Privacy Policy

Version 1.0 · Effective: [DATE] · Verity serves women worldwide. We apply one high, GDPR-level standard of protection to every user, wherever you live — this policy is written to comply with the EU/UK GDPR, South Africa's POPIA, and applicable US state health-privacy laws, and we extend the same baseline everywhere.

This policy explains what personal information Verity collects, why, who we share it with, how long we keep it, and the rights you have.

1. Who we are

Verity is operated by [Registered entity name and registration number], of [business address] ("Verity", "we", "us"). For data-protection purposes we are the responsible party (POPIA) and the data controller (GDPR). Information Officer / privacy contact: [name], [privacy@verity.app].

2. The data we collect

Most of what Verity collects is health data, which the law treats as especially sensitive ("special personal information" under POPIA; "special-category data" under GDPR).

Account data — email and password (only if you create an account). You can use Verity in local-only mode without an account.
Profile data — display name, age / date of birth, life stage, current concerns, optional photo.
Health & cycle data — cycle entries, symptoms (including mental-health, sexual and intimate-health symptoms), energy and mood, sleep, nutrition and exercise logs, and free-text notes.
HRT data — hormone-therapy type, delivery method, dose, brand, start date, and changes over time.
Support-person data — if you link a support person: the link, and observations they log about you (and, for support people, observations you log about the person you support).
Consent records — which consents you gave, when, the version of the text shown, and the app version.
Technical data — device type, OS version, app version, crash diagnostics. No advertising identifiers.

Vera — free tier (curated Q&A): The free Vera answers a fixed set of preselected questions with pre-written, clinician-reviewed information, served on your device. It is not sent to any AI service and does not process free-text you type.

Vera — premium tier (Ask Vera AI): If you subscribe to Verity Premium, Ask Vera AI processes the question you type. With your consent, and without identifying details, your question is sent to an AI provider that answers grounded in Verity's clinician-reviewed library. We do not use your health data to train any AI model. Full details are provided before you subscribe.

What we do NOT do: we do not sell your data; we do not share it with advertisers or ad networks; we do not embed advertising or social-media tracking SDKs; we never use your health data to target ads.

3. Why we use your data, and our legal basis

To provide tracking (cycle, symptom, sleep, nutrition, exercise, HRT), insights, trends and your doctor report — your explicit consent to process health data (GDPR Art 9(2)(a); POPIA s27(1)(a)); and performance of our contract for the non-health parts (GDPR Art 6(1)(b)).
To provide Vera's curated information — your consent; no external processing is involved.
To enable support-person mode — your explicit consent and your support person's, recorded at linking.
To keep the app secure, fix bugs, prevent abuse — our legitimate interests (GDPR Art 6(1)(f); POPIA s9).
To meet legal obligations — legal obligation (GDPR Art 6(1)(c); POPIA).

You can withdraw consent any time in Settings; withdrawal doesn't affect prior processing and may mean parts of the app stop working.

4. Who we share data with (sub-processors)

We share data only with the providers we need to run Verity, each bound by a written data-processing agreement and acting only on our instructions:

[Hosting provider / our own server] — cloud database, authentication and storage (self-hosted MongoDB). Hosting region: [EU (e.g. Frankfurt) or South Africa — state the actual region].
Expo — push notifications.
[Email provider] — transactional email (e.g. deletion confirmations).
AI provider (Verity Premium only) — powers Ask Vera AI; receives the question you ask, without identifying details, only on your consent. We will name the provider and its safeguards here before Premium launches.

A current list is available at [verity.app/subprocessors]. International transfers: where data moves outside its home country, we rely on lawful transfer mechanisms — Standard Contractual Clauses / UK IDTA and, for POPIA, contractual adequate-protection commitments and your consent (POPIA s72).

AI provider — Verity Premium only. The free app sends nothing to any AI. If you subscribe to Verity Premium's Ask Vera AI, an AI-provider sub-processor answers your questions — only on your consent, without identifying details, and grounded in our vetted content. We will name the provider and its safeguards here before Premium launches, and we never use your health data to train an AI model.

5. How long we keep data

Account, profile, logs, HRT, support-person data — kept while your account is active; deleted when you delete your account (section 7), within 30 days and usually sooner.
Consent records — kept for the life of the account plus a limited period after deletion, as proof of consent.
Local-only data — stored on your device only; removed when you delete it in-app or uninstall.
Crash diagnostics — [e.g. 90 days].

6. Your rights

Depending on where you live: access (POPIA s23; GDPR Art 15), correction (s24; Art 16), deletion (Art 17; s24), portability — Verity offers a JSON export (Art 20), object/restrict (Arts 18, 21), withdraw consent (Art 7(3)), and complain to a regulator (SA Information Regulator, your EU supervisory authority, or the UK ICO). US residents (California CPRA; Washington My Health My Data Act) have additional rights over consumer-health data; we do not sell it. Contact [privacy@verity.app].

7. Deleting your account

In Settings → Privacy & Data you can permanently delete your account. This hard-deletes your data from our systems (not a soft delete), removes your authentication record, deletes your on-device data, and sends a confirmation email. We complete deletion within 30 days. We keep only a minimal, timestamped, de-identified record that a deletion took place (a hashed request reference and date — no personal or health data), to meet our own legal obligations and prove the erasure was honoured. If you used support-person mode, observations about you are deleted or anonymised; tell us if you also want observations you authored removed.

8. Data on your device

Verity stores some data locally for speed and offline use; sensitive local data is encrypted at rest. Deleting the app removes local data, but a device backup (iCloud/Google) may retain a copy under that provider's terms. Use the in-app delete to remove server-side data.

9. Children

Verity is for adults aged 18 and older. We do not knowingly collect data from anyone under 18. If we learn we have, we delete it.

10. Security

We protect your data with encryption in transit and at rest, per-user access controls so each user can only reach their own data, least-privilege access, and a documented incident-response process. No system is perfectly secure; if a breach affects you, we will notify you and the relevant regulator as the law requires.

11. Changes and contact

We will update this policy as Verity evolves and tell you about material changes. Questions or requests: [privacy@verity.app]. Postal: [address].