Consumer Health Data Privacy Policy

**Draft for legal review. Do not publish with placeholders.**

Effective date: `[DATE]` Version: `[VERSION]`

This Consumer Health Data Privacy Policy describes how `[NAVELLE LEGAL ENTITY NAME]` (“Navelle,” “we,” “us,” or “our”) collects, uses, discloses, and protects consumer health data through Navelle's website, web application, and related services. It supplements Navelle's general Privacy Policy.

## Consumer health data we may collect

Depending on the features you choose to use, consumer health data may include:

- Menopause stage and age range - Symptoms and symptom severity you choose to log - Mood information you choose to log - Sleep, movement, nutrition, pelvic health, sexual health, mental wellness, or stress information you choose to provide - Wellness goals and interests - Messages you choose to send to Mennie - Inferences or observations generated from information you choose to enter, such as non-clinical patterns in symptom or mood logs - Information showing your use of menopause-related educational content or features

Navelle Phase 1 does not request laboratory records, prescriptions, treatment records, insurance information, or medical-record numbers. Please do not submit those items through the platform.

## Sources of consumer health data

We collect consumer health data directly from you when you create a profile, track optional wellness information, use Mennie, save content, choose interests, participate in eligible features, or contact us. We may also generate limited non-clinical observations from information you choose to enter. We do not purchase consumer health data from data brokers.

## Why we collect and use consumer health data

We use consumer health data to:

- Provide the features you request - Display and maintain your optional symptom and mood history - Personalize educational content when you choose personalization - Generate optional Mennie responses after you provide AI consent - Maintain your chat history when enabled - Protect the platform, investigate security events, and prevent misuse - Comply with applicable law and respond to valid legal requests

We will not use consumer health data for materially different purposes without providing required notice and obtaining consent when applicable.

## Consumer health data we disclose

We may disclose limited consumer health data to service providers that process information on our behalf to operate, host, secure, support, or provide features of Navelle. Depending on the services enabled at launch, these providers may include:

- Lovable for application infrastructure and AI routing - OpenAI as the selected model provider for optional AI features - Supabase for authentication, database, file storage, and backend services - Cloud hosting, security, communications, accessibility, and customer-support providers approved by Navelle

Service providers may use the information only as permitted by contract and applicable law to provide services to Navelle. Complete the final policy with the current provider list and links before publication.

Navelle does not sell consumer health data. Navelle does not disclose consumer health data for targeted advertising. Navelle does not use health-related activity to create advertising audiences.

## AI processing

Mennie is optional. We process information through Mennie only after you provide affirmative consent. The information processed depends on your request and may include the message you enter and limited profile, symptom, mood, or wellness context needed to respond. Mennie is not a healthcare professional and does not provide diagnosis or treatment.

You may decline AI features and continue using non-AI features. You may later withdraw AI consent in Settings. Withdrawal stops future AI processing but does not automatically delete prior chat history unless you request deletion.

## Your rights

Subject to applicable law and permitted exceptions, you may request to:

- Confirm whether we collect or disclose your consumer health data - Access consumer health data associated with you - Correct inaccurate information - Delete consumer health data - Withdraw consent - Obtain a portable copy of information you provided - Appeal a denied privacy request when applicable

You may submit a request through `[PRIVACY REQUEST LINK]` or email `[PRIVACY EMAIL]`. We may need to verify your identity before completing a request. Authorized agents may submit requests where applicable law permits.

## Data retention

We retain consumer health data only as long as reasonably necessary for the feature you requested, the retention preference you selected, security, dispute resolution, legal compliance, and enforcement of our agreements. The final published policy must include Navelle's actual retention schedule for profile data, tracking data, AI chats, consent records, backups, and support records.

## Security

We use administrative, technical, and organizational safeguards designed to protect consumer health data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Navelle maintains an incident-response process and will provide legally required notices following a qualifying breach.

## International and cross-border processing

Navelle is based in the United States. If you access Navelle from Canada, your information may be processed and stored in the United States, where privacy laws may differ. We use contractual and technical safeguards designed to protect information processed by service providers.

## Changes to this policy

We may update this policy as our services or legal obligations change. We will post the updated effective date and provide additional notice or obtain renewed consent when required.

## Contact us

`[NAVELLE LEGAL ENTITY NAME]` `[MAILING ADDRESS]` `[PRIVACY EMAIL]`