipients handle your information in a way that is consistent with the Australian Privacy Principles. We select reputable providers and review their privacy commitments accordingly.

10. Data retention

Active accounts

We retain your account information and health tracking data for as long as your account is active and for a reasonable period thereafter to allow you to return to the service.

Inactive accounts

If your account has had no activity for a continuous period of three years, we will contact you at your registered email address to notify you that your account and data are scheduled for deletion. You will have a reasonable period to respond and reactivate your account before deletion proceeds. If we do not receive a response, your account and associated data will be permanently deleted.

Account deletion

If you choose to delete your account, we will take steps to delete or anonymise your personal information within a reasonable timeframe. Some residual information may be retained for a short period in backup systems before being purged, and we may retain limited information where required by law (for example, transaction records for tax purposes).

Support communications

Information shared with us via support emails is retained only as long as necessary to resolve your query and for a reasonable period thereafter.

We do not retain your data in identifiable form for longer than is necessary for the purposes described in this policy.

11. Cookies & local storage

Endometriosis Companion uses browser local storage and session storage to maintain your login session, remember your preferences (such as dark mode settings) and store temporary app state between sessions. This is standard practice for web applications and is necessary for the app to function.

We do not currently use third-party advertising cookies, tracking pixels or behavioural analytics cookies.

If we introduce third-party analytics tools in the future, this policy will be updated before those tools are implemented, and we will provide appropriate notice.

You can clear local storage data at any time through your browser settings. Doing so will log you out of the app and reset your local preferences.

12. Data storage & security

We take reasonable technical and organisational measures to protect your personal information from unauthorised access, disclosure, alteration or destruction.

These measures include:

• Encrypted connections (HTTPS) for all data transmitted between your device and our servers
• Encrypted storage for passwords using hashing and salting — we do not have access to your password
• Access-controlled cloud infrastructure via Supabase, with row-level security policies restricting data access to authenticated users
• Health tracking data stored in an Australian data region
• Restricted access to personal information — only systems and service providers reasonably required to operate the platform

No method of transmission or storage is completely secure. While we use all reasonable efforts to protect your information, we cannot guarantee absolute security. If you become aware of any security issue relating to your account, please contact us immediately at [email protected].

We recommend protecting your device with a passcode, Touch ID or Face ID, and using a unique, strong password for your Endometriosis Companion account.

13. Automated decision-making

Endometriosis Companion does not engage in automated decision-making or profiling activities that produce legal effects or similarly significant effects on you.

The AI companion feature generates observational insights from your tracking data, but these insights are informational only. No automated decisions are made about you on the basis of your health data without human involvement. The app does not make decisions about your eligibility for services, access to healthcare, insurance or any other matter of consequence.

14. Your rights

Depending on your location and applicable law, you may have the following rights in relation to your personal information.

Rights under the Australian Privacy Act

If you are located in Australia, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Make a complaint to the Office of the Australian Information Commissioner (OAIC) if you believe we have not handled your information in accordance with the Australian Privacy Principles

Rights under GDPR (EU and UK users)

If you are located in the European Union or United Kingdom, you have the right to:

• Access — request a copy of the personal information we hold about you
• Rectification — request correction of inaccurate or incomplete information
• Erasure — request deletion of your personal information (subject to legal retention requirements)
• Data portability — request your personal information in a structured, commonly used and machine-readable format
• Restriction — request that we restrict processing of your personal information in certain circumstances
• Objection — object to processing carried out on the basis of legitimate interests
• Withdraw consent — withdraw your consent to health data processing at any time, without affecting the lawfulness of processing before withdrawal
• Lodge a complaint — lodge a complaint with your local data protection supervisory authority if you believe we have not handled your information lawfully

How to exercise your rights

To exercise any of the above rights, or to make a complaint or enquiry about your personal information, please contact us at [email protected]. We will respond within a reasonable timeframe and in any event within 30 days. We may need to verify your identity before processing your request.

You can delete your account directly from within the app. Deleting your account will remove your health tracking data from our active systems.

Supervisory authority contacts

• Australia: Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au
• European Union: your local EU member state data protection authority
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk

15. Age restriction

Endometriosis Companion is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18.

By creating an account and using the service, you confirm that you are at least 18 years of age. We ask users to confirm this at the point of account creation.

If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information promptly. If you believe a person under 18 has created an account, please contact us at [email protected].

Note: endometriosis and related conditions are diagnosed in people of all ages, including those under 18. If you are a young person who would benefit from this tool, we encourage you to use it with the knowledge and support of a parent, guardian or healthcare provider.

16. Business transfers

If Endometriosis Companion is sold, transferred, merged or acquired by another entity, your personal information may be transferred as part of that transaction. In the event of such a transfer, we will take reasonable steps to ensure that your information remains subject to privacy protections consistent with this policy.

We will notify you by email or through a prominent notice within the app before your personal information is transferred to a new entity under materially different privacy terms, and you will have the opportunity to delete your account if you do not wish your information to be transferred.

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in the law, our data practices, the features of the service, or other factors.

When we make material changes — changes that significantly affect how we collect, use or share your information — we will notify you by email at your registered address and display a prominent notice within the app before the changes take effect.

The date at the top of this policy reflects when it was last updated. We encourage you to review this policy periodically. Your continued use of the service after changes take effect constitutes your acceptance of the updated policy.

Previous versions of this policy are available on request.

18. Medical disclaimer

Endometriosis Companion is an educational tracking tool. It is not a medical device, does not diagnose medical conditions, does not provide treatment recommendations, does not replace professional healthcare advice, does not guarantee health outcomes and does not provide emergency medical services.

Information generated by the app — including AI-generated insights, pattern summaries and phase-based guidance — is intended for educational and self-tracking purposes only. Always consult your GP, gynaecologist or endometriosis specialist for medical advice specific to your situation.

If you are experiencing a medical emergency, contact emergency services immediately.

19. Contact us

If you have questions, concerns or requests relating to this Privacy Policy or your personal information, please contact us:

We aim to respond to all privacy-related enquiries within 30 days.

Plain-English summary