PCOScanPrivacy Policy
Last updated: 29 July 2026 · Applies to the PCOScan iOS app and the pcoscan.health website
PCOScan is operated by NoLemon NoMelon ("we", "us", "our"), the data controller for the personal data described in this policy. You can reach us at jfleming@nolemon.app.
PCOScan handles information about your health. We take that seriously. The short version: we collect what the app needs to work, we never sell your personal data, we never share your health data for advertising, and you can export or delete everything yourself, in the app, at any time. The long version follows.
1. Information we collect
1.1 Account information
You sign in with Apple or Google. From your chosen provider we receive your name, email address (if you use Apple's "Hide My Email", we receive the private relay address instead), and a unique account identifier. Authentication is handled by Google Firebase Authentication. We do not receive or store passwords.
1.2 Health and wellness information you provide
This is the core of the app, and it is health data. It includes:
- Your PCOS profile — answers you give during onboarding and in settings, such as where you are in your PCOS journey (diagnosed, suspecting, learning), symptoms you experience, your goal (for example fertility support, clearer skin, or steadier energy), medications you choose to tell us about, and cycle-regularity answers.
- Symptom logs — symptoms you tap to record (for example breakouts, energy crashes, cravings, cycle irregularity) and their intensity, with dates.
- Cycle data — period start and end dates you log in the app.
- Apple Health import (optional) — if you grant permission, we read your menstruation history from Apple Health so you don't have to re-log it. This is read-only and permission-gated by iOS; you can revoke it at any time in the Health app. If you use the watch-based ovulation feature, your nightly wrist-temperature readings are processed entirely on your device — raw temperature data never leaves your phone; only the resulting estimate (for example "ovulation likely around a given date") is shown to you and stored with your cycle records.
1.3 Scans and photos
When you scan a meal, label, or supplement, we collect the photo you take or choose, the information extracted from it (for example nutrition facts and ingredients), the resulting scores and explanations, and any notes or accuracy flags you add. Photos are uploaded over an encrypted connection to our cloud storage and linked to your account.
1.4 Purchase information
Payments are processed by Apple; we never see your card details. To know whether your subscription is active we use RevenueCat, which processes your Apple purchase receipt and a pseudonymous app-user identifier on our behalf.
1.5 Usage and device information
We use Amplitude to understand how the app is used: events such as screens viewed, scans completed, and features used, together with device type, operating system version, app version, language, and a pseudonymous device/user identifier. A small sample of sessions (about 1 in 10) is recorded as an interaction replay — a reconstruction of taps and screen transitions used to diagnose usability problems. We may also use an attribution service (AppsFlyer) to understand which marketing channel an install came from.
1.6 Server logs and diagnostics
Like almost every online service, our servers keep technical logs (IP address, request identifiers, timestamps, error details) for security, debugging, and abuse prevention.
1.7 Support correspondence
If you email us, we keep the correspondence so we can help you and improve the product.
1.8 Website
The pcoscan.health website is hosted on GitHub Pages (GitHub, Inc.), which may log visitor IP addresses as part of standard web hosting. The site loads fonts from Google Fonts, which involves your browser sending your IP address to Google. The site itself sets no analytics or advertising cookies.
2. How we use your information
- To provide the service — scoring your scans, personalizing results to your profile and goal, drawing your cycle and symptom patterns, and building your appointment report.
- AI processing — photos you scan, and the text extracted from them, are analyzed by Google's Gemini models via Google's API to produce scores and explanations. We do not permit our AI providers to use your data to train their models. Barcode scans query the OpenFoodFacts database; only the barcode number is sent, never your identity.
- To manage your subscription — verifying entitlements and preventing abuse of usage limits.
- To improve the product — analytics, crash and error diagnosis, and (if you flag a result) reviewing flagged scans to improve scoring quality.
- To communicate with you — service messages, replies to your support requests, and optional notifications you control in iOS settings.
- To protect the service and comply with law — security, fraud and abuse prevention, and legal obligations.
We do not sell personal data. We do not run third-party advertising in the app, and we never share your health data (profile, symptoms, cycles, scans) with advertisers or data brokers.
3. Legal bases (UK and EEA)
| Purpose | Legal basis |
|---|---|
| Providing the app, scoring scans, subscriptions | Performance of a contract (our Terms of Use) |
| Processing your health data (profile, symptoms, cycles, Apple Health import) | Your explicit consent, which you may withdraw at any time by deleting the relevant data or your account |
| Analytics, product improvement, session replay | Legitimate interests in improving and securing the service, and consent where required |
| Security, logs, abuse prevention | Legitimate interests in protecting the service and its users |
| Legal compliance | Legal obligation |
4. Who we share information with
We share personal data only with service providers ("processors") who help us run PCOScan, under contracts that restrict their use of it:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Cloud hosting, storage, and content delivery | United States |
| Google (Firebase) | Sign-in and authentication | United States / global |
| Google (Gemini API) | AI analysis of scanned photos and extracted text | United States / global |
| Amplitude | Product analytics and session replay | United States |
| RevenueCat | Subscription management | United States |
| Apple | Payments, App Store distribution | United States / global |
| AppsFlyer | Install attribution (if enabled) | United States / global |
| GitHub | Website hosting | United States |
We may also disclose information if required by law, to protect our rights or the safety of users, or as part of a business transfer (in which case this policy continues to apply to your data and we will notify you of any change of controller).
5. International transfers
We are based in the United Kingdom and our infrastructure is hosted in the United States. Where personal data is transferred out of the UK or EEA, we rely on appropriate safeguards, including the UK International Data Transfer Addendum and the EU Standard Contractual Clauses with our providers, and, where applicable, providers' certification under the EU–US / UK–US Data Privacy Framework.
6. How long we keep information
- Account and health data — kept while your account exists. When you delete your account, your profile, scans, photos, symptom and cycle logs are deleted from our production systems promptly, and from encrypted backups within 35 days.
- Server logs — retained for up to 90 days.
- Analytics — retained in pseudonymous form per our analytics provider's retention settings.
- Support emails — kept as long as reasonably needed to handle and document requests.
- Aggregated, anonymized statistics (which cannot identify you) may be kept indefinitely.
7. Your rights and controls
You can, at any time:
- Export your data — in the app (a machine-readable export of your profile, scans, and logs).
- Delete your account and data — in the app (Settings → Delete account), or by emailing us. See also our account deletion page.
- Revoke Apple Health access — in the iOS Health app.
- Withdraw consent for health-data processing — by deleting the relevant data or your account.
If you are in the UK or EEA you additionally have the rights of access, rectification, erasure, restriction, portability, and objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects (PCOScan's scores are informational suggestions and have no such effects). To exercise any right, email jfleming@nolemon.app. We will respond within one month. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, your local data protection authority.
If you are a California resident, you have equivalent rights under the CCPA/CPRA to know, access, delete, and correct your personal information, and to opt out of "sale" or "sharing" — we do not sell or share personal information as those terms are defined, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. We do not discriminate against you for exercising your rights.
8. Security
Data is encrypted in transit (TLS) and at rest. Photos are stored in access-controlled cloud storage and served via short-lived signed URLs. Access to production systems is restricted and logged. No system is perfectly secure, but we design for the sensitivity of the data we hold, and if a breach affecting your data ever occurs we will notify you and regulators as required by law.
9. Children
PCOScan is not directed to children under 13, and we do not knowingly collect personal data from them. Because the app processes health data, you must be at least 13 to use it, and at least the age of digital consent in your country if it is higher (up to 16 in some EEA countries). If you believe a child has provided us personal data, contact us and we will delete it.
10. What PCOScan is not
PCOScan is not a medical device and does not provide medical advice, diagnosis, or treatment. Cycle information is descriptive of your own logged history — it is not contraception and must not be relied on to prevent or achieve pregnancy.
11. Changes to this policy
We will post any changes here and update the date at the top. For material changes — especially any affecting health data — we will notify you in the app before they take effect.
12. Contact
NoLemon NoMelon · jfleming@nolemon.app