PRIVACY POLICY

version effective 09.01.2024

1. What is the Privacy Policy?

By using the iYoni app, you entrust us with your personal data, including your health and lifestyle data. This Policy explains how we process the data we receive from you in order to provide you with information and support on taking care of your health, fertility, contraception, while trying to get pregnant and during infertility treatment.

Operating in the field of new technologies, we know how important it is to adequately protect your personal information. Therefore, we make special efforts to protect your privacy and the information you provide to us.

We carefully select and use appropriate technical measures, especially those of a programmatic and organizational nature, to ensure the protection of the personal data processed.

In our Privacy Policy you will find all the most important information regarding our processing of your personal data.

We ask you to read it and promise that it won’t take you more than a few minutes.

1.1 Who is the administrator of the iYoni mobile application?

The administrator of the website is LIFEBITE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ based in Olsztyn, at Prof. Aleksandra Martyniaka 16/1, 10-763 Olsztyn, registered by the District Court in Olsztyn, VIII Economic Division of the National Court Register, KRS 0001079294; Tax Identification Number (NIP) 7393994164, National Business Registry Number (REGON) 527412861, with a share capital of 51,000.00 PLN (i.e.: us).

2. Personal information

What legal act governs the processing of your personal data?

Your personal data is collected and processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119, p. 1), commonly referred to as: GDPR. To the extent not regulated by the GDPR, the processing of personal data is governed by the Personal Data Protection Act of May 10, 2018.

2.2 Who is the controller of your personal data?

The administrator of your personal data is LIFEBITE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ based in Olsztyn, at Prof. Aleksandra Martyniaka 16/1, 10-763 Olsztyn, registered by the District Court in Olsztyn, VIII Economic Division of the National Court Register, KRS 0001079294; Tax Identification Number (NIP) 7393994164, National Business Registry Number (REGON) 527412861, with a share capital of 51,000.00 PLN, telephone: + 48 696 706

587, e-mail: contact@iyoni.app.

You can contact us about your personal information via:

email: contact@iyoni.app

3. How do we process the Personal Data that you provide to us?

What personal data do we process and for what purposes?

In our application, we offer you a number of different services for which we process different personal data, based on different legal grounds.

3.1.1 purpose: to register and maintain an account, including providing the functionality available in the account

personal information: e-mail address, username

legal basis: Article 6(1)(b) GDPR, i.e. processing for the purpose of taking action at your request, prior to entering into a contract, and processing necessary for the performance of a contract to which you are a party

data storage time: until the account is deleted

3.1.2 purpose: to conclude and execute an access service agreement

personal information: e-mail address, username

data storage time: until the statute of limitations on claims

3.1.3 purpose: to monitor the menstrual cycle/cycle while using contraception

Personal data: user name, age, given data on cycle length, bleeding, taking or not taking medications

data storage time: until the account is deleted

3.1.4 purpose: to record fertility symptoms and signs from the body

Personal data: body temperature measurements, observations on cervical mucus, data on

intercourse and sex drive, results of ovulation tests and gynecological ultrasound (description), body symptoms, mood.

legal basis: Article 9(1)(a) GDPR, i.e. processing on the basis of your consent to process specific data

data storage time: until you withdraw your consent

purpose: recording daily activities

personal data: information about your diet, sleep parameters, physical activity performed, use of stimulants

legal basis: Article 9(1)(a) GDPR, i.e. processing on the basis of your consent to process specific data

data storage time: until you withdraw your consent

3.1.6 purpose: complete questionnaires to assess health/fertility/examination results/preparation for prescription visit (generate report)

Personal data: data on your health and lifestyle, medical history, pregnancies, diseases in the family, risk factors for fertility, medications and supplements taken, test results

legal basis: Article 9(1)(a) GDPR, i.e. processing on the basis of your consent to process specific data

data storage time: until you withdraw your consent

3.1.7 purpose: to share cycle information, health, fertility, mood, needs, calendar events, messages with your partner – within the app connection

Personal data: cycle data, chances of pregnancy, contraceptive intake, mood, supplemental information, chat text messages, calendar events

legal basis: Article 9(1)(a) GDPR, i.e. processing on the basis of your consent to process specific data

data storage time: until you withdraw your consent

3.1.8 purpose: to establish, assert and enforce claims and defend against claims in proceedings before courts and other state authorities

personal data: name, surname, mailing address, taxpayer identification number, e-mail address, telephone number, IP address

legal basis: art. 6(1)(f) GDPR i.e. processing for the purpose of realizing our legitimate interest in establishing, pursuing and enforcing claims and defending against claims in proceedings before courts and other state authorities

data storage time: until the expiration of the statute of limitations for claims concerning the performance of the contract

3.1.9 purpose: to fulfill legal obligations under the law, in particular tax and accounting regulations

personal data: name, surname, individual identification numbers used for payments, e-mail address, telephone no., mailing address, bank account no. payment card no.

legal basis: Article 6(1)(c) GDPR, i.e. the processing is necessary to fulfill our legal obligations under the law, in particular tax and accounting regulations

data storage time: until the expiration of legal obligations incumbent on the Administrator that justified the processing of personal data

3.1.10 purpose: direct marketing of own services, including remarketing

personal data: data provided in your account, in particular your username and your behavior in the application, such as clicks

legal basis: Article 6(1)(f) GDPR, i.e. processing for the purpose of our legitimate interest consisting in direct marketing of our own services (including those performed by subcontractors), including remarketing

storage time: until you object to the processing of your personal data

3.1.10 purpose: to inform about Application Partners’ projects, research, events organized by third parties (e.g., patient organizations)

personal data: data provided in your account, in particular your username and your behavior in the application, e.g. clicks, interest profiling data

Legal basis: Article 6(1)(f) GDPR, i.e. processing for the purpose of our legitimate interest in providing relevant information on partner organizations’ collaborations, initiatives and events

storage time: until you object to the processing of your personal data

3.2 Voluntariness of providing personal data

Your provision of the required personal data is voluntary, but is a condition for us to provide services to you (such as creating an account).

3.3 Recipients of personal data

Recipients of your personal data may be: entities providing accounting, legal, debt recovery, analytical and IT services to us, as well as medical or scientific services (in this case only with your additional consent to transfer the data and provide a medical service or participate in a scientific study).

3.4 Automated decision-making (including profiling)

We will display personalized recommendations to you based on the information you complete in your account, in particular regarding your test results, lifestyle or monthly cycle, answers to questions in additional surveys. Recommendations contain information automatically tailored to your needs, taking into account the parameters you enter, and serve, depending on the purpose you select in the app, to improve your health, adjust contraception, increase your chances of getting pregnant, support in infertility treatment or during pregnancy, among others. The app analyzes the data you have completed and then pinpoints factors that affect your health, fertility, contraception or pregnancy as recommendations.

In addition, based on your behavior in the App, i.e. interest in the services, click history and content viewed, we customize for you the marketing message then displayed to you in the form of push notifications.

3.5 Will we transfer your personal data outside the EEA or to an international organization?

We do not transfer your personal data outside the EEA or to an international organization. However, the stores from which you can download our App and which process payments on the App may store your personal data on servers located in the US. To do so, please refer to the privacy policies of these entities.

Google LLC is listed as a participant in the Privacy Shield program (link: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active), and uses model contractual clauses on data security approved by the European Commission. Privacy Policy: https://policies.google.com/privacy?hl=pl&fg=1

Apple uses standard contractual clauses approved by the European Commission for cross-border transfers of personal data. Privacy Policy: https://www.apple.com/legal/privacy/pl/

4. How we process the personal data we receive from app users to connect to the partner app

Our mobile application allows you to share the information you have completed in your account with the people you designate, through a combination of two applications (user and partner). To do this, you link your application through the software to the application of the person you wish to share the information you have selected in that person’s application. In such cases, we transfer

your personal information to the designated other person using our application. In order to give you full control over your data, in the application you can decide at any time in the settings which data will be passed on to the person using the linked application, and you can completely opt out of the connection.

5. What rights do you have in connection with our processing of your personal data?

Under the GDPR, you have the right to:

request access to your personal data (Article 15 GDPR);
request rectification of your personal data (art.16 GDPR);
request deletion of your personal data, the so-called “right to be forgotten” (Article 17 GDPR);
request the restriction of the processing of personal data (Article 18 GDPR);
object to the processing of personal data (Article 21 GDPR);
request the transfer of personal data (Article 20 GDPR).

If you make any of the above-mentioned requests to us, we will inform you without undue delay

– and in any case within one month of receipt of the request – of the action taken in connection with your request.

If necessary, we can extend the one-month deadline by another two months due to the

complexity of the request or the number of requests.

In any case, we will inform you within one month of receipt of the request about the extension of the deadline and give you the reasons for the delay.

5.1 Can you withdraw the consent you have given for the processing of personal data?

You may revoke the consent you have given for the processing of your personal data at any time.

Withdrawal of consent to process personal data does not affect the lawfulness of the processing performed by us on the basis of your consent before its withdrawal.

If you wish to withdraw your consent to the processing of your personal data, submit your request to: contact@iyoni.app.

In case you want to revoke your consent to the processing of personal data for the purpose of providing the “Newsletter” service, you can opt-out by writing to us.

5.2 Complaint to the supervisory authority

If you believe that the processing of your personal data violates data protection laws, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place where the alleged violation was committed.

In Poland, the supervisory authority under GDPR is the President of the Office for Personal Data Protection.

For more information, click here.