Privacy Policy

Last updated: November 8th, 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable. Under GDPR (General Data Protection Regulation), You can be referred to as the Data Subject or as the User as you are the individual using the Service.

Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Areté Apps Kft., 1136 Budapest, Tátra utca 5/A alagsor 2. ajtó, Hungary, email hello@areteapps.hu. For the purpose of the GDPR, the Company is the Data Controller.

Health Data means pregnancy-related health information including but not limited to: due date, pregnancy history, symptom logs, vital signs, laboratory test results, prenatal screening biomarkers, medical reports (including ultrasounds and discharge summaries), and any data you enter into the Application.

Application means the software program provided by the Company downloaded by You on any electronic device, named Szívem.

Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.

Account means a unique account created for You to access our Service or parts of our Service.

Service refers to the Application.

Country refers to: Hungary

Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used. For the purpose of the GDPR, Service Providers are considered Data Processors.

Third-party Social Media Service refers to any website or any social network website through which a User can log in or create an account to use the Service.

Personal Data is any information that relates to an identified or identifiable individual. For the purposes for GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity. For the purposes of the CCPA, Personal Data means any information that identifies, relates to, describes or is capable of being associated with, or could reasonably be linked, directly or indirectly, with You.

Device means any device that can access the Service such as a computer, a cellphone, watch or a digital tablet.

Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

Data Controller, for the purposes of the GDPR (General Data Protection Regulation), refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.

Do Not Track (DNT) is a concept that has been promoted by US regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites.

Business, for the purpose of the CCPA (California Consumer Privacy Act), refers to the Company as the legal entity that collects Consumers' personal information and determines the purposes and means of the processing of Consumers' personal information, or on behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information, that does business in the State of California.

Consumer, for the purpose of the CCPA (California Consumer Privacy Act), means a natural person who is a California resident. A resident, as defined in the law, includes (1) every individual who is in the USA for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the USA who is outside the USA for a temporary or transitory purpose.

Sale, for the purpose of the CCPA (California Consumer Privacy Act), means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's Personal information to another business or a third party for monetary or other valuable consideration.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• First name, and last name if you give one (it is optional)
• Date of birth
• Country of residence: it decides which antenatal screening schedule your pregnancy calendar and onboarding show (Hungary's, the United Kingdom's or the United States', and international recommendations anywhere else), and which version of an article you see in Guides, your weekly reading list and the articles linked from your health screens. Articles about antenatal care, local services, benefits, rights and helplines are written separately for Hungary, the United Kingdom and the United States, and people living anywhere else see a general version.

Pregnancy and Health Data

The app is a pregnancy tracking application. We collect the following categories of pregnancy-related and health data:

Current Pregnancy Information:

• Due date and calculation method (last menstrual period, ultrasound dating, conception date, or IVF transfer date)
• Number of fetuses (singleton, twins, etc.)
• Gestational age and trimester

Previous Pregnancy History:

• Previous pregnancy dates and outcomes: whether you have recorded a previous pregnancy, and whether one ended in a live birth, also decides which articles appear in your weekly reading list. Recording one can only add articles there, never remove them; changing or deleting a record takes away what it added.
• Baby names and sex at birth (both optional): used to personalize pregnancy history records and educational content. If you leave either field empty we simply do not store a value for that entry.

Symptom Tracking:

• Red flag symptoms (e.g., vaginal bleeding, chest pain, vision changes, reduced fetal movement)
• Common pregnancy discomforts (e.g., nausea, fatigue, back pain, Braxton Hicks contractions)
• Symptom severity levels and frequency

Vital Signs and Biomarkers:

• Blood pressure, heart rate, body weight, body temperature
• Blood glucose levels (see "Blood Glucose Targets and Testing Schedule" below for the targets and schedule recorded alongside them)
• Prenatal screening results (e.g., hCG, PAPP-A)
• Laboratory test results from uploaded reports

Blood Glucose Targets and Testing Schedule:

If you set up blood glucose tracking, we store more than the readings themselves:

• Your testing schedule: which moments of the day you test at (for example fasting, after lunch, bedtime), the time of day you expect to test at each, whether your after-meal readings are taken one or two hours after eating, and when you completed the setup. If you chose no fixed times, we store only that, with no moments of the day
• Your targets: the low limit and the upper target for each kind of reading that you enter, copied from what your care team gave you. We do not supply any target of our own
• The targets saved with each reading: when you save a reading, we store with it the low limit and the upper target you had for that kind of reading at that moment, so it stays marked against them if you change your targets later. They change only if you change the reading's timing or choose to apply your current targets to it
• Display preference: whether you read glucose in mmol/L or mg/dL

You record all of this yourself; we do not receive it from your care team. The glucose settings do not ask why you are testing or how your glucose is being treated, and record no medication. You can change any of it at any time in the app's blood glucose settings. Completing a pregnancy clears your targets and your testing schedule, and all of it is deleted with your account.

Medical Reports:

• Laboratory reports, ultrasound reports, discharge summaries
• AI-extracted data from these reports (see AI Processing section)
• Healthcare provider and institution names appearing in reports

Pregnancy Photos:

• Photographs you choose to add of yourself during pregnancy ("bump photos"), the date each photo was taken, and an optional caption you write
• The date is read from the photo file's own metadata and shown to you before saving, so you can correct it. It is the only thing we take from that metadata
• Before a photo is stored we re-save the image, which removes the location, the device identifiers, and the camera's original timestamp. Where you were is never stored, and cannot be recovered from what we hold
• These photos are stored separately from your medical reports and are never sent for AI analysis. Unlike the lab reports described above, nothing reads, extracts from, or interprets their content. There is no face, body, or measurement detection of any kind
• They are private to your account. There is no public link to a photo and no way to create one; images load on your device through temporary links that expire
• You can delete a single photo yourself: open it, choose More, then Delete. It is removed from the app at once, and we delete the stored image in the same step. If deleting the stored image ever fails, it is no longer shown anywhere in the app, and you can write to us at privacy@areteapps.hu to have it erased. Deleting your account removes your photos along with everything else we hold for you

Profile Information:

• Pregnancy experience: whether this is your first pregnancy, whether you already have a child, or that you have been pregnant before and have no children yet (you can also choose not to share it). It decides which articles appear in your weekly reading list. You answer it once, during setup.
• Wellness interests and goals (the wellness focuses you pick in onboarding). You can change or clear them at any time under Account › Wellness focuses
• Support system preferences
• How you heard about the app

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

Feedback You Send Us

Sending feedback from Account → Feedback & Suggestions is optional. When You do, We store the message You write, the category You choose (Suggestion, Bug or Other), the date You sent it, and a status our team sets as it reviews it. The message is free text, so it contains health details only if You write them in; please include only what we need to understand the issue.

• Who can read it: only You and our team. Other users of the app cannot see Your feedback.
• What we use it for: to understand problems and improve the Service. We do not send Your feedback to AI providers.
• Legal basis: our legitimate interest in improving the Service (GDPR Art. 6(1)(f)). If Your message contains health details, We process them on the basis of Your explicit consent (GDPR Art. 9(2)(a)), which You give by choosing to send them, and only for this purpose.
• Where it is stored and for how long: with the rest of Your account data in our database (see "Recipients of Personal Data" below), until Your account is deleted, following the schedule in "Retention of Your Personal Data".

Records of AI Use

Each time We ask Google Gemini to read a lab report You uploaded, We record that the request was made: when, which model answered, how long it took, whether it succeeded, and how many units of text (tokens) the model read, used for its reasoning and wrote. The record holds nothing You wrote or uploaded and none of Your results: not the document, not a value.

• Who can read it: only our team. It is not shown in the app.
• What we use it for: to know what the AI features cost to run, per account and per month, so that We can price and plan the Service. It is never used to decide anything about Your health.
• Legal basis: our legitimate interest in running the Service's AI features at a sustainable cost (GDPR Art. 6(1)(f)).
• Where it is stored and for how long: in our database, linked to Your account and, for a lab report, to that report. It is included in the copy of Your data You can download. When You delete a report, the record's link to it is removed. When Your account is deleted, every link to Your account and to Your reports is removed and the record is kept without those links, so that our cost history stays complete.

Health Data Processing

Analysis of Health Data with AI (Google Gemini)

The app uses Google Gemini AI to analyze laboratory reports and medical documents you upload. This AI processing includes:

• OCR (Optical Character Recognition): Extracting text from PDF documents and images of lab reports
• Data Extraction: Identifying biomarker names, values, units, and reference ranges

Important: When you upload a document for AI analysis, the document content (which may include your name, dates, healthcare provider names, and test results) is transmitted to Google Cloud servers for processing. Google processes this data according to their Cloud Data Processing Addendum.

The app uses the paid tier of the Google Gemini API. Under the Gemini API Additional Terms (paid services), Google does not use your prompts or responses to train Google's foundation models or improve its products. No content you upload is used to train AI models. The AI processing is solely for providing you with extracted information from your own documents.

Data Storage

When you create an account and use the app, your health data is stored on our servers (Supabase, located in the European Union). This allows you to access your data across multiple devices when signed in to your account.

Home and Lock Screen Widgets

If you add a widget to your phone's home screen or lock screen, the app stores a small copy of your estimated due date and one of three states (a pregnancy is currently recorded, a birth was recorded in the last ninety days, or neither) on your device, so the widget can show your pregnancy week while the app is closed. The widget reads this copy and nothing else; it never sends it anywhere. It is written only while your phone reports a widget on your screen, and it is deleted from the device when you sign out, after you remove your last widget the next time the app is opened, and whenever the app finds it on a phone where you are signed out. The app language is kept separately on the device, whether or not you add a widget, and is not deleted at sign-out, so a widget with nothing to show still asks for the app in your language. Anyone who can see your phone's screen can see the widget. Every widget design is offered in your phone's widget gallery under its own name, and that version shows your week and day and, on most widgets, the days remaining, or a short prompt, and never names pregnancy, a baby, a trimester or a due date. A design may also be offered in a version marked "with due date", which also shows the trimester and your due date. You choose which one to add, and you can remove a widget at any time.

Benefit Paperwork Settings on the Calendar

If your country has family benefit dates on the pregnancy calendar, you can turn those dates off, and you can say how you work (employed, self-employed, a student, without a job right now, or something else) so the benefit sheets show where you claim first. Both answers are stored only on your device. They are never sent to us or to anyone else, and they are deleted from the device when you sign out. The question is optional: leave it unanswered and the sheets show every way to claim.

Information Collected

When you use our Application, below are examples of the categories of information (which may include some personal information) that may be collected from or about You:

Contact information such as your name and email address. This information is used for registering your account.

Health Data including pregnancy information, symptoms, vital signs, uploaded medical reports, and any pregnancy photos you add, as described in the "Pregnancy and Health Data" section above.

Technical data, which in many cases is non-personal information, i.e., data in a form that does not, on its own, permit direct association with any specific individual. Technical data includes, for example, information about your app usage, app version and installation ID, device identifier, and technical data about your device, such as operating system and model.

Security of Your Health Data

We have implemented reasonable precautions to protect the information we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our best efforts, no data security measures can guarantee 100% security. You should take steps to protect against unauthorized access to your password, phone, and computer by, among other things, signing off after using a shared computer, choosing a robust password that nobody else knows or can easily guess, and keeping your log-in and password private. We are not responsible for any lost, stolen, or compromised passwords or for any activity on your account via unauthorized password activity.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

To provide and maintain our Service, including to monitor the usage of our Service.

To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.

To contact You: to send You, by email, the sign-in codes You ask for when signing in.

To manage Your requests: To attend and manage Your requests to Us.

To develop health-related products and improvement activities.

We may share your personal information in the following situations:

With Service Providers: We share Your personal information with Service Providers only to run the Service: to host it and store Your data, to process Your Health Data with AI when You use the features that rely on it, and to monitor errors and crashes. Each one is listed in "Recipients of Personal Data (Processors under GDPR Art. 28)" below. We do not share Your personal information for advertising.

For Business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of our business to another company.

With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include Our parent company and any other subsidiaries, joint venture partners or other companies that We control or that are under common control with Us.

Not with other users: the app has no public or shared areas. Other users cannot see Your profile, Your health data or anything else You enter, and signing in with Apple or Google does not show Your activity to Your contacts there.

Automated Processing of Your Health Data (GDPR Art. 13(2)(f))

The app uses Google Gemini (paid-tier API) to perform one automated operation on your Health Data. The disclosure below covers the existence of automated processing, the logic involved, and the significance and consequences for you, as required by GDPR Art. 13(2)(f) and WP29 Guidelines WP251rev.01.

Lab extraction.

• *Logic:* the uploaded PDF/image is sent to the Gemini API, which performs OCR and structured field extraction using the gemini-3.8-flash model. The model reads the individual results (biomarker name, value, unit, reference range) and also classifies the document as a whole: its type, its date, the issuing provider, a short title, which antenatal examinations it evidences, and whether it is a health document at all. That last judgement only decides how the app describes a document it could read nothing from. It never withholds, hides, or refuses anything you upload.
• *Output:* pre-filled values shown in a review screen.
• *Your role:* extracted values are stored with the report and shown to you for review; no value is tracked as one of your health values until you confirm it, and you can correct any value first.
• *Significance and consequences:* no clinical decision is taken automatically; an unconfirmed value is retained as part of the report you uploaded but is excluded from your biomarker trends.

Lawful basis. This operation relies on your explicit consent under GDPR Article 9(2)(a), specifically the AI Processing consent collected at onboarding (alongside the broader Health Data Processing consent for non-AI processing). See the AI Disclaimer screen in the App and the "Recipients of Personal Data (Processors under GDPR Art. 28)" section below for processor identity, location, and safeguards.

Right to withdraw, object, or request human review. You can withdraw consent at any time through Account → Privacy & Consents. Withdrawal of consent is currently handled together with account deletion; a dedicated AI-only opt-out is planned. You also retain the right to lodge a complaint with your supervisory authority (see "Supervisory Authority" below).

Decisions With Legal or Similarly Significant Effects (GDPR Art. 22)

The app does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning You or similarly significantly affect You within the meaning of Article 22(1) GDPR. We do not sell or share your data for use in automated decision-making or profiling by any third parties. If such features are introduced in the future, we will notify you in advance and ensure you are able to exercise your rights under applicable data protection laws, including the right to obtain human review and to contest any automated decision.

Retention of Your Personal Data

We retain your data according to the following schedule:

Data Deletion: You may delete your health data at any time from within the App. If you delete your account, all associated data will be permanently deleted within 30 days, except records of AI use, which are kept with every link to you removed (see "Records of AI Use"). After this period, data cannot be restored.

Transfer of Your Personal Data

Primary Data Storage: Your health data is stored on servers located in the European Union (Supabase EU region).

International Transfers: When you use features that require AI processing (lab report analysis), your data is transmitted to Google Cloud servers, which may include locations outside the European Economic Area (EEA). These transfers are protected by the EU Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 ("the SCCs"). A copy of the SCCs is available on request from dpo@areteapps.hu.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy. No transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency). Other legal requirements:

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data (for example: encryption at rest, in transit and data minimized collection and usage principles, etc.), We cannot guarantee its absolute security.

Recipients of Personal Data (Processors under GDPR Art. 28)

We engage the following recipients to process your Personal Data on our behalf, only for the purposes and on the documented instructions described below. Where required by Article 28(3), each engagement will be governed by a written data-processing agreement before processing begins.

For more information, see each recipient's privacy policy:

• Supabase: https://supabase.com/privacy
• Google Cloud: https://cloud.google.com/privacy
• Sentry: https://sentry.io/privacy/

File Sharing Services

The app offers features that allow you to export, download, and share your health data for your personal use or to share with healthcare providers. When you choose to share your data using third-party apps or services (such as email, cloud storage, or messaging platforms), please be aware that those platforms are outside of our control.

We strongly encourage you to review the privacy policies and data handling practices of any third-party service you use to ensure your information is protected according to your expectations.

Payments

Nothing can be bought in the app today, so we hold no payment or purchase information about You. Paid subscriptions are planned. When they are offered, they will be bought through the Apple App Store or Google Play, which process the payment, and this Privacy Policy will be updated before then to say what information about Your purchases we receive and how long we keep it.

GDPR Privacy

Legal Basis for Processing Personal Data under GDPR

We may process Personal Data under the following conditions:

Consent: You have given Your consent for processing Personal Data for one or more specific purposes.

Performance of a contract: Provision of Personal Data is necessary for the performance of an agreement with You and/or for any pre-contractual obligations thereof.

Legal obligations: Processing Personal Data is necessary for compliance with a legal obligation to which the Company is subject.

Vital interests: Processing Personal Data is necessary in order to protect Your vital interests or of another natural person.

Public interests: Processing Personal Data is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Company.

Legitimate interests: Processing Personal Data is necessary for the purposes of the legitimate interests pursued by the Company. In any case, the Company will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Your Rights under the GDPR

The Company undertakes to respect the confidentiality of Your Personal Data and to guarantee You can exercise Your rights. You have the right under this Privacy Policy, and by law if You are within the EU, to:

Request access to Your Personal Data. The right to access, update or delete the information We have on You. You can view and edit most of what You enter (Your profile, pregnancy details, logs and uploaded reports) within the app, and You can delete Your account from Account → Manage account → Delete Account. You can download a copy of everything stored in Your account from Account → Manage account → Download a copy of your data, after signing in again: one ZIP file with Your records as JSON and CSV files, the lab reports and bump photos You uploaded, and this Privacy Policy. The copy is made on Your device; We do not keep it. Data We hold outside Your account, such as error reports and backups, is not in it: to receive a copy of that, or for anything You cannot do in the app, contact Us.

Request correction of the Personal Data that We hold about You. You have the right to to have any incomplete or inaccurate information We hold about You corrected.

Object to processing of Your Personal Data. This right exists where We are relying on a legitimate interest as the legal basis for Our processing and there is something about Your particular situation, which makes You want to object to our processing of Your Personal Data on this ground. You also have the right to object where We are processing Your Personal Data for direct marketing purposes.

Request erasure of Your Personal Data. You have the right to ask Us to delete or remove Personal Data when there is no good reason for Us to continue processing it.

Request the transfer of Your Personal Data. We will provide to You, or to a third-party You have chosen, Your Personal Data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which You initially provided consent for Us to use or where We used the information to perform a contract with You.

Withdraw Your consent. You have the right to withdraw Your consent on using your Personal Data. If You withdraw Your consent, We may not be able to provide You with access to certain specific functionalities of the Service.

Right to Restriction. You have the right to ask Us to restrict the processing of Your Personal Data, for example while You contest its accuracy. The app has no setting for this yet, so contact Us to make the request.

Profiling. The weekly summaries of Your Health Story count what You logged in each pregnancy week; they are worked out on Your device each time You open them, are not stored, and do not rate or predict anything about Your health. The app does not engage in profiling that produces legal effects or similarly significantly affects You within the meaning of Article 22 GDPR, and does not use any profiling output to make decisions about You.

Exercising of Your GDPR Data Protection Rights

You may exercise Your rights by contacting Us. Please note that we may ask You to verify Your identity before responding to such requests. If You make a request, We will try our best to respond to You within 30 days. You have the right to complain to a Data Protection Authority about Our collection and use of Your Personal Data. For more information, if You are in the European Economic Area (EEA), please contact Your local data protection authority in the EEA.

GDPR Contacts

Data Protection Officer (DPO)

Email: dpo@areteapps.hu

*Note: As the Company is established in Hungary (an EU Member State), no separate EU Representative is required under GDPR Article 27.*

Supervisory Authority

If you are in Hungary, you may contact the National Authority for Data Protection and Freedom of Information (NAIH):

• Website: https://naih.hu/
• Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary

Washington My Health My Data Act

If you are a Washington State resident, the Washington My Health My Data Act provides you with additional rights regarding your consumer health data:

Right to Know: You have the right to confirm whether we are collecting, sharing, or selling your consumer health data and to access that data.

Right to Delete: You have the right to request deletion of your consumer health data.

Right to Withdraw Consent: You have the right to withdraw your consent to the collection, sharing, or sale of your consumer health data at any time.

Categories of Consumer Health Data Collected: We collect pregnancy-related health data including due dates, symptoms, vital signs, blood glucose readings together with the targets you enter and the targets saved with each reading, your glucose testing schedule, laboratory results, medical reports, and pregnancy photographs you add as described in the "Pregnancy and Health Data" section above, and any health details you choose to include in feedback you send us (see "Feedback You Send Us").

Purpose of Collection: We collect this data to provide the App's pregnancy tracking features, including marking your readings against targets you enter and the weekly summaries of what you log.

Third Parties with Access: The recipients listed in the "Recipients of Personal Data (Processors under GDPR Art. 28)" section may process your consumer health data on our behalf.

We do not sell your consumer health data.

To exercise your rights under the Washington My Health My Data Act, please contact us at privacy@areteapps.hu.

Health Breach Notification (FTC Rule, 16 CFR Part 318)

The Company is a vendor of personal health records under the U.S. Federal Trade Commission's Health Breach Notification Rule (16 CFR Part 318). This means we are required to notify you, and in some cases the FTC, if your unsecured personally identifiable health data is acquired by an unauthorized person.

Who we notify, and when:

• Affected individuals: If we discover a breach of your unsecured health data, we will notify you without unreasonable delay and no later than 60 calendar days after discovering the breach.
• The FTC: If a breach affects 500 or more individuals, we will notify the FTC within 10 business days of discovering the breach. Breaches affecting fewer individuals are recorded and reported to the FTC in our annual log.
• Other parties: Where the Rule or other applicable law requires it, we will also notify third parties (for example, prominent media outlets in an affected area).

What a breach notice will tell you:

• A description of what happened and the approximate date(s) of the breach
• The categories of health data involved (for example, pregnancy, symptom, vital-sign, lab, or photo data)
• The steps we are taking to investigate the breach, mitigate harm, and protect against further breaches
• What you can do to protect yourself
• How to contact us for more information

How we will reach you: We will notify you by email at the address associated with your account, and, where required, by a prominent notice within the App.

This notification commitment complements our GDPR Article 33/34 obligations (see "GDPR Privacy" above) and works alongside the safeguards described in "Security of Your Personal Data" and "Retention of Your Personal Data." To report a suspected breach or ask questions about this Rule, contact our Data Protection Officer at dpo@areteapps.hu. U.S. residents may also contact us at privacy@areteapps.hu.

CCPA Privacy

Your Rights under the CCPA

Under this Privacy Policy, and by law if You are a resident of California, You have the following rights:

The right to notice. You must be properly notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.

The right to access / the right to request. The CCPA permits You to request and obtain from the Company information regarding the disclosure of Your Personal Data that has been collected in the past 12 months by the Company or its subsidiaries to a third-party for the third party's direct marketing purposes.

The right to say no to the sale of Personal Data. You also have the right to ask the Company not to sell Your Personal Data to third parties. You can submit such a request by visiting our "Do Not Sell My Personal Information" section or web page.

The right to know about Your Personal Data. You have the right to request and obtain from the Company information regarding the disclosure of the following:

• The categories of Personal Data collected
• The sources from which the Personal Data was collected
• The business or commercial purpose for collecting or selling the Personal Data
• Categories of third parties with whom We share Personal Data
• The specific pieces of Personal Data we collected about You

The right to delete Personal Data. You also have the right to request the deletion of Your Personal Data that have been collected in the past 12 months.

The right not to be discriminated against. You have the right not to be discriminated against for exercising any of Your Consumer's rights, including by:

• Denying goods or services to You
• Charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties
• Providing a different level or quality of goods or services to You
• Suggesting that You will receive a different price or rate for goods or services or a different level or quality of goods or services.

Exercising Your CCPA Data Protection Rights

In order to exercise any of Your rights under the CCPA, and if you are a California resident, You can email or call us or visit our "Do Not Sell My Personal Information" section or web page.

The Company will disclose and deliver the required information free of charge within 45 days of receiving Your verifiable request. The time period to provide the required information may be extended once by an additional 45 days when reasonable necessary and with prior notice.

Do Not Sell My Personal Information

We do not sell personal information.

The app does not sell, rent, or trade your personal information or health data to third parties for monetary or other valuable consideration. We do not use advertising networks or tracking technologies that would constitute a "sale" under CCPA.

"Do Not Track" Policy

Our Service does not respond to Do Not Track signals. We do not track users across third-party websites.

Children's Privacy and Age Requirement

The app is intended for users who are 18 years of age or older.

This is a pregnancy tracking application designed for adults. We do not knowingly collect personally identifiable information from anyone under the age of 18. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us immediately. If We become aware that We have collected Personal Data from anyone under the age of 18, We will take steps to remove that information from Our servers.

Your California Privacy Rights (California's Shine the Light law)

Under California Civil Code Section 1798 (California's Shine the Light law), California residents with an established business relationship with us can request information once a year about sharing their Personal Data with third parties for the third parties' direct marketing purposes.

If you'd like to request more information under the California Shine the Light law, You can contact Us using the contact information provided below.

California Privacy Rights for Minor Users (California Business and Professions Code Section 22581)

California Business and Professions Code section 22581 allow California residents under the age of 18 who are registered users of online sites, services or applications to request and obtain removal of content or information they have publicly posted. To request removal of such data, and if you are a California resident, You can contact Us using the contact information provided below, and include the email address associated with Your account. Be aware that Your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page. When a change materially affects how we collect, use, or share your data (a new category of data, a new recipient, or a new purpose), we will re-obtain your consent on our app, let You know via email and/or a prominent notice on Our Service prior to the change becoming effective, and update the "Last updated" date at the top of this Privacy Policy. Changes that only narrow what we collect, or that correct or clarify wording, are posted here without moving that date.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, You can contact us:

• By email: support@areteapps.hu
• By visiting this page on our website: https://szivem.app/contact