Privacy Policy

1. Introduction

Nyah Digital ("we," "our," or "us") operates the Ember Cycle mobile application (formerly known as "Mindful Mama") (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App. This policy applies to all users of the Ember Cycle application.

IMPORTANT: The Ember Cycle app provides educational information and wellness guidance related to maternal health. This app is not intended to provide medical advice, diagnosis, or treatment. Always consult with qualified healthcare professionals for medical decisions.

2. Information We Collect

2.1 Personal Information

• Email address (for account creation and authentication)
• Display name or username
• Profile photo (optional)
• Account preferences and settings
• Apple Sign-In Data: When using Sign in with Apple, we receive a user identifier and (at your discretion) your name and email address as permitted by Apple's authentication service
• Biometric Data: If you enable biometric login (Face ID, Touch ID, or fingerprint authentication), biometric templates are stored securely on your device only and are never transmitted to or stored on our servers
• Date of Birth: Collected once during sign-up solely to confirm that you are at least 18 years old, in accordance with our age requirement (Section 8). We store your date of birth with your account; it is not used for advertising or profiling.

2.2 Health and Wellness Information

Fertility and Reproductive Health Data: The App collects sensitive fertility and reproductive health information that you voluntarily provide, including but not limited to:

• Menstrual Cycle Data: Period start/end dates, cycle length, flow intensity, symptoms, and related notes
• Cycle Tracking: Ovulation predictions, fertile window estimates, basal body temperature (if provided), cervical mucus observations, and ovulation test results
• Pregnancy-Related Information: Due dates, pregnancy weeks, trimester information, fetal development tracking, pregnancy symptoms, birth plans, and prenatal appointment notes
• Postpartum Recovery Data: Birth date, delivery information, postpartum recovery metrics, breastfeeding logs, and recovery milestones
• Health goals and wellness preferences
• Wellness recommendations completion status
• Personal notes and journal entries related to your health journey
• Progress tracking data across all maternal health stages

Important: All fertility predictions, ovulation estimates, and cycle forecasts are algorithmic calculations based on your input data and historical patterns. These are estimates only and should not be relied upon for contraception, medical diagnosis, or treatment decisions. The App is not intended for use as birth control.

2.3 AI Chat Assistant Content

The App includes an optional in-app AI chat assistant ("Ember"). When you use the assistant, we collect and process:

• Your chat messages: The free-text questions and messages you type to the assistant, which may include health details you choose to share.
• Conversation history: Your messages and the assistant's responses are stored in your account so the conversation persists across sessions. You can clear your chat history at any time from within the chat.
• Health context used to personalize answers: To generate a relevant response, the assistant is supplied with certain health information from your account (for example, your current cycle day and phase, recent fertility logs, pregnancy or postpartum dates, logged symptoms, health conditions, and supplements). This context is assembled on our servers for the purpose of answering your question.

To produce a reply, your message and the health context described above are transmitted to and processed by our AI provider, OpenAI, which runs the language model that generates the response. See Section 4.1 (Service Providers) for details about how this data is handled, and Section 3.4 for how AI is used. AI responses are generated automatically, may be inaccurate, and are not medical advice — see the Medical Disclaimer in Section 16.

2.4 Subscription and Purchase Data

If you purchase a paid subscription (Ember+), we and our subscription providers process purchase and entitlement information, including:

• Your subscription status and the plan you hold (e.g., monthly or annual)
• Transaction and receipt identifiers and store account identifiers provided by the Apple App Store
• Purchase amount and currency for analytics and accounting purposes

Payments are processed by the Apple App Store, and subscription/entitlement state is managed through our subscription service provider, RevenueCat. We never receive or store your full payment-card number. See Section 4.1 for details.

2.5 Usage Information

• App usage patterns and feature interactions
• Device information (device type, operating system, app version)
• Log data (access times, pages viewed, app crashes)
• Analytics data for app improvement

2.6 Technical Information

• Device identifiers (device ID)
• Push notification token (a device identifier used to deliver notifications, stored with your account)
• IP address and general location information
• Network connection information
• App performance and error data

3. How We Use Your Information

3.1 Primary App Functions

• Provide personalized health and wellness recommendations
• Track your progress through different maternal health stages
• Deliver relevant educational content and resources
• Enable app features like progress tracking and milestone celebrations
• Synchronize your data across devices
• Verify that you meet our minimum age requirement (18 years or older)

3.2 App Improvement and Analytics

• Analyze app usage to improve features and user experience
• Identify and fix technical issues and bugs
• Develop new features based on user needs
• Conduct research to enhance our services

3.3 Communication

• Send important app updates and security notifications
• Provide customer support and respond to inquiries
• Send educational content and wellness tips (with your consent)

3.4 Automated Processing and AI

• AI chat assistant: When you message the in-app assistant, we send your message together with relevant health context from your account to our AI provider (OpenAI) so a language model can generate a response, which we then display to you and store in your chat history.
• Pattern insights: We generate cycle and wellness insights from the data you log. These insights are computed on our own systems and are not sent to the AI provider.
• No automated decisions with legal effect: We do not use automated processing to make decisions that produce legal or similarly significant effects about you. AI responses and insights are informational only and are not medical advice.

4. Information Sharing and Disclosure

We do not sell your personal information for money, and we never share your detailed health records or the reproductive-health entries you log (such as cycle, symptom, pregnancy, or fertility data) with advertising networks or use them for ad targeting.We share information only with the service providers and in the limited circumstances described below. One clarification: our product-analytics provider (Smartlook) receives a coarse signal of which app "mode" you use (for example, cycle, pregnancy, postpartum, or vitality) — this is described in Section 4.1. The App contains no third-party advertising, and we do not share your personal information with advertising networks or use it for cross-context behavioral advertising (see Sections 8.1 and 10).

4.1 Service Providers

We work with the following third-party service providers (sub-processors) to operate the App. For each, we describe what data is involved and why. Where a provider has its own privacy policy, that policy also governs its handling of the data it receives.

• Supabase (backend, authentication, and database): Our primary backend and system of record. Supabase stores your account information and all of the health and wellness data you log (cycles, fertility logs, pregnancy and postpartum data, food and supplement logs, insights), as well as your AI chat history. Data is transmitted via TLS and stored with Supabase-managed encryption at rest. Row-level security and access controls restrict access so the App returns only your own account's data.
• OpenAI (AI chat assistant): Powers the in-app "Ember" assistant. When you send a chat message, your message and relevant health context from your account are transmitted to OpenAI's API, which runs the language model that generates the reply. Your chat messages and the assistant's replies are also stored in your account on our backend. OpenAI processes this content in order to return a response; its handling of data submitted through its API is governed by OpenAI's API data-usage policies. We do not use your chat content to train our own models. You can avoid this processing entirely by not using the chat assistant, and you can clear your stored chat history from within the chat at any time.
• RevenueCat and the Apple App Store (subscriptions): If you purchase Ember+, payment is processed by the Apple App Store, and your subscription and entitlement state is managed through RevenueCat. These providers receive your account identifier and purchase/receipt information. They do not receive your health data, and we do not receive your full payment-card number.
• Smartlook (product analytics / session replay): Records masked, wireframe-only session replays of how users navigate the App — linked to your account identifier (and therefore not anonymous) — to help us diagnose problems and improve the experience. Recording is configured in a wireframe (non-pixel) mode, all text inputs are masked by default, and screens that contain health data (such as the fertility log, period entry, and AI chat screens) are explicitly marked sensitive so their contents are not captured. Recording is paused on sign-in, sign-up, and password screens. Smartlook receives your account identifier and non-identifying app-flow events (for example, onboarding step completion); these events do not include your health values. You can opt out of session recording in the App's settings.
• Sentry (crash and error reporting): Captures crash and error diagnostics (stack traces, app version, device and lifecycle context) so we can fix problems. Before sending, we redact your email address and strip health fields from app event logs. Sentry still receives your account identifier and error details. Sentry is disabled in development builds.
• Expo (push notifications and app delivery): Provides our push-notification delivery service and our build / over-the-air update platform. To deliver a notification, the notification content and your device push token transit Expo's push service. Notification copy consists of generic reminders (which may indicate your life-stage, e.g., a pregnancy reminder) and does not include your detailed health records. The over-the-air update channel delivers app code, not your personal data.
• Apple (Sign in with Apple): An authentication provider used when you choose Sign in with Apple. In this flow, identity information flows from Apple to us (a user identifier and, at your discretion, your name and email); we do not send your health data to Apple for authentication. If you use Apple's Hide My Email, Apple relays a private email address on your behalf.

We require our service providers to protect your information and to use it only for the purposes we specify. As stated above, we do not share your detailed health records or logged reproductive-health entries with advertising or analytics networks or use them for ad targeting; the only exception is the coarse app-mode signal noted in the Smartlook entry above. The only providers that receive your detailed health data are our backend (Supabase) and, for the chat feature you choose to use, our AI provider (OpenAI).

4.2 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or to protect our rights, property, or safety, or that of our users or the public.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to the same privacy protections.

4.4 User-Initiated Social Media Sharing

Shareable Milestone Cards: The App allows you to create and share milestone cards (such as pregnancy week milestones) to social media platforms. This feature is entirely voluntary and user-initiated.

• You Control What is Shared: Before sharing, you can customize which information appears on the card, including your name, due date, and custom messages. All sharing options are optional and disabled by default.
• No Automatic Sharing: We never automatically post your information to social media. You must explicitly tap the "Share" button and choose where to share.
• What We Don't Share: Milestone cards do not include sensitive medical information, test results, healthcare provider names, medications, or medical conditions.
• Your Responsibility: When you share content to social media, that content becomes subject to the privacy policies and terms of service of the social media platform (e.g., Instagram, Facebook, WhatsApp). We have no control over how third-party platforms use or display your shared content.
• Data Tracking: We do not track what you share or where you share it. The sharing feature uses your device's native sharing functionality.

Your Privacy Rights: You acknowledge that by voluntarily sharing milestone cards to public social media platforms, you are making that information publicly available. Consider your privacy preferences before sharing personal pregnancy information publicly.

5. Data Security and Protection

5.1 Security Measures

We implement the following security measures to protect your data:

• TLS Encryption in Transit: All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS) protocols
• Encryption at Rest: Your data is stored using Supabase-managed encryption at rest with industry-standard AES-256 encryption
• Secure Authentication: Email/password authentication with secure password hashing and optional biometric login (stored locally on your device only)
• Row-Level Security (RLS): Database policies restrict access so that, through the App, your data is returned only to your authenticated account. As noted below, this is not end-to-end encryption, and authorized personnel and our backend provider retain the technical ability to access data when necessary.
• Access Controls: Strict access controls limit who can access backend systems and data
• Regular Security Updates: We regularly update our systems and dependencies to address security vulnerabilities

Note on Encryption: While we use robust security measures, your data is not end-to-end encrypted. This means Nyah Digital and our service providers (Supabase) have the technical ability to access your data if necessary for service operation, legal compliance, or security purposes. Your data is encrypted during transmission (TLS) and at rest (Supabase-managed encryption), but we control the encryption keys.

5.2 HIPAA Considerations

Important: Nyah Digital and the Ember Cycle app (formerly Mindful Mama) are not "covered entities" or "business associates" as defined under the Health Insurance Portability and Accountability Act (HIPAA). HIPAA applies to healthcare providers, health plans, and healthcare clearinghouses that handle protected health information in the course of providing medical services.

However, we implement security measures consistent with HIPAA standards as a best practice for protecting your health information. This app is designed for personal wellness tracking and educational purposes only and is not intended as a medical device, diagnostic tool, or substitute for professional medical care.

We strongly encourage users to share relevant health information from this app with their qualified healthcare providers, who ARE covered by HIPAA and can provide appropriate medical guidance based on your data.

5.3 Data Breach Response

We will notify affected users without undue delay and in accordance with applicable law if we discover a security incident that compromises your personal information. Upon discovery of any breach, we will take immediate steps to secure the data, investigate the incident, and prevent further unauthorized access.

6. Your Rights and Choices

6.1 Access and Control

• Access and portability: From the App's Settings screen, tap "Export my data (JSON)" to generate a structured, machine-readable file containing the rows of data linked to your account, which you can copy to your clipboard and save. The export covers your account profile, cycle and fertility tracking, daily fertility/vitality/hot-flash/food logs, basal-body-temperature analysis, cycle insights, your progress across all modes, completed recommendations and workouts, supplements, fertility-tracking settings, shared links, your AI chat messages, support tickets, feedback, and your subscription records. (A small number of newly added tables are scheduled to be added to the export; they hold no data for existing accounts until a future app release.) Exports are limited to a small number per hour.
• Correction: Update or correct your information at any time within the App.
• Deletion: From the App's Settings screen, tap "Delete account and all data". Deletion is carried out immediately and cannot be undone (see Section 6.3).

6.2 Communication Preferences

• Opt out of promotional communications while maintaining essential service notifications
• Control push notification settings through your device or app settings
• Manage email preferences through your account settings

6.3 Data Retention and Account Deletion

We retain your information for as long as your account is active or as needed to provide services. You can delete your account at any time from the App's Settings screen ("Delete account and all data").

Deletion is immediate and irreversible. After a single confirmation, we permanently erase your account and everything linked to it — your profile, cycle and fertility data, daily logs, AI chat history, workouts and progress, shared links, support tickets and correspondence, feedback, subscription records, and your login credentials — in a single operation that completes before the confirmation screen appears. There is no grace period, no recovery window, and nothing to cancel: once you confirm, your data is gone and we cannot restore it, even if you ask us to. The App also clears the copies held locally on your device, including saved sign-in credentials and scheduled reminders.

After each deletion we re-check every table that can hold data linked to an account and confirm that nothing remains; if anything did remain, the deletion is aborted in full rather than left partially done, and you are asked to retry. The only thing we keep is an anonymous record that a deletion took place — a timestamp and a count of the records removed, carrying no identifier, email address, or content of yours — which we retain for security and accounting purposes. Your own activity records in our audit log are erased along with the rest of your data.

Immediate erasure applies to your data in our primary systems. Limited copies may persist for a short additional period in encrypted backups and in the independent logs of the service providers described in Section 4.1 (for example, crash, analytics, attribution, and AI-provider logs), which are deleted on each provider's own rolling retention schedule. We may also retain certain records where required by law.

Deleting your account does not cancel a subscription. Subscriptions purchased through the App Store are billed by Apple, and only you can cancel them, from your Apple account's subscription settings. Cancel before deleting your account, or you may continue to be charged.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States where Nyah Digital is located. We ensure that such transfers comply with applicable data protection laws and that your data receives adequate protection through appropriate safeguards.

8. Age Requirements and Privacy

Our App is intended for users who are at least 18 years of age. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected personal information from someone under 18, we will take steps to delete such information promptly.

By using the App, you represent and warrant that you are at least 18 years old and have the legal capacity to enter into this Privacy Policy.

8.1 No Advertising; Do-Not-Sell/Share Requests

The App contains no third-party advertising, and we do not use or share device advertising identifiers with ad networks. We do not sell your personal information for money and do not share it for cross-context behavioral advertising as defined by U.S. state privacy laws (such as California's CCPA/CPRA). Earlier versions of the App offered a free, ad-supported tier; that tier and its advertising SDK have been removed. If you would nonetheless like to submit a request, email us at support@nyahdigital.com with the subject "Do Not Sell or Share My Personal Information" and we will honor it.

9. Third-Party Services and Links

Our App may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

10. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA:

• Right to know what personal information is collected and how it's used
• Right to delete and to correct your personal information
• Right to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information for money, and — because the App contains no advertising — we do not share personal information for cross-context behavioral advertising (see Section 8.1).
• Right to limit the use of sensitive personal information. The reproductive and health data you log is "sensitive personal information." We use it only to provide the App's tracking and wellness features you request (and, when you use the AI assistant, to generate your responses) — not for cross-context behavioral advertising or for inferring characteristics about you. We do not sell or share your sensitive personal information.
• Right to non-discrimination for exercising your privacy rights.

To exercise these rights, use the in-app export and deletion tools (Section 6) or email support@nyahdigital.com. You may also designate an authorized agent to submit a request on your behalf.

11. Consumer Health Data (Washington, Nevada, Connecticut)

This section addresses U.S. consumer-health-data laws, including Washington's My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act, and serves as our Consumer Health Data Privacy notice for residents of those states. The reproductive, fertility, pregnancy, and postpartum information you log is "consumer health data" under these laws.

• Collection and use: We collect consumer health data only when you choose to enter it, and we use it to provide the tracking, insight, and wellness features you request, and — when you use the AI chat assistant — to generate your responses (see Sections 2, 3, and 4.1).
• Affirmative consent; no sale: We process your consumer health data based on your consent, and we do not sell it. We do not share it with advertising networks or use it for ad targeting.
• Who receives it: The only third parties that receive your detailed health data are our backend provider (Supabase) and, for the optional AI chat you use, our AI provider (OpenAI), as described in Section 4.1.
• Your rights: You may access, export, and delete your consumer health data, and withdraw your consent, using the in-app tools described in Section 6 or by emailing support@nyahdigital.com.
• No geofencing: We do not use geofencing around any health-care facility to identify, track, or send notifications to users based on their proximity to such facilities.

12. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with your local data protection supervisory authority

12.1 Data Controller and Legal Bases

The data controller for your personal data is Nyah Digital (Utah, United States; support@nyahdigital.com). We rely on the following legal bases under Article 6 of the GDPR: performance of a contract (to provide the App and the features you request, including subscriptions); consent (for optional features such as the AI chat assistant, analytics, session recording, and personalized advertising); legitimate interests (to secure, maintain, and improve the App, where not overridden by your rights); and legal obligation (where we must retain or disclose data by law).

12.2 Special-Category (Health) Data

Your reproductive, fertility, pregnancy, and related health data are "special-category" data under Article 9 of the GDPR. We process this data solely on the basis of your explicit consent (Article 9(2)(a)), which you provide by choosing to enter this data and to use the related features. You can withdraw your consent at any time by deleting the relevant data, discontinuing use of a feature (for example, the AI chat assistant), or deleting your account from the App's Settings screen; withdrawal does not affect processing carried out before withdrawal. Withdrawing consent for essential health-tracking features may mean those features can no longer function.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy in the App and updating the "Effective Date" at the top of this policy. Your continued use of the App after such changes constitutes acceptance of the updated policy.

14. Governing Law

This Privacy Policy and any disputes arising out of or relating to it shall be governed by and construed in accordance with the laws of the State of Utah, United States, without regard to conflict of law principles. Any legal action or proceeding arising under this Privacy Policy will be brought exclusively in the federal or state courts located in Salt Lake County, Utah.

15. Contact Information

16. Medical Disclaimer and Limitations of Liability

16.1 Birth Control and Contraception Disclaimer

16.2 Algorithmic Predictions Disclaimer

All fertility predictions, ovulation estimates, cycle forecasts, and period predictions provided by the app are algorithmic calculations based on your historical data and statistical averages. These are estimates only and may not accurately reflect your individual physiology. Actual ovulation, fertile windows, and cycle lengths can vary significantly due to stress, illness, hormonal changes, medications, and other factors. Do not rely on these predictions for medical decisions or contraception.

16.3 Birth Plan Disclaimer

The birth plan feature is a planning and organizational tool only. Birth plans created in the app are suggestions and preferences, not medical instructions. Actual birth experiences may differ significantly from your plan due to medical necessity, complications, or other factors. Always follow the guidance of your healthcare providers during labor and delivery, even if it differs from your birth plan. Nyah Digital is not responsible for birth outcomes, complications, or any deviation from your birth plan.

16.4 Pregnancy and Birth Complications

16.5 No Professional Relationship

Use of this app does not create a doctor-patient, therapist-patient, or any other professional healthcare relationship between you and Nyah Digital. The app is not a substitute for in-person medical consultations, examinations, or treatment.