1. DESCRIPTION OF SERVICE:

Kizmit LLC, (“Kizmit,” “Us,” “We,” or “Our”) operates Kizmit, a women’s wellness web application that correlates phases of the moon with wellness, mood, and emotional-wellbeing content, and which You may optionally sync with Your menstrual cycle (the “Services”). Kizmit is a consumer lifestyle and wellness product. It is not a medical device, does not provide medical advice, diagnosis, or treatment, and is not intended as a substitute for professional medical or mental-health care. Kizmit does not make health claims about the Services and does not label or describe menstrual cycle phases using clinical or diagnostic terminology. Kizmit is not currently regulated as a “covered entity” or “business associate” under HIPAA. This Privacy Policy explains what information We collect, how We use and protect it, and Your choices. Kizmit does not sell Your personal information for monetary compensation.

By visiting our Sites or using the Services, You are consenting to the information collection, use, and sharing practices described in this Privacy Policy, as modified from time to time by Us. If You do not agree with this Privacy Policy, please stop using the Services and Sites.

1.2 STANDALONE CONSUMER HEALTH DATA NOTICE:

To the extent You choose to sync Kizmit with Your menstrual cycle, or otherwise provide information that constitutes “Consumer Health Data” under Washington’s My Health My Data Act or a similar law of another state, that information is separately and specifically addressed in Our Consumer Health Data Privacy Policy, available below. As a matter of company policy, We apply the protections described in that policy to all users, regardless of state of residence. In the event of any conflict between that policy and this Privacy Policy regarding Consumer Health Data, the Consumer Health Data Privacy Policy controls.

1.3 THIRD-PARTY SERVICE PROVIDERS:

Kizmit uses a number of third-party service providers (“Subprocessors”) to operate the Services, including, without limitation: Lovable / Lovable Cloud (application hosting and backend infrastructure, including access to an AI system through its AI gateway); Supabase (database, authentication, and storage, provisioned through Lovable Cloud); Cloudflare (security and performance); Google (sign-in and, where You grant read-only access, Google Calendar data); Open-Meteo, (local weather conditions); once-deployed, Resend (transactional email); once-deployed, Customer.io (lifecycle and marketing email, on an opt-in basis); once subscriptions launch, Stripe (payment processing); once the marketing site it live Netlify (marketing website hosting); OpenStreetMaps (geocoding/location search) and, where activated, an affiliate/referral platform. These Subprocessors receive only the information reasonably necessary to perform their function and are contractually restricted from using Your information for their own independent purposes. This Privacy Policy applies only to the Sites and Services owned and operated by Kizmit; it does not govern the privacy practices of these third-party providers, and We recommend You review their respective privacy policies.

1.4 MARKETING SITE VS. IN-APP PRODUCT:

This Privacy Policy addresses both (a) our public marketing website (kizmit.app) and (b) the logged-in Kizmit application. Certain practices described below, particularly advertising cookies and pixels, apply only to the marketing website. It is Kizmit’s policy not to use advertising or analytics cookies within the logged-in application, or in connection with Your wellness or Consumer Health Data, under any circumstances.

2. DATA COLLECTION & USE; ELIGIBILITY:

We collect personal information that You provide directly to Us, information collected automatically through Your use of the Services, and information generated through the operation of the Services’ automated systems. As part of registration, You will need to provide Your name and a general location (used to determine Your lunar location and local weather conditions). The Services are intended for use by individuals eighteen (18) years of age or older. The Services are not directed at, and We do not knowingly collect personal information from, children.

3. INFORMATION WE COLLECT:

For purposes of this Privacy Policy, “Personal Information” means information that can be used to identify You, such as Your name, email address, or location. We collect the following categories of information:

Account & Profile Data. Your name, email address, authentication credentials (via Supabase), and general location. Location is self-reported information used to determine Your lunar location and to retrieve local weather conditions; Kizmit does not collect continuous or precise device GPS tracking as part of this feature. To keep You signed in, the logged-in application uses strictly necessary session storage (for example, through Supabase Auth). This storage is not used for advertising or analytics and does not require the opt-in consent, which governs non-essential marketing-site trackers only.
Google Account Data (Optional). If You connect Google Sign-In, We receive Your Google account identity. If You separately grant calendar access, We receive read-only access to Your Google Calendar events (calendar.readonly scope) so the Services can reflect Your calendar. This is a sensitive-tier OAuth scope; You provide explicit consent to it during sign-in, and calendar write-back is not currently offered.
Weather and Lunar Data. Kizmit’s current implementation calculates moon phase and illumination locally based on the date and Your general location, without sending this information to an external moon-data service. Kizmit separately retrieves local weather conditions (such as barometric pressure, temperature, and sky conditions) from Open-Meteo, associated with the relevant date, without sending Your personal data to that provider.
Fill-in-the-Blank Answers (“Reflections”). Kizmit prompts You with fill-in-the-blank style prompts that are designed not to directly solicit physical or mental health information. Your answers are encrypted at rest. As a matter of routine practice, We do not review, access, use, or sell Your Reflection answers. Our systems and personnel may access encrypted answers only in defined circumstances, such as to comply with a legal request, investigate suspected abuse or fraud, or provide customer support at Your request, and any such access is limited to what is reasonably necessary for that purpose. We may use Your answers through automated processing solely to generate personalized feedback and content for You; this functionality is not currently active in the Services. You may delete Your Reflection answers at any time.
Marketing Site Visitor Data. Simply by visiting Our marketing website, Netlify (which hosts the site) incidentally collects visitor data such as IP address and other log data in the ordinary course of serving web pages; this is separate from, and not conditioned on, the cookie/advertising consent choices described in Section 7. If You submit Our marketing-site contact form, We also collect the information You provide (such as Your name, email address, and message), and email notifications about Your submission are routed through Resend.
Optional Cycle-Sync Data. If You choose to sync Kizmit with Your menstrual cycle, that information is Consumer Health Data and is addressed specifically in Our Consumer Health Data Privacy Policy.
Billing and Subscription Data. Processed by Stripe, our payment processor.
Communications Data. Transactional emails (such as signup confirmation, password reset, and email-change notices) are sent through Resend. If You opt in to marketing communications, Your email address and a profile of Your product activity (such as check-in activity, onboarding milestones, and insight views) are sent to Customer.io to personalize those communications.
Waitlist Data. If You join Our pre-launch waitlist, We collect Your email address (and any other fields the waitlist form requests) and route it to Customer.io.
Marketing Site Cookies, Analytics, and Advertising Data.

3.1 AUTOMATED PROCESSING AND AI SYSTEMS:

It is Our policy that, when activated, Kizmit’s AI-generated feedback and content will be produced using automated technology, including an AI system accessed through our application platform’s AI gateway (Lovable AI), currently built on Google’s Gemini large language models or a comparable large language model provider, to generate personalized feedback and content from Your Reflection answers and other app activity. This functionality is not currently active in the Services.

Kizmit does not use Your Reflection answers or other Consumer Health Data to train any third party’s general-purpose AI models, and does not use them for advertising. When active, AI-generated content will be provided for entertainment, self-reflection, and general wellness purposes only; it is not medical, mental-health, psychological, or diagnostic advice, and Kizmit does not represent that AI-generated feedback is accurate, complete, or suitable for Your circumstances.

4. HOW WE USE THE INFORMATION WE COLLECT:

Provide and Personalize the Services. To create and maintain Your account, calculate lunar and weather correlations, and generate personalized feedback.
Payment Processing. If You purchase a subscription, payment information is processed by our third-party payment processor, Stripe. Kizmit does not store full payment card information.
Transactional and Marketing Communications. As described herein, transactional emails are sent via Resend, and, only if You opt in, marketing/lifecycle emails and related behavioral data are sent via Customer.io. Marketing communications are opt-in only and We do not enroll You by default and do not treat a failure to opt out as consent.
Marketing Site Analytics and Advertising. These practices are consent-gated and apply only to the marketing website, not Consumer Health Data or in-app wellness activity.
Product Improvement. We may use aggregated or de-identified information to improve the Services.
Complying with the Law. We disclose information if We have a good-faith belief that disclosure is reasonably necessary to comply with the law, legal process, or an enforceable government request, or to protect the rights, property, or safety of Kizmit, our users, or the public.

5. DATA SECURITY:

Kizmit implements reasonable administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. However, no system can be guaranteed to be completely secure.

5.1 ADMINISTRATOR ACCESS CONTROLS:

Access to encrypted Reflection answers and other sensitive account information is restricted to personnel who need it for one of the defined purposes such as responding to a legal request, investigating suspected abuse or fraud, or providing customer support You have requested, and such access is logged. We do not grant blanket or routine administrator access to Reflection answers or other Consumer Health Data, and access outside these defined purposes is not permitted.

5.2 SUBPROCESSOR SECURITY:

We require the third-party service providers described herein who store or process Your personal information on Our behalf to maintain security measures appropriate to the sensitivity of the information they process for Us.

5.3 SECURITY INCIDENT NOTIFICATION:

In the event of a breach of security compromising Your personal information, We will notify You and any applicable regulators as required by applicable law, including Washington’s data breach notification statute (RCW 19.255), which requires notification in the most expedient time possible and without unreasonable delay.

6. HOW LONG WE KEEP YOUR PERSONAL DATA:

Account Data. Retained for as long as Your account remains active, or as needed to provide the Services.
Reflection Answers. Retained until You delete them or delete Your account.
Waitlist and Marketing Data. Retained until You unsubscribe or request deletion.
Legal Retention. We may retain data for a longer period where necessary to comply with legal, tax, accounting, or regulatory obligations, or to resolve disputes.

Kizmit’s policy is to ask for Your affirmative opt-in consent before setting non-essential cookies or firing analytics/advertising trackers on our marketing website (kizmit.app), rather than tracking by default and offering only an opt-out. When You visit our marketing website, You will see a consent banner allowing You to choose whether to allow the following categories:

Strictly Necessary (always on). Cookies needed for authentication, security, and fraud prevention (such as Stripe fraud-prevention signals).
Analytics. Tools that help Us understand site traffic and conversion, such as a web analytics tool (which may be Google Analytics 4 or a cookieless alternative).
Advertising / Targeting. Pixels used to measure and improve our advertising, including the Meta Pixel (Facebook/Instagram, including retargeting), and, if and when activated, Google Ads conversion tracking, a TikTok pixel, and/or a Pinterest tag.

Trackers in the Analytics and Advertising/Targeting categories will not fire unless and until You affirmatively opt in through the consent banner, and You may withdraw Your consent at any time through our Cookie Settings tool, available at any time from the website’s footer. We also recognize and honor the Global Privacy Control (GPC) signal as an opt-out request. Marketing-site pages also load Google Fonts, which discloses Your IP address to Google when a font loads. We use UTM parameters (campaign tags appended to links) for attribution; these are not cookies and do not themselves trigger the consent banner. We may run a first-party, one-question post-checkout survey asking how You heard about Kizmit; Your response is tied to Your customer record but is not shared with third-party advertisers.

These advertising and analytics practices apply only to visitors and general marketing-site activity. They are not used to collect, process, or share Your Consumer Health Data or in-app wellness activity, which are addressed in Our Consumer Health Data Privacy Policy.

We maintain a record of the consent choices You make through the cookie banner such as the date, the categories You accepted or declined, and any later changes, so that Your consent can be demonstrated if needed.

7.1 MARKETING SITE BEHAVIOR ANALYTICS:

It is Our policy that any behavior-analytics tool used on Our marketing website (such as Microsoft Clarity or Hotjar) to observe heatmaps or aggregate visitor activity is treated as part of the Analytics or Advertising/Targeting consent category, applies only to the marketing website, and is never used within the logged-in application. No behavior-analytics tool is in use on Our marketing website as of the date of this Privacy Policy; this section governs any such tool once one is selected and deployed.

7.2 IN-APP PRODUCT ANALYTICS AND SESSION RECORDING:

It is Our policy that in-app product analytics (such as PostHog), used to understand feature usage, is held to a higher bar than the marketing-site tools, because in-app activity can reveal or allow inferences about Your wellness, mood, or cycle-related information. Any in-app product analytics tool We use is limited to event-based analytics (such as counts of actions), does not include session replay, masks or avoids collecting sensitive properties, and is evaluated for self-hosting within Our own infrastructure so that event data does not need to be shared with an additional third-party subprocessor. If an in-app analytics tool collects information that constitutes Consumer Health Data, We will update this Privacy Policy and Our Consumer Health Data Privacy Policy, add the tool as a disclosed subprocessor, and obtain Your separate, affirmative consent before doing so. In-app session recording or screen replay is not used. We treat in-app session replay as disfavored given the sensitivity of in-app activity; its deployment requires a dedicated legal and privacy review, field-level masking, and appropriate screen exclusions before use, and this Privacy Policy will be updated before any such feature is enabled. No in-app product analytics tool or session-recording tool is in use as of the date of this Privacy Policy.

8. CALIFORNIA AND OTHER STATE PRIVACY RIGHTS:

If You are a California resident, You have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and if You are a resident of Washington, Colorado, Connecticut, Virginia, Utah, or another state with a comprehensive privacy law (including, for Consumer Health Data, Washington’s My Health My Data Act), You may have similar or additional rights.

8.1 CATEGORIES OF PERSONAL INFORMATION WE COLLECT:

In the past 12 months, we have collected the following categories of personal information: Identifiers (name, email address, device and cookie identifiers); Commercial Information (subscription and payment transaction records); Internet or Electronic Network Activity (marketing-site browsing activity, such as pages viewed and referral source, where You have opted in to analytics/advertising cookies); Geolocation Data (general, self-reported location used to determine Your lunar location and weather conditions); Sensitive Personal Information, including Consumer Health Data (Reflection answers and optional cycle-sync data, as described in Our Consumer Health Data Privacy Policy); Account Credentials; and Customer Communications.

We collect personal information from the following sources: directly from You when You create an account, respond to a Reflection prompt, or contact customer support; automatically through Your use of the Services; and from integrated services You connect to the platform (such as Google Sign-In and Calendar).

We may disclose personal information to the following categories of third parties: service providers supporting platform operations (hosting, database, authentication, payment processing, and transactional/marketing email); and advertising and analytics partners, but only on the marketing website and only where You have opted in. We do not disclose Consumer Health Data to any of these third parties for advertising purposes.

We do not knowingly collect or sell the personal information of individuals under the age of 16.

We use this information only for business purposes, such as performing analytics, securing and maintaining the functionality of our services, and improving our content and features. We do not collect sensitive personal information as defined under California law, and we do not sell or share personal information for monetary compensation as defined by the CCPA/CPRA. Additionally, we do not knowingly collect or sell data from individuals under the age of 16.

Because our marketing-site advertising pixels (Meta Pixel and, where activated, Google Ads, TikTok, and Pinterest) operate only after Your opt-in consent, no “Sharing” of personal information for cross-context behavioral advertising occurs unless and until You opt in; You may withdraw that consent at any time as described herein. We do not sell or share Consumer Health Data under any circumstances, as described in Our Consumer Health Data Privacy Policy.

8.3 YOUR RIGHTS; HOW TO EXERCISE THEM:

As a California resident, You have the right to: know the categories and specific pieces of personal information We have collected about You; delete personal information We have collected from You, subject to certain exceptions; correct inaccurate personal information; opt out of the Sale or Sharing of Your personal information; and not be discriminated against for exercising these rights. California law also gives You the right to limit a business’s use of Your sensitive personal information (which, for Kizmit, includes Consumer Health Data) to purposes necessary to provide the Services. Kizmit already limits its own use of sensitive personal information to that purpose as a matter of practice, and does not use it for advertising, profiling, or other secondary purposes that would otherwise require Us to offer a separate opt-out link.

To submit a request, contact Us at hello@kizmit.app. We may need to verify Your identity before processing Your request. We recognize and honor the Global Privacy Control (GPC) signal.

8.4 OTHER STATE PRIVACY RIGHTS (COLORADO, CONNECTICUT, VIRGINIA, UTAH, AND SIMILAR STATES):

If You are a resident of Colorado, Connecticut, Virginia, Utah, or another state with a comprehensive privacy law, You have rights similar to those described above, including the right to access, correct, and delete Your personal information, and the right to opt out of the sale of Your personal information and of targeted advertising. Because non-essential advertising and analytics trackers on Our marketing website never fire until You affirmatively opt in through the consent banner described in Section 7, We do not engage in the sale of personal information or targeted advertising with respect to You unless and until You opt in, and You may withdraw that consent, which operates as Your opt-out, at any time through our Cookie Settings tool, available at any time from the website’s footer. You may exercise any of these rights, or appeal a decision on a request, by contacting Us at privacy@kizmit.app.

9. YOUR RIGHTS AND CHOICES:

Account Review and Export. You can review and update Your account information by logging into the Services.
Deletion. You may delete Your Reflection answers, disable cycle sync, or delete Your account at any time.
Opt-Out of Marketing. You may opt out of marketing emails at any time using the unsubscribe link included in each message or by contacting Us; this will not affect transactional/account emails.
Cookie Preferences. You may change Your marketing-site cookie and advertising consent at any time through the Cookie Settings tool, available from the website’s footer.

10. EMAIL NOTICE:

When You register for the Services, You will have the opportunity to opt in to the Kizmit email list. By opting in, You will receive account-related information and, if You choose, marketing information about Kizmit’s products and features. You may opt out of marketing emails at any time, but You may not be able to opt out of account, security, or legally required notifications while You maintain an account.

11. CAN-SPAM ACT:

We collect Your email address to send account and service information, respond to inquiries, and, where You have opted in, send marketing communications. In accordance with the CAN-SPAM Act, We will not use false or misleading subject lines or email addresses; will identify marketing messages as advertisements in a reasonable way; will include Our physical business address in marketing emails; will monitor any third-party email marketing service (such as Customer.io) for compliance; and will honor opt-out/unsubscribe requests promptly, including via the link at the bottom of every marketing email.

12. CONTACT INFORMATION:

If You have any questions about this Privacy Policy or the Services, please contact Us at:

kizmit llc
306 W Redwood St # 4442
Baltimore, MD 21201
privacy@kizmit.app

CONSUMER HEALTH DATA PRIVACY POLICY

Effective Date: August 2026

This Consumer Health Data Privacy Policy (“Health Data Policy”) supplements the Kizmit Privacy Policy and describes how Kizmit LLC (“Kizmit,” “We,” “Us,” “Our”) collects, uses, shares, and protects “Consumer Health Data” as defined under Washington’s My Health My Data Act, RCW 19.373 (“MHMDA”), and under Nevada’s Consumer Health Data Privacy Act, NRS Chapter 603A, and “medical information” as defined under California’s Confidentiality of Medical Information Act, as extended by Assembly Bill 352 (“CMIA”), and, to the extent applicable, similar laws of other states. As a matter of company policy, We apply the protections described in this Health Data Policy to all Kizmit users, regardless of state of residence, rather than limiting them to Washington, Nevada, or California residents only.

1. WHAT INFORMATION THIS POLICY COVERS:

Because Kizmit’s optional cycle-sync feature and certain wellness and emotional-wellbeing features may reveal or allow inferences about Your reproductive health or emotional/mental wellbeing, We treat the following categories of information as “Consumer Health Data”:

Menstrual Cycle Sync Data. If You enable this optional feature, the cycle dates and any related information You provide.
Reflection Answers. Your fill-in-the-blank “Reflection” answers, to the extent they reveal or allow inferences about Your physical or mental health status, including reproductive health, menstrual cycle, or emotional wellbeing, even though Kizmit’s prompts are designed not to directly solicit health information.
Wellness and Emotional-Wellbeing Information. Any mood, wellness, or emotional-wellbeing information You provide, or that Kizmit generates about You based on Your activity in the Services.

2. WASHINGTON CONSUMER HEALTH DATA:

Consumer Health Data broadly means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status, including data related to reproductive or sexual health, and data that, alone or in combination with other information, is used to infer or derive information about a consumer’s health status.

We collect Consumer Health Data directly from You (for example, when You enable cycle sync or respond to a Reflection prompt) and automatically through Your use of the Services (for example, information Kizmit derives or infers about Your wellness based on Your activity).

2.1 PURPOSES FOR COLLECTION AND USE:

We collect and use Consumer Health Data solely to: provide and personalize the Services to You, including generating personalized feedback through the automated/AI processing described in the Privacy Policy; maintain and secure Your account; and comply with legal obligations. We do NOT use Consumer Health Data to serve You or anyone else targeted advertising, and We do NOT use Consumer Health Data for any purpose beyond providing the Services to You without first obtaining Your separate, valid authorization.

We do not, and will not, sell Consumer Health Data. We do not share it with any third party for targeted or cross-context behavioral advertising. The advertising pixels and analytics tools described in Our Privacy Policy operate only on Our public marketing website in connection with general visitor and marketing data, and are never used to collect, process, or share Consumer Health Data. If this ever changes, We will update this Health Data Policy and obtain Your separate, affirmative consent before sharing.

2.3 NO GEOFENCING:

We do not use geofencing technology to establish a virtual boundary around any healthcare facility for the purpose of identifying, tracking, collecting data from, or sending notifications to consumers regarding their Consumer Health Data or health care services.

2.4 YOUR RIGHTS:

You have the right to:

2.4.1 CONFIRM AND ACCESS:

You have the right to confirm whether We are collecting, sharing, or selling Your Consumer Health Data, and to access that data, including a list of all third parties and affiliates with whom We have shared or sold Your Consumer Health Data (currently none, other than the processors described herein) and an active email address or other online mechanism You may use to contact them directly.

You have the right to withdraw Your consent to Our collection and sharing of Your Consumer Health Data at any time; for example, by disabling cycle sync or deleting Your Reflection answers.

2.4.3 DELETION:

You have the right to have Your Consumer Health Data deleted. When We receive Your deletion request, We will delete it from Our records, including from all parts of Our network, and will notify all affiliates, processors, contractors, and other third parties with whom We have shared Your Consumer Health Data of Your request; those parties are required to honor it and delete the data from their own records. If Your data is stored in archived or backup systems, deletion from those systems may be delayed to enable restoration of the archive or backup, but that delay will not exceed six months from the date We authenticate Your deletion request.

2.4.4 HOW TO SUBMIT A REQUEST:

You may submit a request to exercise any of these rights at any time by emailing Us at privacy@kizmit.app. You do not need to create a new account to exercise these rights, though We may ask You to use an existing account, if You have one, to help verify Your identity. If We cannot verify Your request using commercially reasonable efforts, We may ask You for additional information reasonably necessary to authenticate You and Your request, and We are not required to act on the request until You provide it.

2.4.5 RESPONSE TIMEFRAMES AND FEES:

We will respond without undue delay, and in all cases within 45 days of receipt (extendable once, by an additional 45 days, if We notify You of the need for more time within the initial 45-day period, along with the reason). We will not charge You for responding, up to twice per year; if Your request is manifestly unfounded, excessive, or repetitive, We may charge a reasonable fee to cover the cost of responding, or decline to act on it.

2.5 APPEALS:

If We refuse to act on Your request, You may appeal by replying to Our denial or emailing Us at privacy@kizmit.app with “Appeal” in the subject line. We will respond in writing within 45 days of receipt, explaining what action We took (or didn’t take) and why. If We deny Your appeal, We will also provide You with a way to contact the Washington State Attorney General to submit a complaint.

3. NEVADA:

Nevada’s Consumer Health Data Privacy Act, codified at NRS Chapter 603A, defines “Consumer Health Data” in substantially the same way as the MHMDA and applies regardless of the size of the business collecting it. For the same reasons described above, We treat the categories of information as Consumer Health Data under Nevada law.

As under Washington law, We collect and use this information solely for the purposes described in Section 2.1 above.

We do not, and will not, sell Your consumer health data. We do not share it with any third party for advertising purposes. We share it only with the third-party processors identified herein.

We do not use geofencing technology to establish a virtual boundary around any mental health, reproductive health, or other healthcare facility for the purpose of identifying, tracking, collecting data from, or sending notifications to consumers regarding their consumer health data or health care services.

You have the same rights pertaining to access, consent, and deletion, as described in Section 2.4 above.

You may submit a request using the same process described above.

4. CALIFORNIA MEDICAL INFORMATION:

California’s CMIA, as extended by Assembly Bill 352, provides that a business offering a “reproductive or sexual health digital service”, as defined by a service that allows a consumer to manage information about the consumer’s reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity, is deemed a “provider of health care” for purposes of the CMIA, even if the business and its personnel are not licensed healthcare providers. Kizmit’s optional cycle-sync feature allows You to track and manage information about Your menstrual cycle, and Kizmit treats Menstrual Cycle Sync Data, together with related Reflection Answers and wellness information, as “medical information” protected under the CMIA.

4.1 AUTHORIZATION-BASED DISCLOSURE:

We will not disclose medical information covered by this Section except: (a) with Your valid, written authorization; (b) to the processors identified herein, acting on Our behalf under contract; (c) as required or permitted by the CMIA or other applicable law; or (d) as compelled by valid legal process.

4.2 ENHANCED ACCESS AND SEGREGATION CONTROLS:

As a matter of Our own policy, We limit access to reproductive-health-related medical information to personnel and processors who need it to provide the Services, and We do not knowingly share it with any individual or entity outside the United States. Your Reflection answers are protected by database-level encryption at rest plus per-user access controls; Our systems and personnel may access this information only in the defined circumstances described in Our Privacy Policy.

4.3 YOUR RIGHTS UNDER THE CMIA:

To the extent the CMIA applies to information Kizmit holds about You, You have the right to access Your medical information, request correction of inaccurate information, and be free from unauthorized disclosure. You may exercise these rights by contacting Us at privacy@kizmit.app.

5. GENERAL PROTECTIONS FOR ALL USERS:

This Health Data Policy specifically addresses Washington, Nevada, and California law because those are the states with laws directly targeting consumer health data or reproductive/sexual health information. A number of other states have comprehensive privacy laws that classify health-related information as “sensitive data” subject to similar protections. Rather than track each state’s requirements separately, it is Our policy to apply the protections described in this Health Data Policy to all Kizmit users, regardless of state of residence.

6. THIRD PARTIES WHO PROCESS CONSUMER HEALTH DATA ON OUR BEHALF:

We share Consumer Health Data only with the service providers who store or process it on Our behalf solely to provide the Services, currently: Lovable / Lovable Cloud and Supabase (application hosting, database, authentication, and storage). It is Our policy that AI-generated feedback from Your Reflection answers, when activated, will be generated through the AI system accessed via Our application platform’s AI gateway (Lovable AI), currently built on Google’s Gemini large language models or a comparable large language model provider. This functionality is not currently active in the Services; this Health Data Policy discloses it in advance so that no further policy update is required to activate it. Any provider used for this purpose, whether now identified or added later, is contractually restricted from using Consumer Health Data for its own independent purposes or for advertising, and is prohibited from using it to train general-purpose models. If Kizmit’s use of Consumer Health Data for this purpose ever expands beyond generating personalized feedback as described in Section 2.1 above, We will update this Health Data Policy and obtain any consent required by law before doing so.

We will obtain Your affirmative, opt-in consent before collecting Your Consumer Health Data for a new purpose not disclosed in this Health Data Policy, separate and distinct from Your acceptance of the Terms and Conditions or general Privacy Policy. If We ever need to share Your Consumer Health Data with a third party other than a processor described herein, which We do not do today, We will obtain Your affirmative, opt-in consent to that sharing separately and distinctly from any consent obtained to collect the data in the first place, as required by the MHMDA. Enabling optional cycle sync requires the separate opt-in consent described in Our Terms and Conditions.

8. CHANGES TO THIS POLICY:

We may update this Health Data Policy from time to time. Material changes will be communicated as described in Our Terms and Conditions, and, where required by law, We will obtain renewed consent before applying material changes to previously collected Consumer Health Data.

9. CONTACT:

If You have any questions about this Health Data Policy, please contact Us at: