Orliea Privacy Policy

Previous version. Version 2.1 was in force from 9 October 2026 to 13 October 2026 and is kept here as published. The current privacy policy replaces it.

Version 2.1, effective 9 October 2026. Applies to the Orliea app on iOS and Android. The website orliea.app has its own privacy notice.

The short version

• Orliea is a record. You log how you feel, and we store it and show it back to you. We never diagnose, never give medical advice, and nobody at Orliea reads your entries.
• Your health data is used for one thing: running Orliea for you. That means storing your record, showing it back to you in your log, charts, cycle view and summaries, reading the lab reports you choose to upload, keeping it all secure, and answering you when you write to us. It is not sold, not used for advertising, and not used to train AI.
• We do not sell your data. No advertising, no ad tracking, no data brokers, no employers, no insurers.
• No AI is trained on your data. Not ours, not anyone else's.
• Your data is stored in Germany, by a German company, under European data protection law, wherever you live.
• You are in control. Export a copy or delete everything, at any time. Deleting is immediate and permanent.
• We tell you before anything changes. New provider, new feature that touches your data, new version of this policy: you hear about it first, by email.

The rest of this page explains each of those in detail.

1. Who we are

Orliea is run by:

Orliea UG (haftungsbeschränkt)
Ammerlander Hauptstr. 5, 82541 Münsing, Germany
Registered at Amtsgericht München, HRB 315939
Managing director: Hanna Metz
Email: [email protected]

In data protection language we are the "controller": the company responsible for your data. We have no data protection officer, because the law does not require one at our size, and no EU representative, because we are in the EU.

This policy covers the Orliea app. If you visited orliea.app or signed up to the launch waitlist there, the website's own privacy notice covers that.

2. What we collect

We collect only what the app needs to work. Nothing on this list is hidden, inferred or bought from anyone else.

2.1 Your account

• Your first name, or whatever you would like to be called. Used to greet you and printed on summaries you create.
• Your email address. It is how you sign in (we email you a one-time code; there is no password) and how we reach you about your account.
• Your date of birth. We check you are 18 or over when you sign up. You can also choose to print it on summaries you create, because clinics identify people by name and date of birth.
• Your consent record: that you agreed to this policy and to Orliea storing your health data, and when.
• Settings: your reminder preference and your language preference.

2.2 Your health record

This is the point of Orliea, and it is the most sensitive data anyone holds about you. In law it is "special category" data, which means it gets the strongest protection and can only be stored with your explicit agreement. You give that agreement when you tick the consent box at sign-up.

Everything below is optional in the sense that you decide what to log. Nothing is required.

• Symptoms: which ones you track, and how you rate them each day, with any notes.
• Mood, energy, sleep and how your day was.
• Your cycle: period dates, flow, spotting, discharge, cramps, your typical cycle and period length, and your contraception if you tell us.
• Conditions: diagnosed or suspected, with dates and notes.
• Medications and supplements: what you take, doses, whether you took them, side effects and how well they work for you.
• Context: sleep, stress, alcohol, caffeine, exercise, water, food, whether you were ill, and the behaviour patterns you choose to track.
• Food reactions and procedures you record.
• Documents you upload: lab reports, scans, letters, as PDFs or photos.
• Lab results you enter, or that are read from a document you upload (section 7).
• Links you make between records (for example, a document attached to a condition).
• Free text wherever the app lets you write: notes, concerns, descriptions. Please remember that free text can contain anything, including information about other people. We never analyse or search it. It is stored and shown back to you as you wrote it.
• Summaries you create from your record (a monthly summary or a summary for an appointment). A summary contains only what you tick, and printing your name and date of birth on it is your choice. Summaries are created on your phone from your record; we do not store them on our servers. Once you download or share a summary, that copy is under your control, not ours.
• Requests you send us through the Requests box: the type, what you wrote, and when. It may contain health details if you choose to write them.

2.3 Your subscription

Subscriptions are bought through the Apple App Store or Google Play. They handle payment. We never see or store your card details. From the store we receive a confirmation that you subscribed, the plan, its status (trial, active, cancelled) and its renewal date, so the app knows to let you in. We use RevenueCat to receive those confirmations from the stores (section 6). RevenueCat knows you by a random id we assign, never by your email.

2.4 Technical data

• Sign-in and session: when you sign in, and a session token stored on your phone so you stay signed in. The token is kept in your phone's secure storage.
• Server logs: our database provider keeps standard technical logs (the address your phone connects from, the time, what was requested, errors) for a short period set by our provider's plan, to keep the service running and secure.
• Error records: the app records its own failed saves and loads in an error table, so we can find faults. These records are stripped of health content before they are written, and they are deleted after 90 days.
• Lab extraction use: when you use lab extraction (section 7), we record that you did and when, nothing about the document, for 30 days, to limit misuse of the feature.
• App updates: when you open the app it checks Expo's update server for a newer version of the app's code. That check sends your phone's platform (iOS or Android), the app's version, a random identifier the app created on your phone (not a hardware ID), and, like any internet request, your IP address. It never sends anything from your account or your record. Expo is listed in section 6.
• Store statistics: Apple and Google show us how many people download and subscribe, by country, in aggregate. That comes from the stores, not from anything inside the app.

2.5 What we deliberately do not collect

• No location. Not your GPS, not your IP address stored against your account.
• No contacts, no photos beyond the documents you choose to upload.
• No advertising identifiers.
• No data from any other app or service. Everything in your record was typed, tapped or uploaded by you.

3. We do not track you

No advertising, no ad tracking. There are no advertising, marketing or attribution tools in the app that identify you, and there will not be. Nothing in the app tells an ad network who you are or what you do, we do not retarget you, and we do not upload user lists to advertising platforms. A build rule blocks such tools from being added, and it is checked every time the app is built. If we ever advertise Orliea, the app takes no part in measuring it. We see only numbers that identify nobody: the app stores' own aggregated reports, how many people used a promo code, and how many visits a campaign link brought to our website.

No analytics or crash reporting today. As of this version, the app contains no analytics tool and no crash-reporting service, so nothing inside the app reports what you do or what goes wrong to any other company. If we add one later, to find faults or to see which features are used, it will be set up so that nothing you logged can reach it, the company running it will be added to our providers page (section 6) with 30 days' notice, and this policy will say so.

The one thing stored on your phone is the sign-in token that keeps you logged in. It is not tracking, and it never leaves your phone except to prove to our servers that it is you.

4. Why we use your data, and the legal basis for it

European law requires us to name a legal reason for each use. Here they are, in plain words.

What we never do with it: sell it, use it for advertising, share it with employers, insurers or data brokers, train AI on it, or use it for any purpose other than running Orliea for you. If we ever want to use your data in a new way, we will ask first.

No automated decisions. Orliea does arithmetic on what you entered: counts, averages, cycle day numbers, an estimate of when your next period might start. It does not decide anything about you, score you, or assess your health. No decision with legal or similar effect is ever made about you by software.

5. Orliea never diagnoses

This belongs in the privacy policy because it is a promise about what we do with your data.

• Orliea is not a medical device and is not certified or registered as one.
• Orliea does not diagnose, treat, or give medical advice. It shows you what you recorded. Every chart, count and date in the app is arithmetic on your own entries.
• No doctor, nurse or other clinician reviews your data. Nobody at Orliea reads your entries.
• We will never contact you about your health, however your entries look. Orliea does not watch for problems and will not warn you.

Always talk to a qualified healthcare professional about your health. If you need help urgently, contact your doctor or your local emergency services.

6. Who we work with

We use a small number of companies to run Orliea. Each one has signed a data processing agreement with us, meaning they may only handle your data on our instructions and for our purposes. We keep the current list on a separate page, orliea.app/providers, and we give at least 30 days' notice on that page and by email before adding anyone new.

As of 9 October 2026:

Nobody else receives your data, with three exceptions, all explained below: if the law requires it (section 14), if Orliea is sold (section 12), or if Orliea closes (section 13).

7. AI in Orliea

Orliea uses AI for exactly one thing: reading the values off a lab report you upload, so you do not have to type them in. Nothing else in Orliea uses AI. Your daily check-in, your charts, your summaries and everything you see about your record are plain arithmetic on your entries.

This feature is switched on account by account. If it is not on for your account yet, the document step offers manual entry only, and nothing is ever sent to the provider below.

How it works, and what leaves Orliea:

• You start it. Extraction only runs when you tap "extract" on a document you uploaded. You can always enter values by hand instead. Starting it is how you agree to it, each time; the values it reads are stored under the health-data consent you gave at sign-up.
• Only the document goes. The request contains the document and the instruction to read the values. Nothing from your account and none of your other health data goes with it. Not your name, not your email, not your symptoms, not your other results.
• You can censor it first. Before extracting, you can black out anything printed on the document (your name, your clinic, your ID number). The censored copy is used for extraction and then deleted. The original stays uncensored in your record.
• You check every value. The AI pre-fills the form. Nothing is saved until you have reviewed it and tapped Save. The AI transcribes. It never interprets, flags, or comments on your results.
• The provider is Anthropic, an American company (contracting for customers in the EEA through Anthropic Ireland, Limited), through its Claude API, under a commercial agreement that includes a data processing addendum and the EU Standard Contractual Clauses for the transfer to the United States.
• Never used to train AI. Anthropic's commercial terms state that it may not train its models on customer content sent through the API.
• Retention at the provider. Anthropic does not keep the content of API requests by default and deletes any temporary copies within 30 days. One exception we want you to know about: if its automated safety systems flag a request as a possible misuse of its service, Anthropic may keep that content for up to two years. It may also keep its own safety rating of a flagged request for up to seven years. That rating is not your document or anything in it, only Anthropic's own assessment of the request. A lab report is very unlikely to trigger that, but it is their rule and we are telling you.

8. Where your data is stored, and transfers

Your record is stored in Frankfurt, Germany, wherever you live. We are a German company, so European data protection law (the GDPR) applies to everything we do with your data, whether you are in Berlin, Dublin or Denver.

Some of the companies we work with are outside the EU (section 6). Where data leaves the EU, it is covered by the EU Standard Contractual Clauses, a contract approved by the European Commission that binds the recipient to European standards. Where a US provider is also certified under the EU-US Data Privacy Framework, section 6 says so.

Requests from authorities. Because we are a German company holding data in Germany, requests for your data from any authority are handled under German and EU law. We would only hand over data where the law clearly requires it, we would challenge requests we believe are unlawful, and we would tell you unless the law forbids it. We hold as little as possible about you beyond your record itself, which is by design.

9. How we protect it

Honest description, no marketing words.

• Encrypted in transit and at rest. Everything between your phone and our servers travels over TLS. The database and the file storage are encrypted at rest on the server.
• Row-level isolation. Every row in the database is tied to your account, and the database itself refuses to show it to anyone else. This is enforced at the database layer, not just in the app.
• No passwords. Sign-in is by a one-time code to your email, so there is no password to leak. This also means your email account is the key to your Orliea account. Please keep it secure, and tell us if you think someone else has accessed it.
• Private documents. Uploaded documents live in a private storage area that only your account can reach, opened through links that expire within a minute.
• No tracking surface. No third-party tools inside the app means fewer places for data to leak.
• Access. Only the managing director has access to production systems. No contractor or investor has access to real records.
• What we do not claim. We do not offer end-to-end encryption, and we do not claim that only you can read your data. Our systems can read it in order to show it to you. We say this plainly because some apps in this space have implied otherwise.

If something goes wrong. If we ever have a data breach that puts you at risk, we will tell you without undue delay, and we will notify the Bavarian data protection authority within 72 hours as the law requires.

10. How long we keep it, and deleting

• While your account exists: your record is kept so you can use it.
• When you delete your account: everything is deleted immediately and permanently: your account, your whole record, your uploaded documents, your consent record. The deletion runs as one operation across the whole database. We cannot recover it, so get a copy first if you want one. Copies in our provider's routine backups are deleted on a short rolling schedule.
• If you stop using Orliea: an account that has not been opened for three years is deleted, with everything in it, in the same way as when you delete it yourself. We email you 60, 30 and 7 days before, with how to download a copy first. Opening Orliea once is enough to keep your account. An account with a running subscription, or a free account we have given you, is never deleted this way.
• Requests box messages: deleted automatically 12 months after you sent them. The copy emailed to us is deleted once we have dealt with it.
• Emails you send us: kept 12 months after the matter is closed, then deleted.
• Sign-in codes: valid for one hour, then useless.
• Subscription confirmations: deleted with your account. Apple and Google keep their own purchase records under their own rules.

Deleting is in the app: Settings, Data & Privacy, Delete my account and all data. Two taps and a confirmation. You can also request deletion as described on orliea.app/support or by email, and we will do it for you.

11. Your rights, and how to use them

Under the GDPR, and we apply the same rights to everyone wherever you live:

• Access: a copy of everything we hold about you.
• Export (portability): your data in a machine-readable format. Settings, Data & Privacy, Export my data gives you a complete copy at any time. You can also ask us by email and we send it within a month.
• Correction: everything in your record can be edited in the app. Your name and settings too. Email us for anything you cannot change yourself.
• Deletion: section 10.
• Withdraw consent: Orliea cannot work without storing your health data, so withdrawing that consent means deleting your account, which you can do at any time.
• Restriction and objection: you can ask us to pause or stop a particular use of your data.
• Complain: you can complain to a data protection authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. You can also complain to the authority in your own country.

To use any right, email [email protected]. We answer within one month. We may ask you to confirm it is really you, usually by replying from your account email.

If you live in the United States: you have the same rights as everyone else above. We never sell your data and never share it for advertising, so there is nothing to opt out of.

12. If Orliea is sold

If Orliea is ever sold or merged into another company, your data would go with it, under this policy and no weaker one. Before that happens you would get an email with notice and the chance to export and delete your data first.

13. If Orliea closes

If we ever stop running Orliea, we will give you at least 60 days' notice by email, keep export working throughout, and then delete all user data.

14. If the law requires it

We will disclose data where a law, a court or an authority requires it, in the way described in section 8. We will not disclose anything to anyone on a voluntary basis.

15. Age

Orliea is for people aged 18 and over. We check your date of birth at sign-up. Orliea is not directed at children and we do not knowingly hold data about anyone under 18. If you believe we do, email us and we will delete it.

16. Changes to this policy

When we change this policy in a way that matters to you, we email you at least 30 days before it takes effect, and the version number and date at the top change. Previous versions stay available at orliea.app/privacy-archive. If you do not agree with a change, you can export your data and delete your account before it takes effect.

Small changes (a typo, a new address) may be made without notice, and the date at the top still changes.

17. Contact

Orliea UG (haftungsbeschränkt)
Ammerlander Hauptstr. 5, 82541 Münsing, Germany
[email protected]

Orliea is a record of what you tell it. It is not a doctor, and it never will be.

Version 2.1, 9 October 2026 · Previous versions · Who we work with