Privacy policy
How Vagilant collects, stores, uses and deletes your health information, and the rights you have over it.
Draft pending legal review.
This policy is written to describe how Vagilant actually works, but it has not yet been reviewed by a qualified lawyer and the company details below are not final. It must be reviewed before launch. Items marked [TO CONFIRM] are waiting on incorporation.
Last updated: October 29, 2026
This policy explains what information Vagilant collects, why, how long we keep it, and what you can do about it. Vaginal health data is among the most sensitive categories of personal information there is, and we have tried to write this in language you can actually read.
Who we are
Vagilant Care Ltd. [TO CONFIRM: company registration in progress] operates vagilant.care and is the controller of the personal information described here. You can reach us at info@vagilant.care.
Registered address: [TO CONFIRM]. Company number: [TO CONFIRM].
What we collect
Information you give us
- Account details. Your name and email address, and a password stored only as a cryptographic hash. We never store your password itself.
- Assessment answers. Your responses to the online assessment, including symptoms, cycle information and anything else you choose to enter.
- Sensor readings. The pad colors you record from the liner.
- Messages. Anything you email us.
Information collected automatically
- Technical data. IP address, browser and device type, and pages visited, used to keep the service secure and working.
- Cookies, described in our cookie policy.
Why we use it, and our legal basis
| What for | Legal basis |
|---|---|
| Creating and running your account | Performance of a contract with you |
| Generating your assessment results and reports | Your explicit consent |
| Keeping the service secure and preventing abuse | Our legitimate interests |
| Improving the product using aggregated, de-identified data | Your explicit consent, withdrawable at any time |
| Replying to you when you contact us | Our legitimate interests |
Your health information is processed only with your explicit consent. You give that consent in the app, you can see exactly what you have consented to on your consents page, and you can withdraw any consent at any time without losing access to your account.
What we never do
- We do not sell your personal information to anyone, ever.
- We do not share your health information with advertisers, data brokers, insurers or employers.
- We do not use your health information to target advertising to you.
- We do not share identifiable data with third parties for their own purposes.
Who we share it with
We share personal information only with service providers who help us run Vagilant (hosting, email delivery and error monitoring), and only to the extent they need it to do that job. They are bound by contract to protect it and may not use it for their own purposes. [TO CONFIRM: the final list of sub-processors will be published here.]
We may disclose information where we are legally required to, or to protect someone's safety. If we are ever compelled to hand over data, we will tell you unless we are legally prohibited from doing so.
Where your data is stored
Data is stored on servers located in [TO CONFIRM]. Where information is transferred outside your country, we rely on appropriate safeguards such as standard contractual clauses.
How long we keep it
- Account and health data. Kept for as long as your account is open. If you delete your account, it is permanently erased within 30 days.
- Backups. Deleted data may persist in encrypted backups for up to 90 days before being overwritten.
- Records we must keep by law. Retained only for the period the law requires.
How we protect it
Health data is encrypted at rest and in transit. Access is restricted to the minimum number of people who need it, all access is logged, and passwords are stored using industry-standard hashing. No system is perfectly secure, but we treat this data as the sensitive category it is.
Your rights
Wherever you live, you can:
- Access everything we hold about you, and export it yourself from your account.
- Correct anything inaccurate.
- Delete your account and all its data, permanently, from your account settings.
- Withdraw consent to any processing based on consent.
- Object to or restrict processing based on legitimate interests.
- Complain to a regulator.
If you are in Canada
Your rights arise under PIPEDA and applicable provincial legislation. If you are not satisfied with our response to a complaint, you can contact the Office of the Privacy Commissioner of Canada.
If you are in the United States
Depending on your state, you may have rights under laws such as the California Consumer Privacy Act, the Washington My Health My Data Act, or similar state legislation covering consumer health data. These include the right to know, delete, correct and opt out of sale or sharing, and we do not sell or share your data in the first place. Contact us to exercise any of them; we will not treat you differently for doing so.
Note that Vagilant is not a healthcare provider or covered entity, so HIPAA does not generally apply to the data you give us directly. We apply comparable safeguards regardless.
Children
Vagilant is not intended for anyone under 16, and we do not knowingly collect information from children. If you believe a child has created an account, email us and we will delete it.
Changes to this policy
If we make a material change, we will tell you by email and update the date at the top of this page before the change takes effect. We will never reduce your rights retroactively.
Contact
Questions, requests or complaints: info@vagilant.care.