Kiyo Consumer Health Data Privacy Policy

Effective September 3, 2026

About this policy

This Consumer Health Data Privacy Policy supplements the Kiyo Privacy Policy and applies where information that Kiyo processes is "consumer health data" under the Washington My Health My Data Act. Kiyo is operated by Project July ("we", "us").

We do not sell consumer health data, and we do not use it for advertising.

Categories of consumer health data we collect, and why

We collect the following categories of consumer health data:

• Menstrual cycle records. Period start and end dates, whether a period is ongoing, the history of those records, average cycle length, period length, and your Cycle Syncing settings.
• Menstrual cycle records imported from Apple Health, if you choose to start an import.

We collect this data only if you turn on Cycle Syncing and give separate consent to it, and only to:

• show and predict your cycle phases and provide reference information in Kiyo; and
• sync those records between the devices you are signed in on, including the web version.

If you use Kiyo without an account, your menstrual cycle records stay in storage on your own device and we do not receive them.

We do not use consumer health data for any other purpose. Our usage records — which screens are opened and which features are used — never include the contents of your cycle records.

Categories of sources we collect it from

• You. The records you enter in Kiyo yourself.
• Your device. Menstrual cycle records held in the Apple Health app, read only if you start an import yourself and allow it in iOS. Kiyo never changes or deletes what is stored in Apple Health.

Categories of consumer health data we share

We share the categories listed above — menstrual cycle records, including any imported from Apple Health — only with the service providers that store and transmit them for us, and only so that Kiyo can work.

We do not sell consumer health data. We do not share it with advertisers, data brokers, analytics companies, or anyone else for their own purposes.

Categories of third parties and specific affiliates we share it with

We have no affiliates. Kiyo is operated by a single Korean sole proprietorship, and there are no parent, subsidiary, or sister companies to share data with.

We share consumer health data with these categories of third parties:

• Cloud service providers that process it on our behalf. Specifically Supabase Pte. Ltd and the sub-processors it engages, including Supabase, Inc. (support) and Amazon Web Services, Inc. (hosting) — our database, authentication and server functions. Our data is held in the AWS Asia Pacific (Tokyo) region (ap-northeast-1), in Japan. They may use it only to provide those services to us.
• Law enforcement or government authorities, only where the law requires it or where an investigative authority makes a lawful request following the procedures the law sets out.

How to exercise your rights

If you are a Washington consumer, you have the right to:

• confirm whether we are collecting, sharing, or selling your consumer health data, and to access it;
• receive a list of all third parties and affiliates we have shared or sold it to, and contact information for each;
• withdraw your consent to our collection and sharing of it; and
• have it deleted, including from our backups.

You can do the following yourself in Kiyo:

• Withdraw consent and delete: in settings, tap Withdraw cycle syncing consent. Your cycle records are deleted from this device straight away and removed from our servers the next time the app syncs. Withdrawal applies to your whole account, so the other devices you are signed in on delete their copies as well.
• Turn the feature off without deleting: the Cycle Syncing switch stops the feature but keeps your records, so you can turn it back on later. Use Withdraw cycle syncing consent if you want the records gone.
• Delete everything: delete your account in settings.
• Access: your cycle records are shown to you in the app on the Cycle tab.

For anything else — including a request for the list of recipients — write to team@kiyoplanner.com.

We will respond without undue delay and within 45 days of receiving your request. If the request is complex we may extend that once by a further 45 days, and we will tell you why before we do.

If we deny your request, we will tell you why and how to appeal. If we then deny your appeal, we will give you a way to contact the Washington State Attorney General to submit a complaint.

Contact us

• Project July (Representative: Sol Kim)
• 40-14, Yonghwahaebyeon 1-gil, Geundeok-myeon, Samcheok-si, Gangwon State, Republic of Korea
• team@kiyoplanner.com

Changes to this policy

We will not collect, use, or share categories of consumer health data, or use it for purposes, that are not described in this policy without first disclosing them and obtaining your consent. When this policy changes, we post the change on kiyoplanner.com.