GaiaBerry App Privacy Policy

Who we are

GaiaBerry (Pty) Ltd, a South African company ("GaiaBerry", "we", "us"), is the responsible party for the personal information processed through the GaiaBerry app. This policy explains what we collect, why, how long we keep it, who we share it with, and your rights under the Protection of Personal Information Act, 2013 (POPIA).

Our designated Information Officer can be contacted at info@gaiaberry.co.za for any privacy request or complaint. You may also complain to the Information Regulator (South Africa) at inforegulator.org.za or complaints.IR@justice.gov.za.

Health information is special personal information

Information about your cycle, fertility, symptoms, pregnancy and medication is special personal information under section 26 of POPIA. We process it only with your explicit consent, which you give during onboarding, and only to provide the app's features to you. Every health question in the app is optional. You can withdraw consent at any time by deleting your data (see "Your rights").

What we collect

• Assessment answers: your main concern, symptoms, cycle details, stress, sleep and energy, how long you have been trying, age range and whether you take medication.
• Cycle and journal data: period dates and flow, symptoms, mood, cervical mucus, ovulation tests, basal body temperature, notes, programme reflections, checklist ticks and daily habits (drops, vitamin, water, tea).
• Pregnancy information: that you are pregnant and your due date, if you choose to enter it.
• Questions you ask Gaia and Gaia's answers.
• Account details: your email address and a user ID, once accounts are available.
• Subscription status: whether you have Premium, from Apple or Google. We never see your card details.
• Basic, non-health usage data: for example that a trial started or a product link was tapped, used only in aggregate.

What we do not do

• We never sell or rent your personal information.
• We never share your health information for advertising, and the app contains no third-party advertising.
• We never put health information in analytics or crash reports.
• We never send your name or email to the AI provider.

Why we use it (POPIA section 11)

• Consent: to process your health information and provide your plan, predictions, reminders and Gaia's answers.
• Contract: to provide your account and your Premium subscription.
• Legitimate interest: to keep the app secure, prevent abuse (for example, the free question limit), and improve the app using aggregate statistics.
• Legal obligation: to keep financial records where the law requires it.

Where your information is stored

Your cycle logs, journal, checklist, habits and chat history are stored on your phone. When you create an account, this information is also stored in our secure database so it can follow you to a new phone. It is encrypted in transit and at rest, and access rules ensure only you can read your own records.

Reminders (drops, vitamin, water, tea and your daily plan) are scheduled on your phone and do not send your information anywhere.

Gaia, our AI assistant

When you ask Gaia a question, our server sends your question, the recent conversation and limited context (your assessment profile, cycle day and phase, pregnancy status and whether you have Premium) to our AI provider, Anthropic PBC (USA), to generate an answer. We do not send your name, email or account ID.

Under Anthropic's commercial terms, information sent through its API is not used to train its models. Our server keeps a count of your questions and the processing cost to apply the free and fair-use limits; it does not keep the text of your questions. Messages that suggest a medical emergency or distress are answered on your phone with emergency and support numbers before anything is sent.

Gaia's answers are general wellness information, not medical advice (see our Terms of Use).

Who we share it with

We share only what each service needs to work, with operators bound to protect it (POPIA section 21):

• Supabase Inc. (USA): accounts and secure storage of your app data. Its servers may be located outside South Africa.
• Anthropic PBC (USA): generating Gaia's answers, as described above.
• Apple and Google: app distribution and subscription payments, under their own privacy policies.
• RevenueCat Inc. (USA): managing subscription status across Apple and Google, using an anonymous ID.

When you tap a product, it opens on gaiaberry.co.za, which is covered by the website's own Privacy Policy.

Cross-border transfers (POPIA section 72)

Some of these providers process information outside South Africa. We only use providers bound by data protection laws or contractual safeguards that give your information a level of protection comparable to POPIA, and you consent to this transfer when you agree to store your health information during onboarding.

How long we keep it

• On your phone: until you delete it or delete the app.
• In your account: until you delete your account. We then delete your records from our live database within 30 days and from backups within 90 days.
• Gaia usage counts: kept with your account and deleted with it.
• Financial records of subscriptions are kept by Apple and Google; any we hold are kept for 5 years as tax law requires.

Your rights

Under POPIA you may:

• ask what information we hold about you, and get a copy. In the app: Profile, then Download my data.
• ask us to correct it, or correct it yourself in the app.
• ask us to delete it. In the app: Profile, then Delete my account and data. This deletes everything immediately on your phone and, once accounts exist, in our database.
• withdraw your consent at any time, by deleting your data.
• object to processing and lodge a complaint with the Information Regulator.

Email info@gaiaberry.co.za for anything you cannot do in the app. We respond within 30 days. Deleting your data does not cancel a subscription; cancel that in your App Store or Google Play account.

Age

The app is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has used the app, contact us and we will delete their information.

Changes

We will tell you in the app about any material change to this policy before it takes effect. The current version is always available in the app and at gaiaberry.co.za/legal/app-privacy.