SHE Privacy Policy

The short version

• Your cycle, check-ins, wearable data and scores are stored on your iPhone. Our servers use them only to calculate your insights and don’t store them.
• We never sell your data. Your health data never goes to advertisers, data brokers, analytics or marketing tools.
• You can export your data, or delete your account and withdraw your consent, at any time from inside the app.
• SHE is for people aged 16 and over.
• SHE is a wellness app. It is not a medical device and not a method of contraception.

1. Who we are

SHE is provided by Yuliia Ishchenko, an individual entrepreneur registered in Kyiv, Ukraine, Marii Svitlychnoi street 5/2 (“SHE”, “we”, “us”). We decide how your personal data is used, which makes us the data controller.

• Privacy contact: hello@sheappglobal.com

2. Who SHE is for

SHE is for people aged 16 and over. We don’t knowingly collect data from anyone younger. If you believe someone under 16 is using SHE, write to us and we’ll delete their account.

3. What data we process and why

SHE reads only the wearable data types listed above. We don’t read any other Apple Health or Garmin data, even if it’s on your device.

We don’t collect your precise location, contacts, photos, calendar or payment card details. Like any online service, we and our providers see your IP address, which can reveal your approximate region. Apple handles payments; we only see whether your subscription is active.

4. Where your data is stored

• On your iPhone. Your name, birth date, cycle dates, check-ins, wearable data, scores and forecasts are stored on your iPhone.
• In your iPhone’s backup. If you back up your iPhone to iCloud or a computer, iOS includes SHE’s data in that backup, as for any app. Apple manages these backups; SHE doesn’t send anything to iCloud itself and can’t read them.
• Calculated on our servers, never stored. To calculate your cycle phase, Capacity score and forecasts, your iPhone sends the data needed to our servers in the Netherlands (EU). The servers use it for that calculation, send the result back to your iPhone and never write it to our database, cache, queues, logs or backups.
• Garmin. Garmin only delivers data through a server. Once Garmin is available and you connect it, your Garmin data passes through our servers on its way to your iPhone and isn’t stored there. If your iPhone is offline, we don’t hold the data for it; it’s sent again once your iPhone is back online. Garmin’s own handling of your data is covered by Garmin’s privacy policy.
• On our servers. We keep your account ID, your email address, consent records, training plan, settings and subscription status. This is what comes back when you sign in on a new iPhone.
• With our sign-in provider. Your email address is stored by our sign-in provider in the United States.
• Moving to a new iPhone. Your health history isn’t stored on our servers, so it can’t be restored from them. It moves with your iPhone when you set up the new one from a backup or with Quick Start. You can also export it from More › Export my data. If you delete SHE, its data on your iPhone is deleted too.

Because we don’t store your cycle, check-in, wearable or score data on our servers, we have none of it to share, lose or hand over.

5. Analytics and crash reports

We use analytics and crash-reporting tools to see which screens are used, where people get stuck and why the app crashes. They receive technical data only: your SHE account ID once you’ve signed in, a random installation ID, device model, iOS and app version, which screens you open and crash logs. They never receive cycle dates, phase, symptoms, check-in answers, Capacity scores or wearable data. When you delete your account, we ask our analytics provider to delete your events. You can turn analytics off at any time in More › Privacy › Usage analytics; SHE then stops sending your app usage to our analytics provider until you turn it back on. Subscription events, such as starting a trial or renewing, still reach it from our subscription management provider. They never include health data.

SHE doesn’t use your advertising ID and doesn’t track you across other companies’ apps or websites.

6. Who receives your data

We never sell your personal data. We never share your health data with advertisers, data brokers, insurers or employers.

Service providers process data on our behalf, under contract, and only for the purposes in section 3:

You can ask us for the names of the specific providers that received your data, and we’ll tell you.

We may disclose data if the law requires it. We only respond to a legally valid order, we check every request, we challenge requests that are too broad, and we disclose only the minimum required. Where the law allows, we tell you first. We don’t store your cycle, check-in, wearable or score data on our servers, so we have none of it to disclose.

7. International transfers

Our servers are in the Netherlands. Some providers process data in the United States. When data leaves the European Economic Area or Ukraine, we rely on an adequacy decision (including the EU–US Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses.

8. How long we keep data

9. Your rights and controls

You can, at any time:

• See and correct your data in the app.
• Export your history as a CSV file in More › Export my data.
• Withdraw consent to health data processing in More › Privacy › Health data, which takes you to delete your account. You can also delete your account directly in More › Delete account, or write to hello@sheappglobal.com. SHE can’t calculate your insights without your health data, so withdrawing consent ends SHE’s health features.
• Revoke Apple Health access in the Health app. SHE then stops reading your wearable data, and your account stays.
• Delete your account in More › Delete account. This deletes your account, training plan and settings from our servers within 30 days, and removes your health data from your iPhone. We keep a record of when you gave and withdrew consent for 3 years, to show we asked. Deleting your account doesn’t cancel your App Store subscription; cancel that in iOS Settings.
• If you’ve removed the app. Removing the app deletes its data from your iPhone but doesn’t delete your account. To delete your account, reinstall SHE and use More › Delete account, or write to us.
• Turn off analytics in More › Privacy › Usage analytics, or ask us to restrict processing.
• Complain to a data protection authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, the authority in your country.

For anything you can’t do in the app, write to hello@sheappglobal.com. We’ll answer within one month.

10. Security

We protect data in transit with TLS, limit who on our team can access our servers, and check that health data never reaches our logs, analytics or marketing tools. Your health data lives on your iPhone, so your passcode and Face ID protect it too. If a security incident affects you, we’ll tell you and the relevant authorities within the time the law requires.

11. Notifications and emails

SHE sends push notifications only if you allow them in the iOS prompt. You can choose which ones you get in More › Notifications, or turn them all off in iOS Settings › Notifications › SHE. Our legal basis for push notifications is your consent.

What our messaging provider receives. To deliver these notifications, our messaging provider receives a device token (a random identifier for your iPhone in SHE), the text of the notifications, when you open and leave the app and which screens you open, your time zone, the date you first signed in, whether notifications are on, and your subscription status. Apple receives the device token and the text. Neither ever receives your cycle dates, phase, symptoms, check-ins, wearable data or scores.

Emails. We email you only about your account: sign-in codes, important changes to this policy or our Terms of Use, and replies to your support requests. These emails never contain health data. We don’t send marketing emails unless you’ve agreed to receive them.

How long we keep it. Device tokens and notification settings are kept until you turn notifications off, sign out or delete your account.

12. Additional information for US residents

Consumer health data. Your cycle dates, check-ins, wearable data and the scores we calculate from them are consumer health data. We collect them only with your consent and use them only to provide SHE. We never sell consumer health data. We share it only with the service providers in section 6, for calculation, and they don’t keep it.

Your rights. You can confirm whether we process your consumer health data, access it, delete it and withdraw your consent, as described in section 9. When you ask us to delete it, we also ask our service providers to delete it.

Washington, Nevada and similar state laws. This section is our consumer health data privacy policy. To use your rights, write to hello@sheappglobal.com. If we refuse a request, you can appeal by replying to our answer.

13. Not medical advice

SHE is a wellness app. It doesn’t diagnose, treat or prevent any condition, and it isn’t a method of contraception. Talk to a doctor about symptoms, pregnancy or any medical question.

14. Changes to this policy

If we change how we use your data, we’ll tell you in the app before the change takes effect. If the change needs your consent, we’ll ask for it first. We keep previous versions of this policy and will send them to you on request.

15. Contact