— Legal —
Privacy Policy
1. Data controller
Anna Sadliy Specialist in Gynaecology and Obstetrics MyGyno Große Ortstraße 85B 21762 Otterndorf Germany Email: mygyno@mygyno.org
2. General
Protecting your personal data is very important to us. To use the core features of MyGyno, a free registration with an email address and password is required so that your reports can be securely linked to your account. Registration, sign-in and account management are handled through our service provider Supabase, Inc., which operates the authentication service and the associated account database on our behalf (processor under Art. 28 GDPR). Only account data is processed there: your email address, your password (stored solely as a cryptographic hash), your name and technical sign-in information such as the time of registration and of the last login. Your symptom entries, reports and health-tracking data are not stored in this account database. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
2a. Scope of this policy
This privacy policy describes two separate areas: (a) the MyGyno mobile app and (b) this website, www.mygyno.org. Analytics, advertising and advertising-measurement services (Firebase Analytics, Google AdMob, Google UMP and the Meta SDK / Meta App Events) are used exclusively inside the mobile app — not on this website. Processing carried out by the website is described separately in section 15.
3. Processing of your input (health data)
Your answers about complaints and symptoms are processed only locally on your device to show you a first orientation. This information is not transmitted to us and is not stored permanently on our servers. If you wish to pass your report on to your doctor, this happens exclusively in the way described in section 4, through your own email app. This health data is not transmitted to analytics or advertising providers. Categories: information about symptoms, complaints, cycle and health history. Purpose: showing a first orientation. Legal basis: Art. 6(1)(b) GDPR in conjunction with Art. 9(2)(a) GDPR (explicit consent). How that consent is obtained: before any processing of health data begins, the app shows you a separate consent notice explaining which details are processed and for what purpose. You give your consent through a distinct, deliberate confirmation. That confirmation is not pre-selected, it is separate from registration and from accepting the Terms of Use, and it is voluntary. As long as you have not given this consent, no health data is processed; the symptom assessment is then unavailable, while you can continue to use the other areas of the app. To be explicit: neither using the app, nor opening a feature, nor creating an account, nor accepting this privacy policy replaces this consent or counts as such. You can withdraw your consent at any time with effect for the future by not using the feature any further and by deleting your stored reports or your account in the app. The lawfulness of processing carried out before the withdrawal remains unaffected.
4. Sharing your report with your doctor (done by you)
If you want to share your report with your doctor, the PDF is generated locally on your device. Your device then opens the operating system's share or send dialog: you choose your own email app yourself, enter the recipient yourself and start the sending yourself. The email is therefore sent through your own email provider directly to the practice you selected. The privacy terms of your own email provider apply to that transmission. Our servers do not receive or store the medical PDF as part of this sharing process. Because you generate the report yourself, choose the recipient yourself and initiate the sending yourself, no data is shared with unknown third parties. You are responsible for the correctness of the recipient address you enter.
5. Medical data is not used for advertising
MyGyno does not use medical, health-related or health-tracking data for advertising, advertising personalization, advertising targeting, advertising audiences or advertising signals. Such data is not transmitted to Google, to Meta or to any other advertising provider and is not included in analytics events or event parameters. This separation applies regardless of the privacy choices you make in the app.
6. App analytics: Google Firebase Analytics
In the mobile app we use Google Firebase Analytics (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for users outside the EEA, Google LLC, USA) to understand and improve the stability and usability of the app. Categories processed: a pseudonymous app instance identifier, usage events (e.g. screens opened and features used), app version, device model, operating system version, language setting and a coarse region derived from the IP address. Excluded: the content of your symptom entries, your reports and your health-tracking data are not transmitted as events or event parameters. Consent: collection follows the consent mechanism implemented in the app. You can refuse analytics consent, and you can change or withdraw your choice at any time later in the app's privacy settings. Analytics consent is separate from advertising consent — accepting advertising does not automatically mean accepting Firebase Analytics, and vice versa. Legal basis: Art. 6(1)(a) GDPR.
7. Advertising: Google AdMob / Google Mobile Ads SDK
The free version of the mobile app is supported by advertising and uses Google AdMob and the Google Mobile Ads SDK for this purpose (provider: Google Ireland Limited, Ireland; for users outside the EEA, Google LLC, USA). No advertising is delivered in the paid subscription. Technical categories processed in the current configuration: IP address (and the coarse region derived from it), device and app information (device model, operating system version, app version, language/region), ad interaction data (ad requests, impressions, clicks) and session-based signals used for ad delivery, frequency capping and the detection of fraud and invalid traffic. Not processed: medical and health-related data. It is never passed to the advertising SDK and is never used to select ads. Advertising content is not chosen on the basis of your symptom entries, reports or health history. Legal basis: Art. 6(1)(a) GDPR where consent is required for the relevant processing; consent is obtained through the privacy request described in section 8.
8. Privacy choices via Google UMP
To manage the applicable advertising and privacy choices we use the Google User Messaging Platform (UMP) inside the mobile app. Depending on the requirements that apply to you, a privacy request may be shown when you open the app, where you make your choice. You can change or withdraw your privacy choices at any time later through the privacy options available in the app. A withdrawal takes effect for the future and does not affect the lawfulness of processing carried out before it. Users in applicable U.S. states may additionally receive, through Google UMP, the privacy choices required under U.S. state privacy laws. Where applicable, these include the choices concerning the sale or sharing of personal information and concerning targeted advertising. You can call up and change these choices at any time through the privacy options in the app as well. The actual request is shown exclusively inside the mobile app. No AdMob or UMP request is displayed on this website.
9. Advertising identifiers
Depending on the platform and on your privacy choices, advertising identifiers may be used to deliver ads and to measure advertising. Section 9a applies in addition to advertising measurement with Meta. On iOS, the advertising identifier (IDFA) is only used if you have granted the corresponding permission through your device's App Tracking Transparency (ATT) prompt. If you do not grant that permission, or if it is not requested, the IDFA is not used and ads are not delivered on a personalised basis. On Android, the Google Mobile Ads SDK may access the Android Advertising ID (AD_ID) to the extent permitted by your privacy choices, in particular for ad delivery, frequency capping and fraud detection. The same advertising ID (AAID) may also be used for the advertising measurement with Meta described in section 9a, after the applicable consent. To be clear: we ourselves do not combine your data into cross-device or cross-app advertising profiles. However, where you have given the required consent — on iOS additionally the ATT permission — your conversion events are attributed to our advertising campaigns as part of the advertising measurement with Meta described in section 9a, which may involve cross-app or cross-service processing by Meta. Without that consent this does not take place. Medical or health-related data is never linked to advertising identifiers. You can control these identifiers yourself at any time: on iOS via “Settings → Privacy & Security → Tracking”, on Android via “Settings → Google → Ads”, where you can reset or delete the advertising ID. You can also change your advertising and privacy choices in the app at any time via the privacy options described in section 8.
9a. Advertising measurement with Meta
In the MyGyno mobile app (iOS and Android) we use the Meta SDK (Meta App Events) for advertising measurement and attribution. For users in the EEA, Switzerland and the United Kingdom the provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; for users outside these regions, Meta Platforms, Inc., USA. Purpose: to understand whether and how our ads on Meta platforms (e.g. Facebook and Instagram) lead to installs and completed actions in the app, and to measure the effectiveness of those campaigns (conversion measurement and attribution). Events sent to Meta are limited to general conversion events: app install or app launch, completed registration, purchase and subscription. Together with these events, technical information may be processed, such as a pseudonymous app or device identifier, the IP address, device and app information (device model, operating system version, app version, language/region), the time of the event and, for purchases, the amount and currency. No health data is sent to Meta: no health-related or medical data is transmitted to Meta. This applies expressly to symptom entries, diagnoses, examination and check results, pregnancy information, cycle-related information and the content of medical reports. Such data is not part of the transmitted events or event parameters, and no advertising audiences are built from it. iOS: the advertising identifier (IDFA) is accessed only after the required consent and after permission has been granted through your device's App Tracking Transparency (ATT) prompt. If you decline the ATT prompt, or if permission is not granted, the IDFA is not collected and is not transmitted to Meta; measurement then only takes place in a limited, aggregated form within the mechanisms provided by Apple. Android: on Android the Google Advertising ID (AAID / AD_ID) may be used for advertising measurement where this is permitted and after you have given the applicable consent. Consent and withdrawal: Meta measurement and tracking remains disabled until the required consent has been given; without consent, no events are sent to Meta. You can withdraw your consent at any time with effect for the future through the privacy options in the app. A withdrawal is respected and transmission to Meta stops from that moment; the lawfulness of processing carried out before the withdrawal remains unaffected. Legal basis: Art. 6(1)(a) GDPR (consent) and, where information stored on your device is concerned, Section 25(1) TDDDG. Meta's role and international transfers: for the processing carried out as part of this advertising measurement, we and Meta Platforms Ireland Limited are joint controllers in part within the meaning of Art. 26 GDPR, on the basis of the Controller Addendum provided by Meta. For Meta's own subsequent processing, Meta is solely responsible; details are set out in Meta's privacy policy. Where data is transferred to the USA or to other third countries, the transfer is based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where applicable, on the certification of Meta Platforms, Inc. under the EU-US Data Privacy Framework (Art. 45 GDPR); the agreements concluded with Meta apply in addition. Access to this data by U.S. authorities cannot be entirely ruled out.
10. Ad-free subscription
MyGyno is available in a free, advertising-supported version and in a paid, ad-free subscription version. While a subscription is active, no advertising is delivered. Purchase and billing are handled by the respective app store (Apple App Store or Google Play); payment data is processed by that store, not by us.
11. International data transfers
A transfer to third countries, in particular to the USA, may take place with the following service providers: Google (Firebase Analytics, AdMob, UMP and the consent-based Google Ads tag on this website), Meta Platforms Ireland Limited and Meta Platforms, Inc. (consent-based advertising measurement in the mobile app, see section 9a), Supabase, Inc. (authentication and account database of the app), Vercel Inc. (hosting of this website) and Plus Five Five, Inc. (Resend), USA (email delivery of enquiries sent through this website). This is based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where applicable, on the respective provider's certification under the EU-US Data Privacy Framework (Art. 45 GDPR). In addition, data processing agreements concluded with these providers apply.
12. Retention
Reports and history stored locally on your device remain until you delete them or delete your account. Your account data (email address, password hash, name, sign-in timestamps) is stored by our service provider Supabase, Inc. until you delete your account; deleting the account removes it there. Reports that you send to your doctor through your own email app are not stored by us. Server log data of this website is retained by our hosting provider Vercel Inc. only for a short period for security and operational purposes and is deleted afterwards. Information submitted through the forms on this website is stored by Plus Five Five, Inc. (Resend), USA for up to 30 days in line with our current Pro configuration, unless the actual account configuration changes. Analytics and advertising data is stored by Google according to the retention period configured in our Firebase and AdMob accounts and Google's own retention rules, and is then deleted or aggregated. The conversion events transmitted to Meta are stored by Meta in line with Meta's own retention periods and are then deleted or aggregated. Beyond that, we delete data as soon as the purpose of processing no longer applies and no statutory retention obligations prevent deletion.
13. Recipients / service providers
Supabase, Inc. — registration, sign-in and account database of the mobile app (processor). Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA — hosting and delivery of this website. Google Ireland Limited or Google LLC — Firebase Analytics (app analytics), Google AdMob / Google Mobile Ads SDK (advertising), Google User Messaging Platform (privacy choices), Google Ads tag (conversion measurement on this website, only after your consent). Meta Platforms Ireland Limited and Meta Platforms, Inc. — Meta SDK / Meta App Events for advertising measurement and attribution in the mobile app, only after the required consent (see section 9a). Plus Five Five, Inc. (Resend), USA — email delivery of enquiries sent through the forms on this website. Apple and Google — distribution and billing of the app through the respective store. Data processing agreements are in place with these providers where legally required. We do not use any other analytics, advertising or tracking services.
14. Permissions
The app only requests permissions when you actively use a feature that needs them. You can revoke permissions at any time in your system settings.
15. This website (www.mygyno.org)
On this website we use no AdMob, no Google Mobile Ads SDK, no UMP request and no Meta pixel or Meta SDK. We use two measurement tools here: the Google Ads tag (gtag.js, conversion ID AW-18391781385) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it solely to measure whether a visit to this website came from one of our Google Ads campaigns (conversion measurement). In doing so, your IP address, browser and device details, the page requested and the ad click identifier may be transmitted to Google, and cookies (including _gcl_*) may be set. This tag is only loaded after you have actively agreed in the cookie notice; without your agreement no script is loaded from Google and no such cookie is set. We use Google Consent Mode: without consent, ad_storage, ad_user_data, ad_personalization and analytics_storage remain set to “denied”. Legal basis: your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG; for the transfer to the USA, section 11 applies. You can change or withdraw your decision at any time with effect for the future via “Cookie settings” in the footer of this website. No health data is collected through this website and no health or medical data is transmitted to Google. In addition, for anonymous reach measurement we load the visit tracker of Metricool Software, S.L., c/ Téllez 12, Entreplanta H, 28007 Madrid, Spain (metricool.com). This script sets no cookies, stores no information on your device and does not assign you a unique identifier; it only transmits technical data of the page visit (including IP address, time, page requested, referrer) to Metricool. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in anonymous reach measurement). No health data is transmitted to Metricool either. This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the site, Vercel processes technically necessary server log data (including IP address, time, page requested, browser type, referrer) in order to deliver the site securely and reliably; legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Where data is transferred to the USA in that context, section 11 applies. All fonts are served locally from our own server. No Google Fonts are loaded from Google servers, so your IP address is not transmitted to Google for font loading. Your language selection is stored exclusively locally in your browser (localStorage). If you use the contact form for doctors, the information you enter is transmitted to us through our server function and our email service provider Plus Five Five, Inc. (Resend), USA for the purpose of delivering and processing your enquiry; legal basis: Art. 6(1)(a) or (b) GDPR. Plus Five Five, Inc. (Resend), USA stores this email data for up to 30 days in line with our current Pro configuration, unless the actual account configuration changes. The forms on this website are intended exclusively for ordinary contact and business enquiries — for example about cooperation with a practice. They are not a channel for medical reports, findings or any other health information. Please do not send medical or health-related details through these forms.
16. Complete account and data deletion
You can fully delete your account yourself at any time — directly in the app via “Delete account” on the home screen. This permanently removes your credentials (email, password, name) from the account database operated for us by Supabase, Inc., as well as all reports stored locally on your device and your entire history. This is not a partial deletion of selected data; it is a complete account deletion. On request we will additionally delete any email content sent to us — just send a short email to mygyno@mygyno.org.
17. Minimum age and adolescents
MyGyno is intended for users aged 16 and over. Only persons who are at least 16 years old may create an account. Background: under Art. 8 GDPR, consent-based processing in information society services is valid on the basis of the person's own consent only from the age of 16; EU member states may lower that age to as low as 13. In Germany, the age limit of 16 applies. If you live in a member state with a lower age limit, persons under 16 additionally require the consent or authorisation of the holder of parental responsibility — irrespective of this, we set the minimum age for MyGyno uniformly at 16. Because the app concerns particularly sensitive health data within the meaning of Art. 9 GDPR, we do not knowingly collect data from persons below this minimum age. If we become aware that an account has been created contrary to this requirement, we delete it together with the associated data without undue delay. Parents and legal guardians can contact us about this at any time at mygyno@mygyno.org.
18. Your rights (Art. 15–21 GDPR)
You have the right at any time to access, rectification, erasure, restriction of processing, data portability and objection. Consents you have given — in particular for analytics and advertising — can be withdrawn at any time with effect for the future through the privacy options in the app. Otherwise, contact mygyno@mygyno.org.
19. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live.
20. Changes
We may update this privacy policy to reflect current legal or technical requirements. The latest version is always available in the app and at this address. Last updated: 29 August 2026.