Consumer Health Data Privacy Policy
Who we are. Orliea UG (haftungsbeschränkt), Germany, the company that runs the Orliea app for iOS and Android. Email: [email protected]. Company details and postal address: legal notice.
1. The consumer health data we collect, and how we use it
Everything in your Orliea record is consumer health data. You decide what to log; nothing is required beyond your email address, your name and your date of birth. The categories:
- Symptoms you track and how you rate them each day, with any notes
- Mood, energy, sleep, and how your day was
- Your menstrual cycle: period dates, flow, spotting, discharge, cramps, your typical cycle and period length, and your contraception if you tell us
- Conditions you have or suspect, with dates and notes
- Medications and supplements: what you take, doses, timing, whether you took them, side effects and how well they work for you
- Context: sleep, stress, alcohol, caffeine, exercise, water, food, whether you were ill, and the behaviour patterns you choose to track
- Food reactions and procedures you record
- Documents you upload (lab reports, scans, letters) and lab results you enter or have read from a document
- Free text wherever the app lets you write
- Your consent record, and the fact that you hold an Orliea account or subscription, which by itself shows that you use a women's health app
Purpose, and how it is used. One purpose: running Orliea for you. That means storing your record, showing it back to you in your log, calendar, charts, cycle view, big picture and the summaries you create, reading the values off a lab document when you ask, keeping it secure, and answering you when you write to us.
How it is processed. Your record is stored encrypted on servers in Frankfurt, Germany, and shown only to you on your signed-in device. Everything you see is arithmetic on your own entries: counts, averages, cycle day numbers, an estimate of your next period. Orliea does not interpret, diagnose, score or warn. The one use of AI is reading values off a lab document you upload, and only when you start it; you check every value before anything is saved.
What we do not do with it. We do not sell it. We do not use it for advertising and there are no advertising or tracking tools in the app. We do not share it with employers, insurers or data brokers. We do not train AI on it. We do not use it for any purpose other than running Orliea for you. If we ever want to collect a new category of health data or use your data for a new purpose, we will tell you first and ask for your consent before doing so.
2. Where it comes from
- You. Everything in your record was typed, tapped or uploaded by you in the app.
- A file you bring from another app. If you import your period history from another app, the file is read on your phone and only the list of period days is stored.
- Documents you upload, and the values read from them when you ask.
We do not buy, infer or receive health data from anyone else: no other apps, devices, data brokers or public sources.
3. Who we share it with
Categories of consumer health data shared with third parties: none. We do not share your consumer health data with any third party for its own purposes, and we have no affiliates. The list of third parties with whom we have shared or sold your consumer health data is empty.
Three legal exceptions, each described in the Privacy Policy: a lawful order from a court or authority (handled under German and EU law; we challenge unlawful requests and tell you unless the law forbids it); if Orliea is ever sold, your data goes with it under this policy and you get notice and the chance to delete first; if Orliea closes, you get 60 days' notice and export stays open.
Companies that work for us. A small number of companies process data on our behalf, under written contracts that let them act only on our instructions. The law does not count this as sharing. They are listed, with what each one handles and where, at orliea.app/providers. In short: Supabase (our database and file storage, in Frankfurt); Anthropic (reads the one lab document you ask us to read, and nothing else about you); Resend (sends our emails); Google Workspace (our mailbox); RevenueCat (knows whether your subscription is active, by a random id, never your name or email); Expo (delivers app updates; sees your phone's platform and a random install id, never your record). Apple and Google sell you the subscription directly under their own terms; they are not our processors and we never see your payment details.
4. Your rights, and how to use them
You have the right to:
- confirm whether we collect, share or sell consumer health data about you, and to access it;
- receive the list of third parties with whom we have shared or sold it (it is empty);
- withdraw your consent and have us stop collecting;
- have your consumer health data deleted;
- review and change anything in your record.
In the app: every entry in your record can be edited. Settings, Data & Privacy, Export my data gives you a complete copy. Settings, Data & Privacy, Delete my account and all data deletes everything, immediately and permanently.
By email: write to [email protected] from the email address on your account and tell us what you want. We may ask you to confirm from that address; that is how we check it is you. You never need to create a new account to use a right.
Timing. We answer within 45 days of your request, and we may extend once by another 45 days where a request is complex, telling you why within the first 45 days. A deletion made in the app takes effect at once. A deletion requested by email is completed within 30 days of confirming it is you, and we pass the deletion on to every company that processes data for us. Backup copies held by our database provider are removed within seven days.
Free, and no penalty. Using your rights costs nothing and we will never treat you differently for using them.
Appeals. If we refuse to act on a request, you can appeal: email [email protected] with "Appeal" in the subject line within 60 days of our answer. We reply in writing within 45 days with what we did or did not do and why. If we deny your appeal, you can complain to your state's Attorney General: Washington, atg.wa.gov/file-complaint; Nevada, ag.nv.gov (Office of the Attorney General, Bureau of Consumer Protection).
5. Tracking across websites
No third party collects consumer health data about you over time or across different websites or online services when you use the Orliea app or orliea.app. There are no advertising or tracking tools in either.
6. Changes to this policy
If we change this policy in a way that matters to you, we email every user at least 30 days before the change takes effect, and the version number and date at the top change. Previous versions stay available at orliea.app/privacy-archive.
7. Contact
Orliea UG (haftungsbeschränkt)
[email protected]
Postal address: see the legal notice
Version 1.0, 13 October 2026 · Privacy Policy · Who we work with