Privacy Policy

• No ads:There is no advertising, retargeting or data-broker code on this website or in the app.
• No sale of personal health data:We do not sell or rent personal data, and we do not share it with advertisers.
• No AI training on your content:Your messages and entries are not used to train, tune or improve AI models — ours or a provider's.
• Data minimisation:We collect the smallest amount of information that makes the Service work, and we say what it is below rather than describing it in general terms.

This is the complete list for harmoflux.com. If something is not on this list, this website does not collect it.

We never ask for, and this website never collects, your symptoms, cycle dates, medications, diagnoses or any other health information.

• Consent:Waiting-list signup and any marketing email. You can withdraw it at any time.
• Contract:Creating your account, processing your subscription and providing support.
• Legitimate interests:Keeping the Service secure and preventing abuse (for example, rate limiting by IP).
• Legal obligation:Keeping the financial records that tax law requires.

These bases are named for the GDPR. If you are in Canada we handle your data under PIPEDA, and if you are in California under the CCPA/CPRA — in each case you have the rights listed in section 8.

The chat bubble on this website answers questions about HarmoFlux. Here is precisely what happens when you use it:

• What is sent:The text of your message (maximum 500 characters) plus up to the last 10 turns of that conversation, forwarded to the Lovable AI Gateway, which currently routes to a Google Gemini model.
• What is not sent:Your name, email, account ID or any identifier. The request is not tied to your account, even if you are signed in.
• What we keep:Nothing. Conversations are not written to our database. The transcript exists in your browser tab and disappears when you close it. Our server logs record that a request happened, not what it said.
• Training:Content sent through the gateway is not used to train models.
• Please don't:Enter personal health details, symptoms or anything you would not want processed by a third-party AI provider. The assistant is for product questions.

AI can be wrong. The assistant does not provide medical advice, diagnosis or treatment — see section 10.

Sections 1–4 describe this website. The HarmoFlux app is where health information is entered, so it is covered separately here.

• What you can enter:Cycle dates, symptoms and how severe they were, medications and supplements with dose and timing, notes on how you felt afterwards, sleep, hydration and other wellness entries. All of it is optional — the app works with as little or as much as you choose to log.
• Where it is stored:In your account in our managed Postgres database, hosted in a Supabase region, encrypted in transit (TLS) and at rest. Row-level security restricts every row to the account that created it.
• Who can see it:You. It is not sold, rented or shared with advertisers, data brokers, employers or insurers, and there is no advertising SDK in the app. A small number of engineers can access production data only where necessary to fix a fault or respond to your support request.
• AI features (Plus plan):When you use an AI wellness insight or ask the in-app assistant, the relevant entries for that request are sent to the Lovable AI Gateway, which currently routes to a Google Gemini model, for the length of the request. The provider does not use content sent through the gateway to train or improve models. AI features are optional; not using them means no health entry leaves our database for AI processing.
• Retention:Health entries are kept for as long as your account is active, because the point of the app is a history that builds over years. Delete an individual entry and it is removed from the live database immediately and from encrypted backups as those backups age out, within 30 days. Delete your account and all health data is removed on the same 30-day schedule.
• Export:You can export your data, and the doctor-ready PDF summary, from the app at any time.
• What the app does not do:No fertility or contraception guidance, no diagnosis, no drug-interaction checking, and no claim that anything you logged caused anything else. HarmoFlux records timing.

This is the full list of third parties involved in running this website. Each may use the data only to provide its service to us.

Data may be processed outside Canada. Where that happens, transfers rely on contractual safeguards with the provider. We will update this list before adding a new provider that handles personal data.

This website carries no advertising, retargeting or cross-site tracking code. For visitor statistics it uses Plausible Analytics (Plausible Insights OÜ, Estonia — EU-hosted), a cookieless analytics service. Plausible sets no cookies, assigns no persistent identifier, does not track visitors across websites, and does not sell or share data. It records the page URL, referrer, country, and a browser/device category, and stores no IP address. Aggregate site statistics are retained for as long as the site is operated; no visitor-level records are kept.

Alongside page views, a small number of named events can fire. None of them carry health information, and none identify you:

• • cta_click — which page a "start tracking" button was pressed on
• • app_store_click — which page a download button was pressed on
• • pricing_interaction — which plan was viewed or selected
• • feature_page_view — which product page was viewed
• • chat_opened — that the on-site assistant was opened, and from which page
• • calculator_used — that the period calculator produced a result. The dates you enter stay in your browser and are never sent to us or to Plausible.
• • outbound_telehealth — that a link to a telehealth partner was followed

Cookies are covered in full in our Cookie Policy: essential and authentication cookies only, no advertising cookies.

Any contribution to research is de-identified, aggregated and used only with consent.

• Opt-in:Contribution is off unless you turn it on in the app's settings, and you can turn it back off at any time.
• De-identified:Your name, email and account identifiers are never included, and re-identification is contractually prohibited.
• Purpose:Product improvement and general women's-health research — never advertising.

• • Access — get a copy of the personal data we hold about you
• • Correction — fix anything that is wrong or out of date
• • Deletion — have your data erased, subject to legal record-keeping
• • Portability — receive your data in a common machine-readable format
• • Withdraw consent — unsubscribe or leave the waiting list at any time
• • Object or restrict — ask us to stop or limit a specific use
• • Complain — raise a concern with your privacy regulator (in Canada, the OPC)

Email Show email address from the address associated with your account or waiting-list entry, and say which right you are exercising. We reply within 30 days — our own service commitment, which is at least as fast as the response deadlines under GDPR, CCPA/CPRA and PIPEDA. There is no charge, and asking costs you nothing in service quality.

Step-by-step instructions are on our data request page.

• In transit:All traffic uses HTTPS/TLS.
• At rest:Our database is encrypted at rest by the hosting provider.
• Access control:Every table has row-level security enabled. Administrative access is limited to accounts holding an explicit admin role, stored separately from user profiles.
• Payments:Card details go directly to Stripe. We never receive or store them.
• Breach notice:If a breach affects your personal data, we will notify affected users and the relevant regulator without undue delay.

Report a security issue to Show email address. No method of transmission over the Internet is completely secure, and we do not claim otherwise.

Your tracking entries — cycles, symptoms, medications, supplements, notes — are created and held in the HarmoFlux app, which is a separate system from this website. Within the app:

• Your entries are yours:They are stored so that only your account can read them, and they are not sold, rented or shared with advertisers.
• Export:You can export your data and generate a doctor-ready summary you control.
• Deletion:You can delete your account from the app's settings, or email us. We commit to completing deletion within 30 days — our own service commitment, which is at least as fast as the deadlines set by GDPR, CCPA/CPRA and PIPEDA. See exactly what is deleted.
• Research contribution:Off by default, opt-in only, de-identified — see section 7.

HarmoFlux is available from age 13. A user aged 13 to 17 may hold their own account only with the verifiable consent of a parent or legal guardian, who must review this policy with them. We do not knowingly collect personal information from anyone under 13, and the Service is not directed to children under 13.

Our first-period content is written for young users and for the parents and guardians supporting them. Purchases and paid plans must be authorised by the parent or guardian. A parent or guardian can request access to, export of, or deletion of their child's data at any time. If you believe a child under 13 has given us personal information, email Show email address and we will delete it.

When we change this policy we update the effective date above. For a change that materially affects how we handle your data — a new subprocessor, a new category of collection, a longer retention period — we will notify account holders by email before it takes effect.