MenoSera Privacy Policy

Last updated: October 13, 2026

MenoSera is operated by AUROQ LIMITED ("AUROQ", "we", "us" or "our"). This Privacy Policy explains how we handle personal information when you use MenoSera and contact us. AUROQ LIMITED is responsible for the processing described here and, where applicable, acts as the data controller. You can contact us at auroq.global@gmail.com.

MenoSera supports personal health recording, education and preparation for conversations with healthcare professionals, including during perimenopause and menopause. The information you choose to record can be sensitive. This Policy describes the controls that apply to that information. It does not itself obtain your consent to access Apple Health, process sensitive information in the cloud or send information to an AI provider; those choices require the relevant permission or consent when the feature is offered.

Features vary by app version, device and region. Optional account, synchronization, AI and paid features are covered only when they are available and you use them. Their inclusion here does not mean that every feature is available in your version of MenoSera.

1 Information we handle

Information you provide

Health records and profile. Depending on the features you use, you may enter age or age range, menopause or menstrual background, symptoms and severity, bleeding or menstrual dates, sleep, mood, concentration, energy, pain, physical measurements, activity, fluid intake and related notes. Optional medical profile fields may include relevant conditions, surgery, treatment history, contraception, medicines, hormone therapy and supplements. Intimate, urinary, vaginal and sexual health information may reveal information about your health or sex life.

Treatment records. You may record a treatment plan, schedule, dose as entered by you, actual use, missed entries and personal observations. A planned entry and a record of actual use are separate information. We do not infer that a reminder was delivered, or that a medicine was taken, solely because a schedule exists.

Uploaded reports. When you upload a clinical report, we handle the selected image, PDF or text and information extracted from it, such as dates, test names, values, units, reference ranges and your corrections. The original may also contain your name, date of birth, hospital number, clinician details or other identifiers. Removing visible identifiers can reduce disclosure, but does not guarantee that a report is anonymous.

Private journals and photographs. If you use journal features, we handle the text and photographs you select. Journal content is private to your use of the service. It is not automatically included in AI requests or healthcare summaries merely because it is stored in MenoSera.

AI interactions. If you choose an AI feature, we handle your question, the information you authorize for that request, relevant conversation messages, any conversation summary and the resulting explanation. Questions and answers can themselves contain sensitive health information. You can use general information features without authorizing access to your personal health records.

Support and optional account information. When you contact us, we receive your email address, message and attachments. Please avoid sending a full medical record when a brief description is sufficient. If an account or synchronization feature is offered, its sign-in screen explains the account identifiers and information needed to provide it. An account is not required merely to send us a privacy request.

Information from your device and service providers

Apple Health. If an Apple Health connection is available and you grant permission, we read only the data types requested for that feature and authorized by you. These may include sleep, activity, heart measurements, body measurements or menstrual information, as specifically identified in the permission flow. A category listed here is not a request for every data type in that category. Access is optional and read-only. MenoSera does not write entries to Apple Health.

Purchases. If you purchase through an app store, the store processes payment details under its own terms and privacy policy. We may receive product identifiers, transaction or receipt references, subscription status and entitlement information needed to provide access and resolve purchase issues. We do not receive your complete payment card details from an Apple in-app purchase.

Technical information. Online features may generate IP addresses, request identifiers, app and operating system versions, device or language settings, error information and security logs. An IP address may indicate an approximate location; we do not request GPS access to provide the health recording features described here. We minimize identifiers and exclude report contents, health values and conversation text from ordinary analytics and diagnostic events.

If optional usage analytics are offered, their notice explains the events and provider involved. We obtain a separate opt-in before collecting those events, and withdrawal stops new optional analytics collection. A random identifier remains personal information if it can be linked to a user; it is not automatically anonymous. We do not access your microphone, audio recordings, entire photo library or unrelated files to provide the features described in this Policy.

2 Why we use information

We use information to save and display your records; calculate the trends and comparisons you request; manage your chosen reminders; extract information from reports; provide authorized AI explanations; prepare summaries you choose to export; administer available accounts and purchases; respond to support or privacy requests; and protect the service against misuse and security incidents.

A healthcare summary uses the information you select for that summary. A report-specific question uses valid information from the selected report and relevant information you provide in that report's conversation. Report-specific chats do not load other reports, health records, journals, intimate health entries or medical profile fields from the app. A separate general record explanation feature may use relevant records within the scope you authorize for that feature. A general knowledge question does not use your personal records.

We do not sell personal information, share it for cross-context behavioral advertising or use health information to target advertising. We do not use your reports, health records or private conversations to train general-purpose AI models or create profiles for other users. AI processing is not permission to use private information in marketing. We require appropriate restrictions on service providers before enabling processing of this information.

3 Legal grounds and sensitive information

Where a law requires a legal basis, we use the basis appropriate to the specific activity. This may include performing our agreement with you to deliver a feature you request; complying with a legal obligation; obtaining your consent for an optional activity; or pursuing legitimate interests such as proportionate security and fraud prevention, where those interests do not override your rights.

Health and sex life information may receive additional protection under applicable law. Where required, we obtain explicit consent, separate consent or another valid sensitive-data authorization before the relevant processing. A contract, device permission or acceptance of our Terms of Use is not automatically a substitute for that authorization. We do not rely on a broad security or product improvement purpose to justify unrestricted access to health content.

You can withdraw consent for future processing through the available controls or by contacting us. Withdrawal does not make earlier lawful processing unlawful. An optional feature may stop working if the necessary authorization is withdrawn. Where a different lawful ground requires limited retention, we explain the relevant information and purpose rather than treating withdrawal as permission to keep using it for unrelated activities.

4 Permissions and processing choices

Records used only by an on-device feature remain on your device; AUROQ does not receive them merely because you save or view them locally. A cloud feature transmits the information needed for the authorized operation. Choosing that feature does not automatically enable synchronization of all local records. Any optional synchronization feature explains its data scope and storage arrangements before you enable it.

Device permissions and cloud consent serve different purposes. Permission to select a photograph or read Apple Health data does not itself authorize uploading that information to an AI provider. Before a cloud report analysis or personal AI request, the feature identifies the information to be sent, its purpose, the recipient or active provider, and material processing and retention conditions, and obtains your explicit permission before transmission.

Camera and photo access is limited to the inputs you choose. File access is used for the documents you select. Notification permission is used for the reminders you enable. Notifications may appear on a lock screen or a connected device. Generic notification wording limits exposure, but any custom wording you choose may reveal information to someone who can see that device.

You can change device permissions in system settings. Refusing an optional permission does not authorize another way to obtain the same information. Basic local features that do not need the refused permission remain available where supported. Revoking Apple Health access stops new authorized reads; deleting MenoSera copies does not, by itself, delete source entries in Apple Health or change Apple's permissions.

5 AI services and uploaded reports

When a cloud AI feature is enabled, our backend may use a permitted, configured business API service from OpenAI or Google Gemini. We identify the active service before personal information is sent. We do not silently treat all available providers as interchangeable recipients. A material change in provider, purpose or data scope is disclosed before the new processing, with renewed consent where required.

We send the information needed for the request, rather than automatically sending every uploaded report or the complete conversation history. Report follow-up questions may use the current valid report facts, necessary source excerpts, relevant unexpired messages and a limited conversation summary. Information you provide in that conversation remains user-provided context and is not automatically saved as a health record. Correcting a report invalidates dependent explanations and conversation context. Information outside the authorized scope is excluded. Text recognition is used to read report text and tables; uploading a medical image does not authorize diagnostic interpretation of that image.

For an AI report explanation, we send validated extracted fields and only the necessary de-identified source excerpts. Direct identifiers and candidate fields that have not passed validation are excluded from that request. Cloud text recognition may need an original file that still contains identifiers; in that case, a separate upload notice explains that disclosure and obtains your explicit permission before upload. De-identification is not a promise that the remaining information cannot identify you.

Providers may retain request information or service logs according to the particular API service, contract and configuration. We disclose material conditions for the active route. We do not promise universal zero retention, no human access or immediate deletion of every provider log. We do not send sensitive health content through a provider route that permits incompatible general model training or does not permit the intended use.

You can read the providers' general information at OpenAI Privacy Policy, OpenAI API Data Controls, Google Privacy Policy and Gemini API Terms. These materials do not replace the notice for the specific route used by MenoSera.

6 Recipients and disclosures

Service providers. Where cloud features are available, hosting, storage, text recognition, AI, security or support providers may process the information necessary for their work under appropriate contractual and access restrictions. A cloud or AI feature identifies material recipients before sensitive information is sent. Providers are not authorized to use private health content for their own advertising or unrelated profiling.

People or services you choose. You may save, copy or share a summary or report with a clinician, another app or another person. We do not contact a clinician or send a report to an external chatbot simply because you created an export. If you choose an external service, including ChatGPT, its own terms and privacy practices govern the copy you send. We cannot recall an exported copy from its recipient.

Legal and safety disclosures. We may disclose the minimum information reasonably required to comply with a binding legal obligation, protect legal rights or respond to a legally justified safety or security issue. We assess requests and applicable restrictions rather than granting unrestricted access to all health information.

Business changes. If an acquisition or reorganization affects the service, information may transfer subject to applicable law, appropriate safeguards and continued protection for the purposes described here. We provide notice and obtain additional authorization where required before materially different processing.

7 Retention and deletion

Saved records and reports. Information you choose to save is retained for the feature while you keep it, subject to your deletion choices and any clearly disclosed retention setting. A saved report is separate from its AI conversation; expiration of the conversation does not automatically delete a report you chose to retain.

Conversations and summaries. For an enabled online AI feature, our default retention limit for ordinary and report AI messages is 30 days from each message's creation, and for a limited conversation summary is at most 90 days from its creation. A shorter limit applies if you delete the conversation, withdraw the relevant processing scope or its source information expires. Updates do not extend retention of original sources or indefinitely renew a summary's expiry. Expired or deleted source information is removed from associated conversation memory and excluded from new AI requests, even if the summary's own limit has not yet been reached.

Temporary files. Upload and processing copies are removed when their task is completed, cancelled or fails. We aim to clear abnormal temporary remnants within 24 hours. Removing our copy does not automatically delete a provider's copy; we also issue deletion instructions supported by the provider, subject to the disclosed service conditions and applicable law.

Recovery and permanent deletion. Where a record has a recovery period, the deletion screen identifies it; the normal recovery period is 30 days. A permanent deletion option removes the recovery copy. Deletion or withdrawal of a processing scope stops new processing of the affected information without waiting for that recovery period.

Deleting an uploaded report covers its stored original, extracted fields and revisions, generated explanation, and associated report conversation and memory. A medicine record you separately confirmed and saved is an independent record that you can delete separately. Where you have kept a historical healthcare summary, we explain whether it is retained and offer deletion of that snapshot. A retained snapshot is not a way to reintroduce deleted information into new AI processing.

Cloud completion and exceptions. Our operational target is to complete deletion from our cloud systems, processor resources and recoverable backups within 30 days. The interface or our response distinguishes a completed request from one that is pending or delayed, including an incomplete backup or provider deletion. Applicable legal deadlines still govern your rights. A technical target is not a promise that every independent provider's legally required security log disappears immediately.

Until deletion is confirmed, affected backup copies are restricted and are not used for ordinary processing; if a backup is restored, deletion instructions are reapplied. A technical delay is tracked as incomplete deletion rather than a completed request. Any longer retention required by law, a specific legal claim or a justified security incident is limited to the information, purpose and period actually needed. We identify a relevant exception when responding to a deletion request, subject to lawful restrictions on disclosure. We do not use an unspecified backup or legal exception to retain all health content indefinitely.

Support correspondence and necessary transaction, security and consent records are retained only for the relevant purpose and applicable legal period. If optional usage analytics are enabled, identifiable raw events are retained for no more than 90 days; aggregate statistics may be kept for up to 24 months only where they no longer identify you. These limits do not authorize collection of health payloads in analytics.

Deleting the app may remove local data but does not necessarily delete a cloud copy or cancel an app store subscription. Use the available data deletion controls or contact us for cloud deletion, and manage subscriptions separately in your app store account.

8 Security and storage

We use reasonable technical and organizational measures appropriate to sensitive information, including restricted access, secure transmission for online services and controls over service providers. No system is completely secure. This Policy does not represent that all local storage is end-to-end encrypted or that every provider offers the same security configuration.

Keep your device, account credentials and exported files secure. Someone with access to an unlocked device, notification preview, shared folder or exported document may be able to see your information. We do not provide our own iCloud storage for personal health information. Apple's storage and synchronization of source Apple Health data are governed by Apple and are separate from MenoSera. If an optional MenoSera synchronization service is offered, its storage arrangement is disclosed before you enable it.

If a security incident requires notification under applicable law, we notify affected people and authorities as required and take reasonable steps to address the incident. We do not represent that every use of MenoSera is subject to the same healthcare regulatory regime in every country.

9 International processing

An online service may process information outside the country where you live. The active cloud feature identifies the relevant provider and material processing locations or region information before a sensitive-data transfer. We apply the safeguards required for the relevant transfer, which may include an adequacy decision, approved contractual safeguards or a legally valid transfer authorization, as appropriate.

A statement that MenoSera serves global users is not blanket permission to transfer health information to any country. If applicable law requires a separate transfer notice, consent, representative or other arrangement, we provide or implement it before the processing that requires it. Some features may therefore be unavailable in a region until the necessary arrangements are in place.

10 Your privacy rights

Depending on your location and the applicable law, you may request access to or a copy of your information; correction; deletion; restriction of or objection to particular processing; portability; withdrawal of consent; and information about recipients and processing. Where applicable, you may also challenge a rights decision, use an authorized agent, or complain to the relevant privacy regulator. We do not deny ordinary service or retaliate against you for exercising a protected privacy right.

Use the available app controls or email auroq.global@gmail.com. Describe the request and enough information for us to locate the relevant records. We may request proportionate verification to protect against disclosure to someone else. We do not routinely require a government identity document or your full medical report. If data exists only on your device and we do not hold a copy, we explain the available local controls rather than claiming that we can remotely access or erase it.

We respond within the period required by the law that applies to your request and explain a permitted extension, refusal or limitation where required. Our 30-day cloud deletion target does not replace a legal response deadline. EU and UK users may complain to their relevant supervisory authority. If a US state law gives you an appeal right, you may request an appeal through the same email address and we explain any further complaint route that applies.

11 US consumer health information

Where a US consumer health privacy law applies, the protected information may include reproductive or sexual health records, symptoms, treatment information, clinical reports, health questions and inferences about health, even if those inferences are not medically verified. We collect this information from your entries, selected uploads, specifically authorized Apple Health data and the explanations or summaries you request.

We use it for the requested recording, report, reminder, educational and summary functions described in Sections 2 to 5. It may be disclosed to necessary service providers, the AI service specifically identified before processing, recipients you choose and recipients of a legally required disclosure, subject to the restrictions in Section 6. We do not sell consumer health information, use health information for targeted advertising, or collect health information through geofencing around healthcare facilities.

You can request the access, withdrawal, deletion and other consumer health rights provided by applicable law using Section 10. Where a separate consent is required for collection or sharing, we obtain it; merely accepting this Policy does not supply that consent. If applicable law requires a distinct consumer health privacy notice, we provide that notice with the relevant service.

12 Automated information and health decisions

MenoSera may automatically organize records, calculate comparisons, flag changes or generate an explanation. These outputs can be incomplete or wrong and do not establish a diagnosis, treatment decision or clinical prediction. We do not use these features to make solely automated decisions about your employment, insurance eligibility or access to medical treatment that have legal or similarly significant effects.

13 Adults and changes to this Policy

MenoSera is intended for adults who are at least 18 and have reached the age of majority where they live. We do not knowingly offer the service to children or collect children's information through a parental account exception. If you believe a child has provided information, contact us so that we can investigate and take the appropriate steps.

We may update this Policy as the service or applicable requirements change. We publish the revised date and give appropriate notice of material changes. Where a new purpose, recipient or sensitive-data use requires fresh authorization, we obtain it before beginning that processing. Continued use alone is not a substitute for legally required explicit consent.

14 Contact

For privacy requests, questions or concerns, contact AUROQ LIMITED at auroq.global@gmail.com.