Marlune Privacy Policy

1. The short version

Marlune asks you to write down your sleep, your moods, your cycle and your symptoms. That is sensitive health information and we treat it that way. We never sell it. We never use it for advertising or any other use-based data mining. We never share it with a third party for that party's own purposes. You can export it or delete all of it from inside the app, at any time, wherever in the world you live. This policy explains exactly what we collect, who touches it, and how long it stays.

2. What we collect, and how

We collect only what you type into Marlune, what is needed to run your account, and the usage and diagnostic data set out in section 9. There is no advertising SDK and no cross app tracking, which is why you will never see an App Tracking Transparency prompt from us.

Health data you enter, all of it optional and all of it entered by you:

• Symptom check-ins: hot flashes, sleep disruption, anxiety, brain fog, mood swings, energy, and any symptom you add yourself, each on a five step severity scale.
• Sleep quality and mood scores recorded on each check-in.
• Cycle dates: period start and end dates, cycle length, and the gaps between cycles.
• Context and lifestyle tags: poor sleep, alcohol, exercise, stress, caffeine, travel, hydration, social, and any tag you create.
• Treatment notes: whether you took HRT, and any treatment you choose to record.
• Weight readings: each weight you log yourself, with its date.
• Two answers for your doctor summary, if you give them: whether you still have a uterus, and whether you are using contraception. They are stored with your profile, so they are among the profile basics that section 4 describes.
• Free text notes: anything you type into the optional note on a check-in.
• Juno conversations: what you ask and what Juno answers.
• Anything you choose to import, such as a photo or PDF of a lab result. Section 7 explains what happens to it, and what it requires.

Your answers when you set up Marlune: the stage you feel you are in, which can be that you are not sure yet; whether you still get periods and whether you are on hormone therapy or considering it, if you answer those; the symptoms you want to track, or the common starting set Marlune gives you if you are not sure yet; and your goals, if you choose any.

Profile data, if you choose to give it: your date of birth, your gender and your weight.

Account and service data: your email address, your first name, your subscription status (trial, active, or lapsed), your notification preferences, your app settings, the date of your next appointment if you choose to enter one, and the usage and diagnostic data described in section 9.

From this website: nothing automatic. This page sets no cookies, runs no analytics, and contains no tracking pixels. The only outside request it makes is to Google Fonts, to load the two typefaces, which discloses your IP address and browser user agent to Google in the ordinary course of serving a font file. If you choose to write to support, we hold your email address in our support mailbox for that one purpose, which is answering you.

Apple Health, if you connect it: Marlune can read six things Apple Health already holds, and only if you switch it on. Section 5 sets out exactly what is read, what stays on your phone, and the one thing that does not.

What we never collect: your payment card details, your precise location, your contacts, and your photos beyond anything you deliberately import.

3. How we use it

We use your data to do the things you opened the app for, and nothing else:

• To show you your own history, trends, and personal insights across your own check-ins.
• To let Juno answer you with your own patterns in view.
• To build a doctor-ready summary when you ask for one, and to serve it behind a share link if you create one, which section 8 explains.
• To run your account, your subscription, and the reminders you have turned on.
• To keep the service secure and to fix problems.
• To answer you when you contact support.

We do not use your health data to build a profile of you for anyone else, to target advertising, or to train any AI model.

4. Who else touches it

A small number of companies process data on our behalf so the service can run. These are all the kinds of company involved, and there are no others. Each one is bound by contract to protect your data to the standard this policy sets, may use it only to deliver the service, and may not use it to train any AI model. If you would like the current name of any of them, write to us and we will tell you.

• An AI processing provider, which writes Juno's replies and the wording of your insights. When you ask Juno a question, when an insight is produced, or once a week if you have Juno's weekly message turned on, the relevant check-in context is sent through our backend to that provider for the moment it takes to produce the answer. That context can include your profile basics, your symptom scores and tags, the free text note attached to a day and any note you attached to a single symptom, the symptoms you named yourself and how you have been scoring them, your treatment logs and the trials you set up, your monthly Symptom Index answers, your cycle including how you described your flow, your weight, the quiet hours you set, your water log, your Journey progress, the insights Marlune has already written about you, your doctor visit notes, what you said matters most at that visit, your next appointment date, and any document you have imported. So that Juno can answer with more than the last fortnight in view, it also includes monthly averages of what you logged going back up to a year, and a few of the notes you wrote on earlier check-ins. Older days are sent as those monthly averages, never as the days themselves. Your last few questions to Juno, and her answers, are sent back with a new question so she can follow a conversation rather than starting over each time. If you connected Apple Health, and only if you did, averages of what your watch measured (time asleep, resting heart rate, heart rate variability, wrist temperature and steps) are included too. Body weight read from Health is not. Health data is covered by its own separate permission, so turning that off stops it being included even if AI personalisation stays on. If you import a lab document, it is sent to that provider to be read. Section 7 explains what happens to it. Whether personalised answers are on is your choice, and if you would like to know who this provider is you can ask us at any time, exactly as you can for any of them.
• Cloud hosting and database providers, which run our backend servers and hold your account and everything you have logged.
• Apple, which processes your purchase, and a subscription management provider, which tells us whether you are subscribed. Neither passes us your payment details, and we never see your card.
• Apple and Google, as sign in providers, if you choose Continue with Apple or Continue with Google. They confirm to us that the sign in is genuine, which tells them you use Marlune.
• A push notification delivery provider, together with Apple, if you turn notifications on. They carry the reminder to your phone. A reminder never contains a symptom, a score or any health detail, so nothing of that kind passes through them or appears on your lock screen.
• An install measurement provider, which tells us which link or promotion led someone to install Marlune, so we can credit the people and partners who recommend it. When you install and open the app, it receives technical details about that install: your device model, operating system and app version, your IP address, the time of the install and of each launch, Apple's Identifier for Vendor, and an identifier it creates for this installation. It is never given your account, your name, your email or anything you log, and it cannot read Apple's advertising identifier, because the version of its kit that Marlune carries is built without the code that reads it.

Beyond these, we disclose your data only if you ask us to, or if we are legally required to by valid legal process, in which case we will tell you unless the law forbids it.

We never sell your personal data, and we never share it for cross context behavioural advertising, under any definition of those terms in any privacy law.

If Marlune were ever acquired, your data would transfer only to a buyer bound by these same commitments, and we would tell you before it happened so you could export and delete first if you preferred.

5. Apple Health

Connecting Apple Health is optional, it is off until you switch it on, and every part of Marlune works without it. This is the one place where measurements taken from your own body come into the app, so it gets its own section.

• What we read. Six things Apple Health already holds: your sleep, your resting heart rate, your heart rate variability, your wrist temperature while you sleep, your step count and your body weight. Nothing else. Marlune measures nothing itself, it only reads what your own devices have already recorded.
• Read only, always. Marlune asks Apple for read access and nothing more. It never writes to Apple Health, so nothing it shows you ever changes what is stored there.
• Where the readings stay. Your daily readings stay on your iPhone. They are not uploaded to us, they are not part of your account on our servers, and they are never included in a doctor share link.
• The one thing that leaves your iPhone. If, and only if, you have separately switched on AI processing, Marlune sends a 30 day average of five of those six figures to our AI provider, so Juno can answer questions about your own patterns: sleep, resting heart rate, heart rate variability, wrist temperature and steps. Averages only, never the individual days, and a figure with fewer than five days of readings behind it is left out rather than averaged. Body weight read from Apple Health is deliberately left out of that. This is the only case in which anything read from Apple Health leaves your phone on its own, and it happens for the moment it takes to answer you.
• The one thing you can carry out yourself. If you generate the clinician summary as a PDF, it can include these readings, because that document is for the appointment you are walking into. It is made on your phone and it goes wherever you send it. The share link described in section 8 does not carry them.
• Two switches, not one. Health access and AI processing are separate permissions and you control them separately. If AI processing is off, nothing measured travels at all, even with Health connected. If Health is off, everything else carries on without it.
• Turning it off. You can disconnect Health at any time, in Marlune or in the iOS Settings app under Privacy and Security, then Health. Disconnecting deletes the readings Marlune had stored on your device.
• No sale, no advertising, no training. Nothing read from Apple Health is ever sold, ever used for advertising, or ever used to train any AI model.

6. Juno and AI processing

Juno is the companion inside Marlune. She is software, not a person, and what she says is written by an automated system. This section covers what she is given, what is kept, and where the limits are.

• What we store. Your questions and Juno's answers are saved to your account, word for word, so you can read a conversation back later.
• What is sent, and when. When you ask Juno something, when an insight is written, or once a week if you have Juno's weekly message turned on, a summary of what you have logged travels through our backend to our AI provider for the moment it takes to produce an answer. Section 4 lists what that summary can contain. It is a summary and never a dump: counts, averages and short capped lists, so the individual sips in your water log, your period rows and your raw entries stay on your phone.
• Only with your consent. AI processing is a separate choice you make, and you can withdraw it at any time with the toggle in the You tab. Turn it off and nothing personal is sent from that moment on. Three separate checks enforce it: the screen does not call our backend, the summary is never built, and our backend re-reads your saved answer and discards the summary if it disagrees. Your account and everything you have logged stay exactly as they are.
• No human reviews the answer. Juno's replies are produced automatically and nobody at Marlune reads them before you do. An automated check discards any reply that reads like a diagnosis or a medication instruction, and a plainer written answer is shown in its place. Automated systems can still be wrong, so treat what she says as something to think about, not as a finding.
• What Juno will never do. She does not diagnose. She does not tell you that you have a condition. She does not recommend a medication or a dose, and she will not tell you to start, stop or change any treatment. Those are conversations for your clinician.
• If you are in crisis. Marlune watches for language suggesting you may be in danger, and it does that on your phone, before anything is sent anywhere. When it triggers, Marlune shows you emergency resources straight away, and that message is not sent to our AI provider at all. It is still saved to your own conversation history, like anything else you type.
• Limits. Free accounts get a few chats with Juno each day, and Marlune+ lifts that limit. Nothing about the privacy of a conversation changes either way.

7. Lab document import

If you have a lab result on paper or as a PDF, you can photograph it or upload it and let Marlune pull the numbers out rather than typing them in yourself. This is the one feature that sends a whole document of yours to a third party, so here is exactly what happens to it.

• What happens to the document. The file travels through our backend to our AI provider, which reads it and returns the values. That is the entire reason it goes anywhere. A short summary of your profile and your recent check-ins goes with it, so the plain language notes can speak to what you actually track.
• The document is not kept. We do not store the photo or the PDF. It is used once, at the moment it is read, and then it is gone. Our AI provider may use it only to produce that reading, and may not keep it or use it to train any model.
• What we do keep. The values that were extracted, and the plain language notes written about them, are saved to your account so they can appear in your history. Deleting your account deletes them.
• What it requires. Lab document import needs a Marlune+ subscription and it needs AI processing switched on. With AI processing off the feature does not run, and no document is sent.
• Read the values back. An automated reading can misread a number, especially from a photograph. Check what was extracted against your own copy before you rely on it. If the document cannot be read, Marlune tells you so and shows no values at all rather than guessing at a number. Marlune does not interpret a result or tell you what it means for your health.
• Whatever else is on the page. A lab report usually carries your name, your date of birth and your clinic's details. Those travel with the document if they are in the picture. If you would rather they did not, crop or cover them before you upload.

8. The doctor share link

Marlune can turn your recent months into a short summary and give you a web link to it, so you have something clear to hand a clinician in a ten minute appointment. Please read this section before you send one.

• Anyone holding the link can open it. The page is not password protected and it does not ask the person opening it to sign in. That is deliberate, so a clinician can read it in the room without creating an account, but it means the link itself is the key. The address is long and randomly generated, so it cannot be guessed, but it can be forwarded or screenshotted. Treat the address as if it were the summary, and send it only to someone you mean to read it.
• What is in it. Your most frequent symptoms with a count for each, short sentences describing which way things have moved, the patterns Marlune found between the days you logged a factor and the days you did not, the questions it suggests you ask, what the record cannot tell you, how many days you checked in, the date you made it, and, where you have logged them, lines about your cycle, your HRT status, your monthly index and the treatments you are recording. A symptom you named yourself appears under the name you gave it.
• What is not in it. Your name, your email address, your account number and your date of birth are not on the page. Neither is any individual check-in day, any free text note, any Juno conversation, or anything read from Apple Health. It is a summary, not a copy of your record.
• It is frozen. The link shows the summary as it was on the day you made it. Check-ins you log afterwards do not appear in a link you have already shared.
• How long it lasts. A link expires 72 hours after you create it, and it stops working after 50 openings, whichever comes first. You can also turn it off yourself at any time from inside the app, and it stops working immediately. Deleting your account deletes every link you have made.
• How the page behaves. It asks search engines not to index or archive it, and it passes no address on to whatever the clinician clicks next. Every dead link looks the same, whether it expired, was turned off, or never existed, so the address cannot be used to find out whether a real one is near it.
• We do not send it for you. You choose who receives the link and how it gets to them. Once it has left your hands we cannot control who it is passed on to, which is why it expires so quickly.

9. Cookies, analytics, and what is stored on your phone

There is no cookie banner on this website because there is nothing to consent to. Here is what this site and the app actually use, including the part we would rather tell you plainly than let you work out for yourself.

• This website. No cookies at all. No analytics, no tag manager, no tracking pixels, and nothing that follows you to another site. The only request these pages make to anyone else is to Google Fonts, to load the two typefaces, and that request discloses your IP address and browser user agent to Google in the ordinary course of serving a font file.
• The app. Marlune does not use web cookies. It does store things on your own phone so the app can work: a sign in token, held in the iPhone keychain, that keeps you logged in, a store holding your settings and your history, and an install identifier that lets us tell one installation of the app from another. That identifier is not given to advertisers and is not used to follow you anywhere.
• Third party code inside the app. Three outside services have code running inside Marlune. The subscription provider's kit tells us whether you are subscribed, and it sends Apple's Identifier for Vendor, a value specific to Marlune on your device, with its requests. The push provider's kit holds the token your phone needs in order to receive a reminder. The install measurement provider's kit reports each install and each launch, with the technical details section 4 lists, so we can see which links and promotions bring people to Marlune. None of them shows ads, and there are no advertising networks in Marlune at all.
• Analytics and diagnostics. Marlune records about thirty named events describing how the app is used, such as finishing a check-in or opening an insight, together with crash reports, technical error reports, your app version, your platform and operating system version, and your device model. We use these to find what is broken and what is confusing. They are on by default and there is currently no switch in the app to turn them off. We would rather say that plainly than imply a choice you do not have.
• What those never carry. An event records that something happened, never what you wrote or how you scored it: no symptom, no severity, no note, no cycle date, no Juno message. A crash report is built from a fixed list of technical fields and is scrubbed of anything resembling an email address or a token before it is sent. Both are deleted when you delete your account.
• No advertising identifiers. Marlune does not use Apple's advertising identifier, does not track you across other companies' apps or websites, and will therefore never show you an App Tracking Transparency prompt.

10. Legal basis, and how to withdraw consent

Where the GDPR or similar law applies, we process your health data on the basis of your explicit consent, which you give when you create an account and start logging. We process account and billing data to perform our contract with you, and security logs on the basis of our legitimate interest in keeping the service safe.

Install measurement never touches your health data, and it relies on our legitimate interest in knowing which links and promotions bring people to Marlune. You can object to it at any time by writing to us, and we will ask the provider to delete what it holds about your installation.

You can withdraw consent for AI processing at any time, on its own, using the toggle in the You tab. Turning it off stops any personal context being sent to the AI provider from that moment, and you keep your account and everything you have logged. If you would rather remove everything, deleting your account erases it from our servers as well as your phone, and section 11 says where that control is. Withdrawing consent does not affect processing that already happened lawfully before you withdrew it.

11. How long we keep it, and how to delete it

Your check-ins stay in your account for as long as your account exists, because the whole value of the record is its length. Nothing is kept on a hidden clock of its own.

You can delete everything yourself, from inside the app, without calling or emailing anyone first. Open the You tab, tap Personal details, then in the Account group tap Delete account and confirm. Because this is health information, we ask you to confirm once before it runs.

Deletion removes your entire account record and the personal data attached to it: your check-ins, symptom history, cycle dates, notes, treatment logs, Juno conversations, and your account details. It is a deletion, not a deactivation, and it cannot be undone. Copies held in encrypted backups are purged within 30 days. If you would like a copy first, the export control sits on that same Personal details screen.

Install measurement details are not part of your Marlune account, because they are never linked to it, so deleting your account does not reach them. The provider keeps them for a limited period under our agreement with it, and if you write to us we will ask it to delete what it holds about your installation.

Deleting your account does not cancel your subscription, because Apple bills it. Please cancel in your Apple Account settings as well.

12. Your rights

Wherever you live, you can access your data, export it in a portable format, correct it, and delete it, using the controls in the app. Depending on where you live you may also have the right to object to or restrict certain processing, and the right to complain to your local data protection authority. Residents of California and other United States states with comparable laws have the right to know, delete, correct, and opt out of sale or sharing, and we will not discriminate against you for exercising any of them. There is nothing to opt out of on sale or sharing, because we do neither.

To exercise a right the app does not already cover, write to marluneappsupport@gmail.com and we will respond within 30 days.

13. Communications

Marlune reaches you in two ways, by notification on your phone and, rarely, by email. This is all of it, and how to stop each one.

• Notifications on your phone. Marlune sends one only if you allow notifications and turn a reminder on, and you choose the time and your quiet hours. Each kind has its own switch, in Marlune under Notifications: the daily check-in reminder, win back nudges, your weekly reflection, Juno's weekly message, streak protection and water reminders. You can also switch them all off in the iOS Settings app under Notifications.
• What a notification says. It never contains a symptom, a score, or any other health detail, so nothing of that kind appears on your lock screen. The ones about your subscription say only that a payment failed, or that your membership has started, renewed, or ended.
• Receipts. Apple bills your subscription, so Apple sends the receipts. We do not.
• Email. We have an email address for you only if you signed in with Apple or Google, and if you used Sign in with Apple and chose to hide your address, what we hold is Apple's relay address, or no address at all. We may use it for the two things we have promised in writing to tell you: that this policy has materially changed, and that Marlune is being discontinued. Creating an account does not put you on a mailing list and we do not send marketing email. If we ever did, one reply asking to stop would be enough.
• When you write to us. If you email support we reply to the address you wrote from, and we keep the thread in our support mailbox so we can pick up where we left off. It never enters the app or your Marlune account.

14. Security

Your data is encrypted in transit and at rest. Marlune does not sync your data to iCloud itself. If you have iCloud Backup switched on, your iPhone backs Marlune up along with everything else on the device, under your own Apple account and your own control. Access to production systems is limited to the people who need it to operate the service, and support staff see your account details only when you contact us for help. If a breach ever affected your data, section 15 sets out exactly what we would do.

15. Data breach notification

No system is perfect, and we will not pretend otherwise. If personal data held by us or by one of our processors were ever exposed, lost, or reached by someone who should not have it, this is what would happen.

• We contain it first. We close the hole, establish what was reached and whose data it was, and keep what we need in order to understand it.
• We tell you. If your data was involved and the breach is likely to put you at risk, we notify you without undue delay, at the email address on your account if we have one, and in the app if we do not. We will not wait until every detail is settled before telling you the parts we already know.
• What the notice will say. What happened and when, what kinds of data were involved, what we have done about it, what we suggest you do, and an address that reaches a person.
• We tell the regulators. Where the GDPR or a comparable law applies, we notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and in the United States we follow the deadline each state sets.
• What we will never do. A Marlune account has no password of its own, so nobody at Marlune will ever ask you for one, and we will never ask you for a payment card or a verification code in a message about a security incident. Neither will anyone acting for us. If something claiming to be from Marlune asks you for any of those, it is not from us, and we would like to hear about it.

16. Children

Marlune is for adults aged 18 and over. We do not knowingly collect data from children. If we learn that we have, we will delete it.

17. International transfers

Our processors operate in the United States, so if you use Marlune from elsewhere your data will be transferred to and processed in the United States. Where the law requires a transfer mechanism, we rely on Standard Contractual Clauses with the processors described in section 4.

18. HIPAA

Marlune is a direct-to-consumer wellness app, so HIPAA does not apply to it and we do not claim to be HIPAA covered. Rather than claim a certification we do not hold, we would rather list exactly what we collect, which is what this document does.

19. Changes, and how to reach us

If we change this policy in a way that materially affects you, we will tell you in the app and by email before the change takes effect, and we will update the date at the top. Questions, requests, and complaints all go to the same place: marluneappsupport@gmail.com. A person reads every message.