Privacy Policy
Version 0.9-draft · Effective 2026-08-07
Pre-launch legal review is required before publication. The controller identity, privacy contact, and this draft must be confirmed by qualified counsel.
What this means in practice
- Your symptom entries stay only on this device; we do not offer accounts or cloud sync.
- Apple Health data is read only after you choose it; we never write it to Apple Health or iCloud.
- We do not sell health data or use it for advertising, marketing, or behavioural profiling.
- You can delete all local data in Settings. Deleting the app also permanently deletes these records; they cannot be recovered.
- If you export a report, its copy can remain in the share destination you choose; delete that copy separately.
Full legal text
1. Controller, scope, and version
This Privacy Policy describes how Menolora (the “App”, “we”, “us”) handles personal data in its iOS and web applications. It applies from 2026-08-07 under version 0.9-draft.
The data-controller contact for privacy requests is —. The legal entity details and contact route must be verified before public launch. This policy is provided in English and Turkish with the same substantive commitments; where translations differ, mandatory applicable law prevails.
2. Data we process and why
Local app use: we process the stage you select, symptom type, severity, date/time, optional notes, appearance and language preferences, and locally generated report metadata. The purpose is to provide the personal tracking, pattern, reading, and doctor-visit-preparation features you request.
Optional HealthKit use: after a contextual iOS permission request, we may read selected sleep, heart-rate, and menstrual-flow data from Apple Health only on your device to show it beside your private record. We do not write any data to Apple Health. Account creation and transfer of health records to our servers are not offered in this release.
3. Legal bases and consent
Health and sexual-health-related observations are sensitive/special-category data. Where KVKK, GDPR, or similar law applies, we rely on permission you freely give through iOS for Apple Health access and on providing the local functionality you request on your device. You can withdraw Apple Health permission in iOS settings; withdrawal does not affect processing already lawfully completed.
We do not require Apple Health, analytics consent, or an account in order to use manual symptom logging. Because we do not transfer health records to our servers, we do not request consent for cloud transfer.
4. Local-first storage and HealthKit
Symptom entries and generated report metadata are stored only in the app’s private local database. The iOS build marks that database as excluded from device/iCloud backup. HealthKit data is never written to iCloud by this App.
Apple Health permission is managed through iOS. Apple may not reveal whether a user denied a read permission; an empty result is therefore treated as no available data, not as an instruction to bypass the system setting. Manual entry remains available at all times.
5. Third-party services and no health-data transfer
This release has no account, cloud sync, or server service that receives health records. We do not transfer your symptoms, notes, cycle records, Apple Health context, or reports to us or another processor. We use Expo EAS Update to deliver code, design, and content updates to the App; the service may process technical app information and network-request data to determine update compatibility, but it does not receive your health records.
Apple provides the HealthKit platform, App Store payments, and the App Store lookup for a newer native version under its own terms. Expo is a technical service provider only for the update delivery described above. We currently do not enable advertising SDKs, behavioural analytics, or crash-reporting SDKs. We do not sell, use for advertising or marketing, or share health data with third parties.
6. Retention, export, and deletion
Local records remain on the device until you delete them, uninstall the App, or use Settings > Delete all of my data. The action deletes local symptom entries, HealthKit-derived records, reports, and preferences immediately from the App database.
Locally generated PDFs can remain in a device share destination selected by you; delete any copies you exported separately. After you delete the App, we have no account or backup copy from which to restore local records.
7. Your rights
You can delete local records using Settings > Delete all local data and export a visit report through your device’s share menu. Because the App does not keep health records on a server, you do not need to ask us to access or delete them.
Depending on where you live, you may have rights related to data processing, consent, or complaints. Under KVKK, health data is special-category data; under GDPR you may also complain to a competent supervisory authority. Contact us at — with questions about this local-only commitment or our privacy practices.
8. International transfers, cookies, and web use
This release does not transfer App health records to our servers, so those records are not subject to an international transfer by us. Expo EAS Update infrastructure may process technical update-request data outside Turkey or the European Economic Area; health records are not included in that request. In the web app, records remain in your browser’s local storage; clearing browser/site data or using unsupported private browsing can remove them.
The App’s web shell is designed to run without advertising or behavioural cookies. If cookies or similar tracking technologies are added to the web application or marketing site, we will provide a separate notice and obtain consent where law requires before non-essential tracking starts.
9. Security and children
We use reasonable technical and organisational measures appropriate to the sensitive nature of the data, including local-only storage and the iOS backup-exclusion marker. No method of storage is completely secure, so please protect your device with a passcode or biometrics and use platform security features.
The App is not directed to, and must not be used by, anyone under 18. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data.
10. Changes and contact
We will keep a version history and will not silently make a material change to health-data handling. Material changes will be flagged in the App before or when they take effect, and we will request renewed consent where required.
For privacy, export, correction, deletion, or consent questions, use —. Before launch, this draft must be reviewed by qualified counsel familiar with KVKK, GDPR, consumer, and health-data requirements.