Privacy Policy

This Privacy Policy explains how PCOS Lens ("PCOS Lens," "we," "us") handles information when you use our website and web application. PCOS Lens is a general-wellness product for adults in the United States. It is not a healthcare provider, health plan, or insurer, and it does not provide medical care. Because of this, the health information you enter is treated as "consumer health data" under state law rather than HIPAA-protected health information. See the dedicated Consumer Health Data section below for the additional protections that apply to it.

We collect only what the product needs to work for you:

• Account information: your email address and a securely hashed password.
• Profile information: a preferred name, your date of birth (used to confirm you are 18+ and then retained only as your age-eligibility record), goals, and dietary preferences you choose to share.
• Health and wellness data: your assessment answers and driver-profile result, and the daily entries you log (such as cycle, mood, energy, sleep, weight, and symptom notes). You control what you enter.
• Usage data: basic, privacy-preserving product events (for example, that a screen was viewed) used to understand the flow of the app. These events never include your health data or identifiers.
• Billing information: none. PCOS Lens is free during early access, we do not offer paid plans right now, and we do not collect payment details of any kind. If we ever introduce paid plans, card details would be handled directly by our payment processor (Stripe), and we would still never see or store your full card number.

We use your information to deliver the features you ask for, to produce your driver profile, tailor your plans, save your logs, power the AI coach, and keep your account secure. We never sell your health data, and we never use it for advertising or send it to advertising networks. We also do not use it to train third-party AI models. Those are permanent commitments, not early-access ones.

Voice logging and spoken coach replies use your browser's built-in speech capabilities by default, which run on your device. When you use the high-quality voice option, the text of the coach's reply (not your health data, and not any recording of your voice) is sent to our text-to-speech provider solely to generate audio. We do not store recordings of your voice, and we do not log the content of your voice transcripts on our servers.

We do not sell your personal information, and we do not sell or share your consumer health data. We do not disclose your health data to advertising or analytics third parties. We share limited information only with service providers that help us run the product (such as our cloud database host and our email provider, and a payment processor only if we ever offer paid plans), and only under contracts that require them to protect it, use it solely to provide their service to us, and notify us of any breach. Each such provider that could touch personal or health data is bound by a data processing agreement.

We may disclose information if required by law or to protect the rights and safety of our users or the public. If PCOS Lens is ever involved in a merger or acquisition, we will honor the commitments in this policy and notify you of any change in control of your data.

We use only first-party cookies that are essential to sign you in and keep your session secure. We do not run third-party advertising trackers, and no cookie or tag on our site carries your health data. If we ever introduce optional analytics or advertising tags, they will be strictly first-party for conversion measurement only, gated behind your consent, and excluded from every health context by design.

Wherever you live in the United States, you can exercise these rights directly in the app or by contacting us:

• Access and export: download your data from Settings. Viewing and exporting your own logged data is always free.
• Delete: delete your account and associated data from Settings; we cascade the deletion to our processors.
• Correct: update your profile information at any time.
• Withdraw consent: as easily as you gave it, from Settings.

We honor the Global Privacy Control and other recognized universal opt-out browser signals for opting out of sale or sharing (we do not sell or share health data in any case). To make a request or ask a question, email privacy@pcosbloom.com. We respond within the timeframes required by applicable law (generally within 45 days).

Some states, including Washington (My Health My Data Act), Nevada (SB 370), and Connecticut, give special protection to "consumer health data." This section is our Consumer Health Data Privacy Policy and is linked from our homepage.

• Categories we collect: reproductive and menstrual-cycle information, symptoms, and wellness metrics you enter; your assessment answers and driver-profile result.
• Sources: you. Health data comes only from what you type or dictate into the app.
• Purposes: solely to provide the features you request (your profile, plans, tracking, insights, and coach).
• Who we share it with: we do not share your consumer health data with any third party for their own use, and we never sell it. Our infrastructure processors (database host, email provider, and, only for the high-quality voice option, our text-to-speech provider, which receives coach reply text, not your health data) act on our instructions under contract.
• Consent: we ask for your opt-in consent to collect health data beyond what is strictly necessary to deliver a feature, and we would ask for separate, unbundled consent before ever sharing it (we currently do not share it at all). You can withdraw consent at any time in Settings.
• Your rights: to access, delete (including having us direct our processors to delete), and withdraw consent. Use Settings or email privacy@pcosbloom.com.
• No geofencing: we do not use geofences around healthcare facilities and never will.

We encrypt your data in transit using TLS and encrypt it at rest. Access to production data is restricted, passwords are stored using a modern one-way hashing function, and every request for your data is scoped to your own account on the server. We describe only safeguards we actually use; we do not make superlative security claims.

We maintain an incident-response plan consistent with the FTC Health Breach Notification Rule. If a breach affecting your health data occurs, we will notify affected individuals without unreasonable delay and no later than 60 days after discovery, and we will notify the FTC (and media where required) for larger breaches, as the Rule requires.

We keep your information for as long as your account is active. When you delete your account, we delete your personal and health data from our systems and direct our processors to do the same, except where we must retain limited records (such as proof of purchase consent, if you ever buy a paid plan) for the period the law requires.

PCOS Lens is intended for adults 18 and older and is not directed to children. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

PCOS Lens provides general wellness and educational information only. It is not a medical device and does not diagnose, treat, cure, or prevent any disease. Your driver profile is a wellness insight, not a diagnosis. Always consult a qualified healthcare provider for medical advice.

If we make material changes, we will update the effective date above and, where required, ask for your renewed consent before the change affects your data.

Questions or privacy requests: privacy@pcosbloom.com.