Legal

Consumer health data privacy notice

For residents of Washington, Nevada and Connecticut — what health data we collect, who sees it, and how to control it.

Effective date: 14 August 2026 · Version: 1.0

1. Who this notice applies to

This Consumer Health Data Privacy Notice applies to residents of Washington, Nevada and Connecticut, and to anyone whose consumer health data is collected in Washington. It explains how CyclePlate, operated by The Bett Collective Limited, handles your consumer health data under the Washington My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act.

It supplements our Privacy Policy. Where the two differ for residents of these states, this notice applies.

2. Consumer health data we collect

“Consumer health data” means personal information that identifies, or could reasonably be linked to, your past, present or future physical or mental health. At CyclePlate, that includes:

CategoryExamplesReproductive and cycle dataLast period date, cycle length, period length, phase history, flow logsSymptoms and wellbeingMood, energy, sleep, symptoms and spotting logsDiet-related health informationAllergies, intolerances, dietary restrictions, eating styleContraception statusWhether you use hormonal birth control (used for Contraceptive Nutrient Replenishment mode)InferencesYour predicted phase, upcoming period dates, and the meal recommendations we derive from your data

We do not collect precise location, biometric data, or data from health devices.

3. Where we get it

  • From you — when you complete onboarding and log in the app.
  • From the app — inferences we calculate from what you log.
  • We do not buy consumer health data from data brokers or other third parties.

4. Why we collect and use it

  • Calculate your current cycle phase and predict upcoming phases
  • Generate phase-aligned meal suggestions, weekly plans and grocery lists
  • Personalise daily nudges and phase-change notifications you enable
  • Keep the service secure and fix errors
  • Comply with the law

5. Who we share it with

We share consumer health data only as needed to run CyclePlate, or when you tell us to:

RecipientWhat they receiveWhyCloud infrastructure provider (e.g. Firebase / Supabase)Stored account and health dataHosting, database and login — processor under a data processing agreementGoogle Gemini (AI provider)Current phase, dietary restrictions and cuisine — never your name, email, period dates or symptom logsGenerating meal suggestions for CyclePlate Plus subscribers only, with their separate consent — under a data processing agreementYour partner (Partner Mode)Only what you choose: current phase, energy level, today’s foods. Never exact dates, symptoms, notes or meal historyAt your direction, and only while you keep it onLegal authoritiesOnly what the law requiresTo comply with valid legal process

We have no affiliates that receive your consumer health data. Push notification, analytics and crash-reporting providers do not receive consumer health data.

6. Your consent

We ask for your consent before we collect consumer health data, at onboarding. If you start CyclePlate Plus, we ask separately before any of it is sent to our AI provider — Plus features cannot work without it, and the free tier never sends health data to AI. Each consent request explains what we collect or share, why, and with whom.

You can withdraw consent at any time — email cycleplateprivacy@gmail.com or delete your account in the app (You → Accounts & preferences → Delete my account). Some features may stop working without it.

7. We do not sell your consumer health data

We never sell your consumer health data, and we never share it for advertising. If that ever changed, we would first ask for your separate, signed authorization, as the law requires.

We do not use geofencing around healthcare facilities, and we do not collect precise location.

8. Your rights

You have the right to:

  • Confirm and access — whether we collect, share or sell your consumer health data, a copy of it, and a list of every third party and affiliate we have shared it with, including their contact details
  • Withdraw consent — to our collecting and sharing your consumer health data
  • Delete — your consumer health data, including from our processors and any third parties we shared it with
  • Appeal — if we refuse a request (see section 9)

To use these rights, email cycleplateprivacy@gmail.com with the subject “Health data request”, or use the in-app options. We will confirm your identity using your account email and respond within 45 days. If we need more time, we may extend this by another 45 days and will tell you why. Requests are free, up to twice a year. We will never treat you differently for using your rights.

9. Appeals

If we refuse your request, you can appeal by emailing cycleplateprivacy@gmail.com with the subject “Appeal”. We will reply in writing within 45 days (60 days for Connecticut residents), explaining what we decided and why.

If you are unhappy with the outcome, you can complain to your state attorney general:

10. Security and retention

Consumer health data is encrypted in transit and at rest, and only team members who need it can access it. When you delete your account, your consumer health data is deleted within 30 days, and from backups within 90 days.

11. Contact us

Health data requests and appeals: cycleplateprivacy@gmail.com
Security concerns: cycleplatesecurity@gmail.com
Postal address: The Bett Collective Limited, Safari Business Arcade, Thika Road, Roysambu, Kasarani, P.O. Box 00618, Nairobi, Kenya