Consumer Health Data Privacy Policy
Why this is a separate document.
Washington's My Health My Data Act, Nevada's SB 370, and Connecticut's health data provisions require companies handling consumer health data to publish a policy specifically about that data — separate from a general privacy policy. This is that document. Our general Privacy Policy also applies to you.
1. Who we are
Unbroken Consulting Pte. Ltd. ("HERmones," "we," "us"), 68 Circular Road, #02-01, Singapore 049422. Contact us about this policy at privacy@hermones.com.
This policy covers the HERmones mobile application and hermones.com.
2. What consumer health data we collect, and why
Consumer health data means information linked to you that identifies your past, present, or future physical or mental health status. Because HERmones is built around menopause and perimenopause, we treat almost everything you enter as consumer health data.
| Category | Examples | Why we collect it |
|---|---|---|
| Reproductive and menstrual health data | Cycle phase you select or that the App estimates; menopause and perimenopause status | To generate your daily reading and identify recurring patterns |
| Symptoms and bodily functions | Hot flashes, sleep disruption, joint pain, skin and hair changes, mood, energy, and other symptoms you log | To generate your reading, translation, and pattern observations |
| Mental and behavioral health data | Mood and stress entries; anything you write in journal entries | To reflect back what you have recorded and identify patterns over time |
| Lifestyle inputs relating to health | Movement, alcohol, sugar, supplements | To show how these appear alongside your logged symptoms |
| Health-related inferences we generate | Your hormonal age reading, pattern observations, and daily translation | These are produced by automated processing of what you log. They are estimates for reflection, not medical findings |
| Onboarding answers | Answers used to personalize your readings | To set up the App for you |
We use consumer health data only to provide the App to you, to answer messages you send us, and to fix defects. We do not use it for advertising, marketing targeting, or profiling for advertising purposes.
3. Where the data comes from
- Directly from you — everything you log, write, or select in the App.
- Generated by the App — readings, estimates, and pattern observations calculated from your entries.
We do not buy consumer health data, and we do not obtain it from data brokers, advertising networks, or other third parties.
4. What we share, and with whom
We do not sell consumer health data. We have never sold it, and we will not sell it. Under these laws, a "sale" requires your separate signed authorization — we do not seek one, because we do not sell.
We share consumer health data only with service providers acting on our instructions under contracts that prohibit them from using it for their own purposes, from training their systems on it, or from keeping it longer than needed. Here is what each kind of provider receives — and every one of them is named, by company, in the list we keep at hermones.com/subprocessors, so you can see exactly who they are and when that changes.
| Who receives it | What they receive | Why, and on what terms |
|---|---|---|
| Cloud hosting | Your account record and the entries you log, which are held on our servers | Storage and hosting. Acts on our instructions only. Named at hermones.com/subprocessors |
| OpenAI — writes some of the text in the App | Only the entries needed for that text — the Rage Room, and the words that go with your insights. Your hormonal age, HERoscope, the Playbook and Waking Hours do not involve AI and nothing is sent for them | Acts only on our instructions. Contractually barred from using it for its own purposes or training models on it. Holds it up to 30 days in its own abuse-monitoring logs before deleting it. Named on the same page |
| Error diagnostics | Crash and diagnostic information — not your logs | To find and fix defects. Named on the same page |
| Apple Inc. and Google LLC | App distribution and account identifiers. They do not receive your logs from us | To distribute the App, under their own privacy policies |
If a provider receives no consumer health data, it does not appear on that list. If we add or change one, the list changes with it and the date at the top of it moves.
Advertising and analytics technologies
We do not permit advertising or analytics technologies to collect consumer health data. [SELECT ONE — see note below]
Option A (recommended, if you remove advertising tags from all condition-context pages): "Advertising and analytics tags are not present on pages of hermones.com that concern symptoms, conditions, or health assessments. Where such tags are used on general pages, they do not receive consumer health data."
Option B (only if any advertising tag remains on a health-context page): you must name the recipient, describe exactly what is transmitted, and obtain the consumer's consent before collection — separate consent from any other terms. Do not publish Option A while Option B is the reality.
5. Who can see it inside our company
Access is limited to the small number of people who need it to run the App and answer your messages. Everyone with access is bound by confidentiality obligations.
6. Your rights
6.1 Right to confirm and access
You can ask us to confirm whether we collect, share, or sell your consumer health data, and to give you a copy of what we hold, along with the list of third parties with whom we have shared it.
6.2 Right to withdraw consent
You can withdraw your consent to our collection and sharing of your consumer health data at any time. To do this, write to privacy@hermones.com. Withdrawing consent does not require you to delete your history, and it does not affect anything we did lawfully before you withdrew.
6.3 Right to delete
You can ask us to delete your consumer health data. When you do, we remove it from our live systems and instruct every service provider and third party holding it to do the same, and we confirm when that is done.
Deletion reaches our backups and archives as well. We do that by hand rather than automatically, which is why we complete it within 30 days rather than instantly. Separately, OpenAI holds what passed through it for up to 30 days in its own abuse-monitoring logs before deleting it — that retention is theirs, and we cannot shorten it by asking.
6.4 How to exercise these rights
Use the deletion and export controls inside the App, or write to privacy@hermones.com. We will confirm receipt and respond within the time your state's law requires — 45 days in Washington, with one 45-day extension where reasonably necessary, and we will tell you if we need it.
You may use an authorized agent. We may ask you to verify your identity in a way that is proportionate to the sensitivity of the data, and we will not ask for more than we need.
6.5 If we decline
If we cannot fulfill a request, we will tell you why, and we will tell you how to appeal. If we deny your appeal, we will provide the contact details for your state Attorney General so you can complain.
7. We will not discriminate against you
We will not deny you the App, charge you a different price, or give you a lower quality experience because you exercised any right in this policy.
8. Geofencing
We do not use geofencing. We do not collect your precise location, and we do not build any boundary around healthcare facilities or any other place.
9. How long we keep it
Your logged history is kept until you delete it; deleting it removes it from our servers as well. Anything else we hold is kept only as long as needed to provide the App or as legal, tax, and accounting rules require. Diagnostic information is kept 90 days; messages you send us, 12 months; privacy requests, 24 months because the law requires us to record them.
10. State-specific notes
Washington
This policy is our Consumer Health Data Privacy Policy under the My Health My Data Act. We do not collect, use, or share consumer health data beyond what is disclosed here.
Nevada
This policy also serves as our health data notice under Nevada SB 370. Nevada residents have the rights described in Section 6.
Connecticut
Connecticut residents have equivalent rights regarding consumer health data and may exercise them using the contacts above.
11. Changes
If we make a material change to how we collect, use, or share consumer health data, we will tell you before it takes effect and obtain your consent again where the law requires it. The date at the top always reflects the current version.
12. Contact
Unbroken Consulting Pte. Ltd.
68 Circular Road, #02-01
Singapore 049422
privacy@hermones.com