1. Who we are
CyclePlate is operated by The Bett Collective Limited ("CyclePlate," "we," "us," "our"), a company registered in Kenya. We provide a mobile application that delivers phase-based nutrition guidance aligned to your menstrual cycle.
Data controller: The Bett Collective Limited
Contact: cycleplateprivacy@gmail.com
Registered address: Safari Business Arcade, Thika Road, Roysambu, Kasarani, P.O. Box 00618, Nairobi, Kenya
We are registered as a data controller with the Office of the Data Protection Commissioner (Kenya).
2. Privacy at a glance — data nutrition label
A plain summary of every category of data we collect, what we do with it, and whether you must provide it. Full detail follows in the sections below.
Key: We never sell health data. We never share identifiable health logs. AI providers receive only anonymised preference inputs (cuisine, dietary restrictions, current phase) — never your name, email, period dates, or symptom logs.
3. Scope of this policy
This policy applies to all personal data we collect through the CyclePlate mobile application, our website, and any related services. It applies regardless of where you are located.
This policy does not apply to third-party services linked from our app. We encourage you to read their privacy policies separately.
4. The data we collect
We collect only what we need to provide the service. Below is a complete list.
4.1 Data you give us directly
4.2 Data we collect automatically
4.3 Data we do not collect
We do not collect:
- Precise GPS location
- Contacts or address book
- Camera or microphone data
- Financial data (payments processed directly by the Apple App Store or Google Play)
- Biometric data
5. Legal basis for processing
We process your data only where we have a lawful basis to do so. The basis varies by jurisdiction and by type of data.
5.1 All markets
5.2 Kenya (Data Protection Act 2019)
We process your health data as sensitive personal data under Section 46 of the Kenya Data Protection Act 2019, on the basis of your explicit consent given at onboarding. You may withdraw consent at any time by deleting your account.
We have registered as a data controller with the Office of the Data Protection Commissioner (ODPC) as required by the Act.
We note the provision of Section 30 of the Kenya DPA 2019 which states health data may only be processed by or under the responsibility of a health care provider. Our nutrition content is reviewed by a registered dietitian who holds professional responsibility for the framework. We have sought local legal advice to confirm this satisfies the provision.
5.3 South Africa (POPIA — Protection of Personal Information Act 4 of 2013)
Your health data constitutes special personal information under POPIA. We process it on the basis of your explicit consent (Condition 1) and for the purpose of providing the service you requested (Condition 2).
5.4 Nigeria (Nigeria Data Protection Act 2023)
We process your sensitive personal data on the basis of explicit consent as required by the NDPA 2023. We have assessed our status as a data controller and will register with the Nigeria Data Protection Commission where required.
5.5 United Kingdom and European Union (UK GDPR / EU GDPR)
For users located in the UK or EU, our lawful bases are:
- Consent — for health and cycle data, and for marketing communications
- Contract — for delivering the service you signed up for
- Legitimate interests — for security, fraud prevention, and product improvement, where these do not override your rights
You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.
6. How we use your data
We use your data only for the purposes stated. We do not use your identifiable health data to train AI models.
We never:
- Sell your personal data
- Share your health data for advertising purposes
- Use your identifiable data to train third-party AI models
- Share your data with employers, insurers, or government bodies unless required by law
7. AI processing and automated decision-making
7.1 How AI is used
Meal suggestions, weekly plans, and daily nudges are generated by an AI system using your cycle phase, cuisine preference, and dietary restrictions as inputs. The AI framework has been reviewed and approved by a registered dietitian.
7.2 AI provider
Our AI suggestions are powered by Google Gemini. Relevant preference data (cuisine, dietary restrictions, current phase) is sent to the Gemini API to generate suggestions. We do not send your name, email, identifiable health logs, or period dates to Google Gemini.
You can review Google's privacy policy at https://policies.google.com/privacy.
7.3 Automated decision-making
CyclePlate uses automated systems to generate food suggestions. These suggestions do not constitute medical decisions and carry no legal or similarly significant effect on you. You are not subject to automated decision-making in the legal sense under GDPR Article 22 or equivalent provisions.
7.4 Opting out
AI features — including meal suggestions, weekly plans and daily nudges — are part of CyclePlate Plus. Before you start Plus or a Plus trial, we ask for your separate consent to send your current phase, cuisine and dietary restrictions to our AI provider. If you do not consent, you cannot use Plus features, but you can keep using the free tier, which does not use AI processing. You can withdraw this consent at any time in You → Data & privacy.
8. Sharing your data
8.1 We share data with
8.2 Partner Mode
If you activate Partner Mode, you choose specifically what your partner can see (current phase, energy level, today's foods). Your exact period dates, symptom details, personal notes, and meal history are always excluded from Partner Mode. You can revoke partner access at any time.
8.3 Business transfers
If CyclePlate is acquired or merged, your data may be transferred to the new entity. We will notify you before any such transfer and give you the opportunity to delete your account.
9. International data transfers
Your data may be stored and processed outside your country of residence, including in the United States and European Union, where our infrastructure providers operate.
Where we transfer data outside your jurisdiction, we apply appropriate safeguards:
- Kenya: We seek to minimise cross-border transfers. Where transfers occur, we use contractual agreements that protect your rights under the Kenya DPA 2019.
- South Africa: International transfers comply with Section 72 of POPIA. We use binding agreements with recipients to ensure equivalent protection.
- Nigeria: International transfers comply with the NDPA 2023. We use data processing agreements with international recipients.
- EU/UK: International transfers use Standard Contractual Clauses (SCCs) approved by the European Commission, or UK IDTA where applicable.
10. Data retention
We keep your data for as long as your account is active. When you delete your account:
We do not retain your data for longer than necessary for the purpose it was collected.
11. Security
We protect your data through:
- Encryption in transit (TLS 1.2 or higher)
- Encryption at rest (AES-256 or equivalent)
- Access controls limiting which team members can access personal data
- Regular security assessments
- Secure deletion procedures
Data breach notification: If we suffer a breach that is likely to result in risk to your rights, we will notify:
- The relevant supervisory authority within 72 hours of becoming aware
- Affected users without undue delay where the breach is high-risk
No system is perfectly secure. If you believe your account has been compromised, contact cycleplatesecurity@gmail.com immediately.
12. Your rights
Your rights depend on where you are located. We honour all of the following:
We will respond to all requests within 30 days. We will not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.
13. Regulatory authorities
If you are not satisfied with our response to a privacy concern, you have the right to complain to your local supervisory authority:
- Kenya: Office of the Data Protection Commissioner (ODPC) — odpc.go.ke
- South Africa: Information Regulator — inforegulator.org.za
- Nigeria: Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng
- UK: Information Commissioner's Office (ICO) — ico.org.uk
- EU: Your local data protection authority (list at edpb.europa.eu)
14. Minimum age
CyclePlate is for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that a user is under 18, we will delete their account and all associated data promptly.
If you believe a person under 18 has created an account, please notify us at cycleplateprivacy@gmail.com.
15. Cookies and tracking
The CyclePlate mobile app does not use browser cookies. We use:
- Analytics SDK — to understand how features are used (anonymised). You can opt out in You → Data & privacy → Anonymous analytics.
- Crash reporting SDK — to identify and fix errors. This cannot be disabled as it is essential to service reliability.
We do not use advertising trackers or share data with ad networks.
16. Changes to this policy
We will notify you of material changes to this policy by:
- Sending an in-app notification
- Updating the effective date at the top of this document
Continued use of the app after a change constitutes acceptance. If you do not accept the updated policy, you may delete your account.
17. Contact us
Privacy queries: cycleplateprivacy@gmail.com
Data deletion requests: cycleplateprivacy@gmail.com
Security concerns: cycleplatesecurity@gmail.com
General support: cycleplatesupport@gmail.com
Postal address: Safari Business Arcade, Thika Road, Roysambu, Kasarani, P.O. Box 00618, Nairobi, Kenya
This policy is written in plain language for accessibility. It is a legally binding document. The plain-language footer note on the in-app version is supplementary only.