Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy describes how DoDo LLC (“Flora,” “we”) collects, uses, shares, and protects consumer health data, as required by the Washington My Health My Data Act and the Nevada Consumer Health Data Privacy Law. It applies to residents of Washington and Nevada and to any person whose consumer health data we collect in Washington.

1. Categories of consumer health data we collect, the purposes, and how we use it

We collect the following, directly from you, to provide the features you request:

Category of consumer health data	Purpose and use
Reproductive and menstrual information (cycle dates, symptoms, fertility details)	To provide the cycle and fertility-planning features you request.
Nutrition and meal information	To generate the meal and nutrition guidance you request.
Physical activity information	To generate the activity guidance you request.
Mental-health and wellbeing information	To provide the wellbeing features you request.
Journal entries, and the free-text notes you can attach to a symptom, meal, exercise, meditation, or wellness log	To store your entries and show them back to you. These are not sent to Anthropic, our AI model provider.
Health-related content in the AI assistant	To generate the assistant’s responses to you.
Inferences drawn from the above	To personalize the guidance the app provides to you.

We use consumer health data only to provide the features you request. We do not use it for advertising or to train artificial-intelligence models.

2. Sources of consumer health data

We collect consumer health data from one source: directly from you, through the app. We do not obtain it from data brokers, health care providers, connected devices, or other third parties.

3. Consumer health data we share, and with whom

We do not share your consumer health data with third parties or affiliates. We use service providers (processors) that handle it only on our behalf, only to operate Flora, under contracts that prohibit them from using it for their own purposes:

Cloud hosting and database (Supabase) — to store your data securely.
AI model provider (Anthropic, which makes the Claude AI model) — only if you turn on AI data sharing, a separate opt-in you control in Settings → AI Data Sharing. Anthropic uses the data to generate the AI coach’s replies and your personalized plans for Flora. It does not use the data to train its models: its Commercial Terms of Service state that it may not train models on customer content, and by default it does not use inputs or outputs from the Anthropic API for training. Anthropic automatically deletes inputs and outputs within 30 days of receiving or generating them, unless it needs to keep them longer to enforce its Usage Policy (for up to 2 years) or to comply with the law.

If you turn on AI data sharing, these are the categories of consumer health data Flora sends to Anthropic, and what it never sends:

When Flora builds or refreshes your plan, including the automatic weekly refresh

Your fertility and cycle answers: how long you've been trying, your timeline, cycle regularity and tracking, reproductive conditions, hormonal medication and fertility testing status, and hormonal symptoms
The estimated cycle phase for each day of the week
Sleep quality, stress level and sources of stress, and how supported you feel
Your diet, food allergies, supplements, dietary preferences and restrictions, and calorie target
Your goal, activity level, workout frequency and length, equipment, preferred workouts, injuries, physical limitations, and medical conditions
Your meditation, journaling and affirmation preferences, mental health goals, the areas you want help with, and your preferred guidance style
The names of meals and exercises you've favorited

When you message the AI coach

Everything you type to the coach, plus your recent conversation
Your age, height, and weight, if you've entered them
Your goal, fitness level, calorie target, workout frequency, equipment, and dietary preferences and restrictions
Meals and workouts you logged in the last 3 days

Never sent

Your name, email address, or account ID
Your journal entries
Your period dates and symptom logs

We have no affiliates with whom we share consumer health data, and we do not disclose it to advertisers or data brokers.

Third-party tracking: We do not permit third parties to collect consumer health data through Flora over time or across different websites or online services.

4. Consent, and our commitments on sharing and selling

We collect and use your consumer health data to provide the features you request; this is necessary to deliver the service you asked for. You choose what to enter and can delete it at any time.
Sending your consumer health data to Anthropic for AI features is a separate opt-in. Flora asks before anything is sent — naming Anthropic and listing the data and why it is sent — and you can turn it off anytime in Settings → AI Data Sharing. Without it, the AI coach and AI plan updates stay off, and the rest of Flora keeps working.
If we ever want to collect, use, or share your consumer health data for a purpose beyond providing a feature you requested, we will first obtain your clear, opt-in consent, presented separately and describing the specific data, purpose, recipients, and how to withdraw. Any consent to share will be separate and distinct from any consent to collect.
We do not sell your consumer health data and will not do so.

5. Your rights

You have the right to:

Confirm and access the consumer health data we have about you, including a list of any third parties and affiliates with whom we have shared or sold it (for us: none — we use only the service providers listed above).
Withdraw consent to our collection or sharing of your consumer health data.
Delete your consumer health data. We honor deletion requests without exception for consumer health data, and we delete the data from backups and archives and direct our service providers to delete it.

To exercise these rights, email support@joinflora.appor use the controls in the app’s Settings. We may ask you to verify your identity, and may ask you to sign in to your existing account to do so, but we will not require you to create a new account. Washington and Nevada law do not permit an authorized agent to make these requests on your behalf, so please submit them yourself.

We will respond within 45 days. If we need more time for a complex or high-volume request, we may extend by up to another 45 days and will notify you before the first 45 days end. If we deny your request, you may appeal by replying to our response; we will inform you of our decision in writing within 45 days. If your appeal is denied, you may submit a complaint to the Washington State Attorney General (www.atg.wa.gov/file-complaint) or, for Nevada residents, the Nevada Attorney General (ag.nv.gov).

6. Withdrawing consent

Where we rely on your consent, you may withdraw it at any time in Settings (for AI features, Settings → AI Data Sharing) or by emailing support@joinflora.app. Withdrawal stops the affected processing going forward and may limit related features; to also remove data already collected, submit a deletion request.

7. Changes to this policy

If we make a material change to this policy, we will update the effective date above and notify affected consumers as required.

Contact

DoDo LLC
Email: support@joinflora.app