Ask Nomi Privacy Policy

Quick Summary

1. Your Consent

By using Ask Nomi, you agree to this Privacy Policy.

When you provide health data, you explicitly consent to us processing:

• Menstrual cycle and reproductive health data
• Symptoms, health conditions, wellness information
• Data from connected devices (HealthKit, Health Connect)

You can withdraw consent anytime. You can turn off AI data sharing in the app's Settings to stop future personal-data transfers to cloud Nomi AI. You can also delete your data or account.

2. Not Medical Advice

• We provide tracking and information tools only
• We do NOT diagnose, treat, or provide medical recommendations
• AI responses may be inaccurate - always verify with healthcare providers
• No doctor-patient relationship is created
• If emergency, call 911 immediately

You assume all risks of using health tracking tools. We are not liable for health outcomes, medical decisions, or delayed diagnoses based on our Services.

3. What We Collect

You Provide

Account Info:

• Name, email, phone number (when you provide it), age, location, preferences
• Class interests, bookings, attendance, cancellations, and program preferences
• Purchase status, subscription status, class-credit balances, grants, redemptions, and expiration dates

Payment Information:

• Apple or Stripe processes your payment details. Ask Nomi receives transaction identifiers, product details, payment status, and subscription dates needed to provide and manage your purchase.
• We do not store your full payment-card number.

Health Data (with your consent):

• Menstrual cycles: dates, flow, symptoms
• Reproductive health: fertility, pregnancy, contraception
• Physical metrics: weight, temperature, activity
• Lifestyle: sleep, stress, exercise
• Medical info: conditions, medications (optional)
• Journal entries and notes

Cloud Nomi AI Data:

• Your chat messages
• Relevant context from information you previously provided, which may include symptoms, cycle information, care-profile and onboarding answers, check-in responses, and recent logs
• We collect this information directly from what you enter during onboarding, tracking, check-ins, and chat

Device Integrations (optional):

• Apple HealthKit, Google Health Connect, wearables
• One-way import only - we don't send data back

We Collect Automatically

Technical Data:

• Device type, browser, IP address (approximate location only)
• App usage, pages visited, features used
• Performance data, error logs

We do NOT collect:

• Precise GPS location
• Your contacts or other apps
• Government IDs or financial accounts

4. How We Use Your Data

Primary uses:

• Provide services (tracking, predictions, AI insights)
• Personalize your experience
• Process purchases, grant and redeem class credits, manage subscriptions, and book or cancel classes
• Improve products (using anonymized data)
• Send service updates and support
• With your express consent, send class reminders and promotional text messages. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help.

Cloud Nomi AI: When you use cloud Nomi AI, we use your message and relevant context only to generate the requested response or AI-powered insight and to operate related safety and security controls.

We do NOT:

• Use health data for advertising
• Sell your data
• Share with employers or insurers
• Make automated decisions affecting your legal rights

Legal bases (GDPR):

• Contract - providing services you requested
• Consent - processing health data
• Legitimate interest - security, product improvement
• Legal obligation - complying with laws

5. How We Share Data

We do NOT:

• Sell your data
• Share health data for advertising
• Give data to employers, insurers, or data brokers

We share with:

Service Providers (under strict contracts):

• Supabase (database), Vercel (hosting), AWS (infrastructure)
• Amazon Bedrock (cloud AI processing - no training on your data)
• Apple, Stripe, and RevenueCat for purchases, subscription status, receipts, and class-credit access
• Email and text-message delivery providers, including Twilio, only to deliver communications you requested or consented to receive
• Analytics providers (anonymized only)

Cloud Nomi AI

When you choose to use cloud Nomi AI and give permission in the app, Ask Nomi sends your chat message and the relevant context needed to answer it to Amazon Web Services through Amazon Bedrock. Relevant context may include symptoms, cycle information, care-profile and onboarding answers, check-in responses, and recent logs that you previously provided in the app.

Before cloud Nomi AI uses this personal information, the app explains the data sharing and asks for your permission. You can decline permission or turn off AI data sharing in Settings. After you withdraw permission, Ask Nomi blocks future transmission of your personal information to cloud Nomi AI.

Amazon Bedrock processes this information only to provide the requested AI response and does not use it to train foundation models. Ask Nomi has a Business Associate Agreement with AWS, and AWS is contractually required to provide privacy and security protections that are the same as or equal to those described in this Privacy Policy and required by applicable law.

Cloud hosting and processing providers

Ask Nomi uses Amazon Web Services (AWS) to securely host, store, and process information collected through the app. The information processed through AWS may include account information, health and wellness information you provide, symptom and cycle tracking data, onboarding and check-in responses, app usage information, and related technical information needed to operate and secure the app.

We use this information to create and manage user accounts, provide symptom tracking and personalized app features, operate and improve the app, maintain security, and support our services.

Ask Nomi has entered into a Business Associate Agreement with AWS. AWS is required to provide privacy and security protections that are the same as or equal to the protections described in this Privacy Policy and required by applicable law.

Ask Nomi does not sell personal health information.

Legal Requirements:

• Valid court orders or subpoenas only
• We review all requests, challenge overbroad ones
• We notify you when legally permitted

With Your Consent:

• Healthcare providers you authorize
• Research studies you opt into

6. Your Rights

All users can:

• Access - Get copy of your data
• Correct - Fix inaccurate information
• Delete - Remove your data (account deletion)
• Export - Download data in portable format
• Withdraw consent - Stop processing anytime

State-specific rights:

• California (CCPA): Right to know, delete, correct, opt-out of sale (we don't sell)
• Washington, Nevada, Colorado, etc.: Similar privacy rights

How to exercise:

• Email: hello@asknomi.ai
• Subject: "Privacy Request - [Your Right] - [Your State]"
• Response: 30-45 days

No discrimination for exercising your rights.

7. Data Security

Your responsibility:

• Use strong passwords, enable 2FA
• Don't share credentials
• Report suspicious activity to hello@asknomi.ai

8. Data Retention

While account active: We keep all your data

After deletion:

• Data deleted from production within 30 days
• Backups purged within 90 days
• Some anonymized data retained for analytics

Inactive accounts:

• After 3 years, we may delete (with 30-day notice)

Cannot be recovered after deletion is complete.

9. Children's Privacy

18+ ONLY. We do not knowingly collect data from anyone under 18.

If we discover an underage account:

• Immediate deletion within 24-48 hours
• All data permanently removed

Report underage users: hello@asknomi.ai with subject "Underage User Report"

10. Your Reproductive Health Privacy

Our pledge:

1. No voluntary law enforcement sharing - only with valid legal process
2. We review all requests, challenge overbroad ones, notify you first
3. Data minimization - less data = less to disclose
4. You control your data - delete anytime, unrecoverable
5. Transparency reports - we'll publish data on legal requests

11. International Transfers

Your data may be processed in the United States.

Primary locations:

• US (primary servers)
• Service providers may process globally

12. Changes

We may update this Policy.

Material changes:

• 30-day email notice before changes take effect
• Continued use = acceptance

If you disagree:

• Delete your account before changes take effect

13. Contact

Key Definitions

Personal Data

Info that identifies you

Special Category Data

Sensitive health info (GDPR)

Consumer Health Data

Health-related info (state laws)

Anonymization

Removing identifiers so data can't be linked to you