This notice applies to data subjects in Brazil under the Lei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018 — LGPD). In substance, it corresponds to the Privacy Policy we apply in the European Union, supplemented by the specific rules of the LGPD. As the controller is established in Spain, the EU General Data Protection Regulation (GDPR) also applies. The European legal bases are consent, including explicit consent for health and sex-life data (arts. 6(1)(a) and 9(2)(a)), performance of a contract (art. 6(1)(b)), compliance with a legal obligation (art. 6(1)(c)) and legitimate interests for the technical purposes described in this Notice (art. 6(1)(f)). Your rights under arts. 15 to 22 GDPR remain available, including restriction of processing and objection on grounds relating to your particular situation, without having to demonstrate non-compliance with the LGPD.
1. SUMMARY
Iséou encrypts your tracking and journal records on your device (AES-256) before they are stored on our servers or synced — of these records, we store only unreadable ciphertext, except for some details needed for reminders and syncing (see section 4). In Standard mode, access can be recovered if you forget your password (we keep an encrypted recovery copy of the key). In Maximum Privacy mode, we hold no copy of your key that we can open: your records can only be unlocked with your password or signed-in device, or your Recovery Key. For the optional AI coaching ("Sofía"), certain health data and, in the chat, your messages are processed in readable form on our servers and those of our AI provider in the EU; your journal text is not included automatically (see section 6). We do not sell your data and do not use it for advertising.
2. WHO IS THE CONTROLLER
The controller of your personal data is:
ICOSO CONSULTING SL ("Iséou") Owner and Director: Daniel Osorio Fernandez Calle Juan de Herrera, Núm 18, Planta 4 y 5 39002 Santander (Cantabria), Spain (European Union) Tax ID: ES B55469902 Commercial Register of Santander, Sheet S-37849 iseou.app Data protection contact: privacy@icoso.es User support: support@iseou.app
Iséou is a wellness app — it is not a medical device and does not replace professional health advice.
3. DATA PROTECTION OFFICER (ENCARREGADO, ART. 41 LGPD)
Our data protection officer (encarregado, DPO) is PRODAT AL ÁNDALUS S.L., which also acts as Data Protection Officer under the EU General Data Protection Regulation (GDPR). Contact: dpdcadiz@prodat.es.
The DPO receives complaints and communications from data subjects and from the Brazilian National Data Protection Agency (ANPD), provides clarifications and advises our team on data protection practices. You can also write to us directly at privacy@icoso.es.
4. WHAT DATA WE PROCESS
We process personal data only where necessary for the service to function.
• Account data: email address, display name/username, sign-in identity (Sign in with Apple/Google). • Subscription data: pseudonymised subscription identifier (SHA-256) and subscription status. Payment is processed exclusively by the respective store (Apple/Google); we do not receive any bank, card or billing data. • Technical data: IP address (max. 7 days, to detect attacks), device and operating-system information in scrubbed crash reports and in RevenueCat SDK connections for checking the subscription status (see section 9). • Usage data: information about how you use the app, our products and services. • App settings: language, colour scheme, reminder-logic metadata. • Sensitive personal data concerning health (art. 5, II): cycle, symptoms, mood, basal temperature, journal, hormone values, self-reported conditions, medications, diet type, allergies, contraceptive method and body measurements — and, if you enable the Apple HealthKit/Google Health Connect import, sleep, resting heart rate, body temperature, heart-rate variability, activity minutes and steps (as encrypted summaries). This data is encrypted on your device (AES-256-GCM) before transmission; our server stores it only as ciphertext. The exception is some data that is currently stored in readable form for reminders, syncing and administration: for medications, the type (contraceptive or other), the contraceptive method, pack size, break days, pack start, intake schedule, first reminder time and reminder settings (on/off, snooze, new-pack alert); for each intake, the status (taken, skipped, late) with date and time; in your profile, whether the contraception questions were answered and when medical notices were confirmed; and also the dates of journal entries and hormone tests, the status of your consents and the times at which records are created, changed or deleted. From this data, and from the number, timing and size of the encrypted records, some conclusions about your health can be drawn. For the optional AI coaching, certain of this data is processed in readable form (see section 6). • Data concerning sex life (art. 5, II): if you choose to record them, sexual activity and contraceptive method. They are encrypted on your device like health data and, together with it, are sensitive personal data.
We collect data through your direct interactions (when you create an account, use features, contact us or send us feedback) and through the automated collection of technical data while the app is running.
5. LEGAL BASES (ARTS. 7 AND 11 LGPD)
• Sensitive health and sex-life data: specific and prominent consent (art. 11, I). Before you use features that require this data, Iséou asks for this consent through a separate affirmative action. Accepting the Terms of Use or this Notice does not replace this consent. • AI coaching ("Sofía"): an additional specific and prominent consent (art. 11, I), requested separately in the app. • Apple HealthKit/Google Health Connect import: specific and prominent consent (art. 11, I), given in the operating-system permissions. • Account, sign-in, subscription and support: performance of a contract, or of preliminary procedures related to a contract, to which you are a party (art. 7, V). • Security, prevention of fraud and attacks, technical stability (access logs, IP address, scrubbed crash reports) and the control log of Sofía chat requests (without conversation content and without health data): legitimate interest (art. 7, IX), limited to the data strictly necessary and always respecting your fundamental rights and freedoms (art. 10). We do not rely on legitimate interest to process sensitive data. • Legal, tax and accounting obligations: compliance with a legal or regulatory obligation (art. 7, II). • Proof of consents: compliance with the legal duty to demonstrate that consent was obtained (art. 8, § 2, together with art. 7, II, and, where processing sensitive data is necessary, art. 11, II, "a"). • Defence in judicial, administrative or arbitration proceedings: regular exercise of rights (art. 7, VI, and art. 11, II, "d"), to the extent necessary.
Withdrawing consent: you can withdraw your consents at any time, free of charge and easily (art. 8, § 5). To withdraw consent to the processing of health and sex-life data, write to privacy@icoso.es or dpdcadiz@prodat.es. Consent for Sofía is managed in the app under Settings → Sofía & AI; permission for the health-data import is withdrawn in your device's system settings; your data-protection region is managed in the app under Settings. Withdrawal applies to the future and does not affect processing carried out earlier on the basis of consent. If you do not consent, or withdraw consent, to health data, you cannot use the features that depend on this data; consent for Sofía is optional and all other features remain available without it.
6. AI-ASSISTED NUTRITION AND LIFESTYLE COACHING ("SOFÍA")
If you use the optional AI coaching feature, we process — on the basis of your specific and prominent consent (art. 11, I) — health-related information in order to give you individual, cycle-aware nutrition and lifestyle tips. For this purpose, your device transmits, depending on the feature, certain health and profile data: categories (e.g. cycle phase, life phase, diet type, allergies, conditions as fixed categories, medications as active-substance classes, contraception as a category, goals, age bracket), summarised values (e.g. frequent symptoms, weekly averages of imported data such as sleep, resting heart rate, heart-rate variability and activity) and concrete measurements such as hormone values together with the number of days since the measurement. These relative time indications may allow the corresponding calendar day to be inferred. We use the region or place of residence you entered in your profile for regional tips and recipes. The name, email address and user identifier of your account are not transmitted to the AI model; journal texts and names of medications or brands in your records are not included automatically. Processing by the model is carried out via Amazon Web Services (AWS Bedrock), with Anthropic's Claude models, in AWS regions within the EU; the content is not transferred to the US. AWS does not store the inputs permanently or use them to train AI models.
If you write to Sofía in the chat, your message and up to five previous messages of the conversation, including earlier replies from Sofía, are also transmitted as free text; very long messages are shortened. Before forwarding to AWS, an automatic filter on our servers replaces certain detected email addresses, phone numbers and IBANs in your own messages. The filter does not remove all personal data: what you write yourself, such as names, dates or information about your health, may be part of the transmitted message. Your requests are forwarded in readable form through our servers but are not stored there; we keep your chat history only encrypted on your device, until you delete it in the chat. To ensure the quality of the AI answers, we keep, for each chat request, a control log without the conversation content and without health data (e.g. language, number of replaced items, indications of impermissible health promises), which can be linked to your account via a pseudonymised identifier. The legal basis is our legitimate interest in a safe and verifiable AI feature (art. 7, IX); you can object at any time. Control logs are deleted after 90 days.
Iséou and Sofía are intended exclusively for wellness, lifestyle and self-observation purposes. They are not intended for the diagnosis, treatment, prevention or prediction of diseases. Sofía is an AI-assisted system; the answers are generated automatically and may be incomplete, inaccurate or unsuitable for your individual situation. Sofía does not replace medical, psychological or nutritional advice.
We do not make solely automated decisions that produce legal effects or similarly significantly affect you within the meaning of art. 22 GDPR. Predictions, indications and AI answers serve exclusively for self-observation and wellness support.
7. PURPOSES AND USE OF YOUR DATA
We provide the cycle and life-phase tracking service, with the records, predictions, information and reminders you request. We share your email address only with the processors needed for hosting and email delivery, as described in section 9, and where disclosure is required by law or court order. We process usage and technical data to provide and improve the app's features, to identify and fix problems and to ensure the stability and security of the services. For development purposes, we collect and analyse feedback and usage data in aggregated form. We do not use health data for advertising, ad profiling or sale, and do not share it to obtain an economic advantage (art. 11, § 4).
• Performance of the contract: we process your data to fulfil our contracts and ensure the proper use of our services. • Customer support: to provide support, we process your name, contact details, communication history and the content of your requests. • Account management: we process your email address and sign-in data to authenticate your account and provide secure access. • Legal obligations: we process your data to comply with legal, tax and accounting obligations.
Notifications: reminders (e.g. for cycle events or intakes) are scheduled and triggered exclusively locally on your device. We do not operate any external push service for this and do not store push tokens; the settings of medication reminders are, however, synced to your account (see section 4). You can switch off notifications at any time in the app or in your device's system settings.
Health-data import (Apple HealthKit/Google Health Connect): if you enable this optional feature, we import passive health signals (e.g. sleep, resting heart rate, body temperature) as encrypted summaries to complement the cycle information. Permission can be withdrawn at any time in the device settings.
Barcode feature (Premium): if you optionally scan a product's barcode, only the barcode number (EAN) is sent, via our server, to the Open Food Facts product database to look up the product name. No health data and no user identifier are transmitted.
No GPS location: Iséou does not record your device's location (GPS). We use the region or place of residence you enter in your profile for regional tips and recipes (see section 6). In the optional place search (e.g. city search), only the search term you type is sent, via our server, to the Nominatim map service (OpenStreetMap). Your data-protection region is derived from the region set on your device (country code), not from your exact location.
Recipe images: to illustrate recipes, our server may request the generation of an image by sending only the name of the dish. This request contains no personal data (see section 10).
8. ENCRYPTION AND SECURITY (ART. 46)
Your health records are encrypted on your device (AES-256-GCM) before they are stored on our servers; we store them only as ciphertext, with the exceptions described in section 4. In Standard mode, we also keep an encrypted recovery copy of your key so that we can restore your access if you forget your password — which means decryption is technically possible for us; we use this path only to restore your access, never to read your data. In Maximum Privacy mode, we do not keep this copy: on our servers your key is stored only in encrypted form that just your password or signed-in device, or your Recovery Key, can unlock; we cannot decrypt your records. We cannot restore your access: if you lose your Recovery Key and also your password or access to your devices, these records are permanently lost. If you choose to save your Recovery Key in iCloud Keychain, a copy will be synced through Apple's service. For the optional AI coaching, certain health data and, in the chat, your messages are processed in readable form on our servers and by our AI provider in the EU, without being stored there (see section 6). We use TLS, restricted access control and EU hosting.
Security incidents: if a security incident occurs that may result in relevant risk or harm to you, we will notify the ANPD and you in accordance with art. 48 LGPD.
9. SHARING — NO SALE
We do not sell your data. We may disclose data to public or judicial authorities where required by law or court order.
Processors (operadores) that process data only on our behalf and under our instructions, with contractual data-protection obligations: • Hetzner Online GmbH (data centres in the EU): hosting of the app, database and website; stores health records as ciphertext, except the data listed in section 4; forwards AI requests; access logs with IP address (max. 7 days). • Amazon Web Services EMEA SARL — AWS Bedrock, with Anthropic's Claude models (AWS regions in the EU): certain health data and chat messages for the optional AI coaching (see section 6). • Scaleway SAS (France, EU): email delivery and encrypted backups. • Sentry (EU data region): scrubbed technical error reports, without health data. You can disable reports sent by the app in Settings; the change takes effect on the next app launch. This option does not disable technical error diagnostics on our servers. • RevenueCat, Inc. (USA): checking the subscription status for everyone who uses the app, with or without a subscription, in pseudonymised form. It receives the pseudonymised identifier (SHA-256), the subscription status, store purchase receipts (if any) and the app's technical connection data (such as IP address and device model) — never your email, your name or health data (see section 10).
Independent controllers: Apple and Google process Sign in with Apple/Google, payments in their stores and HealthKit/Health Connect permissions as independent controllers, under their own privacy policies. We do not receive bank or card data.
Services that receive no personal data: Open Food Facts (only the EAN number), Nominatim/OpenStreetMap (only the search term) and OpenAI (only the name of the dish for recipe images). These requests are sent by our server, without your IP address and without a user identifier.
Apart from AWS and our Hetzner servers that forward the AI requests, none of these recipients receives readable health data.
10. INTERNATIONAL DATA TRANSFER (ART. 33)
Because our company and our infrastructure are located in the European Union, the data you provide in Brazil is transferred to the EU.
European Union: the ANPD has recognised the European Union as a destination providing a level of personal-data protection adequate to that of the LGPD (Resolução CD/ANPD nº 32, of 26 January 2026). Transfers to our servers and processors in the EU (Hetzner, AWS, Scaleway, Sentry) are based on this recognition (art. 33, I). Your synced health records and the related backups are stored in the EU, and the data used for the optional AI coaching is also processed in the EU.
United States: the ANPD's recognition does not cover the United States. We transfer to the US only the data described in section 9, to RevenueCat, Inc., and only to check the subscription status. This applies to everyone who uses the app, with or without a subscription: when you open the app and sign in to your account, the RevenueCat SDK receives, in pseudonymised form, the SHA-256-pseudonymised identifier, the subscription status, purchase receipts (if any) and technical connection data — without email, name or health data. This check is necessary to perform the contract for the use of the app: knowing whether an active subscription exists, unlocking the corresponding features and restoring or processing purchases (art. 33, IX, in conjunction with art. 7, V).
OpenAI (USA) receives only the name of a dish, without any personal data; there is therefore no international transfer of personal data in this case. Apple and Google process data as independent controllers (see section 9), including outside Brazil, under their own policies.
We do not ask for a separate consent for international transfers; the transfers rely on the bases stated above.
11. RETENTION AND DELETION
We delete your personal data or restrict its use as soon as it is no longer needed, unless the law requires longer retention (art. 16).
When you delete your account (Settings → Account → Delete account permanently), your data is removed immediately from active systems. Residual copies in encrypted technical backups are erased within 7 days as part of the rotating backup cycle. An internal deletion log ensures that deleted data does not reappear, even if a backup is restored.
Inactive accounts: we schedule deletion of accounts without an active subscription after 730 days without sign-in or activity recorded on our servers, subject to the advance notices described below. We notify you by email at the registered address 30 days and again 7 days beforehand. A new sign-in or newly recorded activity restarts the period.
Proof of consents: when you delete your account, the record of your consents (document, version, date, language, app version) is kept blocked and pseudonymised — without your email address or your user identifier in clear — for five years, so that we can demonstrate that consent was obtained (art. 8, § 2, and art. 16, I). After this period, it is permanently deleted.
• Processing based on consent or legitimate interest: data is stored until you withdraw consent or object and/or the legitimate interest ceases. • Contract data: kept for the duration of the contractual relationship and thereafter as long as statutory retention obligations apply (e.g. 10 years under Spanish tax and commercial rules). Tax-relevant records (e.g. relating to the pseudonymised subscription identifier) are kept to the extent required by law. Billing and payment data reside exclusively with the respective store (Apple/Google), not with us. • Control logs of Sofía chat requests: 90 days.
12. ACCESS DATA, COOKIES AND LOCAL STORAGE
When you use our website or the app, your device automatically transmits access data to our servers (e.g. when signing in or uploading/downloading information): IP address, system configuration, date and time of access. IP addresses are stored for up to 7 days to detect and prevent attacks; afterwards they are deleted or anonymised. This data is processed on the servers of Hetzner Online GmbH (EU).
The app does not use cookies. The website iseou.app uses only technically necessary local storage (localStorage) to remember your language choice and record that you dismissed the local-storage notice — we do not use tracking cookies, pixels or analytics tools.
13. YOUR RIGHTS (ART. 18)
You can, at any time and free of charge, request: a) confirmation that processing exists; b) access to the data; c) correction of incomplete, inaccurate or outdated data; d) anonymisation, blocking or deletion of unnecessary or excessive data or data processed in breach of the LGPD; e) portability of the data to another service provider; f) deletion of data processed with your consent, subject to the retention cases of art. 16; g) information about the public and private entities with which we share data; h) information about the possibility of not giving consent and the consequences of refusal (see section 5); i) withdrawal of consent (see section 5).
You can also object to processing carried out on other legal bases in the event of non-compliance with the LGPD (art. 18, § 2), and request a review of decisions taken solely on the basis of automated processing (art. 20) where they affect your interests, and obtain clear information about the criteria and procedures used, subject to commercial and industrial secrecy.
How to exercise them: in the app, under My space → Data → Download My Data (access and portability, in machine-readable JSON format) and Settings → Account → Delete account permanently (immediate deletion), or by email to our DPO (dpdcadiz@prodat.es) or privacy@icoso.es. Your request must allow us to verify your identity; we will only ask for additional information where necessary to prevent another person from accessing your data. Confirmation of processing and access to data are provided immediately in simplified form or through a clear and complete statement within 15 days of your request, under art. 19 LGPD. Other requests are handled within the applicable statutory time limits. When we change the version of this Notice in a relevant way, we ask for your consent again.
14. NATIONAL AUTHORITY (ANPD)
If you believe your rights have not been respected, you can petition the National Data Protection Agency (ANPD) — www.gov.br/anpd (art. 18, § 1). As our company is established in Spain, you can also lodge a complaint with the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es.
15. CHILDREN AND ADOLESCENTS
Use of Iséou requires a minimum age of 16. We do not knowingly collect data from persons under 16; if we become aware of it, we delete the data.
16. CHANGES AND LANGUAGE
We may update this Notice, in particular to adapt it to legal changes. The current version is published at iseou.app/privacy and takes effect upon publication; relevant changes are communicated in the app. In the event of discrepancies between the Portuguese and English versions of this Notice, the Portuguese version prevails.
17. TERMS OF USE
Our Terms of Use (iseou.app/terms) contain the further legal information. Terms referring to persons include all genders.