The short version. Cycle Bloom Pal is a health app for people managing PCOS. To work at all, it handles information about your body — your cycle, symptoms, weight, meals and reflections. That is sensitive, and we treat it that way.
We do not sell your data. We do not share it with advertisers. The app does not use an advertising identifier. Analytics and screen recording are off until you switch them on, and the screens that show your health information are masked even then. You can export everything we hold and delete your account from inside the app.
1. Who we are
Cycle Bloom Pal is provided by Cycle Bloom Pal (“we”, “us”, “our”). We are the data controller for the personal information described in this policy.
You can reach us about anything in this document at hello@cyclebloompal.com, or through our contact form.
2. What this policy covers
This policy covers the Cycle Bloom Pal mobile app, the website at cyclebloompal.com, and the backend services it talks to at api.cyclebloompal.com. It does not cover third-party services you reach from the app — for example Google Play, or a video you open on YouTube — which have their own policies.
3. Information we collect
3.1 Information you give us
| Category | Examples | Why we need it |
|---|---|---|
| Account | Email address, display name, password (stored only as a salted hash). If you sign in with Google or Apple, the identifier and email that provider returns. | To create your account, sign you in, and recover access. |
| Health and onboarding answers | Your PCOS-related answers: goals, symptoms, diagnosis context, dietary preferences, activity level and similar. | To build and adjust your personalised plan. |
| Cycle and reproductive health data | Period start and end dates, flow, cycle-day logs, symptoms, moods. | To show your cycle, predict phases, and tailor guidance. |
| Body measurements | Weight entries and other measurements you choose to record, and the dates you record them. | To show progress over time and adjust your plan. |
| Food and meals | Photos you scan, meals you log, the meal slot, and corrections you make to a scan result. | To identify food, estimate nutrition and keep your food history. |
| Reflections and check-ins | Daily and weekly reflection answers, including free-text where offered. | To track how you are doing and surface patterns. |
| Support messages | Anything you write to us by email or through the contact form. | To answer you. |
3.2 Information collected automatically
| Category | Examples | Why |
|---|---|---|
| Device and app | Device model, operating system version, app version, language, time zone, and a generated app-install identifier. | To run the service, fix crashes and keep sessions working. |
| Technical logs | IP address, request timestamps, endpoints called, error and crash information. | Security, abuse prevention, and diagnosing faults. |
| Usage analytics (only if you opt in) | Which screens you open and which features you use, as event names without your health entries attached. | To understand which parts of the app help and which do not. |
| Session replay (only if you opt in) | A recording of how you move through the app. Every text field is hidden, and the cycle, health profile, scan result, weight and profile screens are masked entirely, so a recording shows layout and navigation rather than your health data. | To find where the app confuses people. |
| Purchases | The subscription you bought, its status, and the receipt token issued by Google Play or Apple. | To unlock and maintain your subscription. |
| Notifications | A push token, if you allow notifications. | To send reminders you asked for. |
| Website data | Pages visited, referring URL, and basic analytics cookies or similar technologies on cyclebloompal.com. | To operate and improve the marketing site. |
3.3 What we do not collect
- No advertising identifier. The app explicitly removes the Android advertising-ID permission.
- No precise location. We do not request or collect GPS location.
- No contacts, no microphone, no call or SMS data. The microphone and audio-recording permissions are explicitly removed.
- No card numbers. Payments are handled entirely by Google Play or Apple; we never see your payment details.
4. Camera and photo access
If you use food scanning, the app asks for camera access, or access to the photo you pick. The image is sent to our service to identify the food and is stored with that food log so you can review it. We do not scan your photo library, and we only read the image you choose. You can refuse this permission and still use the rest of the app, including logging food by hand.
5. Health data and your consent
Most of what Cycle Bloom Pal handles is health information — and under European and UK law, data about your health and sex life is a “special category” that needs your explicit consent. We ask for that consent when you create your account and begin onboarding, and you may withdraw it at any time by deleting your account (see section 13). Withdrawing does not affect processing that already happened while consent was in place.
You are never required to answer any particular question. Leaving something blank reduces how well we can personalise your plan; it does not lock you out of the app.
6. How we use your information
- To create and run your account, and keep you signed in securely.
- To generate and adjust your personalised PCOS plan, cycle view, food guidance and movement suggestions.
- To show you your own history and progress.
- To send reminders and notifications you have enabled.
- To operate subscriptions, verify purchases, and handle refund requests.
- To keep the service secure, detect abuse, and debug failures.
- To improve the product — only with the analytics and replay you have switched on.
- To comply with legal obligations.
We do not use your health data to make any decision that produces a legal or similarly significant effect on you, and we do not profile you for advertising.
7. AI features
Two features use artificial intelligence: food scanning and plan generation. When you use them, the relevant input — the food photo, or your onboarding answers — is sent to our AI provider to produce the result. The app tells you this and asks you to agree the first time, before anything is sent.
Our AI processing is carried out through Google as a service provider under contract. Inputs are processed to return your result. Contact us if you need the current retention and training settings under that contract.
AI output can be wrong. Nutrition estimates and plan suggestions are starting points, not facts about your body — see the medical disclaimer in our Terms.
8. Who we share information with
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only with the following service providers, for the purposes shown:
| Provider | What it receives | Purpose |
|---|---|---|
| Cloud hosting provider | All service data | Hosting our backend and database |
| Google (Firebase) | Device and app identifiers; authentication identifiers; analytics events if you opted in | Authentication, push delivery, crash and analytics |
| Google (AI services) | Food photos and onboarding answers, when you use AI features | Food recognition and plan generation |
| Google Play / Apple | Purchase and subscription records | Processing payments and subscriptions |
| UXCam | Masked session recordings and app usage | Only if you opt in to session replay |
| Cloudflare | IP address and request metadata | Network delivery, DDoS protection, and bot checks on public forms |
We may also disclose information:
- to professional advisers (lawyers, accountants, auditors) under confidentiality;
- to a buyer or successor if the business is sold or merged — in which case we will tell you before your information becomes subject to a different policy;
- where we are legally required to, as described in section 17.
9. Legal bases (EEA and UK)
| Purpose | Legal basis |
|---|---|
| Creating your account; delivering the app’s core features | Performance of a contract (Art. 6(1)(b)) |
| Processing health, cycle and reproductive data | Your explicit consent (Art. 9(2)(a)) |
| Analytics and session replay | Your consent (Art. 6(1)(a)) — opt-in, withdrawable |
| Security, abuse prevention, debugging | Legitimate interests (Art. 6(1)(f)) in keeping the service safe and working |
| Keeping purchase and tax records | Legal obligation (Art. 6(1)(c)) |
10. How long we keep it
- Account and health data: for as long as your account exists.
- After you delete your account: removed from live systems within 30 days, and from encrypted backups within 90 days, after which it is gone.
- Technical and security logs: 90 days.
- Session recordings: as configured with our session-replay provider (typically up to 90 days).
- Purchase and tax records: as long as tax law requires, typically 7 years. These contain transaction records, not your health data.
11. Your rights
Depending on where you live, you have some or all of the following rights:
- Access — get a copy of what we hold. The app does this for you: Settings → export your data.
- Correction — fix anything inaccurate. Most of it is editable directly in the app.
- Deletion — erase your account and data (see section 13).
- Portability — receive your data in a machine-readable format.
- Restriction and objection — ask us to pause or stop certain processing.
- Withdraw consent — at any time, including by turning analytics and session replay off in Settings.
- Complain — to your local data protection authority. In the EU you may complain in the country where you live or work. In the UK this is the Information Commissioner’s Office (ico.org.uk).
To exercise a right that is not already a button in the app, email hello@cyclebloompal.com or use our contact form. We respond within one month, and we will not charge you or treat you differently for asking.
12. United States privacy rights
12.1 California (CCPA/CPRA)
In the past 12 months we collected the categories described in section 3: identifiers, customer records, commercial information (purchases), internet activity, and sensitive personal information — specifically health information and, where you log it, information about your sex life or sexual orientation.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We use sensitive personal information only to provide the service you asked for, which means the right to limit its use does not change how we handle it — we already do not use it for anything else.
California residents have the right to know, delete, correct, and to be free from discrimination for exercising these rights. Use the same contact address above; an authorised agent may act for you with proof of authorisation.
12.2 Washington State (My Health My Data Act) and Nevada
This section is our Consumer Health Data Privacy Policy for the purposes of Washington’s My Health My Data Act, and it also addresses Nevada SB 370.
The consumer health data we collect is listed in section 3: cycle and reproductive health data, symptoms, moods, body measurements, food logs, and the health answers you give during onboarding. We collect it directly from you, use it only for the purposes in section 6, and share it only with the processors in section 8.
- We do not sell consumer health data, and we will not do so without the separate, written authorisation the Act requires.
- You may withdraw consent to our collection and sharing, and request deletion, by emailing hello@cyclebloompal.com or deleting your account in the app. We will confirm deletion and instruct our processors to delete it too.
- You may ask for a list of the third parties with whom we have shared your consumer health data.
- If we deny a request you may appeal by replying to our decision; if the appeal is denied you may contact the Washington Attorney General.
12.3 Other states
Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Texas, Oregon and Montana) have comparable rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale and profiling. We do not conduct targeted advertising, sale or profiling. Use the contact address above.
13. Deleting your account and data
You can delete everything yourself, without contacting us:
- Open Cycle Bloom Pal and sign in.
- Go to Profile → Settings.
- Choose Delete account and confirm.
You can also request deletion from the web at our Delete account page. We send a confirmation link to your email; it expires in one hour.
This permanently deletes your account, onboarding answers, cycle logs, weight entries, food logs and photos, reflections and preferences. It is not reversible, so export your data first if you want to keep it.
If you cannot access the app, email hello@cyclebloompal.com from the address on your account with the subject “Delete my account”. We verify ownership before acting and complete the deletion within 30 days.
Deleting the app from your phone does not delete your account. Cancelling a subscription does not delete your account either — subscriptions are managed in Google Play or the App Store.
14. Security
- Traffic between the app and our servers is encrypted with HTTPS/TLS; the Android build refuses unencrypted connections.
- Passwords are stored only as salted hashes — we cannot read them.
- Sign-in tokens are kept in the device’s secure storage (Keychain on iOS, Keystore on Android).
- The app can hide its contents in the app switcher and lock behind your device biometrics, if you enable that.
- Access to production data is limited to staff who need it, and is logged.
No system is perfectly secure. If a breach affects your rights we will notify you and the relevant regulator as the law requires.
15. International transfers
Our service providers operate in the European Union and the United States. Where data leaves the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, together with the additional measures those require. You may ask us for a copy of the safeguards we use.
16. Children
Cycle Bloom Pal is not for children. It is intended for people aged 16 and over, and we do not knowingly collect information from anyone younger. If you believe a child has given us personal information, email us and we will delete it.
17. Law enforcement and legal requests
We take requests for your data seriously, and cycle and reproductive health data especially so. We disclose personal information to authorities only where we are legally compelled — for example by a valid, binding court order addressed to us in a jurisdiction where we operate. We review every request, reject those that are overbroad or legally defective, and where we are lawfully able to tell you about a request concerning your account, we will.
18. Changes to this policy
If we change this policy we will update the date at the top, and for any material change we will notify you in the app or by email before it takes effect. Where a change requires your consent, we will ask for it rather than assume it.
19. Contact us
Cycle Bloom Pal
Privacy enquiries: hello@cyclebloompal.com
General support: support@cyclebloompal.com
Contact form · cyclebloompal.com
See also our Terms & Conditions and Licence Agreement.