Privacy Policy | Mobile App

2.1 Legal Bases

2.2 Data Security

• Encryption of all transmissions via SSL/TLS
• Storage on EU servers
• All data processors are contractually bound under Art. 28 GDPR

2.3 Data Processing Outside the EEA

For third-country transfers, the following apply: the EU-US Data Privacy Framework (DPF) for certified US providers, otherwise Standard Contractual Clauses under Art. 46 para. 2 GDPR. This is noted in the third-party provider table (item 4.7).

‍

2.4 Storage Period

Data is deleted once the purpose of processing no longer applies — unless statutory retention obligations (up to 10 years, e.g. under tax law) require longer storage. After your user account is deleted, personal data is removed without delay, unless legal obligations require otherwise.

‍

2.5 Obligation to Provide Data

Mandatory data is only that which is necessary for concluding the contract or fulfilling a legal obligation. Other information is voluntary.

As a data subject, you can exercise the following rights at any time by messaging support@hermaid.me:

4.1 Download & Operation

When downloading from the Apple App Store or Google Play Store, the store operators transmit data (username, device identifier, timestamp) independently — we have no influence over this. We host the operation of the app on EU servers; in doing so, we process technically necessary data (IP address, timestamp, operating system, app version) to ensure stability and security. Legal basis: Art. 6 I lit. f GDPR.

4.2 User Account & App Features

To set up and operate your user account, we process your email address, password, and optional profile data. Legal basis: Art. 6 I lit. b GDPR. Upon deletion, the account and all personal data are removed without delay, unless legal obligations require otherwise.

4.3 Health Data

Information about symptoms, complaints, cycle or hormonal changes, and diagnoses constitutes health data (Art. 4 no. 15 GDPR) and requires your explicit consent (Art. 9 II lit. a GDPR). We process this exclusively for:

• the onboarding questionnaire to capture your starting situation
• symptom journaling and trend visualizations
• personalized evaluations based on your own entries

Withdrawal is possible at any time; health-related features will no longer be available afterward.

‍

4.4 Employer Programs

The app may be offered through employer license programs. Use is voluntary; no employment-related disadvantages arise from not using it. Employers receive only the number of activated licenses — no access to health data or other individual usage information. Legal basis: Art. 6 I lit. f GDPR.

‍

4.5 Single Sign-On

You can optionally sign in via Apple or Google. The respective provider confirms your login to us; we do not transmit any further data. Providers: Apple Inc. (USA) | Google Ireland Ltd. (Ireland). Legal basis: Art. 6 I lit. f GDPR.

‍

4.6 Payment Processing

4.7 Third-Party Services

All providers listed below are bound by a data processing agreement (Art. 28 GDPR) and process data exclusively on our instructions.

4.8 AI-Powered Chat Function

The optional chat function allows you to ask questions about health topics and app features. When you open it, you are clearly informed that you are interacting with an AI system. Its responses are not a medical diagnosis and do not replace medical advice.

Data processed: the content of your messages, any health-related information, and technical usage data. We recommend not providing personal information beyond your question. Chat content is not used to train external AI models. For internal quality assurance, conversation histories may be evaluated in anonymized form. Only pseudonymized information is transmitted to the AI system (a technical ID and symptom content without direct personal reference). OpenAI cannot link this to you as a person. Nevertheless, we recommend not entering directly identifying information (name, address, email) in the chat. Legal basis: Art. 6 I lit. b GDPR. Withdrawal: the chat function will no longer be available afterward.

‍

4.9 Telemedicine Consultation (Teleconsultation)

You can optionally book appointments with medical professionals and consult with them via video/audio. In doing so, appointment and booking data, communication data (video/audio), health information you provide, and technical connection data are processed. Recordings are only made with separate consent. The medical professional is an independent data controller for their own documentation. Legal basis: Art. 6 I lit. b and h GDPR.

‍

4.10 Optional Participation in Scientific Studies

hermaid may conduct studies on health topics together with scientific institutions. Participation is entirely voluntary — the app remains fully usable without participation. Data is only transmitted upon active sign-up and separate study-specific consent, and exclusively in anonymized form. Legal basis: Art. 6 I lit. a; Art. 9 II lit. a GDPR.

‍

Below is a consolidated overview of all categories of recipients of your data:

The following processing activities require your consent. Withdrawal is possible at any time: app settings, system settings (push), or support@hermaid.me.

hermaid generates personalized evaluations and recommendations based on your own entries. This personalization is based exclusively on data you have entered yourself and has no legal or similarly significant effect on you. It therefore does not constitute automated decision-making within the meaning of Art. 22 GDPR.

The AI-powered chat function generates responses based on your inquiries but does not make decisions about you. You can object to this processing at any time (see Section 3).

We reserve the right to amend this privacy policy (e.g. for new features or changed legal requirements). The current version is always available in the app and at www.hermaid.me. We will notify you separately of any material changes.

‍

For questions: Her-Medical-Aid GmbH – support@hermaid.me

Data Protection Officer: datenschutz@heydata.eu