Privacy Policy
Jurisdiction: This policy is drafted to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU GDPR (where applicable), the California Consumer Privacy Act as amended by the CPRA, the Washington My Health My Data Act, the FTC Health Breach Notification Rule, the Illinois Biometric Information Privacy Act, and other US state privacy laws as listed in Section 10.
1. Who we are and how to contact us
Awakening Fertility is operated by Awakening Sovereignty Limited, a company registered in the United Kingdom with company number 17108297, registered office at The Old School House West Street, Southwick, Fareham, Hampshire, United Kingdom, PO17 6EA.
For UK and EU users, the data controller is Awakening Sovereignty Limited. For US users, references to ‘controller’ should be read as ‘business’ under CCPA/CPRA and ‘regulated entity’ under the Washington My Health My Data Act.
Founder and principal coach: Fiona Boulton.
Data Protection Officer: contactable at support@awakeningfertility.com.
US privacy contact: support@awakeningfertility.com.
Postal: The Old School House West Street, Southwick, Fareham, Hampshire, United Kingdom, PO17 6EA
2. What this platform is, in plain terms
Awakening Fertility is an educational coaching platform built around an AI persona that reflects Awakening Sovereignty’s fertility coaching methodology. The platform provides educational guidance about fertility, hormonal health, pregnancy, and menopause.
The platform does not provide medical advice, does not diagnose conditions, and does not prescribe treatment. Any health-adjacent content is educational and is not a substitute for the advice of a qualified healthcare professional.
3. Categories of personal data we process
| Category | Examples | Source | Phase introduced |
|---|---|---|---|
| Account data | First name, surname, email address, password (hashed), authentication metadata | From you | Phase 1 |
| Onboarding answers | Communication style, current goal, partner status, emotional state, region, age confirmation | From you | Phase 1 |
| Conversation data | Messages you send to the AI persona; AI responses; structured summaries we generate from these | From you / generated | Phase 1 |
| Special category — health | Health-related context you choose to share (cycle data, fertility journey, hormonal symptoms, condition flags such as PCOS, low AMH, endometriosis) | From you | Phase 1+ |
| Cycle and biometric-adjacent | Period dates, basal body temperature, cervical mucus observations, mood logs, sleep, HRV (if you connect a wearable) | From you / wearable | Phase 2 |
| Voice usage data | Whether you have enabled voice rendering of the AI’s responses; playback events. We do not record your voice. | From you | Phase 2 |
| Medical document data | Lab results you choose to upload (PDF or image); structured values extracted by OCR | From you | Phase 3 |
| Visual usage data | Whether you have enabled the visual avatar of Fiona; playback events. We do not collect images of you. | From you | Phase 4 |
| Payment data | Billing email and address; subscription status. Card details are processed by Stripe; we never see them. | From you / Stripe | Phase 2 |
| Technical data | IP address, device type, browser, language, hashed user-agent. Used for security and rate limiting. | Automatically | Phase 1 |
| Consent records | What you consented to, when, how, and what version of the consent text you saw | Generated | Phase 1 |
Categories we deliberately do not collect: precise geolocation (we use country only for crisis-resource routing), facial images of you, audio recordings of you, payment card numbers, government identifiers, employment information, and information about minors.
4. Lawful basis for processing (UK GDPR / EU GDPR)
| Processing purpose | Article 6 lawful basis | Article 9 condition (where special category data is involved) |
|---|---|---|
| Creating your account and providing the platform | Article 6(1)(b) — performance of contract | Not applicable |
| Generating personalised AI coaching responses | Article 6(1)(b) — contract | Article 9(2)(a) — explicit consent |
| Cycle tracking and structured symptom logging | Article 6(1)(b) — contract | Article 9(2)(a) — explicit consent |
| Voice rendering of AI responses | Article 6(1)(a) — consent | Article 9(2)(a) — explicit consent (biometric processing relates to Fiona’s voice clone, not yours) |
| Lab result interpretation | Article 6(1)(a) — consent | Article 9(2)(a) — explicit consent |
| Service emails (e.g. password reset) | Article 6(1)(b) — contract | Not applicable |
| Marketing emails (with your consent) | Article 6(1)(a) — consent | Not applicable |
| Anonymised aggregate research (opt-in) | Article 6(1)(a) — consent | Article 9(2)(a) — explicit consent |
| Security, abuse prevention, audit | Article 6(1)(f) — legitimate interests (in protecting users and the service) | Not applicable (no special-category data is logged) |
| Compliance with legal obligations | Article 6(1)(c) — legal obligation | Article 9(2)(g) where applicable |
You can withdraw any consent at any time, in your settings or by emailing support@awakeningfertility.com. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.
5. How AI processing works
When you message the AI, the following happens. Your message is first passed through a privacy filter that strips identifiers (email addresses, phone numbers, postal codes/zip codes, surnames). Your first name is preserved so the AI can address you by name. The sanitised text is then used to retrieve relevant passages from Fiona Boulton’s coaching content, and combined with a prompt that contains your communication preferences and a short summary of your previous sessions. Anthropic’s Claude model generates the response, which is checked by an automated safety classifier before being returned to you.
The Claude model is operated by Anthropic, our LLM provider. We use Anthropic’s Enterprise tier with a zero-retention agreement: Anthropic does not retain or use your conversation data to train its models.
AI responses are educational coaching, not medical advice. If you have a clinical question, the AI will direct you to a healthcare professional. Where the AI cannot find supporting content in Fiona’s coaching corpus, it will say so rather than guess.
6. Sub-processors
We use the following sub-processors. A live register, with execution dates of each Data Processing Agreement and any updates, is maintained at awakeningfertility.com/legal/sub-processors and is available on request.
| Sub-processor | Role | Data shared | Location |
|---|---|---|---|
| Anthropic | LLM inference | Sanitised conversation context | US (EU opt-in from Phase 2) |
| OpenAI | Embeddings (vector representations of text) | Sanitised query text | US (SCCs) |
| Pinecone | Vector search of Fiona’s corpus | Embeddings of Fiona’s content (no user data) | EU (eu-west-1) |
| Supabase | Primary database | All durable user data | EU |
| Clerk | Authentication | Email, name, auth metadata | US (SCCs) |
| Upstash | Session cache, rate limiting | Session tokens, counters | EU |
| Vercel | Hosting and edge | Request metadata, hosting | EU edge |
| Sentry | Error monitoring | Errors with PII removed | EU (de.sentry.io) |
| Resend | Transactional email | Email address, name | EU/US (SCCs) |
| Stripe | Payments | Email, billing address, payment token | Multi-region |
| ElevenLabs | Voice synthesis | Safety-classified text + Fiona’s voice clone | EU/US (SCCs) |
| Google Document AI (Phase 3) | Lab document OCR | Lab document for ≤24 hours | EU |
| HeyGen (Phase 4) | Visual avatar | Safety-classified text + Fiona’s likeness | US (SCCs) |
| DeepL (Phase 5) | Translation | Sanitised UI strings and corpus | EU |
We will give at least 30 days’ notice before adding a new sub-processor that processes special-category personal data. You can object during that period; if we cannot accommodate your objection, you may terminate your subscription with a pro-rata refund.
7. International transfers
Where personal data is transferred outside the United Kingdom or the European Economic Area, we rely on one of the following safeguards: an adequacy decision (e.g. for transfers to jurisdictions the UK or EU has determined to provide adequate protection); the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCCs) supplemented by a transfer risk assessment; or, where applicable, your explicit informed consent under Article 49(1)(a).
Anthropic, OpenAI, HeyGen, Stripe, Clerk, and Resend (where US-routed) operate under Standard Contractual Clauses with documented Transfer Risk Assessments. Where Anthropic offers EU data processing (effective for our use from Phase 2), we use that option in preference to US transfer.
8. Retention
| Data type | Retention |
|---|---|
| Account profile | While your account is active. Deleted within 30 days of account closure. |
| Conversation summaries | While your account is active; you can delete them at any time. |
| Raw conversation transcripts | Retained for up to 30 days for service quality and safety review, then automatically deleted; only the summary persists. |
| Cycle data (Phase 3) | While your account is active; user-deletable. |
| Lab uploads (Phase 3) | Raw documents are deleted within 24 hours of upload, regardless of processing status. Extracted structured values are retained while your account is active and are user-deletable. |
| Consent records | Six years after your last interaction, for legal evidentiary purposes. |
| Audit logs (admin actions, deletions) | Six years, on append-only storage, for security and regulatory accountability. |
| Backups | Daily snapshots retained for seven days. Where we delete data on request, the deletion will be reflected in any backup restore. |
| Anthropic conversation logs | Subject to Anthropic’s zero-retention Enterprise agreement; we do not store conversations with Anthropic beyond inference. |
9. Your rights (UK GDPR / EU GDPR)
You have the following rights, which you can exercise through your account settings or by contacting support@awakeningfertility.com. We will respond within one month.
- Right of access — you can ask us for a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate or incomplete data.
- Right to erasure (right to be forgotten) — you can ask us to delete your data; we will, within 30 days, unless we have a legal obligation to retain specific records.
- Right to restriction — you can ask us to pause certain processing while a query is resolved.
- Right to data portability — you can receive a structured, machine-readable export of your data.
- Right to object — you can object to processing based on legitimate interests, including profiling.
- Right not to be subject to solely automated decision-making with legal or significant effects — the AI does not make such decisions; it provides educational guidance and you decide what to do.
- Right to withdraw consent — at any time, in settings.
- Right to lodge a complaint with a supervisory authority — for UK users, the Information Commissioner’s Office (ico.org.uk). For EU users, your national data protection authority.
10. United States users — your rights
This section applies to users physically located in the United States. Where state law gives you stronger rights than the general UK/EU framework above, the stronger right applies.
10.1 California (CCPA / CPRA)
If you are a California resident, you have the right to know what personal information we collect about you, the right to delete, the right to correct, the right to opt out of the sale or sharing of your personal information, and the right to limit the use of sensitive personal information. We do not sell or share your personal information for cross-context behavioural advertising.
Sensitive personal information we process includes information about your health, your fertility journey, and content you upload that may reveal sensitive details. We use this information only to provide the service you have asked for; you can ask us to limit its use to those purposes by contacting us.
To exercise your rights, use your account settings or email support@awakeningfertility.com. We will not discriminate against you for exercising any right.
You may use an authorised agent. We will verify the request and the agent’s authority before responding.
10.2 Washington — My Health My Data Act
If you are a Washington resident, you have additional rights regarding ‘consumer health data’ as defined by the Washington My Health My Data Act. We collect consumer health data only with your specific, granular, and freely given consent, and only for the purposes you have agreed to. You have the right to withdraw your consent at any time, the right to delete your consumer health data, and the right to a list of any third parties with whom we have shared it.
We do not ‘sell’ your consumer health data. We do not collect precise geolocation. We do not engage in geofencing around healthcare facilities.
To exercise these rights, use your account settings or email support@awakeningfertility.com.
10.3 Other US states
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Iowa, Indiana, Tennessee, Montana, Delaware, New Jersey, New Hampshire, Kentucky, Rhode Island, Minnesota, and other US states with comprehensive privacy laws have rights similar to those described in California above, including the right to access, delete, correct, and opt out of certain processing. To exercise these rights, contact support@awakeningfertility.com.
We honour the Global Privacy Control (GPC) signal as a valid opt-out request from your browser.
10.4 Children
This platform is intended for adults aged 18 and over. We do not knowingly collect personal information from children. If you are under 13 in the United States, do not use this platform; if we become aware that we have collected personal information from a child under 13, we will delete it without delay (COPPA).
10.5 Health data and the FTC Health Breach Notification Rule
Awakening Fertility is a consumer health app. Some of the personal data we process is ‘PHR identifiable health information’ under the FTC Health Breach Notification Rule. If we experience a security breach involving such information, we will notify affected users and the Federal Trade Commission within the timelines required by that rule (within 60 days, and without unreasonable delay).
10.6 Biometric data
In Phase 2, we will offer voice rendering using a clone of Fiona’s voice. The biometric data being processed is hers, not yours, and is governed by the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and the Washington biometric privacy law as applicable. We do not process biometric data of users at any phase. If we ever introduce a feature that processes user biometric data, we will obtain separate written informed consent in advance.
11. Security
We protect your data with administrative, technical, and physical safeguards designed to meet healthcare-grade standards. These include encryption in transit (TLS 1.3) and at rest (AES-256), database row-level security, audit logging of administrative actions, multi-factor authentication on administrative roles, and a documented incident response plan with 72-hour breach notification under UK GDPR and 60-day notification under the FTC Health Breach Notification Rule.
No system is perfectly secure. We commit to clear, prompt notification if a breach occurs that is likely to result in risk to your rights and freedoms.
12. Cookies and similar technologies
We use only the cookies and storage strictly necessary to operate the service (authentication, security, language preferences). We do not use advertising or cross-site tracking cookies.
13. Changes to this policy
We will notify you of material changes to this policy by email and through an in-app notice at least 30 days before they take effect. The version history is available at awakeningfertility.com/legal/privacy/history.
14. Contact and complaints
Privacy questions: support@awakeningfertility.com
Data Protection Officer: support@awakeningfertility.com
Postal: The Old School House West Street, Southwick, Fareham, Hampshire, United Kingdom, PO17 6EA
UK supervisory authority: Information Commissioner’s Office, ico.org.uk.
EU users: your national data protection authority.
US Federal Trade Commission: ftc.gov.
California Privacy Protection Agency: cppa.ca.gov.