Privacy Policy

1. Who We Are

PCOScan ("we," "us," or "our") is an informational health screening tool. We are not a medical provider, insurer, or healthcare entity under HIPAA. Our contact email for privacy matters is privacy@pcoscan.app.

2. What We Collect

Information you provide directly:

• Email address and password (used only for account authentication via Supabase Auth)
• Symptom screening answers (cycle patterns, androgen signs, risk context) — used only to generate your on-screen report and are not stored server-side unless you create an account
• Daily symptom log entries (energy, mood, sleep, stress, exercise, nutrition notes)
• Onboarding answers (diagnosis timeframe, primary symptoms, goal)

Information collected automatically:

• Google Analytics collects anonymized page views, session duration, and general geographic region (country/city level). No health data is sent to Google Analytics.
• Standard server logs (IP address, browser type, pages visited) retained for up to 30 days for security purposes

3. How We Use Your Information

• To provide and operate the symptom tracking and screening features
• To display your symptom history and dashboard
• To send transactional emails (password reset, account confirmation) — no marketing emails without explicit opt-in
• To improve the product using aggregate, anonymized usage data
• To comply with legal obligations

We do not use your health data to serve targeted advertisements. We do not sell your data to data brokers, insurers, employers, or any third party.

4. Third-Party Services

5. Sensitive Health Information

The symptom data you enter (menstrual patterns, androgen symptoms, etc.) is health-related information. We treat it with heightened care:

• It is never shared with advertisers, data brokers, or third parties beyond the infrastructure providers listed above
• It is never used to make decisions affecting your insurance, employment, or credit
• It is stored under your account and accessible only to you
• Screening results generated without an account are processed entirely in your browser and never sent to our servers

6. Children's Privacy (COPPA)

PCOScan is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, contact us at privacy@pcoscan.app and we will delete it promptly. Users between 13 and 18 should use the service with parental awareness.

7. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and all associated data
• Portability: Request your data in a machine-readable format
• Opt-out of analytics: You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on

To exercise any of these rights, email privacy@pcoscan.app. We will respond within 30 days.

California residents (CCPA/CPRA): You have the right to know, delete, and opt out of the sale of personal information. We do not sell personal information. To submit a verifiable consumer request, email privacy@pcoscan.app.

EEA/UK residents (GDPR): Our lawful basis for processing your data is contract performance (providing the service you signed up for) and legitimate interests (security, fraud prevention). You may lodge a complaint with your local supervisory authority.

8. Data Retention

We retain your account data and symptom logs for as long as your account is active. Upon account deletion, all personal data is permanently deleted within 30 days except where retention is required by law. Anonymized, aggregated analytics data (which cannot identify you) may be retained indefinitely.

9. Security

We implement reasonable technical and organizational measures to protect your data, including TLS encryption in transit, AES-256 encryption at rest (via Supabase), and access controls limiting who can access production data. No system is completely secure; if you believe your account has been compromised, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify registered users of material changes by email or in-app notice at least 14 days before they take effect. Continued use of PCOScan after changes take effect constitutes acceptance of the updated policy.

11. Binding Arbitration and Class Action Waiver

Agreement to Arbitrate. You and PCOScan agree that any dispute, claim, or controversy arising out of or relating to this Privacy Policy, the Terms of Service, or your use of PCOScan (collectively, "Disputes") will be resolved by binding individual arbitration, not in court, except as set forth below. This includes disputes about the validity, applicability, or enforceability of this arbitration agreement.

Arbitration Rules. Arbitration will be administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules, which are available at adr.org. The arbitration will be conducted in English. If the AAA Consumer Arbitration Rules require an in-person hearing, it will take place in the county where you reside.

Class Action Waiver. YOU AND PCOSCAN AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING. If a court or arbitrator decides that applicable law precludes enforcement of this waiver as to any particular claim, then that claim must be severed from arbitration and may be brought in court, while all other claims proceed in arbitration.

Exceptions. Either party may bring an individual claim in small claims court. Either party may seek emergency injunctive or other equitable relief in court to prevent actual or threatened infringement, misappropriation, or violation of intellectual property rights.

Opt-Out. You may opt out of this arbitration agreement within 30 days of first using PCOScan by emailing privacy@pcoscan.app with the subject line "Arbitration Opt-Out" and your account email. Opting out does not affect any other terms.

Governing Law. This Privacy Policy and any Disputes are governed by the laws of the State of Delaware, without regard to conflict of law principles, except where prohibited by applicable law.

12. Contact

For privacy questions, data requests, or concerns: