LYNA Privacy Policy

1. Who we are

LYNA is provided by Lyna Cam UK Limited, a company registered in England and Wales with company number 16586748, registered office 128 City Road, London EC1V 2NX ("LYNA", "we", "us"). We are the controller of your personal data. We are registered with the Information Commissioner's Office (ICO) under number ZB970320.

Privacy questions, requests and complaints: privacy@lyna.cam, or write to the address above marked "Privacy". You can contact our Data Protection Officer at dpo@lyna.cam.

This policy covers the LYNA mobile app, lynahealth.app, the LYNA shop, the LYNA community, and our emails (together, the "Service"). If you are in the United States, please also read section 14 and our Consumer Health Data Policy.

2. Lyna is for adults

Lyna is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you tell us you are under 18 at sign-up, we will not create an account and will not keep your date of birth. If we learn an under-18 has an account, we delete it.

3. What we collect

Some of this is "special category" data under UK data protection law. That includes all health information, and dietary requirements that may reveal your religion. We protect it with the extra safeguards described in this policy.

We do not collect precise location, contacts, face or other biometric data, or medical records from your doctor. If you link Apple Health or Google Health Connect in future, we will read only the data types you approve, and only use them as described here.

Healthcare professional enquiries

If you contact us through our clinical partners page, we collect your name, work email, profession or role, how many client relationships you have, clinic or practice (if given) and how you would like to work with us. Your enquiry is sent to our team by email through our email provider, Brevo. We use these details only to reply to you about partnering, on the basis of our legitimate interest in responding to your enquiry. We do not add you to marketing lists, and you can ask us to delete your details at any time.

4. How we use your information, and our legal basis

UK data protection law requires a legal basis for each use. For health information we also need a condition under Article 9 of the UK GDPR. For health information our condition is your explicit consent, which you give in the app and can withdraw at any time.

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details and you can object (section 10).

If you do not give the health data consent, you can still use recipes and general content, but we cannot provide personalised features.

5. Health research and improving Lyna

We want to learn how nutrition and cycles connect, and to share what we learn. We only use your data for this if you say yes. Each choice below is separate, starts switched off, and can be changed at any time in Settings › Privacy. Saying no does not change how Lyna works for you.

Help improve Lyna. We use pseudonymised copies of your logs and meal photos to improve features such as the meal scanner and recommendations, including training our own machine learning models. We do not let outside AI providers train their models on your data.

Lyna Research. We include your pseudonymised data in our research in these areas: menstrual cycle health; PCOS; perimenopause and menopause; nutrition, diet and wellbeing; and how people use health apps. We publish results only as group figures, and never a figure based on fewer than 10 people.

Share with research partners. We may share pseudonymised data with universities, hospitals and research organisations for studies we list on lynahealth.app before they start. Each partner signs an agreement that limits use to that study, bans any attempt to identify you, bans onward sharing and marketing use, and requires deletion at the end. Each study is reviewed by an independent ethics committee before it starts.

Invite me to studies. We may contact you about a specific study. Taking part is always a separate decision, with its own information and consent.

What "pseudonymised" means. We replace your name, email and account ID with a random code, and keep the key that links the code to you separately, under strict access control. Pseudonymised data is still personal data, and all your rights still apply.

What we never do with research. We never sell or license your health data. We never use research data to make decisions about you or to target marketing at you.

If you change your mind. When you switch a choice off, we stop including your data in new work and remove it from datasets that have not yet been analysed. We cannot remove it from results already published or from anonymous statistics, because those can no longer be linked to you.

6. Anonymous statistics

We may turn data into anonymous statistics, for example "on average, Lyna members log more magnesium in the luteal phase". Before we do, we remove anything that could identify a person, including small groups. Once data is truly anonymous it is no longer personal data. We may publish these statistics or share them with partners.

7. Personalisation and automated decisions

Lyna uses automated processing to build your plan: for example, it estimates your cycle phase, suggests switching modes when your logged periods change, and sets nutrient and calorie targets. This is profiling. It does not produce legal effects or anything similarly significant for you, such as decisions about insurance, credit or employment. A person at LYNA can review any automated suggestion if you ask. Lyna's suggestions are general wellness information, not medical advice or a diagnosis.

8. Who we share data with

We never sell your personal data and never share health information with advertisers or data brokers. We share data only with:

Service providers who process data for us, under contracts that require them to follow our instructions and keep data secure:

You can ask us at privacy@lyna.cam for the current list of named providers.

Other Lyna members, only for content you post in the community. Your first name, profile initial, post and any photo or score you choose to include are visible to members.

Research partners, only if you switch this on (section 5).

Apple and Google, which are independent controllers of the data they collect when you sign in or pay through them. Their privacy policies apply.

Authorities and courts, where the law requires it, or to protect someone's safety. Where allowed, we will tell you first.

A buyer or successor, if LYNA is sold or merged. Your data would stay under this policy, and we would tell you at least 30 days before any change in how it is used.

9. International transfers

We store your data in the UK and EU. Some providers may access data from other countries, including the United States. When that happens we use a lawful transfer mechanism: a UK adequacy regulation (including the UK-US Data Bridge where the provider is certified), or the ICO's International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, with extra safeguards where needed. You can ask us for a copy.

10. Your rights

You have the right to:

• access a copy of your data
• correct data that is wrong
• delete your data
• restrict how we use it
• object to uses based on legitimate interests, including analytics; and to direct marketing at any time
• data portability: get your data in a machine-readable file
• withdraw consent at any time, without affecting what we did before
• not be subject to decisions based solely on automated processing that significantly affect you

Most of these you can do yourself in Settings › Privacy: download your data, change your choices, or delete your account. Otherwise email privacy@lyna.cam. We reply within one month, and may ask you to confirm your identity. Requests are free.

11. Complaints

If you are unhappy with how we use your data, tell us first at privacy@lyna.cam or through Settings › Privacy › Make a complaint. We acknowledge complaints within 30 days and tell you the outcome. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or 0303 123 1113. If you live in the EU, you can complain to your local data protection authority.

12. How long we keep data

13. Security

We encrypt data in transit and at rest, limit staff access to those who need it, keep research data separate from the key that identifies you, and review our security regularly. No system is perfectly secure. If a breach puts your rights at risk, we will report it to the ICO within 72 hours where required and tell you without undue delay.

14. United States residents

LYNA is not a healthcare provider and is not covered by HIPAA. Your health information is protected by this policy and by state consumer health privacy laws.

• Washington, Nevada and Connecticut residents: our Consumer Health Data Policy (lynahealth.app/consumer-health-data) explains what consumer health data we collect, why, who we share it with, and your rights. We collect and share consumer health data only with your consent or as needed to provide the service you asked for. We never sell it.
• California residents: we collect the categories in section 3, including sensitive personal information (health, account login). We use sensitive personal information only to provide the Service and as permitted by law, so a "limit the use" link is not required. We do not sell or share personal information for cross-context behavioural advertising. You have the rights to know, delete, correct and not be discriminated against.
• Breaches: we will notify you and the Federal Trade Commission as required by the FTC Health Breach Notification Rule.
• To exercise US rights, email privacy@lyna.cam or use Settings › Privacy. You may appeal any refusal by replying to our decision; if we deny your appeal, you can contact your state Attorney General.

15. Cookies and similar technology

Our website and app use cookies and software development kits (SDKs). See our Cookie Policy (lynahealth.app/cookie-policy) for details and choices.

App download links

When you tap one of our app download links, we count the tap on our own server and pass only the link, the store and the platform it was posted on to our analytics provider. No cookie is set, and your IP address is not shared.

16. Changes to this policy

We will tell you about significant changes by email or in the app at least 30 days before they apply. We will never start a new use of your health information without asking for your consent first. Earlier versions are available on request.