Privacy Policy

The PMDD Lab

Effective date: 1 November 2026

1. Introduction

This Privacy Policy explains how Bloomful Planners ("Bloomful", "we", "us") processes personal data in connection with The PMDD Lab mobile application (the "App"). It applies to users of the App on Apple iOS and Google Android devices.

The App is designed so that the information users record is stored on their own device. Bloomful does not operate user accounts and does not hold a copy of the information users record in the App, except as described in this Privacy Policy.

2. Controller

The controller of the personal data described in this Privacy Policy is:

Bloomful Planners (sole trader)

Business ID: 3485996-4

Sarvijaakonkatu 16 A 9, 33540 Tampere, Finland

Email: hello@bloomfuljournals.com

3. Information stored on the user's device

The App stores the information that the user enters, including cycle and period dates, moods, symptoms, sleep, energy, habits, notes, experiments, reflections, letters and settings, in local storage on the user's device. This information is not transmitted to Bloomful. Bloomful cannot access or recover it.

If the user has enabled the device's own backup service (Android backup to the user's Google account, or iCloud backup), the App's data is included in that backup under the terms of the backup provider. If the user enables calendar sync, the App writes predicted cycle dates to the user's device calendar, from where they may be synced by the calendar provider. If the user exports their data, the export file is transferred only to the destination the user chooses. Bloomful does not receive the information in any of these cases.

4. Personal data we process

4.1 AI readings

The App offers optional readings written by an artificial intelligence service. When the user requests a reading and has given consent, the App transmits a summary of one menstrual cycle, consisting of: the moods, symptoms, sleep, energy and period flow recorded during that cycle, grouped by cycle phase; the names of habits, symptoms and tags included in the summary, including names entered by the user; the user's experiment question and results, and results of earlier experiments with the same habit; whether the habit is marked as a medication or supplement; and an indicator of whether the user recorded very difficult days, so that the reading can refer the user to support resources.

The summary does not include free-text notes, the calendar dates of entries, or medications entered in the App's settings.

The summary is transmitted to Bloomful's server, operated on Cloudflare's platform, which forwards it to the AI service provider and returns the reading to the App. Neither Bloomful nor the AI service provider stores the summary or the reading, and the AI service provider does not use them to train its models.

To apply limits on the number of readings, Bloomful's server stores counters of readings provided. The counters are associated with a pseudonymous code derived from an anonymous identifier generated by the App, and not with the user's name or contact details.

4.2 Purchases

Subscriptions are sold through the Apple App Store and Google Play. Bloomful uses RevenueCat to determine whether a user's subscription is active. RevenueCat receives an anonymous identifier generated by the App and the user's purchase history from the relevant store. Bloomful does not receive payment card details or the user's name or email address from the stores.

4.3 Crash reports

If the App stops working unexpectedly, it transmits a crash report to Sentry. A crash report contains technical information about the error, the device model, the operating system version and the App version. It does not contain health information or the device's IP address, and it is stored on servers in the European Union.

5. Health data and consent

Information about a user's menstrual cycle, mood and symptoms is health data and constitutes a special category of personal data under Article 9 of the General Data Protection Regulation (GDPR). Bloomful processes such data outside the user's device only for the purpose of providing AI readings, and only on the basis of the user's explicit consent, which the App requests before the first reading.

The user may withdraw consent at any time in the App under Settings › Your data › AI readings. After withdrawal, no summary is transmitted unless the user gives consent again. Withdrawal does not affect the lawfulness of processing carried out before it.

6. Purposes and legal bases

We process personal data for the following purposes and on the following legal bases:

(a) providing AI readings requested by the user, on the basis of the user's explicit consent (GDPR Articles 6(1)(a) and 9(2)(a));

(b) applying limits to the number of AI readings and controlling the costs of the service, on the basis of our legitimate interest (Article 6(1)(f));

(c) verifying subscriptions and providing the paid features the user has purchased, on the basis of the performance of a contract with the user (Article 6(1)(b)); and

(d) identifying and correcting errors in the App, on the basis of our legitimate interest in maintaining a functioning App (Article 6(1)(f)).

Bloomful does not use personal data for advertising, profiling or analytics, and does not sell personal data.

7. Recipients

We use the following service providers, which process personal data on our behalf and under our instructions:

(a) Cloudflare, Inc., which operates the server used for AI readings;

(b) the AI service provider that generates AI readings, under terms providing for no data retention and no use of data for model training (this Privacy Policy will name it when the service starts);

(d) Functional Software, Inc. (Sentry), which processes crash reports.

Apple Inc. and Google LLC process payment and purchase information as independent controllers under their own privacy policies.

8. International transfers

Some of our service providers are established in the United States. Where personal data is transferred outside the European Economic Area, the transfer is based on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework or on the Standard Contractual Clauses adopted by the European Commission.

9. Retention

Information stored on the user's device is retained until the user deletes it or uninstalls the App. AI summaries and readings are not retained. Reading counters relating to subscribers are deleted after twelve months without use; a record that the free reading has been used is retained so that the free reading can be provided only once per installation. RevenueCat retains purchase records for as long as necessary for the subscription and to comply with legal obligations. Crash reports are deleted automatically within 90 days.

10. Your rights

Subject to the conditions of the GDPR, you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time.

Because the information recorded in the App is stored only on your device, you can exercise these rights directly: you can export your data under Settings › Your data › Export my data, and erase it by deleting the App or its data in your device settings, together with any device backups. For personal data held by our service providers, such as subscription records or reading counters, please contact us at hello@bloomfuljournals.com.

You have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, www.tietosuoja.fi) or with the supervisory authority of your place of residence.

11. Age limit

The App is intended for persons aged 18 and over. We do not knowingly process personal data of persons under 18.

12. Security

Data transmitted by the App is encrypted in transit. Bloomful's server does not store health data. The information stored on the user's device is protected by the device's own security features.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The effective date above shows when it was last changed. We will inform users in the App before material changes take effect.

14. Contact

Questions about this Privacy Policy or the processing of personal data may be sent to hello@bloomfuljournals.com or by post to Bloomful Planners, Sarvijaakonkatu 16 A 9, 33540 Tampere, Finland.