Privacy Policy
SheBloom — Arogyasuman Technologies Pvt. Ltd.
Last updated: April 28, 2026
Introduction
SheBloom ("we", "our", "us") is a personal wellness and cycle tracking application. This Privacy Policy explains how we handle your information when you use the SheBloom app.
Information We Collect
SheBloom collects only the information you voluntarily provide. Each data type is collected for a specific purpose as required under Rule 3(b)(ii) of the DPDP Rules, 2025:
- Name (optional) — To personalize your app experience
- Birth date — Age verification (DPDP Act) and cycle predictions
- Menstrual cycle data (period dates, flow, cycle length) — Cycle tracking, predictions, and phase-based insights
- Symptoms and severity — Symptom pattern analysis and health insights
- Mood entries and journal notes — Mood trend tracking and emotional wellness insights
- Medicine and supplement reminders — Medication schedule management
- Water intake data — Hydration tracking and daily goal monitoring
- Wellness goals and preferences — Personalizing recommendations and content
- Quiz scores and educational progress — Gamification and learning progress
- Pregnancy data (if enabled) — Week-by-week pregnancy tracking and guidance
How Your Data is Stored
By default, all your data is stored locally on your device using encrypted local storage. If you choose to create an account and enable cloud sync, your data is also stored on secure servers hosted in India (Mumbai region, AWS ap-south-1) by our infrastructure provider, Supabase. Cloud sync is entirely optional, opt-in, and disabled by default for users under 18.
International Data Transfers
Your cloud-synced data is hosted in India. The cross-border implications depend on where you are located:
- Users in India: Your data remains within India. No cross-border transfer occurs and no additional safeguards are required under the DPDP Act, 2023.
- Users in the European Economic Area (EEA): India has not received an adequacy decision from the European Commission. When you enable cloud sync, your personal data is transferred to India based on (i) the Standard Contractual Clauses incorporated into our executed Data Processing Addendum with Supabase, Inc. (executed 28 April 2026) as a contractual safeguard under GDPR Article 46(2)(c), and (ii) your explicit, informed consent under GDPR Article 49(1)(a) after being notified of the possible risks of transfer to a country without an adequacy decision. Because the data we process includes special categories of personal data — namely data concerning health (menstrual-cycle data, symptoms, mood, medication intake) and data concerning sex life and reproductive health (pregnancy and fertility tracking, PCOS status) — we additionally rely on your explicit consent under GDPR Article 9(2)(a) as the legal basis for processing such data. You may withdraw this consent at any time by switching to local-only mode in Settings or deleting your account.
- Users in the United Kingdom: Same approach — transfers rely on the UK Addendum to the Standard Contractual Clauses (or the UK International Data Transfer Agreement) plus your explicit consent under UK GDPR Article 49(1)(a).
- Users in Türkiye (Turkey): Cross-border transfers rely on your explicit consent under Article 9 of the Personal Data Protection Law (KVKK) No. 6698, since India is not on the Turkish Personal Data Protection Authority's list of countries deemed to provide adequate protection.
- Users in other jurisdictions: Cross-border transfers rely on your explicit consent and any applicable contractual safeguards under your local data protection law.
Local-only mode is always available. If you do not wish your data to leave your country, you can use SheBloom in local-only mode — your health data never leaves your device. Cloud sync is opt-in and disabled by default for minors under the DPDP Act 2023.
If you have questions about how your data is transferred or wish to exercise your transfer-related rights, contact our Grievance Officer at admin@arogyasuman.com.
How We Use Your Information
Your data is used solely to:
- Provide cycle tracking and prediction features
- Generate personalized wellness information
- Track your wellness goals and progress
- Sync data across your devices (if cloud sync is enabled)
Data Sharing
We do not sell, rent, or share your personal health information with third parties. We do not use your data for advertising. We do not share data with analytics services. The only data transmission occurs when you voluntarily enable cloud sync.
Your Rights
Under the Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025, you have the following rights:
- Access and review your personal data at any time
- Export all your data in portable format (Settings > Export Data)
- Request correction of inaccurate data
- Request erasure of all your data (Settings > Delete All Data)
- Withdraw consent for specific data categories (Settings > Data Consent)
- Nominate another person to exercise your data rights
- File a grievance with our Grievance Officer (see below)
- File a complaint with the Data Protection Board of India if your grievance is not resolved
Data Retention
Local data remains on your device until you delete it or uninstall the app. Cloud-synced data is retained as long as your account exists. Deleting your account removes all cloud-stored data.
Children's Privacy
SheBloom is intended for individuals 13 years of age and older. Users under 18 are treated as minors under the DPDP Act 2023: their data is stored locally on-device only, cloud sync is disabled, and no personal data is transmitted to external servers. We do not knowingly collect information from children under 13.
Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top indicates when the policy was last revised. Continued use of the app after changes constitutes acceptance.
Grievance Redressal & Contact
Under the Digital Personal Data Protection Act, 2023, you have the right to raise concerns about how your data is processed. Our Grievance Officer is designated to address your privacy-related complaints.
- Grievance Officer Contact: admin@arogyasuman.com
- Email: admin@arogyasuman.com
- Address: Rewari, Haryana, India
- Response time: We will acknowledge your grievance within 24 hours and resolve it within 9 calendar days
- If you are not satisfied with the resolution, you may file a complaint with the Data Protection Board of India at https://www.dpboard.gov.in
Data Protection Board of India
If your grievance is not resolved to your satisfaction within 9 days, or if you believe your data protection rights have been violated, you may file a complaint with the Data Protection Board of India.