Privacy Policy

1. Who We Are

PeriClue ("we," "us," or "our") is a perimenopause wellness tracking application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the PeriClue mobile application and website (collectively, the "Service").

For questions about this policy, contact us at support@periclue.app.

2. Information We Collect

2a. Information You Provide

• Account information: name, email address, and password when you create an account
• Profile information: age, perimenopause stage, focus areas, and preferences set during onboarding
• Health tracking data: symptoms, mood, energy levels, nutrition, medications, supplements, and doctor notes you enter, plus lab reports you upload. Uploaded lab reports and documents are processed by a third-party AI service provider to extract your results (see Data Sharing).
• AI conversations: messages you send to Ask PeriClue (our AI assistant)
• Website forms: email address and optional details submitted through the waitlist or beta application forms

2b. Information from Apple Health (HealthKit)

With your explicit permission, the PeriClue app reads health data from Apple Health, including:

• Sleep analysis (duration, stages, efficiency)
• Heart rate, resting heart rate, and heart rate variability (HRV)
• Respiratory rate, blood oxygen, and sleeping breathing disturbances
• Steps, active and basal energy, exercise time, distance, and workouts
• Body, basal, and wrist temperature
• Menstrual cycle data
• Body measurements (weight, body fat, lean mass, waist), blood glucose, and mindful minutes

PeriClue writes back to Apple Health only data you create in the app — workouts you record (and their heart-rate and energy samples), period entries, and body measurements you enter — so the Health app stays in sync. It writes nothing else. HealthKit data is used to calculate your PeriClue scores (Sleep, Restoration, Activity) and generate personalized insights. We never sell, share, or use HealthKit data for advertising or marketing purposes.

2c. Information Collected Automatically

• Device information: device model, operating system version, app version
• Usage data: features used, screens viewed, timestamps (collected via privacy-focused analytics with no health data)
• Network information: IP address (used for rate limiting and security, not tracking)

2d. Optional Cannabis Tracker

PeriClue offers an optional, off-by-default Cannabis Tracker. If you choose to enable it, you can privately log your own cannabis use (the type: THC, CBD, or balanced; plus intensity) to see how it relates to your sleep, restoration, and mood. Because this is especially sensitive information, it is handled with extra protection:

• Stored separately from the rest of your health data, in an isolated record.
• Never used in analytics and never sent to our AI (Ask PeriClue or any AI feature).
• Never sold or shared with any third party.
• Deletable at any time: you can delete all cannabis logs from within the app, and deleting your account erases them.

The Cannabis Tracker is for informational self-tracking only. It is not medical advice and not an endorsement of cannabis use. You are solely responsible for ensuring cannabis use is lawful where you live. See our Terms of Service for details.

3. How We Use Your Information

• Provide the Service: calculate health scores, generate insights, personalize recommendations
• AI-powered features: Ask PeriClue conversations, lab-report extraction, and document/doctor-note extraction are sent to a third-party AI service provider for processing. We use a primary AI provider, and a backup provider that handles the same requests when the primary is unavailable or during operational testing. Our AI providers do not use this data to train their models. They may retain inputs and outputs for a limited period for abuse monitoring and operational purposes before deletion, unless retention is required by law.
• Improve the Service: understand usage patterns, fix bugs, improve algorithms. We use AI-assisted development tools to review technical logs and error reports; these do not contain your health information.
• Communications: send password reset emails, important service updates, waitlist and beta updates, and (with your consent) wellness reminders via push notifications
• Security: rate limiting, fraud prevention, and protecting against unauthorized access

4. How We Store and Protect Your Data

• Database: your data is stored with established cloud infrastructure providers
• Encryption: your data is encrypted in transit (TLS/HTTPS); the primary database is encrypted at rest with AES-256
• Passwords: stored using bcrypt hashing. We cannot read your password
• Access: only the app's backend services access your health data programmatically. No human reads your health data in the ordinary course of operating the Service. If you contact us about a problem, we may review the records needed to help you.

5. Data Sharing

We do not sell your personal information. We share data only with:

• Third-party AI providers: AI processing for Ask PeriClue conversations, lab-report extraction, document/doctor-note extraction, and other AI features. We use a primary provider, and a backup provider used when the primary is unavailable or during operational testing. Your data is not used to train their models; it may be retained for a limited period for abuse monitoring and operational purposes, then deleted, unless retention is required by law.
• Cloud infrastructure providers: hosting, database, and storage services that run the app
• An email delivery provider: transactional email (password resets, waitlist and beta communications)
• A push-notification and weather-data provider: delivers notifications and weather context (we send only a coarse location; no precise GPS coordinates are stored)
• A privacy-focused product-analytics provider: behavioral events only, never your health data
• An error-monitoring service: diagnostic data, scrubbed of personal information, to keep the app reliable

All service providers are bound by their own privacy policies and data processing agreements. We do not share HealthKit data with any third party for advertising, marketing, or data brokerage.

Where your data is processed. PeriClue is operated from the United States, and your data is stored and processed in the United States. If you use PeriClue from outside the United States, including from Canada, your information is transferred to and processed in the United States, which may have data-protection laws different from your own. Wherever your data is processed, we protect it under the safeguards described in this policy and our agreements with each provider.

6. Your Rights

• Access: you can view all your data within the app at any time
• Export: download a full copy of your data anytime from Settings → Account → Export My Data, or contact us to request one
• Deletion: you can delete your entire account and all associated data from Settings within the app. Deletion is permanent — your data is erased from our active systems immediately, and any residual copies in encrypted backups are purged within 30 days
• Correction: you can edit your profile and health entries at any time

California residents: we do not sell or share your personal information, and we do not use sensitive personal information beyond providing the Service — so there is no sale or sharing to opt out of, and the right to limit the use of sensitive personal information does not change how we handle your data. You retain the access, deletion, and correction rights described above.

7. Data Retention

We retain your data for as long as your account is active. When you delete your account, all personal data, health records, AI conversation history, and cached scores are permanently deleted from our active systems immediately, with any residual backup copies purged within 30 days. Behavioral analytics events (which never include your health data) are not tied to your health records and may be retained by our analytics provider.

7a. Data Breach Notification

If we discover a breach of security involving your unsecured health information, we will notify you without unreasonable delay and no later than 60 days after discovery, and will notify the U.S. Federal Trade Commission and, where 500 or more residents of a state are affected, prominent media in that state, consistent with the FTC Health Breach Notification Rule and other applicable law.

8. Children's Privacy

PeriClue is designed for adults experiencing perimenopause (typically ages 35-58). We do not knowingly collect information from anyone under 18. If we learn we have collected data from a minor, we will delete it promptly.

9. Consumer Health Data (Washington My Health My Data Act)

This section applies to "consumer health data" under the Washington My Health My Data Act (RCW 19.373) and similar consumer-health-data laws. It supplements the rest of this policy.

Categories of consumer health data we collect: data you provide (symptoms, mood, energy, cycle and reproductive information, medications and supplements, lab results, and doctor notes), and health data you authorize from Apple Health (sleep, heart rate and HRV, activity and energy, temperature, menstrual data, blood glucose, body measurements). We also derive health-related scores and insights from this data.

Sources: you (direct entry and uploads), and Apple Health (with your permission, from your Apple Watch and connected devices).

Why we collect it: solely to provide the Service to you — to calculate your scores, generate personalized insights, and answer your questions. We never use consumer health data for advertising, and we never sell it.

Who we share it with: we do not sell consumer health data and do not share it for anyone else's purposes. We share it only with service providers acting on our behalf, under contract, solely to operate the Service: third-party AI providers (AI processing of conversations, lab reports, and documents, including a backup provider used only when the primary is unavailable), cloud infrastructure providers (encrypted storage and hosting), and a push-notification provider. We do not share consumer health data with advertisers, data brokers, or affiliates for their own use.

Your rights: Washington consumers have the right to (1) confirm whether we collect, share, or sell your consumer health data and access it; (2) withdraw consent to our collection and sharing; and (3) have your consumer health data deleted. You can delete all your data in the app (Settings → Account → Delete Account) or by emailing support@periclue.app; we honor verified requests as required by law. Because we do not sell consumer health data, there is no sale to opt out of. To exercise a right or ask a question, contact support@periclue.app; if we deny a request, you may appeal by replying to our response.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or how your data is handled:

• Email: support@periclue.app
• Person in charge of the protection of personal information (Privacy Officer): support@periclue.app
• Website: periclue.com