Your data, your call.

1. Who we are

anna app is provided by SIA anna app, a private limited company registered in the Republic of Latvia.

• Registration number: 40203715543
• Registered: 27 January 2026
• Registered office: Krišjāņa Barona iela 30A, Riga, Latvia
• Contact email: elina@annahealth.app
• Privacy enquiries: app@annahealth.app

SIA anna app is the data controller responsible for your personal data within the meaning of the UK GDPR, the EU GDPR, and applicable Latvian data protection law.

2. What personal data we collect

We collect different types of data depending on how you use anna.

Account data, date of birth and the signup questions are required to create an account, and anna cannot be provided without them. Connecting Apple Health is optional: you can use anna without it, though daily tips and the doctor report will have less to work with.

2.1 Account data

When you create an account:

• Full name
• Email address
• Date of birth (to confirm you're 18 or over)
• Password (stored hashed, never readable by us)
• Account creation date
• Subscription status

Sign-in methods available: email and password, Google account (we receive your name and email), or Apple ID (we receive your name and email, or an anonymous relay email if you choose).

2.2 Health data (sensitive personal data)

The most sensitive category we handle. Connecting Apple Health is your choice and you can disconnect at any time. The signup questions below are part of creating an account and cannot be answered later or removed separately.

Wearable data from Apple HealthKit:

• Heart rate variability (HRV)
• Resting heart rate
• Sleep hours and quality
• Body temperature
• Steps
• Respiratory rate

Cycle and reproductive health:

• Period start and end dates
• Flow intensity and symptoms
• Cycle phase and day
• Ovulation tracking
• Pregnancy tracking, if applicable

Daily check-ins (optional, you can skip every day):

• Mood (1 to 5 scale)
• Energy level (1 to 5 scale)
• Stress level (1 to 5 scale)
• Physical symptoms, such as headaches or cramps
• Personal notes

Your signup answers:

• Height, weight and date of birth
• Which stage of the transition you are in, and your period and cycle history
• Symptoms you report, and how severe they are
• Existing conditions you tell us about, such as thyroid conditions, PCOS, endometriosis, diabetes, heart conditions, autoimmune conditions, depression or anxiety, or a diagnosed cognitive condition
• Treatments you are using, such as HRT, hormonal contraception or antidepressants
• Sleep, mood, stress, sex drive, skin and digestion
• Whether you have a history of an eating disorder, if you choose to tell us
• Alcohol, smoking, caffeine, diet, allergies, eating patterns and exercise
• Your ethnic background, if you choose to tell us
• Family history of breast, ovarian or bowel cancer, and any known genetic marker, if you choose to answer
• Screening history, if you choose to answer

Medical documents (vault):

• Lab results (PDFs, images)
• Prescriptions
• Doctor visit notes
• Any health documents you choose to upload

2.3 Device and technical data

• Device type and model
• Operating system and version
• IP address, used for approximate region only
• Browser type (website only)
• App usage data, meaning which broad areas of the app are used and time spent
• Device identifiers for Apple HealthKit sync, and a pseudonymous analytics identifier that is not an advertising identifier

2.4 Payment data

• Subscription plan selected
• Purchase date and status
• Purchase confirmation from the Apple App Store

We don't store your card or banking details. All payments are processed by Apple.

2.5 Communication data

• Support messages you send us
• Survey responses
• Feedback

3. How we collect it

3.1 Directly from you

• When you create an account
• When you complete the onboarding health survey
• When you log a daily check-in
• When you track your period
• When you upload documents to the vault
• When you contact support

3.2 From your devices

• Apple HealthKit. With your permission, screen by screen, we sync data from Apple Health.
• Device sensors. We collect technical data when you use the app.

3.3 From third party services

• Google or Apple if you use social sign-in (name and email only)
• Analytics provider. Google Analytics, for both app and website usage statistics. In the app it records which broad areas are opened, such as home or settings, and a small number of milestones such as finishing signup. It never receives health data of any kind.
• Payment processor. Apple App Store, for subscription confirmation

We don't buy data from data brokers. We don't augment your profile with data from any source you have not chosen to share.

3.4 Cookies and similar technologies

Our website uses cookies to remember your preferences, keep the site secure, and understand how the site is used if you agree to it.

For website analytics we use Google Analytics, with IP anonymisation switched on. It sets cookies and loads only if you accept the separate Analytics choice in our cookie banner. If you reject non-essential cookies, it doesn't load and the site works exactly the same.

We also use Microsoft Clarity, which records replays and heatmaps of website pages with text and form fields masked, and which loads only if you accept Analytics. Clarity never runs on the perimenopause check at /check, whatever you choose. The Meta Pixel loads only after the separate Advertising measurement choice: accepting Analytics does not load it. When it loads, Meta receives a PageView and associated website, browser, cookie or click, and network context. anna does not send Meta quiz answers or results, health records, email addresses or customer lists. For that collection and transmission through the Meta Pixel, SIA anna app and Meta Platforms Ireland Limited may act as joint controllers under Meta's Controller Addendum. That joint responsibility is limited to the collection and transmission stage; Meta is responsible for its later processing under its own terms and privacy policy. See our Cookie Policy for details.

The perimenopause check at /check. The quiz runs in the tab you have open. Your answers and progress are held in that tab's session storage under anna_check_v1 and cleared when the tab or browser session ends. Your result is calculated locally in that tab from those answers. None of your answers, progress or result is ever sent to us, written to our database, or sent to any analytics or advertising tool. Your cookie choice is stored locally under anna_consent as category booleans for Analytics and Advertising measurement, the notice version 3.0 and the time you decided; it is not sent to our servers and no consent receipt or visitor identifier is created. If you accept Analytics, Google Analytics may receive only a page view and the generic events quiz_view, quiz_start, quiz_progress at 25%, 50% and 75%, quiz_complete and quiz_outbound, never your answers or result. If you accept Advertising measurement, Meta receives one page view from that page and nothing else. To prevent duplicates, a short list of those generic event names is kept for the current tab session, holding event names only.

4. How we use your data

4.1 To provide anna's core services (legal basis: contract and explicit consent for health data)

Daily tips.

• We analyse your health data using our own algorithm
• We compare your current data against your personal baseline
• We match patterns to our tip library of clinician-reviewed rules
• Anthropic AI helps phrase the tip in clear, supportive language

Vault assistant.

• When you upload documents, we extract text so you can search them
• When you ask a question, we use Anthropic AI to analyse your documents
• Conversation history is stored to improve future responses
• Your documents are never shared with anyone outside anna

Weekly insights.

• We analyse patterns in your data over 7 to 30 day windows
• Insights and recommendations are generated from your data only

Cycle and pregnancy tracking.

• Calculate cycle phases automatically
• Predict period dates
• Provide pregnancy information if you're in pregnancy mode

4.2 To improve anna (legal basis: legitimate interest)

• Analyse how people interact with features, pseudonymised
• Fix bugs and improve performance
• Test new features with aggregated data
• Improve tip accuracy and refine prediction models over time, using anonymised or aggregated data only

4.3 For research (legal basis: explicit consent, opt-in only)

If you opt in, we may share anonymised, aggregated data with research institutions studying women's health, and publish research findings that contain no personal data. You can opt in during onboarding or in Settings, and opt out at any time. If you opt out, your data is not used for research, and saying no doesn't affect your access to any anna feature.

4.4 Marketing and analytics (legal basis: consent and legitimate interest)

Email. Newsletters, health tips, product updates, and subscription offers. Unsubscribe link in every email.

Push notifications. Tip alerts, check-in reminders, important app updates. Disable in device settings.

App usage analytics.

• Which broad areas of the app are used, for example onboarding, home, guidance, paywall, settings
• Key milestones such as sign-up started, sign-up completed, and trial started
• App performance, errors, and crashes
• We never include health data in analytics. Symptoms, check-ins, wearable measurements, cycle data, personal notes, and uploaded documents are never sent to analytics tools
• Tools used: Google Analytics for Firebase, Sentry for crash and error monitoring

Advertising measurement.

• We measure whether our advertising brings people to anna using Apple's privacy-preserving attribution system (SKAdNetwork), which reports only anonymous, aggregated results
• We don't share any user-level data with advertising platforms. No device identifiers, no email addresses, and no customer lists are ever uploaded to an advertising platform
• We don't use advertising identifiers (IDFA), and we don't ask for tracking permission, because we don't track you across other companies' apps or websites
• Never shared: your health data, cycle data, symptoms, or personal notes, under any circumstances
• Tools used: Apple SKAdNetwork and Apple Search Ads

Marketing emails and push notifications can be turned off at any time, see section 10.1. Advertising measurement is anonymous and doesn't identify you.

4.5 Customer support (legal basis: contract and consent)

If you contact us, we access your account to help. We may review your health data only if it's relevant to the question you asked. Support is handled by email. We don't use a third party ticketing system.

4.6 Legal compliance (legal basis: legal obligation)

• Complying with laws and regulations
• Responding to lawful requests such as court orders
• Preventing fraud and abuse
• Protecting user safety

5. Who sees your data

We don't sell your data. Ever.

5.1 Service providers (data processors)

These companies process data on our behalf under written contracts. They cannot use your data for their own purposes.

5.2 Research partners (opt-in only)

If you consent, we share anonymised, aggregated data with universities and research institutions. Data is stripped of all identifiers before sharing. No partner can recover your identity from what we share.

5.3 Legal requirements

• Court orders or other legal processes
• To protect user safety
• To prevent fraud or illegal activity
• In connection with a merger or acquisition

We will challenge overbroad requests where lawful to do so.

5.4 With your explicit consent

For anything else, such as future sharing features, we ask first.

6. International data transfers

anna is based in Latvia (EU). Some service providers are outside the EU, including Anthropic, Google, Microsoft, Meta, Cloudflare, RevenueCat, Sentry, Klaviyo, and Apple.

Safeguards we use:

• Standard Contractual Clauses (EU Commission Decision 2021/914)
• EU-US Data Privacy Framework certification where the provider is certified
• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
• Documented Transfer Impact Assessments for each non-EEA processor

Your data is protected to the same standard regardless of where the processor is based.

7. How long we keep your data

• Active accounts. As long as your account is active.
• Inactive accounts. We retain your data so you can return and access historical patterns. If an account is inactive for 24 months we delete or anonymise it, and we email you 30 days before that happens. You can delete your account in Settings at any time.
• Deleted accounts. Personal identifiers such as name and email are removed immediately. All data is deleted from backups within 90 days. Exception: anonymised data may be retained if you opted in to research, because it cannot be linked back to you.
• Legal exception. Payment records retained for 7 years in compliance with Latvian tax law.

Deletion is permanent and cannot be undone.

8. Your rights

Under the UK GDPR and EU GDPR, you have the rights listed below.

• Right of access. Request a copy of all data we hold about you.
• Right to rectification. Correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"). Request deletion of your account and data.
• Right to data portability. Download your data in a structured, machine-readable format (JSON).
• Right to restriction of processing. Limit how we use your data in specific situations.
• Right to object. Object to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent. For health data processing, by deleting your account in Settings at any time. Marketing and analytics preferences can be changed separately in Settings without affecting your account.
• Rights related to automated decision-making. anna doesn't make solely automated decisions that produce legal or similarly significant effects on you. Daily tips are not automated decisions in the meaning of Article 22 GDPR.

Some rights may not apply where we have a legal obligation to keep data.

How to exercise your rights

• In the app. Settings, then Privacy, then the request you want to make.
• By email. app@annahealth.app
• Response time. Within 30 days. No charge for reasonable requests.

9. Children's privacy

anna is only for users 18 years or older. We don't knowingly collect data from anyone under 18. If we learn an account is held by someone under 18, we delete it immediately. If you're a parent and believe your child is using anna, write to app@annahealth.app.

10. Marketing and cookies

10.1 How to opt out of marketing

• Email. Unsubscribe link in every email.
• Push notifications. Disable in device settings, or in-app Settings, then Notifications.

For the complete list of cookies on annahealth.app, see our Cookie Policy.

11. Changes to this policy

We may update this policy from time to time. We notify you by:

• In-app notification
• Email, for material changes
• Posting the new policy on our website

The effective date is shown at the top of this policy. Continued use after the effective date means you accept the updated policy.

12. Complaints

If you're unhappy with how we handle your data:

1. Contact us first. app@annahealth.app
2. File a complaint with your data protection authority:
   • UK: Information Commissioner's Office (ICO), ico.org.uk
   • EU: Your national supervisory authority
   • Latvia: State Data Protection Inspectorate, dvi.gov.lv

13. Legal basis summary

14. Washington My Health My Data Act

Consumer health data covers period data, fertility status, symptoms, and pregnancy data. If you are a Washington resident, your rights:

• Confirm whether we process your health data
• Access your health data
• Delete your health data
• Withdraw consent, by deleting your account

We don't sell consumer health data.

15. Contact

For privacy questions, general support, or to exercise your rights:

• Email: app@annahealth.app

Thank you for trusting us with your health data. We take that seriously.