Privacy Policy
Last updated 29 October 2026
Haylo helps you track some of the most personal information there is. This policy explains, in plain language, what we collect, why, who helps us process it, and the choices and rights you have, wherever you live.
At a glance
- We never sell your personal information, and we never share your health entries with advertisers, data brokers, insurers or employers.
- We use your health entries only to run Haylo for you: your check-ins, patterns, rituals, reminders and report.
- Our product analytics are limited to a short, fixed list of events that contain no health information.
- You can export your data or delete your account at any time, in the App or by emailing us.
- Haylo is not a medical device and doesn't give medical advice.
On this page
Who we are
Haylo is owned and operated by Bulletproof Technologies (“Bulletproof”, “we”, “us” or “our”), a company based in India. We are the controller (or, under US law, the “business” or “regulated entity”) responsible for the personal information described in this policy.
This policy covers the Haylo mobile apps for iOS and Android (the “App”), our website at haylolife.com (the “Site”), and any support conversations you have with us (together, the “Services”). It doesn't cover third-party services you choose to use alongside Haylo, such as Google or Apple sign-in, the app stores, or anyone you share your report with. Their own privacy policies apply.
You can reach us about anything in this policy at privacy@haylolife.com.
Information we collect
We collect only what we need to run Haylo. Almost all of it comes directly from you.
Account information
- Your email address and the sign-in method you use (an email code, Google or Apple).
- If you sign in with Google, we receive your name, email address and profile photo. We also request your birthday, gender and phone number; Google shows you these on its consent screen and only shares what your Google account settings allow. We use them only to pre-fill your profile, and you can edit or remove them.
- If you sign in with Apple (where available), we receive your name and either your email address or a private relay address that Apple creates for you.
Profile and setup answers
The name you'd like Haylo to call you; your date of birth; what brings you to Haylo (for example endometriosis, suspected endometriosis, PCOS, gut symptoms around your cycle, or pelvic or bladder pain); whether you have a diagnosis; how long symptoms have been going on; what's hardest right now; how symptoms affect your daily life; your cycle details (last period start date, typical length and regularity); your next appointment date and type; and your reminder, notification and app-lock settings.
Health entries
Everything you log in Haylo, including:
- daily check-ins and flare logs: your pain score (0 to 10), symptoms and how severe they are, where you feel pain, bleeding level, and period days;
- possible triggers you select, which can include food and drink, alcohol, caffeine, sleep, stress, exercise, travel and sexual activity;
- what helped, including any medicines you note, and medications you add;
- whether symptoms stopped you from work, school or plans, and any notes you write;
- comfort rituals you try and how helpful you found them; and custom items you create.
Health entries are sensitive. Many laws, including the GDPR and UK GDPR, US state privacy and consumer-health-data laws, Canada's PIPEDA and Australia's Privacy Act, give this kind of information special protection. We apply the extra care described in this policy to all of it, wherever you live.
Reports and exports
Your doctor report and data exports are generated in the App and handed to your device's share sheet. We don't receive a copy of what you share or who you share it with, unless you send it to us.
Subscription information
Purchases are processed by Apple (App Store) or Google (Google Play). We never receive your payment card details. We receive your subscription status, the plan you chose, purchase and transaction identifiers, your store country, and trial, renewal and expiry dates, through the stores and our subscription provider.
Limited product analytics
To understand whether Haylo is working for people, the App records a short, fixed list of events: the app was installed; which onboarding step was reached and whether onboarding was completed; a trial or subscription started or renewed; a check-in was completed (yes or no only); a report was exported (yes or no only); which ritual was opened (by its catalogue number); whether the App was used on day 1, 7 or 30; and the number of check-ins in your first 14 days.
- These events are tied to a random identifier created by the analytics software on your device, not to your name, email address or Haylo account.
- They never include symptoms, pain scores, cycle or bleeding data, conditions, triggers, notes, or the names of the screens you visit. The App blocks any event that isn't on this list.
- Location lookup from IP addresses, automatic screen tracking and session recording are all switched off.
Device and technical information
When the App connects to our servers, they receive the technical information needed to make that connection: your IP address, device model, operating system and app version, and timestamps. Providers that deliver app updates and sign-in see this information too. We use it to keep Haylo working and secure. If we add crash reporting, crash reports will contain technical details about the error and your device, and we will configure them to exclude your health entries.
Support conversations
When you email us, we receive your email address, your message and any attachments. The App's help form adds your account email to the message so we can find your account.
Our website
The Site doesn't use cookies, analytics, advertising pixels or third-party fonts. Our hosting provider processes standard server logs (IP address, browser type, the page requested and the time) to deliver and protect the Site.
Waitlist
If you join the Haylo waitlist on the Site, we collect your email address, your phone number if you choose to give it, the date you joined, and which version of the sign-up wording you saw. We use them only to tell you when Haylo launches: by email, and, if you gave your number, with a single text message containing the download link. We don't link waitlist details to app accounts. You can leave the waitlist at any time with the unsubscribe link in our email, by replying STOP to our text, or by emailing privacy@haylolife.com.
What we don't collect
- Your precise location, contacts, photos, camera or microphone.
- Advertising identifiers (Apple's IDFA or Google's advertising ID).
- Biometric data. Face ID, Touch ID and fingerprint unlock are handled entirely by your device's operating system. Haylo only learns whether unlocking succeeded.
How we use your information
- To provide Haylo: to create your account, sign you in, save and sync your entries across your devices, and show your Today screen, patterns, cycle estimates, comfort rituals and report.
- To tailor the App to you: for example, which symptoms, rituals and report sections you see, based on what brings you to Haylo and what you've logged. This uses fixed, transparent rules. We don't use AI models on your health entries, and we don't build advertising profiles.
- To send reminders: reminders are scheduled on your device at the times you choose.
- To manage subscriptions: free trials, purchases, restores and access to paid features.
- To support you: to answer your questions and handle your requests.
- To improve Haylo: using the limited, non-health analytics described above, for example to see where people get stuck during setup.
- To keep Haylo safe: to prevent fraud and abuse, fix problems and protect accounts.
- To meet legal obligations: to comply with the law, enforce our Terms, and respond to lawful requests.
- To tell you when Haylo launches, if you've joined the waitlist.
- To keep you informed: service emails about your account, security, or changes to our terms or this policy. We'll only send marketing emails if you've agreed, and you can unsubscribe at any time.
What we never do: we never sell your health entries, use them for advertising, share them with data brokers, insurers or employers, or use them to train AI models. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
Legal bases (UK, EEA and Switzerland)
If you are in the United Kingdom, the European Economic Area or Switzerland, we rely on the following legal bases under the GDPR, the UK GDPR and Swiss law:
| What we do | Legal basis |
|---|---|
| Process your health entries and the health-related answers in your profile | Your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR), which you give when you set up Haylo. You can withdraw it at any time by deleting entries or your account. |
| Run your account, sign-in, subscription and the App's core features | Performance of our contract with you (Article 6(1)(b)). |
| Limited product analytics | Your consent, where the law requires it for storing the analytics identifier on your device (for example under the UK's PECR and the EU ePrivacy Directive). Otherwise, our legitimate interest in understanding and improving Haylo (Article 6(1)(f)). |
| Waitlist emails and text message | Your consent (Article 6(1)(a)), which you give when you join. You can withdraw it at any time. |
| Security, fraud prevention and service emails | Our legitimate interests in keeping Haylo and its users safe and informed (Article 6(1)(f)). |
| Keeping records for tax and accounting, and handling legal claims | Legal obligation (Article 6(1)(c)); for health data, the establishment, exercise or defence of legal claims (Article 9(2)(f)). |
Withdrawing consent doesn't affect processing that happened before you withdrew it. Because health entries are central to Haylo, if you withdraw consent for them we won't be able to provide the App's main features.
International data transfers
We are based in India, and our main service providers are based in the United States, so your information may be stored and processed outside the country where you live.
- UK, EEA and Switzerland: we rely on adequacy decisions where they exist (including the EU-US Data Privacy Framework and its UK and Swiss extensions for certified providers), and otherwise on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for a copy of the relevant safeguards.
- Australia: before disclosing personal information overseas, we take reasonable steps to make sure recipients handle it consistently with the Australian Privacy Principles (APP 8).
- Canada: we use contracts to protect information processed outside Canada. While it's there, it may be accessible to courts and authorities in that country.
How long we keep information
| Information | How long we keep it |
|---|---|
| Account, profile and health entries | For as long as your account is open. You can delete individual entries at any time. When you delete your account, we remove it from our live systems within 30 days. Copies in encrypted backups are overwritten within a further 30 days. |
| Product analytics events | Up to 24 months, after which they're deleted or aggregated. They aren't linked to your account. |
| Waitlist sign-ups | Until we've told you Haylo is available, and no more than 12 months after launch. Sooner if you leave the waitlist. |
| Subscription and transaction records | As long as tax, accounting and consumer laws require, typically up to 8 years. |
| Support emails | Up to 2 years after our last conversation, unless you ask us to delete them sooner. |
| Website server logs | Typically no more than 30 days. |
How we protect information
- Connections between the App and our servers are encrypted in transit (TLS), and our providers encrypt stored data at rest.
- Database-level access rules (row-level security) mean each signed-in account can only read and write its own records.
- Information stored on your device is kept in encrypted storage. You can add an app lock using Face ID, Touch ID, fingerprint or your device passcode.
- Reminder notifications never name a condition or symptom.
- Internal access is limited to the authorised team members and purposes described above.
No system is perfectly secure. If a security incident affects your information, we'll notify you and the relevant regulators as the law requires. You can help by keeping your email account and device secure.
Your rights and choices
Wherever you live, you can:
- Access and export your information: use “Export all data” in the App's settings, or export a PDF report.
- Correct your profile and entries directly in the App.
- Delete individual entries, or your whole account, in the App or by email. Here's how.
- Withdraw consent by deleting entries or your account.
- Control notifications in the App or in your device settings.
- Leave the waitlist with the unsubscribe link in our email, by replying STOP to our text, or by emailing us.
- Control analytics: where the law requires consent, we ask before analytics start, and you can switch analytics off at any time in the App's settings.
Making a request
Email privacy@haylolife.com from the address linked to your account. We may need to confirm your identity before acting, usually by checking that the request comes from that address. We respond within one month (or sooner where your local law requires), and we'll tell you if we need more time. Requests are free, and we will never treat you differently for exercising your rights.
You can use an authorised agent where your law allows. We may ask the agent for proof of your permission and ask you to confirm your identity directly.
Appeals
If we decline your request, you can appeal by replying to our decision with “Appeal” in the subject line. We'll respond within 45 days and explain our reasons. If you're a US resident and still disagree, you can contact your state Attorney General.
Region-specific information
United Kingdom, EEA and Switzerland
You have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time. You can complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live or work, although we'd welcome the chance to help first.
California
The California Consumer Privacy Act (as amended by the CPRA) gives California residents the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. We don't sell or share personal information, and we use sensitive personal information only for purposes the law permits (mainly to provide the Services you request), so there is nothing to opt out of or limit. In the past 12 months:
| Category (CCPA) | Examples | Disclosed to |
|---|---|---|
| Identifiers | Email address, name, account ID, random analytics ID, IP address | Service providers |
| Personal records (Cal. Civ. Code § 1798.80) | Name, phone number (if shared by Google or given for the waitlist) | Service providers |
| Protected characteristics | Age (from date of birth), gender (if shared by Google) | Service providers |
| Commercial information | Subscription and purchase history | Service providers, app stores |
| Internet or network activity | The limited analytics events described above | Service providers |
| Sensitive personal information | Health information; account sign-in | Service providers |
Sources, purposes and retention for each category are described in sections 2, 3 and 7. We don't disclose personal information to third parties for their own direct marketing (Cal. Civ. Code § 1798.83).
Other US states
Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Nebraska, Kentucky, Indiana and Rhode Island) have the rights to confirm whether we process their data and to access, correct, delete and obtain a portable copy of it. They can also opt out of targeted advertising, sale and certain profiling; we don't do any of these. We process sensitive data, such as health information, only with your consent and only as necessary to provide the Services you request.
Consumer Health Data Notice (Washington, Nevada and Connecticut)
This notice is our consumer health data privacy policy under Washington's My Health My Data Act, Nevada's SB 370 and Connecticut's consumer health data provisions. It applies to consumer health data, which for Haylo means your health entries and the health-related answers in your profile.
- What we collect: the health entries and health-related profile answers listed in section 2, such as pain scores, symptoms, bleeding and period days, cycle details, conditions or suspected conditions, medications, appointment dates and notes. Because Haylo is about pelvic and cycle health, we treat even the fact that you use Haylo, or have joined its waitlist, as consumer health data.
- Where it comes from: directly from you, in the App or when you join the waitlist.
- Why we collect and use it: only to provide the Haylo features you ask for (check-ins, patterns, rituals, reminders and your report), to support you, and to keep the Services secure.
- Who we share it with: only the service providers that host and run the App (Supabase, as our database and sign-in provider) and, for waitlist sign-ups, our email and text-message providers; our authorised team as described in section 5, and anyone you choose to share your report with. We don't have affiliates that receive it. We do not sell consumer health data, and we don't use geofencing.
- Consent: we collect and share consumer health data only with your consent or as necessary to provide the Services you request, and we'll ask for separate consent before any other sharing.
- Your rights: you can confirm whether we collect or share your consumer health data, access it (including a list of everyone we've shared it with), withdraw consent, and have it deleted. Email privacy@haylolife.com or use the App's export and delete options. You can appeal any decision as described in section 9.
Australia
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Health information is “sensitive information”, which we collect only with your consent and only where it's reasonably necessary for Haylo. You can use a nickname as your display name. You can ask to access or correct your information at any time, free of charge, and we'll respond within 30 days. If you have a complaint, please contact us first. If you're not satisfied with our response within 30 days, you can contact the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992). We take part in the Notifiable Data Breaches scheme.
Canada
We handle personal information in line with PIPEDA and applicable provincial laws. You can access and correct your information and withdraw consent, subject to legal and contractual limits. Our privacy team, reachable at privacy@haylolife.com, is responsible for compliance, including as the person in charge of the protection of personal information under Quebec's Law 25. You can also contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).
India
As a company based in India, we comply with the Information Technology Act, 2000 and its rules on sensitive personal data, and with the Digital Personal Data Protection Act, 2023 as it comes into force. You can contact our Grievance Officer at privacy@haylolife.com, and we'll resolve your grievance within one month.
Children
Haylo is for adults aged 18 and over, and it isn't directed to children. We don't knowingly collect personal information from anyone under 18, including from children under 13 as defined by the US Children's Online Privacy Protection Act. If we learn that we have, we'll delete it. If you believe a child has given us information, please contact privacy@haylolife.com.
Changes to this policy
We'll update this policy as Haylo changes, and change the “last updated” date above. If a change is material, we'll tell you in the App or by email before it takes effect. Where the law requires it, for example before using your health data in a new way, we'll ask for your consent.
Contact us
Privacy questions and requests: privacy@haylolife.com
Postal address: Bulletproof Technologies, India
General support: support@haylolife.com