Privacy Policy

This is the English version of the Dutch privacy policy. If the English and Dutch texts differ in any way, the Dutch version prevails.

1. Introduction

PMDD Tracker (a product name of FemTech Solutions B.V.) respects your privacy and is responsible for protecting your personal data. This privacy policy describes how we collect, use, store and protect your data when you use the PMDD Tracker app ("the App").

Since 10 September 2026 you can also sign up for our newsletter without an account, via the pmddtracker.nl website. Where this policy refers to "the App", it concerns users with an account; section 3.9 separately describes what we process if you only sign up for the newsletter. The two are kept apart: a newsletter sign-up does not create an account and gives us no health data whatsoever.

This policy has been drawn up in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG, UAVG).

2. Controller (the party responsible for your data)

FemTech Solutions B.V. (product: PMDD Tracker)

Correspondence via privacy@pmddtracker.nl (postal address available on request)

Email: privacy@pmddtracker.nl
Website: https://pmddtracker.nl

Data Protection Officer (DPO): not appointed (current phase)

Privacy contact: privacy@pmddtracker.nl

3. What data do we collect?

3.1 Account data

• Email address (for registration and signing in)
• Display name (optional)
• Authentication method (email/password, Apple Sign In or Google Sign In)

If you use Apple Sign In or Google Sign In, we receive your email address and possibly your name from that provider. We do not receive passwords, contacts or any other account data from Apple or Google. Authentication takes place through a secure token mechanism (OAuth 2.0 / OpenID Connect).

3.2 Health data

• Daily symptom scores (21 DRSP items, scale 1-6)
• Interference items (3 items, yes/no)
• Optional: custom symptoms (symptom names you define yourself and daily scores 1-6, max. 20)
• Cycle events (menstruation, spotting)
• Cycle data (start date, length, phase)
• Notes added to daily entries

3.3 Support (Steun)

• Personal signals and actions for clear days and support days
• Letter to yourself
• Instructions for the people around you

3.4 Crisis contacts

• Names and telephone numbers of personal crisis contacts
• Relationship to you as the user

3.5 Medication data

• Medication names, dosage, frequency
• Records of doses taken

3.6 App settings

• Theme preference (light/dark/system)
• Notification settings
• App lock (on/off; Face ID / Touch ID / fingerprint / PIN; no biometric data itself)
• The language you use the app in: your language choice and, if you follow your phone’s language, the language the app therefore actually shows. We need this to send you a change to these terms or a service message in a language you read
• Your device’s country or region setting (for example NL or DE). This is a setting on your device, not a location measurement; we do not measure your location (see 3.7)
• Whether you use the app on Android or on iPhone (iOS), and when the app last reported this. No device model, brand or operating system version. Needed to send you a service notice when a problem only affects your kind of phone
• Your device's time zone (for example Europe/Amsterdam). This is a setting on your device, not a location measurement. We need it so that push notifications are not sent at night (section 3.11). We have stored it since July 2026; until version 1.23 it was not mentioned in this policy

3.7 Data we do NOT collect

• We do not collect location data
• We include no advertising SDKs
• We share no data with advertisers
• We build no user profiles for marketing. Who receives a message in the App is decided only from the general data in section 3.10, never from health data
• We use no advertising or cross-app tracking (no Firebase Analytics, no Google Analytics, no ads SDKs). On Android, the only part of Firebase the App uses is Cloud Messaging, for your device's push address and for delivering push notifications (section 3.11)

3.7a Limited usage analytics and crash reporting

To keep the app stable and useful, we process, with data minimisation:

• Usage analytics (PostHog, EU hosting): anonymous product events such as app opened, screen views, feature activation and PDF export (started/shared/failed). No symptom scores, cycle content, notes, medication names or crisis contacts.
• Crash reporting (Sentry, EU hosting): technical error reports (stack traces, device/OS/app version). No screenshots of app content and no health data.

You can turn usage analytics off under Settings → Privacy & security. Crash reporting supports service stability; see also our internal Legitimate Interest Assessment.

3.8 Email communication data

• Opt-in preference for the newsletter or service updates, and for each kind of message whether you also want it by email (section 3.10)
• Email delivery status (for example delivered/failed)
• Technical delivery metadata (for example the provider's tracking ID)

3.9 Newsletter sign-up via the website (without an account)

If you sign up for the newsletter via pmddtracker.nl, we process:

• Your email address.
• The moment you signed up and the moment you confirmed. We use a double opt-in: after you sign up we send an email containing a confirmation link, and you are only added to the list once you click it. Without that click you receive no newsletter.
• The page you signed up from (for example /luteale-fase), so that we know which articles resonate with people. We keep only the path, no full URL, no search query and no referring website.
• The literal text you agreed to, and its version. That text may change later; your consent is assessed against the text as it stood at that moment.
• Delivery status and technical delivery metadata for the emails we send you, as in section 3.8.

To prevent misuse of the form, we temporarily count how many sign-ups are made from the same IP address and for the same email address. For this we store no IP addresses, but an encrypted derivative that cannot be traced back to the original address. Those counters expire within an hour and are deleted afterwards.

What we expressly do not do: we do not link your newsletter sign-up to health data, we do not infer any health characteristics from your sign-up, and we place no advertising or retargeting pixels on the website. If you sign up from a page about PMDD, that means nothing more to us than that you read that article.

If you also use the App with the same email address, you receive the newsletter once. If you unsubscribe in one place, that applies to both.

3.10 Messages in the App

Under Messages in the App, we can send you messages. There are five kinds:

• Service messages: an outage, a security problem, a required update, or a change to this policy or to the terms. You always receive these.
• Account messages: a reply to your own request, for example a GDPR request, an export or a support question. You always receive these.
• News about the app: new features and explanations of what is already in the App. On by default; you can turn it off under Settings → Messages or at the bottom of every news message.
• Community and research: for example a survey or a call for participants. Off by default; you only receive these if you turn them on yourself.
• Offers: PMDD Tracker's own paid offerings, such as a course. On by default; you can turn it off under Settings → Messages or with one tap at the bottom of every offer.

The first time you open Messages, you see these choices and can change them straight away.

What we process for this:

• Per message: the kind, the language, the text as we sent it, and when the message was delivered, read and archived.
• Your choices per kind, and when you first saw them. If you change your choice for offers or for community and research, we record what you chose and when. That is our proof of your choice.

To decide who receives a message, we use only data from sections 3.1 and 3.6: platform, app version, language, country, how long you have had an account, when you last used the App, whether you completed the introduction and whether you want email updates. Never your health data, not even your cycle. The people at PMDD Tracker who write messages only see how many people will receive a message, not names or email addresses. An account message goes to one person; we record the reason for it.

By email too. A message we send once to a group can also go to your email address. You only get that email if you also get the message in the App, and:

• for service and account messages: if your email address is confirmed;
• for news about the app: if you have turned on email updates;
• for community and research, and for offers: if you have separately turned on email for that kind under Settings → Messages. This is off by default, even if offers are on in the App.

An email with news, community or an offer has an unsubscribe link for that kind at the bottom. For each email we keep which message it was, the language, whether it was sent, failed or skipped, and the delivery ID from our email service (section 3.8). We do not store your address or the text there a second time: they are already with your account and with the message. Just before sending, we check again whether you still want the email; if you turned it off in the meantime, it does not go out. If you change any of these email choices, in the App or with the unsubscribe link, we record what you chose and when.

Messages contain no medical statements about you. In the usage analytics (section 3.7a), the App counts that a message was opened, that its button was used or that a kind was turned off, with only the kind and which message it was, not the text.

3.11 Your device's push address and push notifications

If you are signed in and have allowed notifications for the App, we store your device's push address: a code that lets a notification reach exactly this device. With it we store whether it is an Android phone or an iPhone, whether your version of the App can open a notification, and when the address was last refreshed. No device model and no advertising ID.

With that address we can send you a push notification when a new message is waiting for you in the App (section 3.10). We decide per message whether it comes with a notification. The notification only says that there is a new message, in your language; you only see what it says in the App. You get at most one notification a day, none between 9 pm and 9 am in your time zone, and none if you have already read the message. A message about a new version you have just installed never comes with a notification.

In Settings → Messages you choose what you want a notification for:

• Important messages (service and account messages): on; you can turn it off.
• News about the app, community and research, and offers: off. You only get a notification if you turn that kind on yourself, and only if you also receive that kind in the App. So we only send a notification about an offer if you have separately said yes to that.

If you change one of these choices, we record what you chose and when. For each notification we store which message it was for, the language, whether it was sent, postponed or skipped, to how many devices, and whether you opened the message from the notification. We do not store the text of the message there a second time. Just before sending, we check again whether you still want the notification.

• Android: the address comes from Google's Firebase Cloud Messaging, and Google delivers the notification. This is the only Firebase service we use: no Firebase Analytics and no other Firebase services.
• iPhone: the address comes directly from Apple, and Apple delivers the notification (Apple Push Notification service), without Google. Apple may use data about the use of this service to improve its own services; Apple does not look at the content of a notification.

For each notification, Google and Apple only receive the push address and the neutral text: nothing about your health and nothing from the message. The App does not ask for separate permission for the push address: you turn notifications on or off entirely in your device's settings. The address is deleted when you sign out or turn off notifications for the App, when Google or Apple reports that it no longer works, when it has not been refreshed for 90 days, and when you delete your account.

4. Legal basis for processing

We process your data on the basis of:

• Consent (Article 6(1)(a) GDPR): you actively give consent when you register and — separately from that — when you sign up for the newsletter. For the newsletter, that consent consists of submitting the sign-up form followed by the confirmation click in the email; you can withdraw it at any time using the unsubscribe link. We also send messages about community and research and offers in the App (section 3.10) on the basis of consent. Offers are on by default; you can turn them off under Settings → Messages or at the bottom of every offer. We only send community and research and offers by email if you separately say yes to that; this is off by default. Push notifications for news, community and research, and offers (section 3.11) are only sent if you turn that kind on yourself; they are off by default
• Performance of the contract (Article 6(1)(b) GDPR): necessary to make the App work. This also covers service and account messages in the App, your device's push address, and push notifications for service and account messages (sections 3.10 and 3.11). Service and account messages by email fall under this too
• Legitimate interest (Article 6(1)(f) GDPR): temporarily counting sign-up attempts in order to prevent misuse of the sign-up form (section 3.9), whereby no IP addresses are retained; and messages with news about the App (section 3.10), which you can turn off at any time
• Special categories of personal data (Article 9(2)(a) GDPR): health data is processed on the basis of your explicit consent

5. Where is your data stored?

5.1 Local storage (primary)

The App is offline-first. All data is stored primarily on your own device in an encrypted local database (Hive). You can keep using the App without an internet connection.

5.2 Cloud synchronisation (with an account)

An account is required to use the App. When you are online, the App syncs your data encrypted to the cloud so you can use it on more than one device. Your data is stored on:

• Platform: Supabase (PostgreSQL database)
• Hosting: Amazon Web Services (AWS), region eu-west-2 (London, United Kingdom)
• Location: United Kingdom

The connection to the server is encrypted using TLS 1.3. In addition, the App encrypts your symptom scores and notes on your own device using AES-256 before they are sent, so they are also stored encrypted at Supabase. Data is stored with Row Level Security (RLS), which means that no other user can reach your data or your key.

The key used for that encryption is tied to your account and is held within your account. This is necessary so that you can read your data on a second device. It also means that this is not end-to-end encryption: because we hold the key, we could technically access your data. We do not do so, and access is limited as described in §6, but we state it explicitly because "end-to-end" promises something stronger than what we deliver.

What does storage in the United Kingdom mean? Since Brexit, the UK has been outside the European Union. However, the European Commission has established that the UK protects personal data just as well as the EU itself does. That decision, an adequacy decision under Article 45 GDPR, was renewed on 19 December 2025 and applies until 27 December 2031. Your data therefore enjoys the same level of protection as it would if it were stored inside the EU, and you keep the same rights (see §9). No additional consent from you is required for this storage.

Earlier versions of this policy stated that the data was stored in Frankfurt (Germany). That was incorrect: the database has been located in London since the project was created. We corrected this as soon as it was established. No data has been moved, and nothing has changed about who has access to your data.

Earlier versions also stated that synchronisation was "end-to-end encrypted using TLS 1.3". That wording was wrong in two ways: TLS protects the connection rather than the stored data, and "end-to-end" means that the provider itself cannot access the data, which is not the case here, because we hold the key so that your data is available on more than one device. The security itself has not changed; only the description is now accurate.

6. Security

We take the following measures to protect your data:

• Encryption in transit: TLS 1.3 for all communication with servers
• Encryption on your device: your symptom scores and notes are encrypted with AES-256 on your own device before being sent, so that they are stored encrypted at the hosting provider as well. See §5.2 for what this does and does not mean
• Encryption at rest: AES-256 for database storage at Supabase
• Access control: Row Level Security (RLS), every user sees only their own data
• Optional app lock: Face ID / Touch ID / fingerprint / PIN
• No debug logging in production: sensitive data is not logged
• Secure authentication: JWT tokens with a short lifetime, OAuth 2.0 for social login (Apple/Google)

7. Retention period

• Active account: Your data is kept for as long as your account is active
• After account deletion: All personal data is permanently deleted within 30 days
• Audit trail: An anonymised log of the deletion (containing no personal data) is kept for GDPR compliance
• Messages in the App: news, community and offer messages are deleted 18 months after they were read, archived or expired. Service and account messages remain for as long as your account exists, as a record of what we told you
• Delivery data for messages by email and for push notifications: deleted after 18 months
• Push address: deleted when you sign out, when you turn off notifications, when Google or Apple reports that it no longer works, or after 90 days without a refresh. If we send no push notifications within twelve months of the first registration, we delete all push addresses
• After unsubscribing from the newsletter: we keep your email address marked as "unsubscribed", so that we do not accidentally write to you again. If you want that record gone as well, we delete it on request (section 9)

8. Research data donation

Status as of 29 September 2026: this feature is paused. The App is not sending any research data at the moment. Nothing is sent for participants who gave permission earlier either: their consent remains on record but is not used. New participation is not possible. What follows describes the feature as it worked and as it would work again if we reopen it; we will not do so without asking for consent again. Rows already donated can still be deleted on request via privacy@pmddtracker.nl (§8.5).

8.1 Purpose

The App gives you the option to contribute symptom data to scientific research into PMDD. The aim is to help researchers understand PMDD better, which can lead to better care.

8.2 Your choice

Taking part is entirely voluntary and is off by default. You can give or withdraw your consent at any time via Settings → Contribute to research. Not taking part has no effect whatsoever on how the App works.

The legal basis is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

8.3 What is shared

Before any data is sent, identifying details are stripped on your own device. That means:

• Your account ID, name and email address are not included
• Notes, medication names, crisis contacts and the contents of your Support plan are omitted entirely

What is sent, and stored in a shielded schema:

• Numerical symptom scores (1-6) and interference items
• Cycle events, cycle sequence number and relative cycle day
• The calendar date of each entry
• A stable donor identifier (a random code, not your account ID). That code is also stored on your profile, so that we can keep rows from the same donor together without using your name. The dataset is therefore pseudonymous, not anonymous: we can link a row back to your account if asked
• An age group, derived from the year of birth you give when you join
• The App version number

This is special-category personal data (health data) under Art. 9 GDPR. It remains within the GDPR. The earlier reference to Recital 26 in version 1.10 and before was wrong: it described the original design, not what landed in production.

Correction, 3 September 2026. Up to and including version 1.10, this section stated that exact dates are converted into relative cycle days and that the data falls outside the GDPR once sent. That did not match the production dataset. This version describes what the App actually transmits.

8.4 Where research data is stored

Pseudonymous research data is held in a separate, shielded database schema within our Supabase infrastructure in London. That schema cannot be reached through the regular API and is accessible only through secured server functions.

8.5 Withdrawing consent

You can withdraw your consent at any time. No new data is shared after that. Withdrawing in the App stops new donations; it does not automatically erase what has already been sent.

Rows already donated can be deleted on request, as long as your account still exists. Write to privacy@pmddtracker.nl. This is possible because the donor identifier lives in your profile; it is the only thing connecting your donated rows to you. The rows themselves contain no account ID.

So if you want your donated rows gone, have them deleted first and your account after that. Deleting your account erases your profile and with it that donor identifier. The donated rows remain, but we no longer hold a key to attribute them to you; a request made after that is one we cannot carry out, even if we wanted to.

Correction 29 September 2026. Up to and including version 1.17, this section and §9.3 stated that donated rows could also be deleted on request after you had deleted your account. That was incorrect: the key needed for it is destroyed by that same deletion. The App showed the same incorrect promise in the confirmation after an account was deleted; that text has been changed.

8.6 Recording your consent

When you give or withdraw consent, we record when that happened and which version of the consent text applied. This is necessary to be able to demonstrate that the consent was valid, and it is the only place in this part of the App where your account ID is used.

On 3 September 2026 the controller decided not to ask existing participants for consent again for this correction. The legal basis remains the consent you already gave; what changes is the description of what that consent covers. New participants see this text before they agree.

9. Your rights

Under the GDPR you have the following rights:

9.1 Right of access (Article 15 GDPR)

You can request which data we process about you.

9.2 Right to rectification (Article 16 GDPR)

You can have incorrect data corrected.

9.3 Right to erasure (Article 17 GDPR)

You can delete your account and all associated data. You can do this directly in the App via Settings → Account → Delete account.

Donated research rows live in a separate schema and are not removed automatically. If you want those deleted too, do so before you delete your account, via privacy@pmddtracker.nl (see §8.5). After the account deletion, the connection between you and those rows is destroyed: what remains is data with no key to you, and we can no longer point it out.

9.4 Right to data portability (Article 20 GDPR)

You can export all of your data as a PDF report or as a JSON file. This is available via Settings → Data. The JSON file is not encrypted: it can be read by anyone who can open it. The App points this out to you before you export, so that you can decide for yourself where to keep it.

You can also restore a JSON export you made earlier back into the App, via Settings → Data → Restore data. You first see what is going to be restored and confirm it yourself; only then does anything change. Your consents are never restored from a file, you always give those again yourself. Restoring happens on your own initiative; we have no access to the file.

Before restoring, the App records your current data so that you can undo the action. That snapshot stays in the App's encrypted storage for seven days and is then deleted automatically.

9.5 Right to restriction of processing (Article 18 GDPR)

You can request that the processing of your data be restricted.

9.6 Right to withdraw consent

You can withdraw your consent for data processing at any time by deleting your account. You can turn off messages about community and research and offers in the App under Settings → Messages or at the bottom of the message itself.

9.7 Right to lodge a complaint

You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP):

• Website: https://autoriteitpersoonsgegevens.nl
• Telephone: 088-1805250

10. Sharing with third parties

We do not share your data with third parties, with the exception of:

10.1 Processors and third parties

Party	Role	Service	Location	Purpose
Supabase Inc.	Processor	Database & authentication	United Kingdom (London), covered by an EU adequacy decision	Cloud synchronisation and account management
Resend (Plus Five Five, Inc.)	Processor	Email delivery	United States, with EU Standard Contractual Clauses	Newsletter, service emails and messages by email (section 3.10)
PostHog Inc.	Processor	Product analytics	EU (Frankfurt)	Limited usage analytics without health content (opt-out)
Functional Software, Inc. (Sentry)	Processor	Crash reporting	EU	Stability and error diagnostics
Google LLC (Firebase Cloud Messaging)	Processor	Push address and push notifications, Android only	United States, with the EU-US Data Privacy Framework or EU Standard Contractual Clauses	Your device's push address and delivery of push notifications (section 3.11)
Apple Inc. (Apple Push Notification service)	Processor for delivery; independent controller for its own usage data about the service	Push address and push notifications, iPhone only	US (with EU Standard Contractual Clauses)	Your device's push address and delivery of push notifications (section 3.11)
Apple Inc.	Independent controller	Sign in with Apple	US (with EU Standard Contractual Clauses)	Optional authentication via Apple ID
Google LLC	Independent controller	Google Sign-In	US (with EU Standard Contractual Clauses)	Optional authentication via a Google account

Note on Apple/Google: if you use Apple Sign In or Google Sign-In, Apple and Google respectively act as an independent controller for the authentication on their own platform. We receive only a one-time authentication token and your email address. Apple and Google have no access to your health data in the App.

10.2 Sharing initiated by you

• PDF export: You can generate reports yourself and share them with your healthcare provider. This happens solely on your own initiative.
• Year overview card: You can share an image of a look-back card. The image is not encrypted. This happens solely on your own initiative, after a warning in the App.

11. Cookies and tracking

11.1 In the App

The App uses no cookies, tracking pixels or advertising trackers. Limited usage analytics and crash reporting work as described in §3.7a (opt-out for usage analytics; no health content in events).

11.2 On the website (pmddtracker.nl)

The website pmddtracker.nl does not use Vercel Web Analytics or comparable website trackers. Visitor statistics are not collected via an analytics SDK.

The newsletter sign-up form is not a tracker: it processes only what you fill in yourself, at the moment you press Sign up (section 3.9). If you visit the website without signing up, we process nothing about you.

12. Children

The App is not intended for children under the age of 16. We do not knowingly collect data from children. If we discover that we have collected data from a child, we will delete it immediately.

13. Changes to this policy

We may update this privacy policy from time to time. In the event of substantial changes, we will inform you through the App. The latest version is always available at https://pmddtracker.nl/privacy.

14. Contact

For questions about this privacy policy, or to exercise your rights:

FemTech Solutions B.V. (product: PMDD Tracker)

Email: privacy@pmddtracker.nl
Website: https://pmddtracker.nl

15. Status of this document

This English text has been established internally and is not the result of an external legal review. That is a conscious decision by the controller, taken on 29 July 2026: the English text is a translation of a Dutch policy that was itself reviewed, it adds no new processing activities, and the facts in it have been verified against the underlying registers. What has not been assessed by an English-qualified lawyer is the wording. The risk that follows is limited but real: a term may carry a different legal weight in English than the Dutch equivalent does. This is why the clause stating that the Dutch version prevails is not a formality but the actual safeguard.

Where the English and Dutch texts differ, the Dutch version prevails.

Last updated: 10 October 2026