Last modified: 8/14/2026

1. Our Mission and Your Data

28 exists to build the most accurate and helpful wellness companion for women. Every prediction and insight the App offers you is built from the information you choose to record or connect. The more complete that information is, the more accurate and personal 28 becomes, and the deeper the insights we can give you back. Our members ask us for more insight all the time, and answering that ask well is the reason we collect the data described in this policy.

It is also why we hold that data to a firm standard: collected only with your consent, used only to provide and improve the services you ask for, never sold, and never used to advertise to you. This policy exists so that you always know what we collect, why we collect it, and where it goes.

28 Wellness, Inc.(the “Company”, “we”, or “us”) respects your privacy and is committed to protecting it through our compliance with this policy.

This policy describes the types of information we may collect when you visit 28.coand its subdomains (our “Website”) or use our mobile application, 28 (the “App”), and our practices for collecting, using, maintaining, protecting, and disclosing that information. It includes our Consumer Health Data Privacy Policy (Section 12), which applies to health information as described below, including for the purposes of the Washington My Health My Data Act and similar state laws. If you do not agree with our policies and practices, your choice is not to use the Website or the App.

2. Summary of Key Points

The full policy governs, but the points most members ask about are these:

• We do not sell your personal information, and we do not use your health data for advertising.
• The App contains no advertising SDKs or trackers, and the Website sets no analytics or advertising cookies.
• Your cycle and health data is used to operate the product: predictions, insights, nutrition, chat, and the reminders you enable. We use service providers to operate these features, and Section 9 describes each category of provider and the information it receives.
• Connections to Apple Health, Health Connect, Oura, and a partner are optional, and you may disconnect any of them at any time.
• You may delete your account and its data at any time, in the App or by emailing us.

3. Information You Provide to Us

• Account information. Email address, name, and password (held by our sign-in provider), and, at your option, phone number, date of birth, time zone, and wellness goals.
• Cycle and health information. Period dates and cycle history; symptoms you log, including optional free-text notes and intimate topics such as libido if you choose to log them; moods; body temperature readings; weight; and the meals and food photos you add.
• Communications. Messages you write in the in-app chat, including to our AI companion and our support assistant, and correspondence with our support team.
• Purchase information. Subscription status and purchase history. Payment card numbers are collected by Apple, Google, or our payment processors and are not collected by us.

4. Information from Connected Devices and Services

The following connections are optional and are disabled until you enable them:

• Apple Health (HealthKit). With your permission, the App reads your Apple Watch sleeping wrist temperature to refine your cycle and fertility estimates, and your weight and activity data (steps, distance, active energy, and exercise time) to personalize nutrition. Wrist temperature readings you sync and the weight you confirm during setup are stored on our servers. Steps and activity data are read for display and daily calculations and are not stored on our servers. We do not use HealthKit data for advertising or marketing, and we do not sell it.
• Health Connect (Android). With your permission, the App reads steps, distance, active energy, and exercise sessions for display and daily calculations. This data is not stored on our servers.
• Oura Ring. If you connect your Oura account, we receive your nightly temperature deviation, meaning the difference between your temperature and your personal baseline rather than an absolute temperature, to refine your cycle and fertility estimates. Disconnecting stops new syncing and revokes our access with Oura. Readings already synced remain part of your logged health history until you delete them or delete your account.

5. Information Collected Automatically

The App collects usage and device information, including app version, device type, operating system, feature usage events, and crash and error reports associated with your account identifier, in order to maintain and improve the service. The Website does not set analytics or advertising cookies and does not run third-party trackers. Our hosting providers maintain standard server logs, which include IP address and pages requested, and video content on the Website is streamed by our media provider, which receives your IP address in the ordinary course of serving it.

6. How We Use Your Information

We use information that we collect about you or that you provide to us:

• To operate the App, including cycle tracking, phase and fertility estimates, insights, nutrition, workouts, and chat.
• To personalize your experience and improve the accuracy of your predictions and insights using the information you record and the sources you connect. Temperature data is used to refine the App's estimate of ovulation; it remains an estimate and is not a medical determination.
• To send the notifications and reminders you enable, including period reminders, phase updates, and trial and subscription notices.
• To provide customer support and respond to your requests.
• To process payments and manage your subscription.
• To maintain the security of the service, prevent abuse, and diagnose and fix problems.
• To comply with legal obligations.

We do not use your information to deliver advertisements. We do not use your health data for marketing segmentation beyond the product messaging described in this policy, and you may opt out of marketing messages at any time.

7. Artificial Intelligence Features

The App's chat companion, food scanning, and support assistant are powered by large language models from third-party providers: OpenAI, with Anthropic as a backup provider, and Google for recipe and meal imagery. When you use these features, your messages and photos, together with relevant context from your profile (which may include your first name, current phase and cycle day, predicted period and fertile window, recent symptoms, meals, and weight), are processed by these providers to generate the response. We access OpenAI and Anthropic through their business APIs, which do not use customer data to train their models. Google receives meal and recipe descriptions and images only, and does not receive your identity or cycle data. Chat conversations are reviewed by automated safety systems, and support conversations may be read by our team in order to assist you.

8. Partner Sharing

If you invite a partner, your partner can see your first name, current phase and cycle day, fertility status (including peak fertility days), predicted period timing, and the symptoms you share. A starter set of commonly shared symptoms is enabled when you connect a partner, and you may change or clear that selection at any time in the App. If partner notifications are enabled, your partner receives updates about your cycle, such as phase changes, predicted period timing, and fertile window timing. Disconnecting a partner stops all sharing immediately. Partners do not see your notes, chats, meals, or temperature readings, and they see only the symptoms enabled for sharing.

9. Disclosure of Your Information

We do not sell your personal information, and we do not share it for targeted advertising. We disclose personal information only to the service providers described below, which may use it solely to provide their services to us:

• Operating the service: our sign-in provider, our database provider (with data stored in the United States), our hosting providers, our image storage and delivery providers (for meal photos), our crash and error reporting service, and our feature rollout service, which receives account identifiers only and no health data.
• Product analytics: our analytics service receives app usage events together with your email, name, and date of birth so that we can understand how features are used. Cycle and health data is removed before information is sent to this service.
• Artificial intelligence: OpenAI, Anthropic, and Google, as described in Section 7.
• Messaging: our messaging service sends our emails, push notifications, and in-app messages. So that reminders arrive at the appropriate time, your profile with that service includes cycle timing details, such as current phase and predicted period date, alongside your contact information. You may opt out of marketing messages at any time; transactional notices about your subscription will still be sent.
• Payments and subscriptions: the Apple App Store, Google Play, and our subscription management and payment processing providers, which receive your purchase details and no health data.
• Customer support: support conversations are handled by our team in the support tools we use and include your name, email, and the content of your messages. Copies handled in those tools are retained as support records. If our safety systems flag a conversation as a possible crisis, we retain a record of that flag so that we can respond appropriately.
• Referral program: if you join through or participate in our referral program, your name, email, phone number, and purchase details are shared with the platform that operates it.
• Food databases: when you search foods or scan a barcode, the food name or barcode is sent to USDA FoodData Central and Open Food Facts without information identifying you.
• Grocery delivery:if you choose to send a grocery list to Instacart, the list is transmitted to Instacart and Instacart's privacy policy applies from that point.
• Online shop: purchases at 28.co/shop are processed by our Shopify-powered checkout and our subscription fulfillment provider, which collect your shipping and payment details at checkout under their own policies. Product reviews and shop video are served by third-party review and video providers.

We may also disclose personal information: to a buyer or other successor in the event of a merger, acquisition, or sale of some or all of the Company's assets, in which case this policy's protections continue to apply to your data; to enforce our Terms of Use; or where we believe disclosure is necessary to protect the rights, property, or safety of our members or others.

10. Your Cycle Data

With respect to the reproductive health data you record in the App:

• We collect only the cycle data that you choose to provide or connect. Every source is optional.
• We do not sell it, and we do not use it for advertising.
• When you edit or delete a cycle entry in the App, we maintain a private correction history so that your predictions remain accurate and you can review what changed. That history is visible to you in the App and is deleted with your account.
• We treat any government demand for cycle data as an extraordinary event, subject to the commitments in Section 11.

11. Government and Legal Requests

The following commitments apply to every government or law enforcement request for member data:

• No voluntary disclosure. We do not volunteer member data to any government authority, we do not honor informal requests, and we do not participate in data-sharing programs. Any party seeking member data must present valid legal process.
• Highest available process. Where the law permits us to require a warrant or court order rather than a subpoena or informal demand, we require it.
• Challenge and narrowing. We use every legal means available, including appeals, to resist demands that are overbroad, improper, or issued without sufficient legal basis. If a court ultimately compels production, we produce the narrowest set of data possible and nothing more.
• Notice to you. Where the law allows, we notify you before we comply so that you may challenge the demand yourself. If a court order prohibits notice, we notify you when that restriction expires.
• Data minimization. We design the service to retain no more identifiable health data than the product requires, because data that is not retained cannot be produced.

Certain service providers hold data as described in Section 9 and respond to legal process under their own policies.

12. Consumer Health Data Privacy Policy

This section applies to “consumer health data” as defined by the Washington My Health My Data Act, Nevada SB 370, and similar laws, and supplements the rest of this policy.

• Categories collected: menstrual cycle dates and history; symptoms, moods, and related notes; body temperature readings and temperature deviations; weight; meals and nutrition information; fertility estimates derived from the foregoing; and health information you include in chat or support messages.
• Sources: information you enter in the App, and Apple Health, Health Connect, and Oura if you connect them.
• Purposes: providing and improving the services you request, as described in Section 6. We collect health data only when you choose to enter it or connect a source, with your consent, and we process it only for these purposes.
• Sharing: only with the service providers described in Section 9, and with a partner if you invite one. We do not sell consumer health data, and no affiliates receive it.
• Your rights:you may access your health data, withdraw consent, have the data deleted, and ask who has received it, by using the App's controls or by emailing support@28.co. We honor these requests regardless of your state of residence. If we decline a request, you may appeal by replying to our decision, and the appeal will be reviewed by a person not involved in the original decision.

13. Your Rights and Choices

Regardless of where you live, you may access, correct, download, or delete your personal information, and you may opt out of marketing messages. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy statutes have these rights by law, including the right to confirm whether we process your data, the right to data portability, the right to opt out of targeted advertising and sales (we engage in neither), the right to correct inaccuracies, and the right not to be discriminated against for exercising these rights. Nevada residents may opt out of sales covered by that state's statute; we do not sell data triggering it. California's “Shine the Light” law permits California residents to request information regarding disclosure of personal information to third parties for their direct marketing purposes; we make no such disclosures.

To exercise any of these rights, use the controls in the App or email support@28.co. We will verify your request using your account email. To appeal a decision, reply to our response and request an appeal.

14. Data Retention and Deletion

We retain your information while your account is active. When you delete your account, in the App under Profile or by emailing us, your account record and your health data, including cycle history, journal, temperatures, meal records, and chat history, are deleted from our database, and your sign-in account is deleted with our authentication provider. Copies may persist in encrypted backups for a limited period of approximately 30 days before being overwritten. Certain records survive account deletion: purchase records held by us and by Apple, Google, or our payment processors; support conversations retained as support records in the tools our team uses; and residual copies held by service providers under their own retention schedules. In-app support transcripts are automatically purged from the App on a rolling 30-day schedule even while your account remains open, although copies handled by our support team are retained as described above.

15. Data Security

Your data is encrypted in transit and at rest. Access to production systems is restricted, and we review the data each service provider receives against what its service requires. No internet service can guarantee perfect security, and any transmission of personal information carries some risk, but we treat your health data with the care it deserves; if a breach affects your data, we will notify you as required by law.

16. Children and Age Requirements

The App and the Website are intended for adults 18 years of age and older. Neither is directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we might have information from a child under 13, contact us at support@28.co and we will delete it.

17. Changes to Our Privacy Policy

We post changes to this policy on this page and update the date at the top. If a change materially affects how we handle your health data, we will notify you in the App or by email before it takes effect, and where the law requires it we will ask for your consent.

18. Contact Information

To ask questions or comment about this policy and our privacy practices, contact us at support@28.co.