Consumer Health Data Privacy Policy

Effective date: July 14, 2026 · Replaces the version dated July 11, 2026

This Consumer Health Data Privacy Policy supplements the Dela Cycle Privacy Policy and provides the disclosures required by the Washington My Health My Data Act, Nevada SB 370, Connecticut's consumer health data provisions, and similar laws. It applies to "consumer health data" collected through the Dela Cycle mobile application (referred to as "Dela"), the delacycle.com website, and related services (the "Services") operated by Sbantu LLC ("we," "our," "us"). If there is a conflict between this policy and the Privacy Policy for consumer health data, this policy controls for residents of states with consumer-health-data laws.

1. Categories of Consumer Health Data We Collect

Depending on the features you use and the information you choose to enter, we collect:

• Menstrual and cycle data: period dates, flow, cycle length, spotting, and cycle history
• Reproductive and sexual health information: fertility signals (basal body temperature, ovulation test results, cervical mucus observations), trying-to-conceive information, pregnancy status and pregnancy-related entries (due date, symptoms, kick counts, health visits and appointment reminders, checklist progress), birth control information, and — only if you enable intimacy tracking — intimacy entries
• Symptoms, conditions, and measurements: logged symptoms, mood, energy, sleep, pain, weight, blood-pressure and blood-sugar readings, and health conditions you record (for example PCOS or endometriosis)
• Medication information: medications and supplements you log
• Bodily functions and vital signs from your device (optional): where Connected Health is available and you enable it on a supported device, Dela may import steps and activity, sleep, heart rate, and body temperature through Apple Health or Health Connect, but only for the categories you approve in a separate device-level permission screen.
• Notes and journal entries that may contain health information you choose to write
• Community content: health information you choose to include in a community post or reply
• Data that could identify you as seeking health services: your use of a cycle-tracking app itself, and inferences we derive from the above to provide predictions and insights (for example, predicted period dates, fertile windows, and cycle-phase estimates)

We do not collect precise location data, biometric identifiers, or genetic data.

2. Sources of Consumer Health Data

• You: the entries you make in the app (the overwhelming majority of all data)
• Your device, with your permission: where Connected Health is available and enabled on a supported device, Apple Health or Health Connect categories you separately approve. Dela does not connect directly to Oura, Garmin, or other wearable accounts; their measurements are available to Dela only if they have already been written to Apple Health or Health Connect and you approve Dela's access.
• Derived by us: predictions and insights computed from your entries

We do not buy, license, or otherwise acquire consumer health data from any third party.

3. Why We Collect It (Purposes)

• To provide the tracking, prediction, reminder, insight, and education features you request
• To operate optional features you enable — partner sharing, Connected Health where available, and community.
• When you separately enable optional prediction improvement, to compare experimental prediction methods and contribute eligible records to consent-gated aggregate accuracy evaluation and development of Dela's own models (described in Section 3.1 of the Privacy Policy). Product analytics is a separate choice and does not authorize this use.
• To secure accounts, prevent abuse, and troubleshoot failures (with health fields scrubbed from crash reports)
• To comply with legal obligations

We do not use consumer health data for advertising, and we do not use it to train third-party or general-purpose AI models.

4. How We Collect and Share It — and Your Consent

We collect consumer health data with your consent, given during onboarding and through the optional features you turn on, or as necessary to provide a product or service you have requested. We share it only:

• With processors and platform providers needed to operate Dela: Supabase (database and sign-in), Railway (API hosting), Google Firebase (push delivery; crash/analytics only if you opt in), Sentry (crash reports with health fields scrubbed, only if crash reporting is on), Resend (sign-in emails), Zoho (support mail), Cloudflare (website hosting), and Apple and Google (app distribution and, if you choose their sign-in option, authentication). Dela does not send the health entries you track to Apple or Google as part of app distribution or sign-in. Apple and Google may process store/download, account, device, authentication, and usage/diagnostic metadata under their own terms and privacy policies; Google's integrated sign-in SDK may also process an IP address to estimate general location, as described in the Privacy Policy. Providers acting as Dela's processors are contractually limited to our instructions; Apple and Google may act under their own platform terms for their store and authentication services.
• At your direction: with the partner you invite (read-only, permission-scoped, revocable), with signed-in Dela community members when an approved post or reply you submit is published under a generic community label, in data exports you generate, or, where Connected Health is available, when you enable approved imports from Apple Health or Health Connect. Dela retains the Community account link for moderation, blocking, owner deletion, and legal or safety obligations.
• Under valid legal process, handled narrowly as described in Section 6.3 of the Privacy Policy.

We do not authorize any third party to use the health entries you track for its own advertising, data-broker, or unrelated model purposes. Apple and Google may process the store/download and authentication metadata described above under their own platform terms and privacy policies. Where a law requires separate consent for "sharing" beyond the service/platform operation you request or sharing you direct, we will obtain that consent first; no such discretionary sharing occurs today.

5. We Do Not Sell Consumer Health Data

We do not and will not sell consumer health data. Under Washington law, a sale would require your separate, signed authorization identifying the buyer and expiring after one year; we will never request such an authorization.

6. No Geofencing

We do not collect precise location and do not use any geofence — around health-care facilities or otherwise — to identify, track, or message users or to collect data.

7. Your Rights

If you are a resident of Washington, Nevada, Connecticut, or another state with a consumer-health-data law, you have the right to:

• Know and access: confirm whether we collect, share, or (never) sell your consumer health data, access it, and receive a list of the third parties with whom we have shared it (Section 4 identifies the current service/platform providers and recipient categories)
• Withdraw consent: stop future collection or sharing at any time — in-app (disconnect Connected Health if enabled, turn off optional prediction improvement or analytics, revoke partner access, or use the health-data consent withdrawal/account-deletion path), in your device's health settings, or by emailing us. Because Dela's core tracking cannot operate without processing the health entries you ask it to track, withdrawing core health-data consent stops tracking and removes the account data.
• Delete: delete your consumer health data, including imported Connected Health data and copies in backups within our normal backup cycle (up to 90 days) — the in-app account-deletion flow hard-deletes your records
• Non-discrimination: exercise these rights without being denied service or treated differently
• Appeal: if we refuse a request, appeal our decision

8. How to Exercise Your Rights and Appeal

Use the in-app controls (Settings > Privacy & account) or email privacy@delacycle.com. We will verify your identity, respond within 45 days (extendable by 45 more where the law allows, with notice), and will not charge a fee for up to two requests per year.

If we deny your request, you may appeal within a reasonable period by replying with the subject line "Health Data Appeal." A reviewer not involved in the original decision will respond in writing within 45 days (Washington) or the period your state's law requires, with the reasons for the decision. If your appeal is denied, you may contact your state regulator — for example the Washington State Attorney General (atg.wa.gov), the Nevada Attorney General, or the Connecticut Attorney General.

9. Changes, Governing Law, and Contact

If we change this policy, we will post the updated version here with a new effective date and notify you of material changes as described in the Privacy Policy. Except where the consumer-health-data law of your state provides otherwise, this policy is subject to the Governing Law section of our Terms of Service (Wyoming law); nothing in that choice of law limits the rights your state's law gives you. Questions and requests: privacy@delacycle.com.