Kiyo Consumer Health Data Privacy Policy

Effective August 29, 2026

About this policy

This Consumer Health Data Privacy Policy supplements the Kiyo Privacy Policy and applies where information that Kiyo processes is "consumer health data" under the Washington My Health My Data Act. Kiyo is operated by 프로젝트줄라이 ("we", "us").

We do not sell consumer health data, and we do not use it for advertising.

Categories of consumer health data we collect, and why

We collect the following categories of consumer health data:

• Menstrual cycle records. Period start and end dates, whether a period is ongoing, the history of those records, average cycle length, period length, and your Cycle Syncing settings.
• Menstrual cycle records imported from Apple Health, if you choose to start an import.

We collect this data only if you turn on Cycle Syncing and give separate consent to it, and only to:

• show and predict your cycle phases and provide reference information in Kiyo; and
• sync those records between the devices you are signed in on, including the web version.

If you use Kiyo without an account, your menstrual cycle records stay in storage on your own device and we do not receive them.

We do not use consumer health data for any other purpose. Our usage records — which screens are opened and which features are used — never include the contents of your cycle records.

Categories of sources we collect it from

• You. The records you enter in Kiyo yourself.
• Your device. Menstrual cycle records held in the Apple Health app, read only if you start an import yourself and allow it in iOS. Kiyo never changes or deletes what is stored in Apple Health.

Categories of consumer health data we share

We share the categories listed above — menstrual cycle records, including any imported from Apple Health — only with the service providers that store and transmit them for us, and only so that Kiyo can work.

We do not sell consumer health data. We do not share it with advertisers, data brokers, analytics companies, or anyone else for their own purposes.

Categories of third parties and specific affiliates we share it with

We have no affiliates. Kiyo is operated by a single Korean sole proprietorship, and there are no parent, subsidiary, or sister companies to share data with.

We share consumer health data with these categories of third parties:

• Cloud service providers that process it on our behalf. Specifically Supabase Pte. Ltd and the sub-processors it engages, including Supabase, Inc. (support) and Amazon Web Services, Inc. (hosting) — our database, authentication and server functions. Our data is held in the AWS Asia Pacific (Tokyo) region (ap-northeast-1), in Japan. They may use it only to provide those services to us.
• Law enforcement or government authorities, only where the law requires it or where an investigative authority makes a lawful request following the procedures the law sets out.

How to exercise your rights

If you are a Washington consumer, you have the right to:

• confirm whether we are collecting, sharing, or selling your consumer health data, and to access it;
• receive a list of all third parties and affiliates we have shared or sold it to, and contact information for each;
• withdraw your consent to our collection and sharing of it; and
• have it deleted, including from our backups.

You can do the following yourself in Kiyo:

• Withdraw consent and delete: turn off Cycle Syncing in settings. Your cycle records are deleted without delay when you do.
• Delete everything: delete your account in settings.
• Access: your cycle records are shown to you in the app on the Cycle tab.

For anything else — including a request for the list of recipients — write to team@kiyoplanner.com.

We will respond without undue delay and within 45 days of receiving your request. If the request is complex we may extend that once by a further 45 days, and we will tell you why before we do.

If we deny your request, we will tell you why and how to appeal. If we then deny your appeal, we will give you a way to contact the Washington State Attorney General to submit a complaint.

Contact us

• 프로젝트줄라이 (Representative: 김솔)
• 강원특별자치도 삼척시 근덕면 용화해변 1길 40-14, Republic of Korea
• team@kiyoplanner.com

Changes to this policy

We will not collect, use, or share categories of consumer health data, or use it for purposes, that are not described in this policy without first disclosing them and obtaining your consent. When this policy changes, we post the change on kiyoplanner.com.