1. Who we are and what this policy covers

This Privacy Policy explains how DiaFem (“DiaFem,” “we,” “us”) collects, uses, shares, and protects personal information when you use the DiaFem website, mobile application, health agent, and related services (collectively, the “Platform”). It applies to everyone who uses the Platform, including people who join our waitlist or take a free assessment.

Some information you share through the Platform may also be protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”). When clinician services are provided to you, PHI is handled as described in our Notice of Privacy Practices, which controls if it conflicts with this policy. This policy also serves as our Consumer Health Data Privacy Policy for residents of Washington, Nevada, Connecticut, and other states with consumer health data laws.

2. Our privacy commitments

• We never sell your personal information, including your health data, and we never will.
• We never use your health data for advertising. We do not share it with advertisers, data brokers, or social media platforms, and we do not use it for targeted or cross-context behavioral advertising.
• We never train AI on your identifiable data without your explicit written consent. We may use de-identified, aggregated data to improve our models, as described below.
• You own your health data. You can access, download, correct, or delete it, subject to records we are legally required to keep.
• We collect only what we need to provide and improve your care, and we keep it only as long as we need it.

3. Information we collect

Information you give us:

• Account and contact details, such as your name, email address, phone number, date of birth, ZIP code, and age range.
• Health information, such as symptoms, menstrual cycle data, medical history, medications, supplements, sleep, nutrition, mood, sexual and reproductive health information, questionnaire answers, and lab results you upload.
• Messages and conversations with our health agent and with clinicians.
• Payment information, which is processed by our payment processor. We do not store full card numbers.

Information from connected sources, with your permission:

• Wearable and app data, such as sleep, heart rate, activity, and temperature, from devices and services you choose to connect.
• Laboratory results from labs that perform tests ordered for you, and prescription information from pharmacies.
• Records from other healthcare providers when you authorize us to request them.

Information collected automatically: device and browser type, IP address, approximate location derived from your IP address, app and site usage, and diagnostic data. We use only cookies and similar technologies that are necessary to run the Platform and measure its performance. We do not use advertising pixels or third-party tracking technologies on pages or screens where you enter or view health information.

4. How we use your information

• To provide the Platform: create your account, run your assessment, generate your health summaries and daily protocols, and track your progress over time.
• To support your clinical care: prepare visit summaries for clinicians, coordinate labs and prescriptions, and communicate with you about your care.
• To operate our AI health agent: analyze your data so it can answer your questions and surface patterns relevant to you.
• To communicate with you: account notices, appointment reminders, care updates, and, with your consent, product news. You can opt out of marketing at any time.
• To keep the Platform safe and working: security monitoring, fraud prevention, debugging, and quality review.
• To improve our services, using de-identified or aggregated data wherever possible.
• To comply with law, respond to lawful requests, and protect the rights and safety of our users and others.

We use consumer health data only with your consent or as necessary to provide the services you request. We will ask for your separate consent before collecting or sharing consumer health data for any other purpose.

5. AI and your data

• AI outputs on the Platform are supportive tools, not diagnoses. Clinical decisions are made by licensed clinicians.
• We may de-identify and aggregate data so that it can no longer reasonably identify you, and use it to improve our models, research, and services. We commit to keeping de-identified data de-identified and not attempting to re-identify it, and we require the same of anyone we share it with.
• We will not use your identifiable health data to train AI models without your explicit written consent, which you can withdraw at any time.
• Third-party AI providers that help power the Platform act as our service providers. They may process your data only to deliver the service to you, under contracts that prohibit them from training their own models on it or using it for any other purpose.

6. How we share your information

We share personal information only as described here:

• Your clinicians, so they can provide and document your care.
• Laboratories and pharmacies that fulfill tests and prescriptions ordered for you.
• Service providers that host, secure, and support the Platform, process payments, and send communications. They act on our instructions, under contracts that limit their use of your data and, where required, under HIPAA business associate agreements.
• People and services you direct us to, such as a provider you ask us to send records to or an app you choose to connect.
• Legal and safety reasons, when required by law, subpoena, or court order, or when necessary to protect someone’s health or safety. Where permitted, we will tell you before disclosing your data in response to a legal request.
• Business transfers, if DiaFem is involved in a merger, acquisition, or sale of assets. Any successor must honor this policy, and we will notify you before your information becomes subject to a different policy.

We do not sell personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined under California law.

7. How we protect your information

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls based on job need, multi-factor authentication for staff, audit logging, and regular security reviews. No system is perfectly secure. If a breach affects your information, we will notify you and the appropriate regulators as required by law, including the HIPAA Breach Notification Rule and the FTC Health Breach Notification Rule where they apply.

8. How long we keep your information

We keep personal information only as long as needed to provide the Platform and for the purposes described in this policy. When you delete your account, we delete or de-identify your personal information within a reasonable period, except for information we must keep by law. Medical records created as part of clinician services are kept for the period required by state medical records laws. Waitlist information is deleted when you unsubscribe or ask us to remove it.

9. Your privacy rights

You have the following rights, wherever you live:

• Access and portability: request a copy of your personal information, including your health data, in a portable format.
• Correction: ask us to correct inaccurate information.
• Deletion: ask us to delete your personal information, including consumer health data, subject to legal retention requirements.
• Withdraw consent: withdraw consent you have given us, including for AI training or connected devices, at any time.
• Know who we share with: request a list of the third parties and affiliates that have received your consumer health data.
• Opt out of marketing: unsubscribe from marketing emails or texts at any time.

To make a request, email contact@diafem.care or use your account settings. We will verify your identity before acting, respond within 45 days (or sooner where the law requires), and never discriminate against you for exercising your rights. You may use an authorized agent; we may ask for proof of their authority. If we deny your request, you can appeal by replying to our decision. If you are not satisfied with the outcome of your appeal, you may contact your state attorney general. Additional rights may apply under HIPAA for PHI, as described in our Notice of Privacy Practices.

10. Cookies and tracking

We use strictly necessary cookies to keep you signed in and keep the Platform secure, and privacy-protective analytics to understand how the Platform performs. We do not use third-party advertising cookies or pixels. We honor Global Privacy Control signals as a request to opt out of any sale or sharing of personal information, which we do not do in any case. You can control cookies through your browser settings.

11. Children

The Platform is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us at contact@diafem.care and we will delete it.

12. Where we process data

DiaFem operates in the United States, and your information is stored and processed in the United States. The Platform is not intended for use outside the United States.

13. Changes to this policy

We may update this policy as our services or the law change. If we make material changes, we will notify you by email or in the Platform before they take effect, and where required we will ask for your consent before using your information in a new way. The date at the top shows when this policy was last updated.

14. Contact us

Questions, requests, or concerns about your privacy: contact@diafem.care
Website: DiaFem.care