Privacy Policy

1. Data controller

Cyclezen SAS
Registered office: 1010 avenue de l'Europe, 33260 La Teste de Buch
SIRET: 94289626700013
Represented by Samia Dahmouni, President
General email: contact@cyclezen.ai
DPO: dpo@cyclezen.ai

2. Data Protection Officer (DPO)

The appointment of an external Data Protection Officer specialised in health data is in progress. In the meantime, the address below is your point of contact for any question about the processing of your data and the exercise of your rights.

• Email: dpo@cyclezen.ai
• Response time: 30 days maximum (Art. 12 GDPR).

3. Data collected

3.1 Identification data (Art. 6 GDPR)

• Email address
• Password (stored only in hashed form: bcrypt/Argon2, never in plain text)
• First name (or pseudonym)
• Account creation date
• Date of birth or age range (used as the FHIR extension.ageRange for pseudonymisation)
• Apple Sign-In or Auth0 identifier, not the Apple relay email address in plain text

3.2 Health data (Art. 9 GDPR, explicit consent required)

Data voluntarily entered by the User:

• Dates and length of periods, intensity of bleeding
• Physical symptoms (pain, bloating, headaches, fatigue, etc.)
• Emotional symptoms and mood
• Contraception method used (where applicable)
• Well-being goals
• Personal notes in the journal
• Declared health conditions (endometriosis, PCOS, perimenopause)
• Hormonal protocols followed (where applicable: FHIR MedicationStatement)

All of this data is stored in HL7 FHIR R4 format.

3.3 Technical data

• Device type (model, OS, version)
• Application version
• Technical session identifier (UUID, not linked to the real identity)
• Error logs filtered before sending (personal data removed by the Sentry before_send filter; Sentry service, Germany region)

3.4 Usage data

Pseudonymised usage events: screens viewed, session length, main interactions. No behavioural data is cross-referenced for advertising purposes.

3.5 What we do not collect

• No advertising cookies or advertising trackers.
• No precise location data (GPS).
• No access to contacts, photos or calendar beyond the strictly necessary permissions (HealthKit read-only, with explicit consent).
• No biometric data other than Face ID / Touch ID: strictly local use on the device (Apple Secure Enclave).

4. Purposes, legal bases and retention periods

5. Data hosting

5.1 Health data hosting (HDS)

Health data is intended to be hosted in France with OVH SAS, a provider certified as a Health Data Host (HDS) within the meaning of Article L. 1111-8 of the French Public Health Code. As of the date of this version, activation of this HDS hosting is in progress. Cyclezen is not an HDS host: Cyclezen is the data controller and OVH SAS will act as a certified hosting processor.

The cyclezen.ai website, including its forms (beta registration, tester voting, contact), is hosted by OVH SAS in France on a separate infrastructure that is not health data hosting (HDS).

5.2 Transfers of data outside the European Union

Some of the technical subprocessors listed below are established outside the European Union or belong to groups established outside the European Union. Their involvement may entail transfers of personal data outside the European Union. These transfers are covered by contractual safeguards within the meaning of Chapter V of the GDPR.

5.3 Systematic pseudonymisation before any external call

No health data is sent to a third-party service or to an external language model without prior pseudonymisation. Pseudonymisation is documented and auditable.

5.4 Subprocessors

To provide the Service, Cyclezen uses technical subprocessors, all bound by contractual commitments of confidentiality and data protection in line with the GDPR. The categories of subprocessors include:

• HDS-certified host located in France for the storage of health data (OVH SAS, activation in progress)
• Host of the cyclezen.ai website, outside HDS (OVH SAS, France)
• Authentication service for user account management (Auth0, Okta group, Europe region)
• Error monitoring service (Sentry, Germany region, data filtered before sending)
• Notification services (Expo, Apple Push Notification service)
• Anti-bot service for the website forms (hCaptcha)
• Email sending service (OVHcloud mail service)

The exhaustive list of subprocessors can be provided on request to dpo@cyclezen.ai.

6. Your rights (GDPR)

• Right of access (Art. 15): obtain confirmation that data concerning you is being processed and obtain a copy of it.
• Right to rectification (Art. 16).
• Right to erasure (Art. 17), in particular when you withdraw your consent.
• Right to restriction (Art. 18).
• Right to portability (Art. 20): Cyclezen provides a FHIR R4 export (JSON Bundle) that any FHIR-compatible health system can natively reuse.
• Right to object (Art. 21).
• Right to withdraw consent (Art. 7): at any time.
• Right to set post-mortem directives (Article 85 of the French Data Protection Act, Loi Informatique et Libertés).

To exercise your rights: dpo@cyclezen.ai or from the Application ("Settings → Privacy → My rights").

Complaint to the CNIL (the French data protection authority): 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 · cnil.fr.

7. Consent: granularity and withdrawal

The processing of your health data requires your explicit, freely given, specific, informed and unambiguous consent. You can accept or refuse each purpose independently. No box is pre-ticked.

Each consent is:

• timestamped;
• recorded as a FHIR R4 Consent resource;
• versioned with the number of the Privacy Policy accepted;
• viewable and exportable by the User.

Consent can be withdrawn at any time from "Settings → Privacy → My consents" and is as easy to withdraw as it was to give (Art. 7.3 GDPR).

8. Data security

Cyclezen implements appropriate technical and organisational measures to guarantee the confidentiality, integrity and availability of the Data. These measures include in particular encryption of sensitive data, strong authentication of access, and regular security audits. Details of the measures can be provided on reasoned request to security@cyclezen.ai.

9. Cookies, trackers, analytics

The Cyclezen mobile application does not set any advertising cookie and contains no advertising SDK and no third-party tracking pixel.

The cyclezen.ai website uses only functional cookies strictly necessary for its operation. The forms on the site (beta registration, contact) are protected by hCaptcha, a third-party bot-protection service, which may collect technical data (IP address, browser information) and involve a transfer outside the European Union. A banner in line with CNIL recommendations is displayed on first access, with refusal as easy as acceptance.

10. Profiling and automated decision-making

The Application produces probabilistic estimates (cycle, ovulation, fertile window) from the data entered by the User. These estimates:

• do not constitute automated decision-making producing legal effects within the meaning of Article 22 GDPR;
• are not used as a method of contraception or assisted reproduction;
• can be switched off at any time.

No profiling for advertising or commercial purposes is carried out.

11. Data breach

In the event of a personal data breach likely to result in a risk to your rights and freedoms, Cyclezen will notify the CNIL within 72 hours (Art. 33 GDPR).

If the breach is likely to result in a high risk to your rights and freedoms, you will be informed personally as soon as possible (Art. 34 GDPR), by email and in-app notification.

12. Minors

In accordance with Article 8 GDPR and Article 7-1 of the French Data Protection Act (Loi Informatique et Libertés), the Application is available to minors aged 15 and over with the consent of a holder of parental authority. The Application is not available to those under 15.

Parental support within the application is being studied for a future version (post-MVP 1.2).

13. Changes to the policy

Any substantial change to this Policy will be notified through the Application and by email, at least 30 days before it takes effect.

14. Contact

• DPO and exercise of rights: dpo@cyclezen.ai
• Security: security@cyclezen.ai
• General question: contact@cyclezen.ai
• CNIL: cnil.fr

Version 1.1 · 24 October 2026