OvuPlan Privacy Policy

Who is responsible

OvuPlan is operated by Stefano Freyr Castiglione, a UK sole trader trading as OvuPlan. Stefano Freyr Castiglione is the controller of the personal information described in this policy. The controller's postal address is 27B St Margaret's Road, London NW10 5PY, United Kingdom. Questions, rights requests or data-protection complaints can be sent to support@ovuplan.co.uk.

Information we process

We process your email address, display name, account and workspace identifiers, privacy choices, UK-residency confirmation, treatment cycles, medication schedules and dose history, appointments, tasks, journal entries, supply records, follicle measurements, notification preferences and push-subscription details. This can include health information, which UK data-protection law treats as special-category data.

We also process support messages; limited, sanitised technical error reports; Cycle Pass payment, billing-country and access records; and a small set of service-improvement milestone timestamps. Stripe, rather than OvuPlan, collects your full billing address and payment-card details. At sign-up, Cloudflare supplies a country code so we can check whether the service is available in your region; OvuPlan does not read or store the underlying IP address for this check.

Most information comes directly from you. Our service providers also return limited technical, email-delivery and payment-status information needed to operate the service. OvuPlan does not make decisions about you solely by automated means that have legal or similarly significant effects.

Why we process it and our legal bases

• Providing the service and Cycle Pass: processing needed to create and operate your account, synchronise records, provide features you request, deliver enabled reminders, take payment and handle refunds is necessary to perform our contract with you (UK GDPR Article 6(1)(b)).
• Health information: as well as the contractual basis above, we ask for your explicit consent before processing the health information you choose to enter (Article 9(2)(a)). You can withdraw this consent, but OvuPlan then has to delete your account because it cannot provide its core service without processing those records.
• Security and service improvement: protecting the service, diagnosing sanitised technical errors and recording the limited milestones described below are in our legitimate interests (Article 6(1)(f)). We balance those interests against your rights and minimise the information used.
• Optional analytics: PostHog analytics and public-page session recordings rely on your consent (Article 6(1)(a)). They are not required to use OvuPlan and can be withdrawn at any time.
• Financial records: the limited purchase record described under retention is kept to meet legal accounting and tax obligations (Article 6(1)(c)).

Who handles information

OvuPlan uses Supabase for authentication, database and server functions; Cloudflare for web delivery and encrypted database-backup storage; Stripe for one-time Cycle Pass payments and refunds; Resend for transactional and support email; Zoho Mail for the support mailbox; and, if you accept optional analytics, PostHog Cloud EU for product analytics, error tracking, web performance and privacy-masked recordings of public pages. If you enable push notifications, the encrypted push subscription and a minimised reminder pass through the push service selected by your browser or device. Notification payloads do not contain medication names, appointment types, task text or supply names. These providers process information only for the services described, except where a provider such as Stripe must act as a separate controller to prevent fraud, meet financial-law obligations or operate its regulated payment service.

We may also disclose information where the law requires it, or where reasonably necessary to establish, exercise or defend legal claims. We do not sell personal information, serve behavioural advertising or use treatment information for advertising.

Where information is processed

OvuPlan's Supabase project and primary database are hosted in London. PostHog Cloud EU data is hosted in Frankfurt, and the OvuPlan Zoho Mail account is in Zoho's EU data centre. Encrypted database backups are kept in a private Cloudflare R2 bucket with the European Union jurisdiction restriction. Cloudflare's web delivery network and browser push networks operate globally, and providers or their approved subprocessors may sometimes process or remotely access limited information from other countries.

Where UK rules treat this as a restricted international transfer, we use the safeguard that applies to the provider and destination. This may be UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where applicable, or contractual safeguards such as the UK's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer assessment and supplementary security measures where required. Contact us if you would like more information or a copy of the relevant safeguard.

Service improvement milestones

Separately from optional analytics, we record a small, fixed set of first-time milestone timestamps against your account: when you first reached the Cycle Pass upgrade prompt and when you first started Stripe Checkout. Each record holds only your account identifier, which milestone it was and when it happened. No treatment content, medication, appointment, scan or journal information is included, and no browser, device or IP information is recorded. Each milestone is stored once, so returning to the same screen does not add further records.

This is not used for advertising or profiling and is not shared with any third party. It is deleted after 24 months or with the rest of your account, whichever happens first. It is separate from the optional analytics choice below, and accepting or rejecting analytics does not change it. You can object to this processing by contacting support.

Optional analytics and session recordings

PostHog is disabled until you accept optional analytics. If enabled, we collect page routes, browser and device characteristics, performance measurements, app version, selected feature-success events and sanitised technical errors. We use a pseudonymous account identifier after sign-in and do not attach your email or display name.

Session recording is limited to our public pages. It does not run on sign-in or sign-up pages, or anywhere in the application. Inputs are masked and broad click autocapture is disabled. We do not intentionally record authenticated treatment screens or send medication names, doses, clinic details, appointment notes, follicle values, journal text, support-message content or form values to PostHog. You can withdraw consent through “Privacy choices” without losing app access.

Cookies and device storage

Strictly necessary browser storage supports secure sign-in, application updates and privacy preferences. PostHog cookies or local identifiers are used only after consent. See our Cookie and analytics information.

Retention

Your account, treatment records and support requests are kept while your account remains open and are deleted with the account. Service-improvement milestones are kept for no more than 24 months and are deleted sooner if you delete your account. We do not keep account data indefinitely if you stop using OvuPlan: after two years without a sign-in, we email you to say that the account will be deleted. We delete it six months later unless you sign in, and a sign-in resets that clock. We do not delete an inactive account without first sending this warning.

Other records are kept to a fixed schedule:

• Error reports and notification delivery records: 90 days.
• Email delivery events from our email provider: 90 days.
• Payment provider event records: 12 months.
• Optional analytics events, where you have consented: up to 12 months.
• Optional privacy-masked session recordings: up to 30 days.
• Records of a purchase: six years. UK tax law requires us to evidence a sale, so after account deletion we keep the amount, date, payment references and the account identifier to which the sale was made. We do not keep your name or email in that record. Because the payment references still identify the Stripe transaction, this is the one category kept after account deletion, and it is kept because the law requires it rather than because you consented.

PostHog applies its provider retention limits automatically. Deleting your OvuPlan account also requests deletion of the associated PostHog person and queues deletion of their historical analytics events and recordings.

Backups and account deletion

We create an encrypted database backup each day for disaster recovery. Backups are held in the private EU-restricted Cloudflare R2 bucket, are not used for normal operations and are automatically deleted after 35 days. Account deletion removes your live OvuPlan account and treatment information, but an encrypted residual copy may remain beyond use inside a backup until that backup reaches the end of this cycle.

If deletion cannot finish across OvuPlan's database, PostHog or Stripe, we keep the account active rather than reporting a false success. A restricted deletion record captures the failure and the daily retention process retries it automatically. We review the restricted retry queue and close a deletion request only after reconciliation, subject to the limited financial-record exception above.

We keep a separate, restricted restoration ledger for 42 days containing pseudonymous account identifiers, request timestamps and outcomes, but not deleted treatment content. Before any restored backup can be made available, completed erasures are reapplied and later corrections are reviewed from this ledger. This prevents deleted or corrected information from silently reappearing after an incident.

Security

We use authenticated access controls, encrypted network connections, restricted server credentials and encrypted backups. Access to a restored backup remains blocked until its integrity and privacy-ledger replay have been checked. No online service can guarantee absolute security.

Your choices and rights

You can export your OvuPlan data, change optional analytics consent or request complete account deletion from Settings. Depending on the circumstances, you may also ask for access, correction, restriction, portability or erasure, object to processing based on legitimate interests, and withdraw consent at any time. Withdrawing consent does not make earlier processing unlawful.

Data-protection complaints

Email support@ovuplan.co.uk with the subject “Data protection complaint”. We will acknowledge your complaint within 30 days, investigate it appropriately and tell you the outcome without undue delay. You may also complain to the UK Information Commissioner's Office, although giving us the opportunity to resolve the issue first may be quicker.

Important limits and changes

OvuPlan does not provide medical advice and is not an emergency service. Do not include information about another person unless authorised. We will display a new notice and request any consent required if this policy changes materially. The effective date and version at the top identify the notice that applies.

Return to OvuPlan