Privacy Policy
EvePhase processes intimate health information — your cycle, your symptoms, your treatment. This policy exists so that what happens to that data isn't a mystery. We've kept the language plain and, where we can, we've told you exactly which pieces of information travel where.
On this page
1. Who we are
This policy applies to the EvePhase mobile application and the marketing website at evephase.com. In this document, "EvePhase", "we", and "us" refer to the operator of that app and website. When you use EvePhase we act as the data controller of the personal information you provide.
For any question, request, or complaint about how your data is handled, write to privacy@evephase.com. We aim to respond within 7 days, and always within the statutory 30 days.
2. What we collect
We collect the information you share with us when you set up an account and the information you enter as you use the app. Nothing more. If a feature doesn't need a piece of information to work, we don't ask for it and we don't collect it.
Alongside what you provide, the app records the minimum technical information needed to operate reliably — things like a device identifier so we can deliver notifications, a timezone so reminders arrive at the right hour, and short-lived security records that keep your account safe. We do not collect any advertising identifier, we do not read your location, and we do not access anything on your device beyond what the app itself is built to handle.
Payment details are never seen by us. When you subscribe, all card and billing information is handled entirely by Apple's App Store or Google Play under their own terms. We only receive confirmation that you have an active subscription and when it renews or ends.
3. Why we collect it
We use your information solely to run the app for you — showing your data back to you, generating the insights you request, and running any features you switch on. We also use it to keep your account secure and to send you the transactional emails the service depends on, such as verification and password reset.
We do not use your data to profile you for advertising. We do not sell it. We do not share it with data brokers. We do not use it to train AI models. The only purposes are the ones above and legal obligations we cannot lawfully refuse.
4. Lawful basis (UK & EU users)
For users in the UK and EU, we process your information under the UK GDPR and EU GDPR on these lawful bases: to perform the contract you enter into when you use the app; with your explicit consent for any sensitive information you choose to log; where necessary for the security and integrity of the service; and where we are legally required to do so. You can withdraw your consent at any time by removing the information in question, ending Partner sharing, or deleting your account.
5. Who we share data with
To operate EvePhase we rely on a small number of trusted service providers — for example the providers that host the service, deliver transactional emails, and power the AI-generated insights. Each of them is contractually bound to process your data only on our instructions and only for the specific purpose we've engaged them for. Each is required to implement appropriate security measures and to notify us promptly of any incident.
We do not share your data with anyone else. Not with advertisers. Not with data brokers. Not for any purpose outside the operation of the service. The only exception is a Partner you have specifically invited under Partner mode — and even then, they see only what you have chosen to share, and you can revoke their access at any time.
A current list of the specific service providers is available on request via privacy@evephase.com.
6. How long we keep it
We keep your information for as long as your account is active and only as long as we need it to provide the service. When you delete your account, or ask us to delete your data, we remove it from our active systems in a reasonable timeframe. Where the law requires us to retain a limited record — for example for tax or fraud prevention — we keep only what the law requires, and nothing more.
7. Your rights
Regardless of where you live, you have the following rights over your data:
- Access — request a copy of everything we hold about you.
- Correction — fix anything inaccurate.
- Deletion — ask us to delete your account and all associated data.
- Portability — receive your data in a machine-readable format so you can move it elsewhere.
- Restriction — ask us to stop processing while a dispute is resolved.
- Objection — object to any processing based on legitimate interests.
- Withdraw consent — remove your health data consent at any time, in-app or by request.
To exercise any right, email privacy@evephase.com. We verify identity by confirming control of the account's registered email address. You always have the right to lodge a complaint with a supervisory authority (in the UK: the Information Commissioner's Office).
8. How we protect it
We protect your information with industry-standard technical and organisational measures — encryption in transit and at rest, strict access controls, and a range of safeguards against abuse. Only authorised personnel can access the systems where your data is held, and only for the purposes described in this policy.
No system is completely immune to risk. If we ever become aware of a security incident affecting your data, we will notify you and the appropriate authorities without undue delay, in line with our legal obligations.
9. Children & age minimum
EvePhase is intended for adults dealing with perimenopause or menopause. The service is not directed at anyone under 18, and we do not knowingly collect data from users under 18. If you believe a child has provided us data, contact privacy@evephase.com and we will delete it promptly.
10. International transfers
Some of our sub-processors are located outside your country of residence, principally in the United States. Where data is transferred out of the UK or EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner, together with supplementary technical measures (encryption in transit, encryption at rest, and access controls) to protect the transfer.
11. AI-generated insights
Some features rely on AI to help interpret trends in the information you log. When you request an insight, we send only the minimum information needed for that specific request to our AI insights provider — never anything that identifies you personally. Under our contract with the provider, the information we send is not used to train their models. Insights we generate for you are kept in your account so you can revisit them.
12. Changes to this policy
When we change this policy in a material way — that is, when the categories of data we collect, the purposes we use it for, or the sub-processors we share it with change — we will notify you inside the app and by email, at least 14 days before the change takes effect. Non-material clarifications may be published without notice; the effective date at the top of this page will reflect any change.
13. Contact us
Any privacy question, request, or concern:
- Email: privacy@evephase.com