Legal

Privacy Policy

Your health is intimate. So is your data. Here we explain, in plain language, everything we collect, why, on which legal basis, and how you stay in control, in compliance with Brazil's General Data Protection Law (LGPD, Law 13.709/2018).

Last updated · October 21, 2026

1. Who is the Controller

The Controller of your personal data is Cynamon Health Tecnologia Ltda., a limited liability company organized under the laws of the Federative Republic of Brazil, headquartered in São Paulo, SP ("Cynamon", "we"). For anything related to this Policy, reach our Data Protection Officer (DPO) at [email protected].

2. One-page summary

We collect only what we need to personalize your cycle predictions, emotional check-ins, and the Cyna companion. It is all encrypted, stays under your control, and is never sold. You can access, correct, export, or delete your data anytime inside the app.

The essential commitmentsWe don't sell personal data. We don't share with advertisers. We don't use your history to train third-party AI models. We treat health data as sensitive (Art. 5, II, LGPD) and apply the reinforced safeguards required by Art. 11.

3. Definitions

  • Data subject: you, the individual to whom the personal data relates.
  • Personal data: information related to an identified or identifiable individual.
  • Sensitive personal data: data on health, sex life, genetic or biometric data, and other categories listed in Art. 5, II, LGPD. Most of what you log in Cynamon is sensitive data.
  • Processing: any operation involving personal data, such as collection, use, storage, sharing, or deletion.
  • Controller: Cynamon Health Tecnologia Ltda., which decides the purposes and means of processing.
  • Processor: a third party that processes data on behalf of Cynamon (hosting, transactional email, anti-fraud).
  • DPO: the person responsible for the communication channel with you and with the ANPD.
  • ANPD: the Brazilian National Data Protection Authority.

4. What data we collect

4.1. Account data

  • Name or nickname, email, and password (hashed).
  • Date of birth or age range, and language.
  • Optional profile photo and notification preferences.
  • Social login identifiers (Apple, Google) when you choose those options.

4.2. Health data (sensitive)

  • Period dates, flow, symptoms, and predicted cycle.
  • Mood, energy, sleep, pain, and any other markers you choose to log.
  • Free-form notes, optional photos (e.g. prescriptions, exams), and conversations with the Cyna companion.
  • Fertility, pregnancy, or breastfeeding data when you turn those modules on.
  • Journal: notes you write and parts of your conversation with Cyna that you choose to save, with one tap; each note can carry mood, topics, and symptoms. If you allow it, Cyna reads the notes from the last 14 days to personalize the conversation. You can turn this reading off at any time in the Journal and delete any note.

4.3. Usage and device data

  • App version, device model, operating system, language, and time zone.
  • Performance and diagnostics metrics (crashes, latency), pseudonymized.
  • IP address and connection logs collected under Brazil's Internet Civil Framework (Law 12.965/2014).
  • Essential cookies and, with your consent, analytics cookies.

4.4. Payment data

We do not collect payment data. Cynamon is free, has no paid subscriptions, and includes no in-app purchases.

5. How we collect

  • Directly from you, when you sign up, log data, or chat with Cyna.
  • Automatically, when you use the app (performance telemetry, essential cookies).
  • From partners you authorize to integrate (e.g. Apple Health, Google Fit), only with your explicit consent.

6. Why we use your data

  • Personalize cycle, fertility, symptom, and energy predictions.
  • Show insights, reports, and exports you can choose to share with healthcare professionals.
  • Keep the app running, authentication, multi-device sync, backups, and support.
  • Power the Cyna companion. Conversations stay on your device.
  • Prevent fraud, abuse, and violations of the Terms.
  • Comply with legal and regulatory obligations and respond to authorized requests by public authorities.
  • Send operational communications (security alerts, billing) and, with consent, product news.

7. Legal bases (LGPD Art. 7 and 11)

Each purpose has a specific legal basis. For sensitive health data, we rely on specific and prominent consent, except for the cases listed in Art. 11, II, LGPD.

  • Consent (Art. 7, I and Art. 11, I): cycle logging, symptoms, notes, and other health data.
  • Contract performance (Art. 7, V): account creation and maintenance, and providing the free Service.
  • Legal obligation (Art. 7, II): retaining access logs for 6 months (Internet Civil Framework), invoicing, and responding to authorities.
  • Legitimate interest (Art. 7, IX): information security, fraud prevention, and product improvement using pseudonymized data.
  • Health protection (Art. 11, II, "f"): only when you enable integrations with healthcare professionals you designate.

8. Who we share with

We only share with the processors strictly required to operate the service, always under contracts with data protection clauses equivalent to ours:

  • Cloud hosting (managed servers and databases, encrypted at rest).
  • Transactional email (password reset, security notices).
  • Artificial intelligence provider (OpenAI), only to generate Cyna's replies: your messages, a summary of your cycle and, if you allow Journal reading, the notes from the last 14 days. Under the API terms, this content is not used to train models.
  • Anti-fraud and abuse prevention.
  • Aggregate performance analytics (no personal identification).
  • CRM and marketing automation, only for those who leave an e-mail in the quizzes on this site: the address, the language and which quiz was taken. Nothing you record inside the app goes there, and you can ask for deletion at any time.
  • Public authorities, upon legal or judicial order.

We never share with advertisers or social networks the health data you record inside the app: cycles, symptoms, pregnancy, menopause and conversations with Cyna do not leave here. An up-to-date list of processors is available on request from the DPO.

With the person you choose, in partner mode. If you generate a partner code in the app, the person who uses it can see, read only, your cycle phase and day, your period prediction, your fertile window and, if you turn it on, your mood of the day. Notes, symptoms, conversations with Cyna and pregnancy data are never shown, and sharing is paused during pregnancy, postpartum and menopause. It depends on your specific consent (Art. 11, I, LGPD), recorded when the code is generated, and you can end it at any time, in the app.

With health professionals, only if you send the report. When you request the PDF report to take to an appointment, it is built on our server from your records for the period you chose and delivered only to you; the Journal is included only if you choose to include it, as a summary or in full. We don't send the report to anyone and we don't keep the file: we only record the requested period. You decide who to share it with.

With Google, if you connect Google Calendar. If you connect your Google account in the app, we create a separate calendar in it, called Cynamon, and your reminders become events there: title, time, repetition, end date and the reminder note, if any. We only ask for permission to create and manage the app's own calendars; we do not read or change any other event in your calendar. Cycle, predictions, symptoms, mood and conversations with Cyna never go to Google. The access key provided by Google is stored encrypted on our servers. Sending depends on your specific consent (Art. 11, I, LGPD), recorded when you connect, and you can disconnect at any time in the app: the Cynamon calendar is deleted from your Google account and access is revoked. If you delete your Cynamon account without disconnecting first, the Cynamon calendar stays in your Google account until you delete it there. Cynamon's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. International transfers

Some processors may store or process data outside Brazil (for example, in the United States or European Union). In those cases we apply the safeguards of Art. 33 of the LGPD, requiring standard contractual clauses, recognized certifications, or jurisdictions with an adequate level of protection. You can request details about these transfers at [email protected].

10. How long we keep your data

  • Account and health records: while your account is active.
  • After account deletion: personal data is erased within 30 days, except where retention is legally required.
  • Application access logs: 6 months (Internet Civil Framework, Art. 15).
  • Anonymized data: may be kept indefinitely for statistical purposes, with no possibility of re-identification.

11. How we protect your data

We apply technical and administrative measures to protect your data: TLS 1.3 in transit, AES-256 at rest, account-derived encryption for sensitive notes, least-privilege access, internal multi-factor authentication, 24/7 monitoring, and a formal incident response plan with notification within 72 hours, as required by Art. 48 of the LGPD.

12. Your rights as a data subject (Art. 18)

The LGPD grants you the following rights, exercisable at any time and free of charge:

  • Confirmation that we are processing your data.
  • Access to the data we hold about you.
  • Correction of incomplete, inaccurate, or outdated data.
  • Anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in violation of the LGPD.
  • Portability of data to another provider, in a structured and interoperable format.
  • Deletion of data processed under your consent.
  • Information about public and private entities with which we share data.
  • Information about the option not to provide consent and the consequences of refusing.
  • Revocation of consent, without prejudice to processing previously performed on a valid basis.
  • Objection to processing based on a legal basis other than consent, in cases of LGPD non-compliance.
  • Review of automated decisions that affect your interests (Art. 20).

13. How to exercise your rights

You can access, correct, export, or delete your data directly under Account › Privacy in the app. To revoke specific consents, use the toggles on the same screen. Requests that require manual review may be sent to [email protected]. We reply within 15 days of receipt, in line with the timeline recommended by the ANPD. We may ask for identity verification to protect your account.

14. Children and teens

Cynamon is intended for people aged 13 and older. For users under 18, processing follows the best interest of the teenager (Art. 14 of the LGPD) and requires specific consent from at least one parent or legal guardian. We do not require data beyond what is strictly necessary as a condition of use.

15. Automated decisions

We use statistical and machine learning models to predict cycles and symptoms and to power Cyna's responses. These predictions are informational and do not produce legal effects about you. You may request human review and explanations of the criteria via the DPO email.

16. Cookies and similar technologies

The landing page uses essential cookies and, with your consent, analytics cookies. You can review and revoke consent via the cookie banner shown on first visit or in your browser's settings.

In the landing page quizzes, when you start a quiz we store a random number in your browser, valid for one year, containing no name, e-mail or any data about you. It exists so we do not count the same person twice and, if you ask for the result by e-mail, to link that e-mail to the quiz you have just taken. It is not used outside this site and it disappears when you clear your browser data.

17. Data Protection Officer (DPO)

The DPO is the communication channel between you, Cynamon, and the ANPD. To reach the DPO, email [email protected] with the subject "DPO". We acknowledge receipt within five business days.

18. Complaints to the ANPD

If you feel we have not addressed your request adequately, you may file a complaint with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.

19. Changes to this Policy

We may update this Policy to reflect product changes, legal updates, or new security practices. Material changes will be communicated at least 30 days in advance by email and in-app, and the last-updated date appears at the top of this page.

20. Contact

Privacy questions, requests, or reports? Email [email protected]. Cynamon Health Tecnologia Ltda., São Paulo, SP, Brazil.