CONSUMER HEALTH DATA PRIVACY POLICY (UNITED STATES)

Effective date: 2026-08-10

This policy is written and published in English. Translations into other languages are provided for your convenience; where a translation differs from this English text, the English version governs.

This is a standalone Consumer Health Data Privacy Policy as required by the Washington My Health My Data Act. It applies to residents of Washington State (My Health My Data Act, RCW 19.373), Nevada (SB 370), and any U.S. consumer whose consumer health data Luna processes. It is provided in addition to, and prevails over, our general Privacy Notice with respect to consumer health data.

1. WHO WE ARE

icoso consulting S.L. ("Luna", "we", "us"), Calle Juan de Herrera 18, 39002 Santander (Cantabria), Spain (EU), operates the Luna menstrual-cycle and reproductive-wellness app.

Privacy contact: privacy@icoso.es · Data Protection Officer: Daniel Osorio Fernandez.

Luna is a wellness application. It is not a HIPAA covered entity, not a HIPAA business associate, and not an FDA-regulated medical device.

2. WHAT "CONSUMER HEALTH DATA" MEANS HERE

Under the My Health My Data Act, consumer health data is personal information that identifies a consumer's past, present, or future physical or mental health status — expressly including data related to reproductive and sexual health and menstruation. Because Luna is a cycle-tracking app, much of the data you choose to enter is consumer health data, and we treat it as such.

3. CATEGORIES OF CONSUMER HEALTH DATA WE COLLECT

Only data you choose to provide or explicitly enable:

Cycle and reproductive data: period dates, cycle length, bleeding intensity, predicted and estimated phases, ovulation estimates, contraception method, pregnancy and lifecycle state.

Symptoms, moods, basal body temperature, journal entries.

Self-reported health profile: hormone lab values, self-reported conditions, medications, diet, allergies, body measurements.

Imported device health signals, only if you enable Apple HealthKit or Google Health Connect: sleep duration, resting heart rate, body temperature, heart-rate variability, activity and workout minutes, steps — stored as encrypted 7-day summaries.

Messages you write to Sofía in the AI chat, only if you use it: they may contain health information you choose to write.

4. ENCRYPTION BY DESIGN, AND WHAT IT MEANS FOR US

The records above are encrypted on your device (AES-256-GCM) before they are stored on our servers. We store them only as ciphertext. Exceptions are a few details currently stored in readable form for reminders, syncing and administration: for medications, the type (contraceptive or other), pack size, pause days, pack start date, intake schedule, the first reminder time and the reminder settings (on/off, snooze, refill alert); for each intake, its status (taken, skipped, late) with date and time; in your profile, whether the contraception questions have been answered and when medical notices were confirmed; and the dates of journal entries and hormone tests, the status of your consents and the times at which records are created, changed or deleted. These details, together with the number, timing and size of encrypted records, allow some inferences about your health. AI coaching requests (section 6) are a further exception: they are processed in readable form and not stored. Whether that ciphertext is readable to us depends on your privacy mode:

Maximum Privacy — the default for U.S. users. The key that decrypts your data is protected by your password (or signed-in device) and, as a fallback, by a Recovery Key that only you hold. We hold no copy of it that we can open; on our servers it is stored only in this encrypted form. We cannot decrypt your stored consumer health data — not for ourselves, and not for anyone who demands it from us.

Standard mode, if you choose to opt out of Maximum Privacy. Luna additionally keeps an encrypted recovery copy of your key, so that we can restore your access if you are ever locked out of your account. That recovery path means we are technically able to decrypt your data. We use it solely to restore your own access to your account, and never to read your data.

5. SOURCES OF CONSUMER HEALTH DATA

Directly from you — data you enter in the app.

From your device's health platform (Apple HealthKit / Google Health Connect), only after you grant OS-level permission, which you can revoke at any time in your device settings.

We do not buy consumer health data, and we do not obtain it from data brokers or third-party advertising sources.

6. HOW WE USE CONSUMER HEALTH DATA

To provide the core service you requested: cycle tracking, deterministic predictions, insights, reminders.

Only with your explicit opt-in: AI nutrition and lifestyle coaching ("Sofía"). For this, selected health and profile information is sent — categories, summarised values and individual measurements such as hormone values, with relative time information that can point to a calendar day — but not your account name, email address or user ID, and no journal text or brand or drug names from your entries. If you chat with Sofía, your message and up to five previous messages, including Sofía's earlier replies, are also sent as free text; a filter on our servers replaces certain detected email addresses, phone numbers and IBANs in your own messages, and very long messages are shortened, but anything else you type, including names or health details, is sent as written. Processing occurs within the EU (AWS Bedrock with Anthropic's Claude models); requests pass through our servers without being stored, and your chat history stays encrypted on your device.

We do not use consumer health data for advertising, for profiling for advertising, or to infer characteristics for marketing.

7. SHARING OF CONSUMER HEALTH DATA

We do not share your consumer health data with third parties for their own purposes. We do not disclose it for advertising or sale.

Consumer health data is stored only as ciphertext with our infrastructure provider Hetzner Online GmbH (hosting and database, EU / Finland), which can access stored records only as ciphertext, apart from the reminder and sync details listed in section 4, and cannot read that ciphertext. Our servers at Hetzner also forward AI coaching requests in readable form without storing them.

Processor that receives readable consumer health data, only if you opt in to the AI coaching: AWS (Amazon Bedrock with Anthropic's Claude models, EU), for selected health information and your chat messages as described in section 6, under contractual instructions. Service providers that process non-health, pseudonymous or non-identifying data, or only encrypted records (full list in our Subprocessors List): OpenAI (search terms only), RevenueCat (pseudonymous subscription identifier), Apple and Google (payment), Scaleway (email and encrypted backups, EU), Sentry (crash diagnostics, EU; personal content is largely removed from crash reports before sending). Apart from such residual crash-report content, none of these receive readable consumer health data.

We may disclose data only where legally compelled by valid legal process. What we are able to produce depends on your privacy mode (see section 4): for Maximum Privacy accounts — the default in the U.S. — we can produce only ciphertext that we are unable to decrypt, together with the reminder and sync details listed in section 4, which are stored in readable form. For Standard accounts, the recovery path described in section 4 means decryption is technically possible, and we would produce readable data only where a valid legal process leaves us no lawful alternative.

8. WE DO NOT SELL CONSUMER HEALTH DATA

Luna does not "sell" consumer health data as defined by the My Health My Data Act, and we therefore do not seek the valid authorization that a sale would require. We will not sell consumer health data.

9. YOUR RIGHTS

Regardless of where you live in the U.S., if we hold your consumer health data you may confirm and access the consumer health data we process about you; withdraw your consent to our collection and processing; and delete your consumer health data, including a request that we direct our processors to delete it.

How to exercise: in the app via My space → Data → Download My Data (access and export) and Settings → Account → Delete account permanently (immediate deletion), or by emailing privacy@icoso.es. You can withdraw the health-data collection consent at any time in Settings without deleting your account.

We will honor a deletion request across active systems immediately; encrypted backup copies are purged within the daily backup cycle, within 7 days.

Timeline: we respond within 45 days, extendable once by 45 days where reasonably necessary, with notice.

Appeal: if we decline a request, you may appeal by replying to our decision. If your appeal is denied, you may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint.

No discrimination: we will not deny service, charge a different price, or degrade your experience because you exercised these rights.

10. NO GEOFENCING

Luna does not use any geofence around any healthcare facility to identify or track consumers, to collect data from them, or to send them notifications based on their proximity to such a facility.

11. SECURITY

Health data is encrypted on your device (AES-256-GCM) before upload — in both privacy modes. Our servers store your health records as ciphertext; the exceptions are the reminder and sync details listed in section 4 and the AI coaching requests described in section 6. What differs is where the key lives: in Maximum Privacy mode, the default in the U.S., we hold no copy of it that we can open (on our servers it is stored only in encrypted form that just your password or signed-in device, or your Recovery Key, can unlock), and we cannot decrypt your data. In Standard mode we additionally hold an encrypted recovery copy of your key, which makes decryption technically possible for us; we use it solely to restore your own access to your account (see section 4). TLS 1.3 in transit, EU hosting, least-privilege access, no public database port, and a logged deletion procedure for restored backups. Full measures are described in our technical and organizational measures record.

12. CHANGES

We will post any update here with a new effective date and, for material changes affecting consumer health data, seek renewed consent where required.