Where your PCOS data lives: how Femvia's encryption works

In 2024, the Federal Trade Commission finalised a settlement against Flo Health, one of the largest period-tracking apps in the world, after the company was found to have shared sensitive cycle and pregnancy data with third-party advertising partners [1]. The settlement made one thing very clear. The privacy promises that period-tracker apps had been making for years were, in many cases, not the privacy promises their users thought they were making.

We built Femvia after that became public. Privacy isn't a marketing line for us. It's a choice we built into the app from the start, one that limits what we can ever do with your data. This article explains how.

What Femvia does not collect

We never ask for your phone number, date of birth, address or government ID. Apple's sign-in may offer to share your name, but we don't keep it. Apple also lets you hide your email, and we only ever see a relay address if you do.

You pick a botanical alias when you start: Sage, Ondina, Marigold, whichever you like. Your account is tied to your Apple sign-in, not to your name. Our database holds your alias next to a short health profile, never your name.

The waitlist on this site does collect an email, because we need a way to ring the doorbell once when the app opens. After launch, those emails are used only to send you the launch update. They never travel into the app.

What Femvia does collect, and where it lives

Your daily check-ins, mood scores, sleep and movement logs live on your phone, in the app's private storage. They never reach our servers. Your written notes and chat history get an extra layer: they are scrambled with AES-256 encryption [4], using a key created on your phone that never leaves it.

A small profile does live on our servers, in Mumbai: your alias, goal, PCOS type, cycle length, last period date, height, weight and diet. That's what lets the app set your plan and bring it back if you change phones.

If you want a backup of your logs, the app saves an encrypted file to your own iCloud. Not to a Femvia server. Your phone, your cloud, your key.

This means a few specific things, all on purpose. We can't read the notes, chats or daily logs stored on your phone. Apple can't read the backup either, because it's encrypted with your key. Delete the app and the backup, and that data is gone. On our servers we hold two things: your Apple sign-in record and your profile. Delete everything in Settings removes your profile.

What the AI companion sees

Most of the work happens on your phone. Your phone spots your patterns, works out which type of PCOS fits you, and picks the next card to show you.

When you ask the AI companion a question, three things go to it: your question, your last few messages in that chat, and a short summary of your week. That summary looks like "average energy 2.8 of 5, day 9, follicular phase". It includes your nickname, but never your notes or your email.

The answer comes from Google's Gemini. On our paid plan, Google doesn't use your questions to train or improve its products. It keeps them for up to 55 days to catch misuse, then deletes them. Femvia's server passes them through and stores none of it.

We never sell your data. We don't train AI on it. We don't show it to advertisers. Our business model is the Plus plan, with no behavioural advertising.

What jurisdictions this design is built for

We pay attention to two regulations in particular. The U.S. HIPAA Privacy Rule, updated in 2024 to specifically protect reproductive health information, sets the bar for how covered entities must handle this kind of data in the United States [3]. Femvia is not a covered entity (you aren't a patient of ours; we are not a healthcare provider), but the spirit of that rule shapes our defaults.

In India, the Digital Personal Data Protection Act of 2023 sets new requirements for explicit consent, data minimisation, and the right to erasure for any service processing personal data of Indian users [2]. We designed Femvia to collect as little as possible, which makes these duties simpler to meet. We're working through them with care before our public launch.

What happens if Femvia ever gets hacked

This is the question we ask ourselves. If our servers were breached tomorrow, what would the attacker get?

Our database holds your alias, your Apple sign-in id and email (a relay address if you hid it), and your short health profile: goal, PCOS type, cycle length, last period date, height, weight and diet. The waitlist emails sit in a separate website database until launch.

It does not hold your daily symptom logs, mood scores, sleep data, notes or chats. Those are on your phone, and an attacker in our database can't reach them.

That isn't a marketing trick. It's the choice we made about what kind of company we want to be, made before there was any data to lose.

Your control, plainly

Backups are only made when you tap Back up now, and you can delete the file from your iCloud yourself.

To remove your data, use Delete everything in Settings. It removes your profile from our servers and your logs from your phone. Deleting just the app leaves your profile on our servers, so use the button first.

If you want a copy of what we hold, write to us and we'll send it. It's a short file.

This is the long version of what most companies put behind a 40-page privacy policy. The short version fits on one line, and it is the line we say everywhere: your daily logs stay on your phone, and we built the app so that we couldn't read them if we wanted to.