consumer health data privacy policy
your health data.
your call.
This separate policy explains how Lonely Labs, Inc ("Hey Twin," "we," "us") handles consumer health data. It supplements our general privacy policy.
consumer health data we collect
Depending on what you choose to tell Twin, we may collect:
- period start and end dates and cycle intervals;
- bleeding or flow descriptions;
- cramps, pain, discharge, nausea, fatigue, headaches, and other symptoms;
- mood and how symptoms affected school, sleep, or daily life;
- period products used or discussed;
- questions and messages that reveal period, reproductive, or other health concerns;
- corrections, deletions, and preferences related to that information; and
- inferences needed to organize only the health facts you explicitly shared.
We do not intentionally collect precise location, genetic data, biometric identifiers, medical records from clinicians, or data from fitness trackers or other health apps.
where it comes from
Consumer health data comes directly from your messages and reactions, from corrections or choices you make in the conversation, and from the saved history created from those statements. We may derive a limited structured fact—such as that “cramping” means cramps— to organize what you said. We do not buy consumer health data from data brokers.
why we collect and use it
Twin explains memory when it becomes relevant in the conversation. For a tentative period start, Twin explains why remembering the date helps and asks before saving it. If daily check-ins are enabled, the introduction says they occur and that pause stops them. We use information you choose to share to provide the period-support and tracking service you requested.
We collect and use consumer health data only as needed to:
- answer your period questions and provide practical support;
- remember, correct, summarize, and delete the history you ask us to keep;
- help you understand patterns in your own saved history without diagnosing;
- recognize potentially urgent situations and provide reviewed safety guidance;
- maintain security, prevent abuse, and debug service failures; and
- comply with law or establish, exercise, or defend legal claims.
We do not use consumer health data for advertising, profiling for unrelated purposes, deciding eligibility for employment, housing, credit, insurance, or education, or making automated decisions that produce legal or similarly significant effects.
what we disclose and to whom
To provide the service you request, we may disclose the categories listed above, relevant conversation context, and messaging identifiers to these processors:
- Sendblue: messaging delivery, provider identifiers, and supported message interactions;
- OpenAI: relevant message context and saved facts needed to generate a reply;
- application and database hosting providers: encrypted retained messages, structured health history, preferences, and operational records; and
- security and infrastructure providers: limited records needed to protect, monitor, and reliably operate the service.
We may also disclose specific information when you direct us to, or when reasonably necessary to comply with law, respond to a valid legal process, or protect the rights, safety, and security of users or the service. We have no affiliates with whom we share consumer health data.
no sale
We do not sell consumer health data. We will not sell it without first obtaining the separate, signed authorization required by applicable law.
your health-data rights
You may:
- confirm whether we collect or share your consumer health data;
- access the consumer health data we hold about you;
- ask for a list of third parties and affiliates that received it;
- withdraw consent from future collection or sharing;
- ask us to delete consumer health data, subject to legal exceptions; and
- appeal if we deny your request.
You can ask Twin what do you remember?, correct or forget a detail, or text delete my data. You can also submit a request or appeal throughcontact & help or yo@heytwin.chat. We may verify that the requester controls the relevant conversation before responding.
We will respond within the time required by applicable law and will not discriminate against you for exercising a right. Withdrawing consent does not affect processing already completed, and it may prevent Hey Twin from continuing to provide features that require the data.
retention and security
Encrypted conversation text in the Hey Twin application expires after 30 days. Structured period and symptom history stays until you delete it. Routine delivery records expire after 30 days and minimal coded safety records after 90 days. A single message received before age eligibility may remain only in temporary process memory for up to 10 minutes and is not sent to AI or stored as history before eligibility.
We restrict access and use safeguards designed for sensitive data. Sendblue may retain message content and messaging metadata under its policy. Provider copies and messages on your devices are separate from Hey Twin’s application records; see the general privacy policy for that distinction.
changes to these practices
We will not collect, use, or share a new category of consumer health data, or use it for a materially new purpose, without giving the notice and obtaining the consent required by law. Updates will be posted here with a new effective date.
contact
Operator: Lonely Labs, Inc · Rua João Infante 78, Cascais, 2750-384, Portugal