Your health data is not a product.

1. Introduction

Endometriosis Companion ("we", "our", "us") is committed to protecting your privacy and handling your personal information with care, transparency and respect.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and what rights you have over it.

We understand that the information you share may include deeply personal health information — including symptoms, menstrual cycle details, medications, food logs, pain levels, emotional wellbeing and other sensitive health-related data. We treat this information accordingly.

By using Endometriosis Companion, you agree to the collection and use of your information as described in this policy. If you do not agree, please do not use the service.

2. Who we are

Endometriosis Companion is currently operated by April Wood, an individual based in Victoria, Australia. This policy will be updated when the business is incorporated as a company. The current data controller for your personal information is:

References to "we", "our" and "us" throughout this policy refer to April Wood trading as Endometriosis Companion.

3. Information we collect

Account information

When you create an account, we collect:

• Email address
• Login credentials (stored in encrypted, hashed form — we do not have access to your password)
• Subscription status and plan type
• Payment-related metadata (we do not store full payment card details — see Section 7)
• Date of account creation

Health and tracking information

You choose what to log. This may include:

• Menstrual cycle information, including cycle day, cycle length and phase
• Pain levels and pain locations
• Symptoms such as fatigue, bloating, nausea, bowel symptoms, bladder symptoms, brain fog, mood and anxiety
• Food and meal logs
• Exercise type, intensity and duration
• Supplements and medications taken
• Energy and mood ratings
• Free-text notes you choose to enter
• Questions you submit to the AI companion

This is sensitive health information. We collect it only because you choose to log it, and we use it only as described in this policy.

Device, usage and security information

When you use the service, we may collect limited technical information including:

• Device type and operating system
• Browser type and version
• IP address
• General geographic region (derived from IP address — we do not collect precise location)
• Error logs and crash information
• Security records, such as failed sign-in attempts and blocked or rate-limited requests, which may include your IP address

We do not currently use third-party analytics tools that collect health-event data or symptom-level tracking information.

4. Legal basis for processing

We process your personal information on the following legal bases, which vary depending on the type of information and the purpose for which it is processed.

Australian Privacy Act 1988

For users located in Australia, we handle personal information (including sensitive health information) in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We collect sensitive health information only with your consent, and only for the primary purpose of providing the service you have requested.

UK and EU General Data Protection Regulation (GDPR)

For users located in the United Kingdom or European Union, we process your personal information under the following legal bases:

• Contract performance (Article 6(1)(b) GDPR): processing your account information and subscription data to provide the service you have signed up for
• Explicit consent (Article 9(2)(a) GDPR): processing your sensitive health data, including all tracking information you choose to log, on the basis of your explicit consent
• Legitimate interests (Article 6(1)(f) GDPR): processing limited technical and usage data to maintain the security and functionality of the platform, where this does not override your privacy interests

We do not rely on consent as a legal basis for processing where another legal basis applies. Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and interests.

5. How we use your information

We use the information we collect to:

• Provide, operate and maintain the Endometriosis Companion service
• Generate symptom tracking insights and pattern summaries from data you log
• Process your subscription and manage your account
• Send account-related communications, including subscription confirmation, account notices and pre-deletion warnings (see Section 10)
• Respond to support requests
• Detect, prevent and investigate abuse, fraud or security issues
• Maintain and improve the technical functionality of the platform
• Comply with applicable legal obligations

We do not use your health information for advertising purposes. We do not use your health information to build advertising profiles. We do not share your health information with advertising platforms or marketing systems.

6. AI-generated insights

Endometriosis Companion offers an optional AI companion feature that generates observational insights based on the tracking data you choose to log. This feature uses AI services provided by OpenAI, a company based in the United States. AI insights are not included in every plan.

What the AI feature does

When you request an AI-generated insight, a text summary built from your tracking data is sent to OpenAI's systems for processing. The AI analyses this data and returns an observational summary. The AI is instructed to use cautious, observational language only, and not to provide diagnoses, treatment recommendations or certainty-based conclusions. It can still make mistakes.

What information is sent to OpenAI

The summary is built from your logs and may include:

• Daily entries, including date, cycle day and phase, pain, energy and mood scores, pain locations and symptoms
• Supplements, medications, exercise and food entries
• Notes you have added to log entries
• Pattern summaries calculated from your logs, such as symptom frequency by phase
• The specific question you type into the AI companion

We do not intentionally send your name, email address or payment information to OpenAI. However, any free text you type, such as notes, food entries or questions, is sent as you wrote it. Please avoid entering names, addresses or other identifying details in those fields.

The AI feature is optional. If you do not use AI insight features, your logged health data will not be sent to OpenAI. We ask for your consent before AI insights are used, and you can stop using them at any time.

OpenAI and model training

We do not use information submitted through the AI feature to train any AI models ourselves. We use OpenAI's API, and as far as we are aware, data sent through the API is not used by OpenAI to train its models by default. OpenAI may keep API requests for a limited period for security and abuse monitoring under its own terms. OpenAI's own privacy policy and terms govern its handling of data once it is received, and we recommend you review them if you have concerns.

Where AI processing occurs

Information submitted for AI insight processing is sent to and processed on servers operated by OpenAI, which may be located in the United States or other countries outside Australia. This is an international transfer of your personal information. See Section 9 for further detail.

7. Payment processing

Subscription payments are processed securely by Stripe, Inc., a third-party payment processor based in the United States. When you subscribe, your payment information is handled directly by Stripe.

We do not store full credit card numbers, security codes or full payment credentials on our systems at any time. Stripe provides us with payment confirmation and subscription status information only.

Stripe does not have access to your health tracking data. The only information Stripe receives is what is necessary to process your payment — your email address, payment card details, billing information and the plan you choose.

Stripe's handling of your payment information is governed by Stripe's own Privacy Policy, which we recommend you review.

8. Service providers

To operate Endometriosis Companion, we use carefully selected third-party service providers. Each provider is given access only to the information reasonably necessary to perform their specific function. We do not authorise service providers to use your information for their own purposes.

Current service providers include:

Supabase

Supabase provides database storage, user authentication and backend infrastructure. Your health tracking data and account information are stored on Supabase infrastructure. We have selected an Australian data region for our Supabase project, meaning your data is stored on servers located in Australia. Supabase is incorporated in the United States and its parent infrastructure and support operations may involve access from outside Australia.

Stripe

Stripe processes subscription payments and manages subscription status. Stripe is based in the United States. See Section 7 for further detail.

OpenAI

OpenAI provides the AI language model used for the optional AI companion feature. OpenAI is based in the United States. See Section 6 for further detail. Only users who choose to use AI features have their data sent to OpenAI.

Cloudflare

Cloudflare provides website hosting, security infrastructure and content delivery for the Endometriosis Companion web application. Cloudflare operates a global network of data centres. When you access the app, your request may be routed through and temporarily cached at a Cloudflare data centre in your region, which may be outside Australia. Cloudflare delivers web pages and static assets. Your stored health data is held in Supabase, not Cloudflare.

Google Workspace

We use Google Workspace for support email communications. When you contact us at support@endometriosiscompanion.com, your email and any information you include is processed via Google's email infrastructure. Google is based in the United States.

We do not currently use advertising networks, marketing pixels, behavioural tracking tools or third-party analytics services that collect health-event or symptom-level data.

9. International data transfers

Endometriosis Companion is operated from Australia. However, some of our service providers are located in or operate infrastructure in countries other than Australia, including the United States. This means your personal information may be transferred to, stored in or processed in countries outside Australia.

Specifically:

• OpenAI — United States (and possibly other countries). Applies when you use AI insight features.
• Stripe — United States. Applies when you subscribe.
• Cloudflare — Global network of data centres. Applies to all users when accessing the web app.
• Supabase — Australian data region for stored data. Supabase's parent company is US-based and support or infrastructure teams may access systems from outside Australia.
• Google Workspace — United States. Applies when you contact us by email.

For users located in the European Union or United Kingdom, we acknowledge that some of these transfers involve countries that do not have an adequacy decision from the European Commission. Where this is the case, we rely on providers that are certified under the EU-US Data Privacy Framework (where applicable) or that offer Standard Contractual Clauses as a transfer safeguard.

For users located in Australia, we note that the Australian Privacy Act requires that we take reasonable steps to ensure that overseas recipients handle your information in a way that is consistent with the Australian Privacy Principles. We select reputable providers and review their privacy commitments accordingly. By consenting to use AI insights, you acknowledge that your information will be sent to OpenAI overseas for that purpose.

10. Data retention

Active accounts

We retain your account information and health tracking data for as long as your account is active and for a reasonable period thereafter to allow you to return to the service.

Inactive accounts

If your account has had no activity for a continuous period of three years, we will contact you at your registered email address to notify you that your account and data are scheduled for deletion. You will have a reasonable period to respond and reactivate your account before deletion proceeds. If we do not receive a response, your account and associated data will be permanently deleted.

Account deletion

If you choose to delete your account, we will take steps to delete or anonymise your personal information within a reasonable timeframe. Some residual information may be retained for a short period in backup systems before being purged, and we may retain limited information where required by law (for example, transaction records for tax purposes).

Security and audit records

Records of security events, such as failed sign-ins and blocked requests, may include your IP address and are kept for a limited period for safety and fraud prevention, which may be longer than the retention of your tracking data.

Support communications

Information shared with us via support emails is retained only as long as necessary to resolve your query and for a reasonable period thereafter.

We do not retain your data in identifiable form for longer than is necessary for the purposes described in this policy.

11. Cookies & local storage

Endometriosis Companion uses browser local storage and session storage to maintain your login session, remember your preferences (such as dark mode settings) and store temporary app state between sessions. This is standard practice for web applications and is necessary for the app to function.

We do not currently use third-party advertising cookies, tracking pixels or behavioural analytics cookies.

If we introduce third-party analytics tools in the future, this policy will be updated before those tools are implemented, and we will provide appropriate notice.

You can clear local storage data at any time through your browser settings. Doing so will log you out of the app and reset your local preferences.

12. Data storage & security

We take reasonable technical and organisational measures to protect your personal information from unauthorised access, disclosure, alteration or destruction.

These measures include:

• Encrypted connections (HTTPS) for all data transmitted between your device and our servers
• Encrypted storage for passwords using hashing and salting — we do not have access to your password
• Access-controlled cloud infrastructure via Supabase, with row-level security policies restricting data access to authenticated users
• Health tracking data stored in an Australian data region
• Restricted access to personal information — only systems and service providers reasonably required to operate the platform

No method of transmission or storage is completely secure. While we use all reasonable efforts to protect your information, we cannot guarantee absolute security. If you become aware of any security issue relating to your account, please contact us immediately at support@endometriosiscompanion.com.

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by law.

We recommend protecting your device with a passcode, Touch ID or Face ID, and using a unique, strong password for your Endometriosis Companion account.

13. Automated decision-making

Endometriosis Companion does not engage in automated decision-making or profiling activities that produce legal effects or similarly significant effects on you.

The AI companion feature generates observational insights from your tracking data, but these insights are informational only. No automated decisions are made about you on the basis of your health data without human involvement. The app does not make decisions about your eligibility for services, access to healthcare, insurance or any other matter of consequence.

14. Your rights

Depending on your location and applicable law, you may have the following rights in relation to your personal information.

Rights under the Australian Privacy Act

If you are located in Australia, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Make a complaint to the Office of the Australian Information Commissioner (OAIC) if you believe we have not handled your information in accordance with the Australian Privacy Principles

Rights under GDPR (EU and UK users)

If you are located in the European Union or United Kingdom, you have the right to:

• Access — request a copy of the personal information we hold about you
• Rectification — request correction of inaccurate or incomplete information
• Erasure — request deletion of your personal information (subject to legal retention requirements)
• Data portability — request your personal information in a structured, commonly used and machine-readable format
• Restriction — request that we restrict processing of your personal information in certain circumstances
• Objection — object to processing carried out on the basis of legitimate interests
• Withdraw consent — withdraw your consent to health data processing at any time, without affecting the lawfulness of processing before withdrawal
• Lodge a complaint — lodge a complaint with your local data protection supervisory authority if you believe we have not handled your information lawfully

How to exercise your rights

To exercise any of the above rights, or to make a complaint or enquiry about your personal information, please contact us at support@endometriosiscompanion.com. We will respond within a reasonable timeframe and in any event within 30 days. We may need to verify your identity before processing your request. If you are not satisfied with our response, you can contact the supervisory authority listed below.

You can delete your account directly from within the app. Deleting your account will remove your health tracking data from our active systems.

Supervisory authority contacts

• Australia: Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au
• European Union: your local EU member state data protection authority
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk

15. Age restriction

Endometriosis Companion is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18.

By creating an account, you are required to confirm that you are at least 18 years of age. This confirmation is recorded on our systems at the time of account creation, along with a timestamp, as part of our compliance record.

The service is not available to anyone under 18. There is no parental or guardian consent pathway — the age floor is a hard requirement, not a guideline.

If we become aware that we have collected personal information from a person under 18, we will take steps to delete that account and all associated data promptly. If you believe a person under 18 has created an account, please contact us at support@endometriosiscompanion.com.

16. Business transfers

If Endometriosis Companion is sold, transferred, merged or acquired by another entity, your personal information may be transferred as part of that transaction. In the event of such a transfer, we will take reasonable steps to ensure that your information remains subject to privacy protections consistent with this policy.

We will notify you by email or through a prominent notice within the app before your personal information is transferred to a new entity under materially different privacy terms, and you will have the opportunity to delete your account if you do not wish your information to be transferred.

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in the law, our data practices, the features of the service, or other factors.

When we make material changes — changes that significantly affect how we collect, use or share your information — we will notify you by email at your registered address and display a prominent notice within the app before the changes take effect. Where the law requires it, we will ask for your consent again.

The date at the top of this policy reflects when it was last updated. We encourage you to review this policy periodically. Your continued use of the service after changes take effect constitutes your acceptance of the updated policy.

Previous versions of this policy are available on request.

18. Medical disclaimer

Endometriosis Companion is an educational tracking tool. It is not a medical device, does not diagnose medical conditions, does not provide treatment recommendations, does not replace professional healthcare advice, does not guarantee health outcomes and does not provide emergency medical services.

Information generated by the app — including AI-generated insights, pattern summaries and phase-based guidance — is intended for educational and self-tracking purposes only. Always consult your GP, gynaecologist or endometriosis specialist for medical advice specific to your situation.

If you are experiencing a medical emergency, contact emergency services immediately.

19. Contact us

If you have questions, concerns or requests relating to this Privacy Policy or your personal information, please contact us:

We aim to respond to all privacy-related enquiries within 30 days.

Plain-English summary