FlowHer Privacy Policy

Last updated: October 6, 2026

This Privacy Policy ("Policy") explains how FlowHer period health app and related websites, software, and online services (collectively, the "Services") collect, use, store, share, and protect your personal information when you access, register for, or use the Services.

FlowHer is provided and operated by 杭州大峪科技有限公司 ("we," "us," or "FlowHer"). For privacy requests, contact hi@flowher.app. Please read this Policy before using the Services. Where separate consent is required, the app will ask you to make an explicit choice; using the app alone does not provide that consent.

If you do not agree with any part of this Policy, please stop using our Services immediately.

1. Types of information we collect

We may collect the following types of information on a lawful, legitimate, and necessary basis:

1. Basic account information

Nickname and username
Email address
Device identification information, such as device model and operating system version

2. Health and physiological information, with your authorization

After receiving your explicit authorization, FlowHer may connect with third-party platforms or systems such as Apple Health ("Third-Party Health Sources") to read and analyze certain health and physiological data, including but not limited to:

Heart rate and heart rate variability (HRV)
Sleep duration and sleep quality
Activity and exercise data
Blood oxygen and respiratory rate
Menstrual cycle records, such as period and ovulation records

The above information is collectively referred to as "Health Information."

Important note: Apple Health authorization lets the app read the selected data on your device. Whether information is sent to the cloud depends on the feature you use. Period and cycle records, symptoms, and daily summaries such as HRV, heart rate, wrist temperature, sleep, and body status may be sent to the service for sync or reports. Record sync may also include medication, mood, weight, sexual activity, and notes that you enter. A statement that raw HealthKit samples stay on the device does not mean that all health information stays there. The app will request separate consent for cloud processing of sensitive health information in China cloud accounts. If you decline, the corresponding cloud feature will be unavailable; the app will explain which local features remain available.

3. Usage and interaction information

Service usage frequency and feature clicks
In-app operation logs, after anonymization or de-identification
Crash logs and performance data

If you purchase membership or subscription services, we may collect necessary information such as transaction time and subscription type, but we do not store your full payment account or bank card information. Such information is processed directly by the app store or payment platform.

5. Approximate location information

We may obtain your approximate geographic region, such as country or city level, based on IP address, only for service compliance, statistical analysis, or feature optimization.

2. How we collect information

We collect your information through:

1. Information you actively provide

For example, information submitted when registering an account, filling in profile information, or contacting customer support.

2. Third-party imports authorized by you

For example, Health Information imported from Third-Party Health Sources such as Apple Health.

3. Automatically collected information

Usage and device information automatically recorded through technical means while you use the Services.

System authorization to read health data does not authorize its upload or third-party processing. Where separate consent is required for cloud processing, the app will ask before that processing.

3. Account region, storage, and cross-border processing

Existing AWS accounts stay in their original service region. Travel and changes in network location, system language, or App Store storefront do not automatically move an account.
Once the China new-account service is enabled, accounts first created with the China App Store storefront, and the business records actively synced to those accounts, will be processed and stored by Alibaba Cloud services in mainland China. You can use local features without first signing in with Apple. When you choose to enable a cloud account, the app separately asks for consent to China account and data storage. If you decline, it will not create a China account or create a new AWS account instead.
To preserve account identity and membership benefits, the existing AWS service retains the necessary home-assignment directory, routing state, one-way protected device or Apple identity links, and consent version and time. It sends Alibaba Cloud a signed account-creation proof. Period, health, AI chat, and feedback records remain in the account's fixed service region and are not routinely copied to another business database for this proof.
New accounts in other storefronts continue to use AWS services. Apple processes membership purchases and subscriptions; we process necessary transaction reference digests, product and time information, and entitlement status to assign benefits to the fixed account. If you enable system notifications, delivery may involve Apple's push service. See Section 6 for AI data recipients. The minimum home-assignment directory for China accounts is transmitted to and stored by Amazon Web Services (AWS) in the United States us-west-1 (Northern California) Region. 杭州大峪科技有限公司 determines the purposes and means of processing this directory; AWS provides the cloud infrastructure. AWS's Privacy Notice and contact channel describes account and other information AWS collects for itself; its Data Privacy FAQ addresses content stored by customers. To request access to, a copy of, correction of, or deletion of information relating to your FlowHer account, contact us at hi@flowher.app.

Apple platform services are operated by Apple Inc. and the Apple affiliates that provide the relevant service. Apple's Mainland China Privacy Policy Disclosure lists Apple Inc. in the United States and Apple Distribution International Limited in Ireland among the Apple entities that may receive or access personal information outside mainland China. You can contact Apple or exercise rights concerning information it processes independently through Apple Privacy Inquiries or Apple's Data and Privacy page.

To verify membership benefits after a purchase, restoration, renewal, or refund, the China service sends the necessary original transaction identifier, developer authentication information, and server network metadata to Apple's App Store Server API and receives transaction or subscription status; it does not send health records or the original Apple transaction receipt.

If you allow push notifications and the service is enabled, we send a device token, app identifier, notification identifier, and non-sensitive activity copy and parameters to Apple Push Notification service (APNs). Before every send, an operator manually checks the notification content, destination links, and activity parameters to ensure they contain no personal health, identity, or transaction details.

Certificate status checks may also send certificate serial numbers and other certificate information, along with server network information, to the response service designated by the certificate issuer; no user health records are sent. Processing locations and log retention periods differ across Apple services and certificate status services. We do not apply the App Store purchase-record retention period to APNs or certificate status requests. For information Apple processes independently, see its App Store privacy notice. You may still send requests about information FlowHer transmits to these services to hi@flowher.app.

If processing involves a transfer of personal information across a legal border, we will provide the recipient, categories of information, and processing details and meet applicable legal requirements. We will handle lawful requests from regulators, courts, and law enforcement under applicable law.

If you are located in the European Union or European Economic Area (EEA), we will take compliant cross-border data protection measures under applicable laws such as the GDPR.

When you actively create or use a theme share code or referral code, we process the information needed to complete that feature. Theme sharing involves the code, theme identifier, four theme images you choose to share, theme title, and author's display name. Referrals involve the code, necessary account identifiers for both participants, referral relationship, eligibility, and reward delivery results. You do not need to share health records to use these features.

When participants' accounts are served by different regions, code lookup, theme delivery, and rewards require transferring that necessary information between Alibaba Cloud in mainland China and AWS in the United States (us-west-1). Theme assets are stored in the recipient's account region; membership rewards are recorded in each beneficiary's original region. Accounts, purchases, and health records are not automatically migrated. This processing is limited to fulfilling the sharing, redemption, and referral reward features you actively request, without cross-region health analysis or marketing profiles.

杭州大峪科技有限公司 determines the purpose and means of this processing; Alibaba Cloud and Amazon Web Services provide infrastructure. Contact hi@flowher.app to ask about processing or request access, correction, or deletion. We retain only the records needed to complete requests, recover failed operations, reconcile rewards, and prevent duplicate rewards. Revoking a share stops future redemptions. Previously received content and records involving another account require manual review of both participants' rights and necessary retention; submitting a deletion request does not mean deletion is complete.

Share only theme content you have the right to provide. Content involving another person's information or requiring additional authorization must be shared within the scope of lawful authorization; we do not assume every user image is free of personal information.

4. How we use your information

We use your information only within a reasonable and necessary scope, mainly for:

1. Providing core service features

Including period prediction, body status analysis, status prompts, and related functions.

2. Analysis and experience optimization

Improving algorithms and product experience through anonymized or aggregated data.

3. Customer support and communication

Responding to your inquiries, feedback, and technical support requests.

4. Security and compliance

Preventing fraud and abuse, and protecting system and user security.

We will not use your personal information for purposes unrelated to FlowHer's core functions.

We do not sell or rent your personal information. We may share information lawfully and compliantly only in the following situations:

2. With service providers

For technical support, email notifications, data analysis, and similar purposes, subject to strict confidentiality obligations.

3. Anonymized research and product improvement

For algorithm optimization or statistical analysis, without personally identifiable information.

4. Legal requirements or government requests

When compliant with applicable laws and regulations.

5. Company changes

Such as mergers, acquisitions, or asset transfers.

When you actively use AI image creation, health reports, or health AI chat, our service sends the information needed for your request to the model provider currently configured for that feature. As of September 28, 2026, both image and text models in the China and existing AWS production services are configured to use Volcano Engine. Image creation may send your text and uploaded images. Reports may send period and cycle dates, symptoms, and daily summaries such as body state, HRV, and sleep. Chat may send your question, recent conversation, and health context you select. A feature does not necessarily send every category listed here. The app asks for independent consent before cloud processing of sensitive health and physiological information for China accounts; declining it makes the related cloud sync, reports, and health AI features unavailable. We send these requests to generate the results you ask for and do not use them for advertising or marketing.

1. Data recipient information

Volcano Engine: Beijing Volcano Engine Technology Co., Ltd.; privacy policy and contact details.
Purpose and method: Send the information needed for the configured model through its service interface and receive an image, report, or chat response.
Information involved: The text and images described above, plus the necessary health summaries and context when you use reports or health AI chat.

2. Third-party data protection commitment

We limit what each feature sends. Volcano Ark's platform-specific terms say the platform does not store or use customer data for model training or optimization without the customer's separate consent. The terms also describe processing for legal compliance, troubleshooting, and abnormal-use alerts, without a single retention period for those cases. See Volcano Engine's privacy policy and contact information. To ask which provider a feature actually uses or what data it sends, contact us through the email in Section 13. We will give further notice or seek separate consent before a change where required by law.

3. Collection and use description

You enter text or upload images for image creation. Health reports use necessary summaries from cloud records you have enabled. Health AI chat uses the question you send and the context you select. Stopping use of a feature does not automatically delete information already stored; you can exercise your rights through Section 7.

7. Your rights and choices

You have the following rights under applicable law:

Access and modify your personal information
Request deletion of personal information
Withdraw granted authorization
Restrict or object to certain information processing
Data portability, where applicable in specific jurisdictions

You can find privacy information in the app's settings or send a request to hi@flowher.app. You can withdraw Apple Health system access in iOS Settings; it is separate from consent to cloud processing of sensitive health information for China accounts. In supported app versions, you can withdraw cloud health processing consent separately, or use that email to request that processing stop and to request access, export, or deletion. Withdrawal stops new related cloud processing but does not automatically erase existing records, change the account's service region, or remove purchased benefits.

In app versions that support account deletion requests, you can submit a request in the app and retain its reference number. We manually verify and process it in the account's fixed service region. If you use an older app version or cannot access that feature, you can request deletion by email. Purchased benefits, payment disputes, unusual identity links, and records that must legally be retained may need individual handling. After deletion, we may retain the minimum directory state needed to prevent old credentials from recreating the account and processing receipts that do not contain business content.

8. Information security

We take industry-standard technical and management measures to protect your information security. Please understand that no network environment can guarantee absolute security, and you should also keep your account information safe.

9. Retention period

We retain information according to its purpose and actual lifecycle. We delete or anonymize the relevant information when its purpose ends, you delete a record or account, or an applicable legal requirement calls for it. The main triggers and verified technical periods are:

Account assignment and actively synced period, health, report, image, and feedback records: retained while the account is active, you use the relevant feature, and the records are needed to provide it. We clear the relevant records through the fixed-region process when you delete a record or complete account deletion. Minimum records needed for payment, disputes, security audits, or unusual identity links are handled according to those matters.
AI chats and generated results: retained while providing chat history and features you choose; cleared by account when account deletion is completed. Withdrawing cloud health consent stops related new processing but does not immediately erase existing records. You can separately request deletion.
Alibaba Cloud database in China: automatic data backups and log backups each follow a 30-day retention policy. Information removed from the live database may remain in a backup until it rotates out; backups are used only for recovery and security.
Alibaba Cloud user assets and report objects in China: noncurrent object versions expire under the configured lifecycle rule 180 days after becoming noncurrent. Current versions have no such automatic expiry rule. Account deletion separately clears that account's business objects and historical versions.
Volcano Ark model service: request content is processed under the official terms linked in Section 6. Those terms do not specify one retention period for compliance, troubleshooting, and abnormal-use alert cases; contact us through Section 13 about the handling of a particular request.

10. Protection of minors

FlowHer China cloud accounts are available only to people aged 18 or older. If you believe an account or information belongs to someone below the age requirement, contact hi@flowher.app so we can investigate and act under applicable law.

11. Special notice for California and European users

If you are a resident of California, the European Union, or the EEA, you may have additional data protection rights under applicable law, including the right to know, the right to delete, and the right not to be discriminated against. We will fulfill corresponding obligations under applicable law.

12. Changes to this Policy

We may update this Policy and notify you through the app or this page. If a change to the purpose, method, or categories of processing requires renewed consent under applicable law, we will ask for it again.

13. Contact us

If you have any questions, comments, or requests about this Privacy Policy or personal information protection, please contact us:

Email: hi@flowher.app

Thank you for trusting and using FlowHer. We will continue to treat every piece of your data with caution, restraint, and respect.