Your cycle data, and the laws that name it

Why this page exists

Washington's My Health My Data Act, Nevada's SB 370 and Connecticut's health-data provisions each ask companies that handle consumer health data to publish a notice specifically about it, separate from their general privacy policy. This is ours. If you are not in one of those states, nothing here is different from what our main privacy policy already says — this page is the same facts, arranged the way those laws ask for.

Read the main Onda privacy policy

Who we are

• Anton Bondarenko, sole proprietorship (jednoosobowa działalność gospodarcza)
• Warsaw, Poland
• NIP (tax ID): 9512542660
• onda@helloonda.com

What consumer health data is involved, and where it lives

Onda works from information about your menstrual cycle, which these laws treat as consumer health data. Nearly all of it is stored on your own phone and we never receive a copy: the date your last period started, the period dates and end dates before it, the cycle and period lengths worked out from them, which phase of your cycle you are in on a given day, your answers from setting up the app, your evening check-ins, and the plan the app builds from all of that.

We want to be straightforward about a boundary these laws draw differently from how engineers usually think about it. The calculation that turns your period date into a cycle phase runs on your device, not on our computers, and we never see the inputs or the result. Whether that still counts as us “collecting” your health data is genuinely unsettled — the Washington statute defines collection broadly enough to reach processing that infers or derives health data, and no court or regulator has yet said where on-device processing falls. Rather than rely on that question going our way, we have written this notice as though it applies to us.

One piece of consumer health data does reach our servers, and only if you turn reminders on: the schedule for your reminders and the text of each one. Because a reminder can say which phase you are entering, that text names a phase, and it is stored against a send time and an account identifier. Your period dates, cycle length, cycle day, check-in answers and daily plan are never uploaded, with reminders on or off.

Where it comes from

From you, and only from you. You type the date your last period started; everything else is worked out from it and from answers you give. Onda does not read Apple Health, Google Fit, your phone's calendar, a connected device, or any other app, and it does not buy or receive health data from anyone. You are its only source, and we intend to keep it that way.

What it is used for

• To work out which phase of your cycle you are in, and to build the day's training and food suggestions from that. This happens on your phone.
• To show you a forecast of the weeks ahead, and to place any dates you have marked within it. Also on your phone.
• To send a reminder at a useful moment, if you have turned reminders on.

It is not used for anything else. In particular it is never used to advertise or market anything to you, to build a profile of you, or to decide what to charge you.

Who it is shared with

We do not sell consumer health data. Under Washington's law a “sale” means exchanging it for anything of value, and we do not do that in any form, with anyone, for any price. There is no consent form for it because we are not asking.

If you turn reminders on, the reminder schedule and text described above are handled by two companies acting for us, and only to deliver those reminders:

No one else receives consumer health data from us — no advertising network, no data broker, no analytics company, and no artificial-intelligence service. Our analytics and crash-reporting tools are built so that they cannot receive it at all, which is a stronger arrangement than a promise not to send it.

We would disclose data if a valid court order or legal process required it. If that ever happens we will tell you, unless we are legally forbidden from doing so.

Your rights

If you live in Washington, Nevada or Connecticut you have the right to confirm whether we hold consumer health data about you and to see it; to have it deleted, including from anyone we shared it with; and to withdraw your consent to us collecting or sharing it.

The fastest route for most of this is the app itself, because that is where the data is. Profile → Delete everything erases everything on your phone straight away, deletes your account if you have one, and clears any reminder schedule from our server. There is no waiting period and no undo. Turning reminders off in Profile withdraws your consent for the one thing that leaves your phone, and deletes the schedule.

To make a request in writing instead, email the address at the top of this page. We will respond within 45 days, and will tell you if we need a further 45 — which the law allows, and which we would rather not use. We will not charge you, and we will not treat you differently for asking.

If we turn a request down, you can appeal by replying to our decision. We will review it and write back within 45 days explaining what we decided and why. If we still say no, Washington residents may complain to the Washington State Attorney General at www.atg.wa.gov/file-complaint, Nevada residents to the Nevada Attorney General, and Connecticut residents to the Connecticut Attorney General.

Who can see it inside Onda

Almost nobody, because there is almost nothing to see. The reminder schedules are the only consumer health data we hold, access to the systems that store them is limited to the people who run those systems, and everyone with access is under a duty of confidentiality. We do not let processors access consumer health data beyond what they need to do the job described above, and we do not geofence anything, anywhere — least of all health facilities.

Changes

If we change how consumer health data is handled, we will update this page before the change takes effect, and we will ask for your consent again if the change needs it. Last updated: August 2026.