Privacy policy

Scope and who we are

This Privacy Policy applies to the Cyster mobile application, this website, and related support interactions (together, the “Services”). In this policy,“Cyster,” “we,” “us,” and “our” refer to the operator of the Cyster Services.

Cyster is designed for adults living with or learning about polycystic ovary syndrome (PCOS). The Services combine device-local wellbeing tracking with optional connected health, artificial-intelligence, analytics, and support features.

Information we handle

The information involved depends on the features you choose to use.

Photos, camera, and photo library

If you choose a meal-photo or care-conversation feature, Cyster accesses only the photo you capture or select for that action. The selected image and any note you add are sent for analysis or included in your care conversation. Cyster does not scan your entire photo library.

Voice and speech recognition

If you use voice input, your device’s speech-recognition capabilities convert your spoken words into text. You can review or edit that text before sending it. Apple, Google, or another platform provider may process audio under its own settings and privacy terms.

Product analytics and technical information

Cyster uses PostHog to receive anonymous or pseudonymous product events such as app launches, named screen views, navigation choices, onboarding completion, subscription status, and feature interactions. The current configuration disables session replay, surveys, person profiles, automatic error capture, push-notification tracking, and feature-flag polling. Analytics events are designed not to contain profile values, health selections, journal or chat text, or photos.

When you intentionally send feedback, your rating and written comment may be included in the feedback event so our team can review it. Our backend also records limited operational information such as request method, route, status, duration, and request identifier; the current backend is configured not to log chat bodies, meal photos, tool context, or model output.

Website information

This website does not currently use advertising trackers, analytics cookies, or contact forms. If you email us, we receive your email address, message, and any information you choose to include.

How we use information

We use information as reasonably necessary to:

• provide personalized dashboards, goals, reminders, insights, and local records;
• connect optional health data and write hydration or exercise records when authorized;
• respond to AI chat requests and analyze meal descriptions or selected meal photos;
• show requested recipes, educational guides, exercise media, and app actions;
• maintain, secure, troubleshoot, and improve the Services;
• understand broad product usage without using your health or journal content for analytics;
• respond to support, privacy, and feedback communications; and
• comply with applicable law and protect users, Cyster, and others.

We do not use your health information, photos, journal entries, or chat content for targeted advertising. We do not sell personal information for money.

What stays local—and what is transmitted

Device-local records

Your profile, cycle dates, wellbeing logs, medication schedule, journal entries, chat history, app preferences, and related app state are primarily stored in a database on your device. These records may be included in device backups according to your Apple or Google backup settings, which Cyster does not control.

AI chat

When you send a Cyster Care message, Cyster transmits recent text turns, relevant app context, validated tool results, and any image you attach to the Cyster backend. The backend processes the request using Azure OpenAI. The current integration requests that model inputs and outputs are not stored for model-service history (store: false). Local chat history remains on your device unless you clear it or remove the app.

Meal analysis

When you request AI meal analysis, the description or selected image, filename, file type, and optional note are transmitted to the Cyster backend and Azure OpenAI for that request. Do not include faces, documents, or other unnecessary personal details in meal photos.

Connected health

Apple Health and Health Connect access happens through platform permission controls. Cyster reads only authorized data types. Hydration and exercise entries are written back only if you grant write permission and choose the relevant feature. Cyster’s current backend does not maintain a user health database.

Service providers and sharing

We may disclose limited information to the following categories of recipients:

• Microsoft Azure and Azure OpenAI for AI request processing, backend hosting, catalog delivery, and short-lived exercise-media links.
• PostHog for privacy-conscious product analytics and feedback you intentionally submit. The app currently uses PostHog’s United States ingestion service.
• Apple and Google platform services when you use HealthKit, Health Connect, device backup, speech recognition, app-store purchases, or other operating-system capabilities.
• Advisers, authorities, or counterparties when reasonably necessary to comply with law, protect rights and safety, investigate misuse, or complete a business reorganization subject to appropriate safeguards.
• People you choose, such as a clinician, when you explicitly share a summary or other content from your device.

Providers may process information in countries other than the one where you live. Where required, we use contractual or other recognized safeguards for international transfers. Mandatory protections available in your location continue to apply.

Retention

Device-local records remain until you delete or reset them, clear the app’s storage, or uninstall the app, subject to copies retained in your device backups. Cyster cannot delete your platform backups for you.

Transmitted information is retained only as long as reasonably needed for the feature, security, support, legal obligations, or legitimate business purposes. Retention can vary by data type and provider. For example, submitted feedback may remain with our product analytics records until it is deleted or no longer needed, while the Cyster backend does not currently maintain user accounts or a user-content database.

We may retain minimal records of a privacy request where necessary to document our response and comply with law.

Your choices and rights

Device controls

• Decline or revoke camera, photo, microphone, speech, activity, or health permissions in device settings.
• Use Cyster without connecting Apple Health or Health Connect.
• Review text created from speech before sending it.
• Choose whether to send a photo, feedback comment, chat message, or clinician summary.
• Clear local app storage or uninstall the app to remove device-local records.

Privacy rights

Depending on where you live and subject to applicable exceptions, you may have rights to know or access personal information, correct it, delete it, receive a portable copy, withdraw consent, object to or restrict certain processing, and appeal or complain to a privacy authority. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

Email cystercare.pcos@gmail.comwith the subject “Privacy request.” Describe the feature and information involved. We may need to verify your request. Because Cyster does not currently use user accounts, we may be unable to identify or retrieve information that exists only on your device or is not reasonably linked to you.

You may authorize an agent where local law permits. We will ask for appropriate proof of authority and may still need to verify your identity directly.

Regional disclosures

India

Where India’s Digital Personal Data Protection framework applies, we process digital personal data for lawful purposes based on consent or another basis permitted by law. You may request access to information about processing, correction, completion, updating, or erasure, withdraw consent, and use available grievance and nomination mechanisms as they become applicable. Withdrawing consent does not affect processing already lawfully completed.

European Economic Area, United Kingdom, and similar jurisdictions

Where required, our legal bases include your explicit consent for optional health data and other sensitive information; performance of a contract to provide requested features; legitimate interests in securing and improving the Services where those interests are not overridden by your rights; and compliance with legal obligations. You may withdraw consent at any time through device settings or by contacting us.

California and other U.S. states

In the preceding 12 months, the Services may have handled identifiers and contact details, internet or app activity, health and wellbeing information, photos and other user content, approximate device or network information, and inferences used to provide requested features. These categories are described above with their purposes and recipients. Cyster does not sell personal information or share it for cross-context behavioral advertising, and does not knowingly do so for anyone under 18.

Rights under a particular law apply only when that law covers Cyster and the relevant processing. Nothing in this policy limits mandatory rights available to you.

Security and children

Security

We use reasonable administrative and technical measures intended to protect information, including encrypted network transport, limited operational logging, device permission controls, short-lived media links, and keeping service credentials out of the mobile app. No storage or transmission method is completely secure, and we cannot guarantee absolute security.

Adults only

Cyster is currently intended for people aged 18 and older. We do not knowingly collect personal information from children. If you believe a child has provided information to us, please contact us so we can review and take appropriate action. This restriction does not prevent a parent, guardian, or clinician from discussing general PCOS information with a young person outside the Services.

Changes and contact

We may update this policy as the Services, providers, or legal requirements change. We will update the “Last updated” date and provide additional notice when required. Your continued use after an update is subject to the revised policy, but we will seek consent when the law requires it for a new use of information.

Questions, privacy requests, and grievances can be sent tocystercare.pcos@gmail.com. Please do not include detailed health records or urgent medical information in email.