Version 1.0 · Effective 13 July 2026
Privacy Policy
Lena — clinical-grade AI women’s health companion
Version 1.0 · Effective 13 July 2026
Applies to the Lena mobile app (iOS and Android), lenacare.ai, and the Lena Doctor Portal.
The short version
You are trusting us with data about your body. Here is exactly what we do with it.
We never sell your data. Not to advertisers, not to insurers, not to employers, not to data brokers. Selling or commercially exploiting health data is illegal in France (Art. L.1110-4 of the French Public Health Code), and it is against everything Lena exists to do.
We never use your health data to train third-party AI models. Our AI providers are contractually barred from training on your content.
Your health data is processed on your explicit consent. You can withdraw it at any time.
Nobody sees your data unless you say so. A doctor only gets access to your record when you grant it.
Delete means delete. Your account, cycle history, chats, quiz answers, and health syncs are erased within 30 days. Backups roll off within 90.
Lena is an AI. She is warm and she is well-informed, but she is not a physician and Lena is not a medical device. She does not diagnose you.
Everything below is the detail behind those six lines.
1. Who we are
Lena is built and operated by Gynexperts, a company registered in France. When this policy says “we,” it means Gynexperts.
Data controller — Gynexperts, registered in France
Privacy contact — privacy@lenacare.ai
Data Protection Officer (DPO) — dpo@lenacare.ai
Supervisory authority — CNIL (Commission Nationale de l’Informatique et des Libertés), France
We are the data controller for everything described in this policy — we decide what data is collected and why. Where a doctor you have connected with keeps their own clinical record, that doctor is a separate controller for that record (see §7).
2. What we collect
2.1 Account and identity
Email address — from you, or Apple / Google Sign-In. Required.
Password — from you. Stored hashed (bcrypt). We never see it.
First name, last name — from you, or Apple / Google Sign-In. Optional.
Apple / Google account identifier — from Apple, Google. Used only to sign you in.
Profile photo — from you. Optional.
Language and time zone — from your device. Used to localise the app and time your notifications.
Push notification token — from your device. Only if you enable notifications.
2.2 Health data — special category (Art. 9 GDPR)
This is the sensitive part. We collect it because Lena cannot work without it, and only with your explicit consent.
Body metrics — date of birth, age, height, weight, BMI.
Ethnic origin (optional) — self-declared, used for clinical baselines that vary by population. You may always choose “prefer not to say.”
Cycle — period start and end dates, flow intensity, cycle and period length, irregular-cycle status.
Reproductive status — contraception (method, brand, start date, notes), pregnancy, postpartum / breastfeeding, perimenopause, menopause, fertility treatment, gender-affirming care, other medical reasons for absent periods.
Symptoms — physical and emotional symptoms you log — including cramps, fatigue, mood, sleep, acne, hot flashes, night sweats, libido, vaginal dryness, and others.
Daily check-ins — physical and emotional wellbeing scores, activity logs.
Medications — medications you record.
Diagnosed conditions — conditions you tell us about (e.g. PCOS, endometriosis).
Assessments — your answers and scores across Lena’s questionnaires — fertility (Atlas), perimenopause, sexual wellness, activity, work-life wellness, personality.
Lab results (where you provide them) — values you enter or upload (e.g. AMH, FSH) and Lena’s interpretation of them.
Goals — what you’re here for — planning fertility, understanding your cycle, tackling symptoms, resolving a condition, and so on.
2.3 Apple Health / Health Connect (opt-in only)
If — and only if — you connect Apple Health (iOS) or Health Connect (Android), we read:
Menstrual flow
Sleep (bed and wake times, duration, deep and REM stages)
Steps, walking/running distance, flights climbed, active energy
Workouts (type, duration, energy)
Heart rate (resting) and heart rate variability (HRV)
We only read. We never write anything back to Apple Health or Health Connect. You can revoke access at any time in your phone’s settings or in Lena’s settings; we stop syncing immediately and delete the synced records within 30 days.
2.4 Conversations
Lena AI chat — your messages, Lena’s replies, conversation titles.
Attachments — photos and documents you choose to send. They stay on your device until you send them.
Voice notes — audio you record, and the text transcription of it.
Doctor chat — messages between you and a doctor you have connected with, and any attachments.
Chats routinely contain health information. Treat them as health data — because we do.
2.5 Reports and content
Weekly and monthly cycle reports generated for you, including anonymised comparisons against the average for your age band. Videos you watch, content you favourite, searches you run in the app.
2.6 Subscription
If you subscribe, Apple (App Store) or Google (Play) processes the payment. We never see your card number or bank details. We receive only your subscription status and a transaction identifier.
2.7 Technical data
IP address, device type and operating system, app version, crash reports and error traces, session and refresh tokens, server logs.
2.8 Analytics
With your consent, we record product-usage events (screens viewed, features used, onboarding steps completed, assessments started and completed, check-ins submitted) linked to your account identifier, so we can see what works and what doesn’t. Some of these events carry health-derived values, such as an assessment score or a wellbeing rating. We treat them with the same protection as everything else in §2.2.
We do not run any advertising or attribution SDKs. There are no ad trackers in Lena.
2.9 What we never collect
Precise location. Contacts. Photo library (beyond what you explicitly attach). Microphone (beyond a voice note you deliberately record). Biometric identifiers such as Face ID data — that stays on your device, and Apple never shares it with us.
3. Why we use it, and on what legal basis
Create and run your account — Contract, Art. 6(1)(b).
Track your cycle; predict periods, ovulation and fertile windows — Explicit consent, Art. 9(2)(a) + Art. 6(1)(a).
Calculate your Atlas baseline and Bloom scores — Explicit consent, Art. 9(2)(a).
Power the Lena AI chat, daily briefings and cycle reports — Explicit consent, Art. 9(2)(a).
Sync Apple Health / Health Connect — Explicit consent, Art. 9(2)(a), granted separately in-app and at OS level.
Give a doctor access to your record — Explicit consent, Art. 9(2)(a), granted per doctor, revocable.
Send push notifications and email summaries — Consent, Art. 6(1)(a); revocable in settings.
Manage your subscription — Contract, Art. 6(1)(b).
Keep accounting and tax records — Legal obligation, Art. 6(1)(c).
Product analytics — Consent, Art. 6(1)(a) + Art. 82 of the French Data Protection Act.
Security, abuse prevention, service integrity — Legitimate interest, Art. 6(1)(f).
Improve Lena using aggregated, anonymised statistics — outside GDPR once genuinely anonymised (no re-identification possible).
Withdrawing consent. You can withdraw any consent at any time — in Settings, or by emailing privacy@lenacare.ai. Withdrawal doesn’t undo processing that already happened lawfully, but it stops it going forward. If you withdraw consent for health data processing, Lena’s core features stop working, because there is nothing left for her to read.
4. How Lena’s AI works
Lena is built on large language models. When you chat with her, ask for a report, or complete an assessment, we send the relevant part of your record — your cycle context, recent symptoms, assessment answers, and the conversation itself — to an AI provider acting as our processor under a data processing agreement.
Our AI providers:
OpenAI — primary chat, assessment analysis, voice transcription, text-to-speech.
Google (Gemini) — report generation, fallbacks, image generation.
Under our agreements with them:
Your content is not used to train their models.
Content is processed to return a response and is not retained for their own purposes.
They are bound to the same confidentiality and security standards we hold ourselves to.
Where processing happens outside the EU, see §9.
Lena is an AI system. You are always told when you are speaking to Lena rather than a human. She may be wrong. Her outputs are informational — they are not a diagnosis, a prescription, or medical advice, and they do not replace a consultation with a qualified professional.
No automated decisions with legal or similarly significant effects. Your Atlas score, Bloom scores, and Lena’s insights are informational. Nothing Lena calculates decides anything about you — no eligibility, no denial of service, no legal consequence. You are not subject to a decision based solely on automated processing within the meaning of Art. 22 GDPR.
5. Lena is not a medical device
Lena is a wellness and health-information tool. She does not diagnose disease, prescribe treatment, or replace clinical judgment. If you have a medical concern, speak to a healthcare professional. If you have an urgent or emergency symptom, contact your local emergency service — in France, 15 (SAMU) or 112.
6. Who we share your data with
We share data with a small number of vetted providers who process it on our instructions only, under Art. 28 GDPR data processing agreements.
Hetzner Online GmbH — hosting, database, file storage. Sees all data at rest. Germany / Finland (EU).
OpenAI — AI chat, assessment analysis, transcription, TTS. Sees chat content and health context sent for inference. European Union and United States.
Google — Gemini models; Firebase Cloud Messaging (Android push); Google Sign-In. Sees chat content and health context sent for inference; push tokens; account identifier. EU / US.
Apple — Sign in with Apple; App Store subscriptions; APNs push. Sees account identifier; subscription receipts; push token. Ireland (EU) / US.
PostHog — product analytics. Sees account identifier, name, email, usage events. EU (Frankfurt, Germany).
MailerLite — transactional and notification email. Sees email, name, language. Lithuania (EU).
Doctors. A doctor sees your record only when you grant them access, and only for as long as you leave that access in place. You can revoke it at any time.
Nobody else. We do not share your data with advertisers, insurers, employers, data brokers, or social platforms. We will disclose data to a public authority only where a valid legal order compels us, and we will tell you unless the law forbids it.
If we are acquired, your data may transfer to the acquirer, who would be bound by this policy. We would notify you in advance and you would be free to delete your account first.
7. The Doctor Portal
If you connect with a doctor through Lena:
You give explicit, separate consent for that doctor to see your record.
That doctor sees only what you have shared: your profile, cycle, symptoms, assessments, and your conversation with them.
Doctors are bound by medical confidentiality (secret médical, Art. L.1110-4 of the French Public Health Code) in addition to our contracts with them.
The doctor is a separate data controller for the clinical record they keep, and their own retention obligations apply to it.
You can revoke access at any time in Settings. Revoking stops all future access immediately.
Lena’s AI may prepare a summary or a suggested reply for a doctor. The doctor reads, edits, and decides — the AI never sends anything to you on their behalf without their review.
8. Where your data lives
Your account, health record, chats, and files are stored on servers in the European Union (Germany and Finland).
We are migrating to infrastructure certified as an HDS host (Hébergeur de Données de Santé), the French certification for hosting personal health data. We will announce the completion date here and notify you when the migration is done.
9. International transfers
Two of our AI providers, OpenAI and Google, may process data in the United States.
Where that happens, transfers are protected by:
Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR) — our primary safeguard;
a transfer impact assessment documenting the risk and the measures we apply;
technical and organisational measures including encryption in transit, pseudonymisation where possible, strict data minimisation (we send only what the model needs to answer), and contractual bans on retention and training.
We deliberately do not rely on the EU–US Data Privacy Framework alone as our transfer basis. Standard Contractual Clauses stand independently of it.
You may request a copy of the relevant safeguards at privacy@lenacare.ai.
10. How long we keep your data
Account and all health data — for as long as your account is active.
After you delete your account — erased from live systems within 30 days.
Backups — rolling backups purged within 90 days.
Inactive account — deleted after 24 months without any sign-in, following two email warnings.
Voice note audio — deleted within 7 days of transcription; the transcript follows your chat history.
Apple Health / Health Connect data — deleted within 30 days of disconnecting.
Doctor chat messages — with your account. The doctor’s own clinical record is subject to their professional retention obligations.
Subscription and billing records — 10 years (Art. L.123-22, French Commercial Code).
Connection and security logs — 6 months; up to 12 months where an incident is under investigation.
Analytics events — 13 months.
Proof of consent — 3 years from withdrawal or last collection.
Marketing email list — until you unsubscribe, then 3 years from last contact.
Support correspondence — 3 years.
Anonymised, aggregated statistics — which cannot be traced back to you — may be kept indefinitely.
11. How we protect it
In transit: TLS 1.2 or higher on every connection.
At rest: health data is encrypted in our database and file storage.
Passwords: hashed with bcrypt. Nobody at Lena can read your password.
Sessions: short-lived access tokens with rotating refresh tokens.
Access control: least privilege. Only the engineers who need production access have it, and it is logged. Doctors see only patients who have granted them access.
Auditing: access to health records is traced.
Vendors: every processor is assessed before onboarding and bound by an Art. 28 agreement.
People: everyone at Lena is trained on health-data handling and bound by confidentiality.
If there is a breach that puts your rights at risk, we notify the CNIL within 72 hours (Art. 33 GDPR) and tell you directly, without undue delay, where the risk to you is high (Art. 34 GDPR).
12. Your rights
Under the GDPR and the French Data Protection Act (Loi n° 78-17 of 6 January 1978), you have the right to:
Access (Art. 15) — get a copy of everything we hold about you.
Rectification (Art. 16) — correct anything that’s wrong — most of it directly in Settings.
Erasure (Art. 17) — delete your account and everything in it. Settings → Delete account.
Restriction (Art. 18) — freeze processing while a dispute is resolved.
Portability (Art. 20) — receive your data in a structured, machine-readable format, or have it sent to another provider.
Objection (Art. 21) — object to processing based on our legitimate interest.
Withdraw consent (Art. 7(3)) — at any time, without giving a reason.
Post-mortem directives (Art. 85, Loi Informatique et Libertés) — tell us what should happen to your data after your death — general directives can be registered with a certified trusted third party, or specific directives sent to us directly.
How to exercise them: email privacy@lenacare.ai. We reply within one month. If your request is complex we may extend by two further months, and we will tell you why within the first month. We may ask you to verify your identity — we will not hand your health record to someone claiming to be you.
If we get it wrong: you can complain to the CNIL.
CNIL — 3 Place de Fontenoy — TSA 80715, 75334 PARIS CEDEX 07, France. www.cnil.fr
13. Age
Lena is for people aged 16 and over. We do not knowingly collect data from anyone under 16. If we learn that we have, we delete the account and its data immediately. If you are a parent or guardian and believe your child has created an account, contact privacy@lenacare.ai.
14. Cookies and trackers
In the app: Lena uses local storage on your device to keep you signed in and to remember your preferences — this is strictly necessary and requires no consent. Product analytics identifiers are only activated if you consent, and you can change your mind at any time in Settings.
On lenacare.ai: we use strictly necessary cookies to run the site. Any analytics or measurement cookie is set only after you consent through our banner. Refusing is as easy as accepting, your choice is remembered, and we re-ask no more often than every six months.
15. Changes to this policy
If we change anything material — a new purpose, a new processor, a new category of data — we will tell you in the app and by email before it takes effect, and where the change relies on your consent, we will ask for it again.
Every version is dated. The version history is at the foot of this page.
16. Contact
Privacy questions and rights requests — privacy@lenacare.ai
Data Protection Officer — dpo@lenacare.ai
Security disclosure — security@lenacare.ai
A French-language version of this policy is available at lenacare.ai/confidentialite. In the event of any discrepancy, the French version prevails.
Version history
Version 1.0 — 13 July 2026 — Initial publication.