Privacy Policy

Your health information is deeply personal.

Luna needs that information to understand your health history, recognize patterns over time and become more useful to you. That makes privacy part of how Luna is built, not something added at the end.

The short version is:

• We do not sell your personal or health information.
• Luna uses the information you share to provide your personalized experience.
• Cross-user research and Intelligence Layer development use de-identified information.
• Your identifiable health information is not given to advertisers, employers, insurers, pharmaceutical companies, practitioners, affiliates or outside organizations for their own independent purposes.
• Authorized technology providers process only the information needed to provide their services to Luna.
• You can access, export, correct and request deletion of your personal information.
• Consent to Luna's core health-data processing and internal de-identified learning is required to use Luna.
• If you withdraw that consent, your Luna account will be closed.
• Properly de-identified information cannot later be traced back to you and removed.

This Policy explains those practices in more detail.

Luna is operated by The Perimenopause Lab, also known as PM Lab, in Canada.

PM Lab is responsible for the personal information described in this Privacy Policy.

For privacy questions, data requests, complaints or deletion requests, contact:

support@perimenopauselab.com

Luna is a Canadian product and our privacy practices are governed by applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) where applicable.

If you use Luna from another country, you acknowledge that you are using a Canadian service and that your information will be handled under this Canadian privacy framework.

Luna is intended for adults aged 18 and older.

We do not knowingly create accounts for or collect health information from anyone under 18.

If you believe someone under 18 has created an account, contact us at support@perimenopauselab.com.

We collect information needed to provide, personalize, protect and improve Luna.

Depending on how you use Luna, this may include:

This may include:

• name;
• email address;
• date or year of birth;
• timezone;
• account settings;
• authentication information.

This may include:

• symptoms;
• symptom timing, severity and frequency;
• menstrual and cycle information;
• reproductive and hormonal history;
• medications;
• hormone therapy;
• supplements;
• diagnoses and medical history;
• laboratory information;
• treatments and interventions;
• behaviours and lifestyle information;
• outcomes and treatment responses;
• other health details you choose to share.

This may include:

• text conversations;
• voice conversations;
• transcripts created from voice conversations;
• contextual notes derived from your conversations.

This may include:

• structured symptom records;
• longitudinal health history;
• system scores;
• trends;
• pattern interpretations;
• summaries;
• predictions;
• clinician-ready reports;
• other outputs created from your information.

This may include:

• corrections to Luna's interpretation;
• ratings;
• feedback;
• information you provide to help us improve Luna.

This may include:

• IP address;
• browser or device information;
• session information;
• feature usage;
• errors;
• security events;
• operational logs.

If you purchase a paid Luna service, a payment provider may process your payment information.

PM Lab does not need to store your full payment-card details.

We use your information to:

• create and manage your account;
• provide voice and text conversations;
• maintain your longitudinal health history;
• organize symptoms and health information;
• recognize patterns and trends over time;
• personalize Luna's conversations and educational insights;
• generate summaries and clinician-ready reports;
• support practitioner, product or service recommendations;
• send requested reminders and essential account communications;
• provide customer support;
• protect Luna from fraud, abuse and security threats;
• troubleshoot errors and improve reliability;
• understand how Luna is being used;
• meet legal, accounting and compliance obligations.

Luna's core purpose depends on learning from the health information you share.

Without that information, Luna cannot build your longitudinal health history, identify patterns or provide the personalized functions the service is designed to provide.

Luna is designed to become more useful as she learns from health information over time.

The information associated with your account helps Luna understand your individual history, including how symptoms, cycles, treatments, behaviours, laboratory information and outcomes may change together.

PM Lab also uses de-identified information across Luna users to develop, evaluate and improve Luna's internal Intelligence Layer.

This may include improving:

• Luna's health and symptom ontology;
• conversational understanding;
• information extraction;
• scoring systems;
• longitudinal pattern recognition;
• predictive models;
• summaries and explanations;
• clinician-ready reports;
• recommendation systems;
• safety systems;
• prompts, algorithms and model behaviour;
• other Luna functions.

We may also use de-identified information for internal exploratory analysis and research intended to better understand women's health.

For example, we may investigate which symptoms tend to occur together, what users report most often, how experiences vary over time, which questions Luna should ask more effectively, or where women appear to be struggling to find appropriate information or care.

This internal learning is part of Luna's core service.

For cross-user research, exploratory analysis and Intelligence Layer development, PM Lab uses de-identified information.

Identifying information is separated so that the information used for this work is not intended to identify you personally.

Once information has been properly de-identified so that PM Lab can no longer link it back to you, we cannot identify and remove your individual contribution later.

Withdrawal of consent also cannot reverse:

• analyses already completed;
• findings already produced;
• model improvements already made;
• other product improvements already developed from properly de-identified information.

De-identification reduces privacy risk, but no data system can eliminate every possible risk completely. We use technical, organizational and access safeguards appropriate to the sensitivity of health information.

Health information is sensitive, so Luna requires your express consent before processing it.

By consenting during onboarding, you allow PM Lab to:

• process your health information to provide Luna's personalized functions;
• maintain your longitudinal health history;
• recognize patterns and generate educational insights;
• use de-identified information across Luna users for internal research and exploratory analysis;
• improve Luna's Intelligence Layer, AI systems, models and product functions;
• investigate patterns relevant to women's health;
• improve Luna's safety, accuracy and usefulness.

This consent is required to use Luna because these activities are part of Luna's core functionality.

If you do not consent, you will not be able to use Luna.

You may withdraw your consent.

Because the consent described above is required for Luna to provide its core service, withdrawing it means Luna can no longer continue providing the service to you and your account will be closed.

Closing your account does not automatically mean that all of your personal information is deleted.

You can:

• download your information through available Luna account tools;
• request deletion through your profile where available;
• contact support@perimenopauselab.com to request deletion.

Some information may need to be retained for legal, accounting, billing, security, fraud-prevention, audit or dispute-resolution purposes.

Information that has already been properly de-identified cannot be traced back to you and removed from prior research, analysis or Intelligence Layer development.

This consent covers Luna's internal research, exploratory analysis and Intelligence Layer development using de-identified information.

It does not automatically authorize external or secondary research uses that fall outside those purposes.

If PM Lab later proposes a materially different research use, external research activity or disclosure that requires additional consent, we will ask you before that use occurs.

Access to personal and health information is limited to people and service providers who need it to operate, protect or improve Luna.

Authorized PM Lab personnel are given access only where required for their role and are subject to confidentiality obligations.

For internal research, exploratory analysis and Intelligence Layer work, authorized personnel work with de-identified information and are subject to confidentiality requirements.

Service providers may process personal information only to provide services to PM Lab and are subject to appropriate contractual privacy, security and confidentiality obligations.

Luna relies on technology providers to operate.

Current providers include:

• Microsoft Azure, for application hosting, database infrastructure and Azure OpenAI services;
• Azure OpenAI, for AI processing used in functions such as extraction, summaries and explanations;
• LiveKit, for real-time voice infrastructure;
• Deepgram, for speech-to-text;
• OpenAI, for certain AI processing during voice or conversational interactions;
• Cartesia, for text-to-speech;
• Resend, for account emails, reminders and communications;
• Inngest, for scheduled background processing;
• PostHog, for product analytics and understanding how Luna is used;
• payment providers, when you purchase paid Luna services.

Different providers receive different information depending on the function they perform.

We aim to send only the information reasonably necessary for that function.

Where possible, identifiable health content is minimized or excluded from general product analytics.

Providing services to PM Lab does not give these providers permission to use your identifiable health information to create their own independent women's-health datasets, products or AI models.

Some Luna features require AI and voice-processing providers.

During a voice conversation, audio and conversation information may be processed through providers such as LiveKit, Deepgram, OpenAI and Cartesia so Luna can understand your speech and respond.

After a conversation, Azure OpenAI may process transcripts and relevant health context for functions such as structured extraction, summaries, explanations and reports.

If you say or type identifying information during a conversation, that information may be included in the content required to process your request.

We limit processing to what is reasonably necessary for the Luna function being provided.

Luna may use your information internally to help narrow down practitioners, products or services that appear relevant to you.

A practitioner does not receive access to your Luna health history simply because Luna recommends them.

A product company, retailer, affiliate, sponsor or manufacturer does not receive access to your Luna health history simply because a product or service is recommended.

If you choose to contact a practitioner, share a clinician-ready report, visit another website or purchase a product, information you provide directly to that organization is governed by that organization's own privacy practices.

PM Lab may record recommendation, referral or purchase-related events so we can operate these features and understand whether they are useful.

PM Lab does not sell, rent or trade your identifiable personal or health information.

We do not sell identifiable health information to:

• advertisers;
• employers;
• insurers;
• pharmaceutical companies;
• data brokers;
• practitioners;
• product companies;
• affiliates.

We do not provide identifiable health information to outside organizations for advertising, employment decisions, insurance underwriting or independent AI-model training.

Luna's primary account and health information is stored on Canadian servers using Microsoft Azure infrastructure.

Some technology providers may still process limited information as part of providing specific Luna functions.

Where a provider processes information outside Canada, that processing is governed by the provider relationship and applicable contractual safeguards.

Luna remains a Canadian service governed by our Canadian privacy framework.

We keep personal information only as long as reasonably necessary for the purposes described in this Policy or as required by law.

In general:

• account and health information is retained while your account is active;
• closing your account ends access to Luna but does not automatically delete all personal data;
• if you request deletion, PM Lab will delete information that can lawfully and reasonably be deleted;
• limited billing, audit, security, accounting, legal or dispute-related records may be retained where required;
• properly de-identified information may be retained because PM Lab can no longer identify your individual contribution.

When information is no longer needed, we delete it, de-identify it or securely dispose of it.

Under Canadian privacy law, including PIPEDA where applicable, you may have the right to:

• know why we collect, use and disclose your information;
• access the personal information we hold about you;
• request correction of inaccurate or incomplete information;
• withdraw consent, subject to the consequences described in this Policy;
• ask how your information has been used or disclosed;
• request deletion where applicable;
• request a copy of your information;
• challenge our compliance with privacy requirements;
• make a privacy complaint.

You can use available in-app tools or contact:

support@perimenopauselab.com

We may need to verify your identity before completing a privacy request.

Some requests may be limited where information must be retained for legal, security, fraud-prevention, accounting or similar reasons.

If we cannot fully complete a request, we will explain why.

Health information deserves strong protection.

We use technical and organizational safeguards appropriate to the sensitivity of the information Luna handles.

These may include:

• secure authentication;
• encrypted HTTPS and WSS communications;
• encrypted storage where supported;
• user-scoped access controls;
• restricted administrative access;
• short-lived access or voice-session tokens;
• logging and monitoring;
• confidentiality and privacy obligations for authorized personnel and service providers;
• security testing and review.

No online service can guarantee absolute security.

If a privacy or security breach occurs, we will investigate it and provide notifications to affected individuals and regulators where required by Canadian law.

Luna may use cookies and similar technologies required to:

• keep you signed in;
• protect your account;
• remember settings;
• operate product features;
• understand product performance.

We also use product analytics, including PostHog, to understand areas such as onboarding, feature usage, check-ins, retention, product performance and errors.

General growth analytics should not contain identifiable health content unless specifically required for an approved purpose and appropriately protected.

Where Canadian law requires consent for non-essential cookies or analytics, we will provide the appropriate choice.

Some communications are necessary to operate Luna.

These may include:

• login or verification codes;
• security notices;
• account notices;
• billing or subscription notices;
• changes that materially affect Luna;
• reminders you have requested.

These service communications are part of providing Luna.

Marketing communications are separate.

If you choose to receive Luna news, research updates, offers, product announcements or other promotional communications, we will follow applicable Canadian consent and unsubscribe requirements, including Canada's Anti-Spam Legislation where applicable.

You can unsubscribe from marketing communications without losing access to essential service communications.

Luna will continue to evolve.

That may include changes to Luna's Intelligence Layer, features, models, research activities, service providers or privacy practices.

We may update this Privacy Policy when those practices change.

If a change materially affects your rights, the purposes for which your information is used or the consent you previously provided, we will notify you and obtain additional consent where required by Canadian law.

For privacy questions, data requests, corrections, deletion requests or complaints, contact:

support@perimenopauselab.com

PM Lab is responsible for responding to privacy concerns and requests concerning the personal information under its control.

If you believe your privacy concern has not been appropriately resolved, you may also contact the Office of the Privacy Commissioner of Canada.