NOVABLOOM

PRIVACY POLICY

Last Updated: October 1, 2026

This Privacy Policy explains how Novabloom LLC, doing business as NovaBloom (“NovaBloom,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects Personal Information when you use the NovaBloom mobile application, visit novabloom.io or other NovaBloom controlled webpages, join a waitlist, communicate with us, or use related services and features that link to this Privacy Policy (collectively, the “Services”).

IMPORTANT: NovaBloom handles menstrual cycle, symptom, mood, and reproductive wellness information as sensitive health related information. This Privacy Policy is a notice about our practices. It is not a contract and does not replace any separate consent or authorization that applicable law requires. Our Terms of Use govern use of the Services. Certain consumer health data laws require separate state specific Consumer Health Data Privacy Notices. NovaBloom makes those notices available through the Privacy section of the website and App.

Privacy at a Glance

Contents

1. Scope and Who We Are
2. Important Status of This Privacy Policy
3. Key Definitions
4. Personal Information We Collect
5. Sources of Personal Information
6. How We Use Personal Information
7. Practices We Do Not Engage In
8. Consumer Health Data and Separate Health Data Notices
9. Health and Fitness Platform Integrations
10. Family Billing and Teen Accounts
11. Adult Cycle Sharing
12. Rules Based Personalization and No Generative AI at Launch
13. How We Disclose Personal Information
14. Promotional, Sponsored, Affiliate, and Referral Content
15. Website Cookies, App Technologies, and Similar Tools
16. Deidentified and Aggregated Information
17. Data Minimization and Purpose Limitation
18. Data Retention, Account Deletion, and Backups
19. Data Security and Internal Access
20. Data Incidents and Breach Notification
21. Data Location and U.S. Processing
22. Children and Teen Privacy
23. Your Privacy Rights and Choices
24. U.S. State Privacy Disclosures
25. California Specific Disclosures
26. Legal Requests, Safety, and Government Demands
27. HIPAA and Other Health Privacy Laws
28. Third Party Services and Links
29. Communications and Notifications
30. Changes to This Privacy Policy
31. Relationship to the Terms of Use and Dispute Resolution
32. Contact Us

1. Scope and Who We Are

NovaBloom operates a consumer period tracking and reproductive wellness service designed to help users record menstrual cycle information and other wellness inputs, receive rules based reminders and insights, access educational and Christian faith oriented content, and use optional features such as health platform integrations, family billing, and adult cycle sharing.

This Privacy Policy applies to Personal Information that NovaBloom controls in connection with the Services. It applies to App users, website visitors, waitlist subscribers, people who contact customer support, and other individuals who interact directly with NovaBloom in the United States.

The Services are currently intended for users located in the United States. This Privacy Policy does not govern the independent privacy practices of a third party service or website that you choose to use, including an app store, external merchant, health platform, connected device provider, or website reached through an external link. Sections 9, 13, 14, and 28 explain those relationships in more detail.

The data controller or business responsible for the practices described in this Privacy Policy is Novabloom LLC, 181 W Valley Ave Ste 245 #1427, Birmingham, Alabama 35209.

2. Important Status of This Privacy Policy

This Privacy Policy is intended to provide transparency about NovaBloom’s privacy practices and to satisfy applicable notice requirements. It is not intended to create contractual rights or obligations beyond those created by applicable law or an express written agreement.

Reading, acknowledging, or accepting this Privacy Policy is not a substitute for affirmative, express, written, or separate consent when applicable law requires a particular form of consent. NovaBloom will request a separate consent for processing that legally requires one, including certain collections, uses, or disclosures of consumer health data and certain user directed sharing features.

The Terms of Use govern access to and use of the Services. Privacy related disputes may also be subject to the dispute resolution and arbitration provisions in the Terms of Use to the extent those provisions are valid and enforceable. Nothing in this Privacy Policy or the Terms of Use waives a privacy right or remedy that applicable law makes nonwaivable.

If NovaBloom materially changes its data practices, we will update this Privacy Policy and provide additional notice or obtain new consent where applicable law requires that step before the changed processing begins.

3. Key Definitions

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual or household, and includes equivalent terms such as personal data where applicable law uses those terms.

“Sensitive Health Data” means information that NovaBloom treats as especially sensitive because it concerns or may reveal menstrual cycles, symptoms, moods, fertility or reproductive wellness, pregnancy related information, sexual or reproductive health, or related health and wellness characteristics. This is a NovaBloom operational term and may be broader or narrower than a particular statute’s definition.

“Consumer Health Data” means information treated as consumer health data under an applicable state law, including information that identifies or can be linked to a consumer and reveals, reflects, or can be used to infer physical or mental health status, reproductive or sexual health, or health related services.

“Teen User” means a registered NovaBloom user who is at least 13 but under 18. “Account” means a registered NovaBloom user account.

“Deidentified Information” means information that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, when NovaBloom uses reasonable technical and organizational measures designed to maintain the information in deidentified form and does not attempt to reidentify it.

4. Personal Information We Collect

The categories collected from a particular person depend on how that person uses NovaBloom. We do not require every user to provide every category listed below.

4.1 Account, Identity, and Contact Information

When you create or manage an Account, we may collect your name, email address, phone number, age or date of birth, authentication credentials or authentication tokens, Account preferences, registration information, subscription status, and related Account administration information.

If you use Apple or Google as an optional sign in provider, NovaBloom receives the information that provider makes available to us under the permissions you select, which may include a name, relay or account email address, provider identifier, and authentication token. NovaBloom does not receive your Apple or Google account password.

4.2 Menstrual, Reproductive, and Wellness Information

If you use tracking or wellness features, we collect the information you choose to enter. This may include menstrual cycle dates and patterns, symptoms, moods, activity information, trackers, preferences, goals or settings associated with wellness features, and notes. Free form notes may contain additional information that you choose to include.

Depending on the features you use and what you choose to enter, this information may reveal or permit inferences about menstrual status, reproductive wellness, pregnancy or pregnancy related circumstances, fertility, symptoms, physical or mental wellbeing, sexual or reproductive health, or other sensitive characteristics.

NovaBloom may derive estimates, patterns, reminders, or other rules based outputs from information you provide. Derived information can itself be sensitive because it may reflect or infer health or reproductive information.

4.3 Faith Related Interests

NovaBloom is a Christian faith oriented service. We do not require you to state a denomination or religious belief as a standard Account field. However, use of faith oriented content, preferences, or features may reveal or suggest religious interests. Some U.S. privacy laws treat religious beliefs or information revealing them as sensitive data. NovaBloom does not use faith related engagement to target third party advertising or sell information about religious interests.

4.4 Device, App, Session, and Technical Information

When you use the App, NovaBloom may receive device identifiers, session identifiers, App version, operating system and platform information, IP address, timestamps, login and authentication events, crash logs, diagnostic information, and limited technical or usage events necessary to operate, secure, troubleshoot, maintain, and improve the App.

NovaBloom may use limited device or platform identifiers for App functionality, analytics, crash reporting, security, or subscription management. NovaBloom does not use an advertising identifier to create a profile of menstrual or reproductive health activity for targeted advertising.

4.5 Approximate Location

NovaBloom may infer a general or approximate location from an IP address for security, fraud prevention, service operations, and limited analytics. NovaBloom does not collect precise GPS location through the Services.

NovaBloom does not use geofencing around reproductive health, sexual health, mental health, or other health care facilities to identify, track, collect data from, or send notifications to users based on presence at those locations.

4.6 Communications, Support, and Feedback

If you contact us, we collect the content of your message, your contact details, related correspondence, and any information you choose to provide. Customer support messages and feedback may contain sensitive information if you choose to include it. Please provide only the information reasonably necessary for us to assist you.

4.7 Subscription and Transaction Information

Paid App subscriptions are expected to be processed by the Apple App Store or Google Play. NovaBloom does not receive or store your full payment card number for those transactions. NovaBloom and its subscription management provider, currently RevenueCat, may receive limited transaction or entitlement information such as product purchased, subscription tier, renewal or expiration status, store, transaction or receipt identifiers, and related subscription metadata.

4.8 Website and Waitlist Information

When you visit the website, join a waitlist, subscribe to updates, use a form, visit an online store, or interact with an embedded tool, we may collect information you provide, such as your email address and other form fields, plus limited technical information needed for site functionality, security, preference management, communications, or analytics. The website is hosted using Squarespace and may use Flodesk, Shopify, affiliate links, or other embedded services as described when applicable.

The website may use essential or functionally necessary cookies and similar technologies supplied by NovaBloom or its website service providers. NovaBloom does not intentionally place third party advertising pixels on pages where users enter menstrual, reproductive, symptom, mood, or other Sensitive Health Data.

4.9 Marketing and Communication Information

If you subscribe to promotional email, we collect your email address, subscription preferences, and limited engagement information made available by our email provider, such as delivery status, opens, or link interactions. We use this information to administer communications, measure general engagement, and honor unsubscribe requests.

If NovaBloom later offers marketing text messages, NovaBloom will obtain any separate consent required by law before sending those messages. Acceptance of this Privacy Policy or the Terms of Use is not consent to receive marketing texts.

4.10 Information From Optional Integrations

If you choose to connect an optional health or fitness integration such as Apple Health, Google Health Connect or another Google health or fitness service, or Oura, NovaBloom may receive the categories you authorize through that platform’s permission controls. The categories available depend on the integration and may include health, activity, cycle, sleep, or related wellness information.

NovaBloom requests only permissions that are reasonably related to the user facing feature being provided. You can decline an integration and may be able to revoke access through your device, the third party platform, or NovaBloom.

4.11 Family Billing Information

If a Teen User joins an optional family billing plan, NovaBloom processes information necessary to administer the billing relationship and the invitation and consent flow. The Family Billing Administrator may see limited information such as the Teen User’s name, age or age category, participation status, and billing status. The adult payer does not receive the Teen User’s cycle data, symptoms, moods, notes, trackers, or other reproductive wellness information.

4.12 Adult Cycle Sharing Information

Eligible users age 18 or older may be able to share selected cycle related information with another person through an optional sharing feature. NovaBloom processes the information necessary to create, maintain, and revoke the sharing relationship and to display the information the sharing user has elected to make available. Teen Users may not use cycle sharing.

5. Sources of Personal Information

NovaBloom may collect Personal Information from the following sources:

• You directly, including through Account registration, tracking entries, notes, preferences, customer support, forms, waitlists, surveys, feedback, and feature controls.
• Your device and the Services, including session, security, crash, diagnostic, and limited usage information generated when you use NovaBloom.
• App stores and subscription infrastructure, including Apple, Google, and RevenueCat, for entitlement and transaction status.
• Optional integrations you authorize, including Apple Health, Google health or fitness services, and Oura.
• Authentication providers you choose, such as Apple or Google sign in.
• A Family Billing Administrator or invited participant, but only for information reasonably necessary to initiate or administer the family billing relationship.
• A user who invites you to an adult cycle sharing feature, or you if you invite another eligible adult.
• Website and communications providers, including Squarespace, Shopify, and Flodesk, where those services support a NovaBloom interaction.
• Security and fraud prevention signals that may be generated from IP addresses, sessions, devices, or Account activity.

6. How We Use Personal Information

NovaBloom uses Personal Information for the purposes described below and for compatible purposes permitted by law.

• Provide the core Services. Create and administer Accounts, save user selected tracking information, display histories, operate trackers, deliver reminders, provide educational and faith oriented content, and make requested features available.
• Generate rules based personalization. Use user selected cycle, symptom, mood, activity, tracker, preference, and related inputs to tailor reminders, educational content, wellness insights, encouragement, and other user facing outputs.
• Operate optional integrations. Import, synchronize, display, or otherwise use information from an integration only as authorized by the user and permitted by the integration provider’s rules.
• Administer family billing. Send or process invitations, record participation and consent steps, maintain plan membership, show limited billing administration information, and manage subscription eligibility.
• Provide adult cycle sharing. Enable an eligible adult user to share selected information with an authorized recipient, maintain sharing controls, and process revocation of future access.
• Manage subscriptions. Confirm purchases, subscription tier, entitlement, renewal or expiration status, and access to paid features.
• Authenticate users and secure Accounts. Process sign in events, maintain sessions, detect suspicious activity, investigate abuse, prevent fraud, and protect users and systems.
• Provide support. Respond to inquiries, troubleshoot problems, resolve Account or subscription issues, and improve support processes.
• Send service communications. Provide authentication, security, legal, policy, subscription, Account, and operational notices.
• Send marketing communications. Send newsletters, launch updates, or promotional email when permitted, and honor unsubscribe or other communication preferences.
• Maintain and improve NovaBloom. Analyze performance, crash information, aggregate usage, feature reliability, and product trends, conduct testing, and improve functionality and user experience.
• Protect legal rights and comply with law. Respond to valid legal obligations, enforce applicable agreements, investigate misuse, preserve evidence when legally necessary, and protect the rights, safety, security, and integrity of users, NovaBloom, and others.
• Create deidentified or aggregated information. Produce statistics and insights for internal analytics, product improvement, general audience insights, trend analysis, educational planning, sponsorship or affiliate reporting, and business operations, subject to Section 16.

NovaBloom does not use Sensitive Health Data for a materially different, unrelated, or incompatible purpose without providing any notice and obtaining any consent required by applicable law.

7. Practices We Do Not Engage In

Based on NovaBloom’s current launch practices:

• NovaBloom does not sell Personal Information or identifiable Consumer Health Data to data brokers, advertising networks, or third parties for their independent commercial use.
• NovaBloom does not disclose identifiable menstrual, reproductive, fertility, symptom, mood, pregnancy related, or other Sensitive Health Data to advertisers or data brokers for targeted advertising.
• NovaBloom does not use Sensitive Health Data or health platform data to select third party advertisements, sponsored recommendations, or affiliate offers for an individual user.
• NovaBloom does not use Apple Health or Google Health Connect data for advertising, marketing, sponsorship targeting, or data brokerage.
• NovaBloom does not collect precise GPS location through the Services.
• NovaBloom does not geofence health care facilities for health data collection, tracking, or health related notifications.
• NovaBloom does not give a Family Billing Administrator access to a Teen User’s menstrual, symptom, mood, notes, tracker, or reproductive wellness information merely because the adult pays for a plan.
• NovaBloom does not permit Teen Users to use the adult cycle sharing feature.
• As of the Last Updated date, NovaBloom does not use generative AI chatbots or AI coaching, does not send user health data to a third party generative AI provider, and does not use user data to train a generative AI model.
• NovaBloom does not intentionally place third party advertising pixels or advertising SDKs in authenticated health data entry flows for the purpose of transmitting Sensitive Health Data to an advertising platform.

If NovaBloom proposes a materially different practice in the future, it will evaluate legal and platform requirements, update applicable notices, and obtain separate consent before the new processing begins where required.

8. Consumer Health Data and Separate Health Data Notice

Multiple U.S. states regulate Consumer Health Data outside HIPAA. Because NovaBloom processes menstrual and other reproductive wellness information, certain information handled by NovaBloom may be Consumer Health Data under one or more of those laws.

NovaBloom maintains separate state specific Consumer Health Data Privacy Notices for jurisdictions that require them. For Washington, NovaBloom maintains a standalone Washington Consumer Health Data Privacy Policy limited to the disclosures required by the Washington My Health My Data Act. NovaBloom also maintains a separate Nevada and Connecticut Consumer Health Data Privacy Notice addressing those jurisdictions’ applicable requirements. These notices remain separate from this general Privacy Policy where applicable law requires a distinct notice.

Where a Consumer Health Data law requires affirmative consent for collection, use, or sharing beyond what is necessary to provide a product or service the user requested, NovaBloom will request that consent through a separate flow before engaging in the processing. Where a separate written or feature specific authorization is required for a sale or disclosure of Consumer Health Data or other protected health information, NovaBloom will not treat acceptance of this Privacy Policy or the Terms of Use as such an authorization.

If there is a conflict between this Privacy Policy and an applicable Consumer Health Data Privacy Notice concerning a jurisdiction specific Consumer Health Data disclosure or right, the applicable state specific notice controls for that issue to the extent required by law.

9. Health and Fitness Platform Integrations

Optional health and fitness integrations require heightened controls. NovaBloom will not access data from an integration unless the user has enabled the connection and granted the relevant platform permission.

9.1 Apple Health

If you connect Apple Health, NovaBloom uses information obtained through Apple’s HealthKit framework only for health and wellness functionality that you request, related support and troubleshooting, security, and other uses permitted by Apple’s rules and applicable law. NovaBloom does not use HealthKit information for advertising, marketing, sponsorship targeting, or similar promotional profiling. NovaBloom does not sell HealthKit information to advertising platforms, data brokers, or information resellers.

NovaBloom will not disclose HealthKit information to a third party except with the permission required by Apple and only where the disclosure is permitted by Apple’s rules and applicable law, such as to a service that provides a health or fitness function to the user.

9.2 Google Health Connect and Related Google Health Data

If you connect Google Health Connect or another supported Google health or fitness service, NovaBloom requests only permissions reasonably necessary for the user facing functionality. NovaBloom does not sell or transfer Google health data to advertising platforms, data brokers, or information resellers, and does not use that data to serve advertising. Human access is limited to circumstances permitted by Google’s applicable health data rules and law, such as explicit user support, security, legal compliance, or properly deidentified internal operations.

9.3 Oura and Other Connected Services

If you connect Oura or another supported service, the information available to NovaBloom depends on the permissions you grant and the provider’s interface. The provider independently governs its collection and processing of data in its environment. NovaBloom uses imported information for the connected NovaBloom feature, related support, security, and permitted product operations, subject to applicable law and the provider’s rules.

9.4 Disconnecting an Integration

You may disconnect an integration through available NovaBloom, device, or provider controls. Disconnecting stops future access where supported but does not automatically delete information previously imported into NovaBloom. You may separately request deletion of previously imported information through the controls described in Section 23, subject to applicable law.

10. Family Billing and Teen Accounts

NovaBloom’s optional family plan is a billing arrangement, not a parental monitoring or health data sharing system. A Teen User may create an individual Account independently. Joining a family billing plan requires the participation and consent steps presented to both the Teen User and the adult Family Billing Administrator.

For family billing administration, NovaBloom may disclose to the Family Billing Administrator limited information such as the Teen User’s name, age or age category, plan participation, and billing status. NovaBloom does not disclose the Teen User’s menstrual cycle history, symptoms, moods, notes, trackers, or other reproductive wellness information through the family billing dashboard.

The Family Billing Administrator does not acquire a general right to access, manage, export, or delete the Teen User’s Account or Personal Information merely because the adult pays for access. A Teen User may remove themself from the family billing plan using available controls. The Teen User automatically leaves the teen family billing arrangement at age 18.

NovaBloom may restrict a parent, guardian, or other adult from exercising privacy rights on behalf of a Teen User unless the adult demonstrates authority recognized by applicable law. Billing status alone is not treated as proof of authority to access the Teen User’s health related information.

11. Adult Cycle Sharing

Cycle sharing is optional and available only to eligible users age 18 or older. Before sharing begins, NovaBloom requires the sharing user to complete the applicable feature specific consent or authorization flow and requires the invited recipient to affirmatively accept the recipient terms presented for the feature. Where applicable law requires an additional or specific authorization for disclosure of covered health information, NovaBloom obtains that authorization before the disclosure occurs.

NovaBloom discloses only the information selected or made available through the sharing feature. The sharing user may revoke future access through available controls. Revocation prevents future access through NovaBloom where technically supported, but it cannot retrieve information that a recipient already viewed, copied, downloaded, recorded, or screenshotted before access was revoked.

A sharing recipient is responsible for safeguarding information received from another user. NovaBloom does not use cycle sharing as a means to disclose health data to advertisers, data brokers, or unrelated commercial recipients.

12. Rules Based Personalization and No Generative AI at Launch

NovaBloom may use rules based systems to tailor reminders, educational content, wellness insights, and encouragement based on information the user provides, such as cycle data, symptoms, moods, activity, trackers, preferences, or related settings. These systems apply programmed rules or calculations and may create inferences or estimates.

As of the Last Updated date, NovaBloom does not use generative AI chatbots, AI coaching systems, or third party generative AI tools to process user health data. NovaBloom does not use user Personal Information, including deidentified user health information, to train a generative AI model.

If NovaBloom later introduces generative AI or another materially different automated processing system that changes how Personal Information is used, NovaBloom will evaluate applicable privacy, health data, platform, and consent requirements before launch and will update its notices and obtain any required consent.

13. How We Disclose Personal Information

NovaBloom discloses Personal Information only for the purposes described below, as directed by the user, or as otherwise permitted or required by law. A disclosure to a service provider acting for NovaBloom is not a sale merely because the provider receives information necessary to perform contracted services.

13.1 Service Providers and Processors

We use service providers to perform functions such as cloud hosting, infrastructure, subscription management, communications delivery, customer support, website hosting, online store functionality, security, and technical operations. Current or expected providers include AWS, Monday.com, Slack, Flodesk, RevenueCat, Squarespace, Shopify, Apple, and Google, depending on the feature.

We require service providers that receive sensitive information to handle it for authorized purposes and subject to appropriate confidentiality, security, and data protection obligations where required by law. A provider’s access is limited to information reasonably necessary for the service it performs.

13.2 App Stores and Subscription Infrastructure

NovaBloom exchanges limited subscription and entitlement information with Apple, Google, and RevenueCat to process or verify subscriptions, restore purchases, provide paid features, troubleshoot billing, and maintain transaction records.

13.3 Integrations You Choose

When you enable Apple Health, Google health services, Oura, or another integration, information may flow between NovaBloom and the connected service according to the permissions you grant and the rules described in Section 9.

13.4 User Directed Sharing

NovaBloom may disclose limited family billing information or adult cycle sharing information when the relevant users choose and authorize those features as described in Sections 10 and 11.

13.5 Professional Advisors

NovaBloom may disclose information to attorneys, auditors, accountants, insurers, security professionals, consultants, or other professional advisors when reasonably necessary for legal advice, compliance, security, risk management, auditing, financing, or protection of legal rights. Sensitive information is limited where reasonably practicable.

13.6 Legal, Safety, Fraud, and Security Matters

NovaBloom may disclose Personal Information when NovaBloom reasonably believes disclosure is legally required or permitted, or reasonably necessary to respond to a valid legal process, investigate fraud or misuse, protect the security and integrity of the Services, protect a person from a serious threat where disclosure is permitted by law, or establish, exercise, or defend legal claims. Section 26 describes NovaBloom’s approach to government demands.

13.7 Business Transactions

Personal Information may be disclosed in connection with due diligence, financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or a similar corporate transaction. NovaBloom will use reasonable measures designed to protect sensitive information during due diligence and will comply with any applicable notice, consent, or successor obligation required by consumer health or other privacy law.

13.8 Deidentified or Aggregated Information

NovaBloom may disclose Deidentified Information or aggregated statistics for purposes described in Section 16. NovaBloom does not intentionally include identifiable menstrual or reproductive health information in aggregate sponsorship, affiliate, audience, or business reporting.

14. Promotional, Sponsored, Affiliate, and Referral Content

NovaBloom may display sponsored recommendations, affiliate links, referral links, or cross promotional content related to women’s wellness, health, education, lifestyle products, or services. NovaBloom may receive compensation when a user interacts with or purchases through certain disclosed commercial links.

NovaBloom does not use identifiable Sensitive Health Data or imported Apple Health or Google Health Connect data to select third party promotional content for an individual. NovaBloom does not disclose identifiable reproductive health data to an advertiser, sponsor, affiliate partner, or data broker for targeted advertising.

NovaBloom may use general context, non-sensitive settings, broad product placement, or properly Deidentified Information to measure overall engagement or report general sponsorship and affiliate performance. For example, NovaBloom may report aggregate counts, generalized age ranges, audience categories, or interaction trends that do not reasonably identify an individual.

When you click an external affiliate or referral link, the destination site may receive ordinary web referral or technical information and will process your activity under its own privacy policy. NovaBloom does not intentionally place menstrual, reproductive, symptom, mood, note, or other Sensitive Health Data into an external referral URL or affiliate tracking parameter.

15. Website Cookies, App Technologies, and Similar Tools

15.1 Website

The website may use cookies, local storage, logs, and similar technologies that are necessary for site functionality, security, fraud prevention, preference management, forms, communications, limited analytics, embedded services, or online store functionality. These technologies may be supplied by NovaBloom or providers such as Squarespace, Shopify, or Flodesk.

The exact cookies and similar technologies present on a webpage can change when site features or embedded tools change. Before activating nonessential tracking, NovaBloom evaluates applicable notice and consent requirements and updates its disclosures as required by law.

15.2 App

The App may use first party or service provider libraries, software development kits, device or platform identifiers, session identifiers, logs, and diagnostic events for authentication, App functionality, security, crash reporting, subscription management, and limited product analytics. These technologies are not intended to transmit the content of Sensitive Health Data entries to advertising networks.

15.3 Consent Before Interception or Tracking Where Required

Where applicable law requires prior consent before a third party may intercept, record, or receive the contents of communications or sensitive form entries, NovaBloom will obtain the required consent before activating the relevant technology. A privacy policy presented after the collection begins is not intended to serve as retroactive consent.

15.4 Global Privacy Control and Do Not Track

Some browsers or extensions send opt out preference signals such as Global Privacy Control. Where a legally recognized signal applies to a practice that NovaBloom engages in, NovaBloom will process that signal as required by applicable law. NovaBloom currently does not sell Personal Information or use Sensitive Health Data for cross context behavioral advertising.

There is no universally accepted legal standard for browser “Do Not Track” signals. NovaBloom does not interpret a Do Not Track signal as a general instruction beyond what applicable law requires, but users may exercise the specific choices described in Section 23.

16. Deidentified and Aggregated Information

NovaBloom may transform information into Deidentified Information or aggregate information across users so that the resulting information does not reasonably identify an individual. NovaBloom may use such information for analytics, internal research, educational planning, product improvement, audience insights, trend analysis, sponsorship or affiliate reporting, security analysis, and business operations.

When NovaBloom treats information as deidentified, NovaBloom will take reasonable measures designed to prevent association of the information with an identified individual, will maintain the information in deidentified form rather than attempting to reidentify it, and will impose contractual restrictions on a recipient where applicable law requires those restrictions.

NovaBloom does not use the term “deidentified” to mean merely that a name was removed. Device identifiers, IP addresses, persistent pseudonymous identifiers, combinations of rare health events, or other data can sometimes reidentify a person when combined with additional information. NovaBloom evaluates the information as a whole before treating it as deidentified.

NovaBloom does not disclose identifiable user health information to an outside researcher merely by labeling the activity “research.” Any future research program involving identifiable or reidentifiable health information would require separate legal, ethical, contractual, and consent review before implementation.

17. Data Minimization and Purpose Limitation

NovaBloom seeks to collect, use, and disclose Personal Information that is reasonably necessary and proportionate to provide the feature requested by the user, protect the Services, comply with law, or carry out another disclosed purpose. This principle is especially important for Sensitive Health Data and information concerning Teen Users.

NovaBloom applies heightened privacy review before deploying new Sensitive Health Data fields, new integrations, new SDK events, new advertising or affiliate measurement tools, or materially different uses of existing health data. NovaBloom seeks to avoid collecting Sensitive Health Data merely because it could be useful for an unspecified future purpose.

Where consent is the legal basis or statutory authorization for a processing activity, NovaBloom will make reasonable controls available to withdraw that consent prospectively, subject to processing already completed and lawful retention obligations.

18. Data Retention, Account Deletion, and Backups

NovaBloom retains Personal Information for no longer than reasonably necessary for the purposes described in this Privacy Policy, subject to applicable law, security needs, fraud prevention, dispute preservation, and technical backup cycles. Retention varies by category and context.

18.1 Active Accounts

Account information and user entered tracking information are generally retained while an Account remains active so NovaBloom can provide the Services and maintain the user’s history and settings.

18.2 Logs, Security, and Support Records

Security logs, authentication records, crash information, support communications, and technical records are retained for periods appropriate to troubleshooting, security investigation, fraud prevention, operational continuity, or legal obligations. Those periods may be shorter or longer than the retention of user entered wellness information.

18.3 Subscription Records

NovaBloom may retain limited subscription, entitlement, transaction, refund, and accounting records for the period reasonably necessary to administer purchases, resolve disputes, detect fraud, and satisfy financial or legal requirements. App stores independently retain transaction records under their own policies.

18.4 Account Deletion

A registered user may request Account deletion through available in App controls or by contacting privacy@novabloom.io. NovaBloom’s current architecture is intended to place eligible user data in a routine deletion batch promptly after an authenticated deletion request, generally by the end of the applicable processing day for primary operational records. The time needed to complete deletion across all systems can be longer because of backups, service provider systems, security records, and technical synchronization.

NovaBloom will also send deletion instructions to processors, contractors, or other recipients when applicable law requires NovaBloom to do so. Information that has been validly deidentified so it can no longer reasonably be linked to the user may not be capable of being associated with a deletion request.

18.5 Backups and Archived Systems

NovaBloom uses AWS redundancy and may maintain encrypted backups for disaster recovery and business continuity. Backups are not intended to be used as an active user profile after deletion. Deleted information may remain in backup or archived systems until the applicable backup is overwritten, expires, or is securely deleted. If a backup is restored, NovaBloom will take reasonable steps to reapply outstanding deletion instructions where technically practicable.

Where Washington’s consumer health data law applies, deletion of Consumer Health Data from archived or backup systems will be completed within the period required by that law, which permits a delay of no more than six months after an authenticated deletion request for archived or backup systems, subject to applicable statutory exceptions.

19. Data Security and Internal Access

NovaBloom uses administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, acquisition, use, alteration, disclosure, or destruction. No security program can guarantee absolute security.

Current safeguards include, as applicable:

• Encryption in transit using TLS or SSL and encryption at rest through cloud and application infrastructure.
• Role based access controls and least privilege principles.
• Multi factor authentication for administrative accounts where the relevant system supports it.
• Password hashing or protected authentication through authentication providers and cloud infrastructure.
• Audit logging, monitoring, crash reporting, and security review through cloud and application services.
• Restrictions on vendor access and selection of service providers appropriate for the information they process.
• Access limited to authorized personnel who need information for operations, maintenance, support, security, legal compliance, or another authorized purpose.

Access to user health information is limited to authorized personnel based on operational need and applicable access controls. NovaBloom uses role based and least privilege principles and audit or monitoring controls where supported by the relevant systems.

20. Data Incidents and Breach Notification

NovaBloom maintains procedures intended to identify, investigate, contain, and respond to suspected privacy or security incidents. If an incident involves Personal Information, NovaBloom will evaluate notification obligations under applicable federal and state law.

For consumer health apps, a legally reportable event may include an unauthorized disclosure of identifiable health information, not only a malicious intrusion into a computer system. Where the Federal Trade Commission’s Health Breach Notification Rule applies, NovaBloom will provide notices to affected individuals, the FTC, and other recipients required by that rule within the legally required time and manner.

Nothing in this section promises that every technical anomaly is a legally reportable breach. NovaBloom will make that determination based on the facts, applicable law, and any required risk assessment.

21. Data Location and U.S. Processing

NovaBloom’s primary App hosting and storage environment is expected to use Amazon Web Services in the United States, currently the US East (N. Virginia) Region. Data may be replicated across availability zones within the region for resilience and disaster recovery.

Some service providers may process support, communications, authentication, subscription, or technical information in other locations according to their infrastructure and contracts. NovaBloom does not represent that every copy of every category of Personal Information remains physically located in Virginia.

The Services are currently intended for U.S. users. If NovaBloom later intentionally launches outside the United States, it will evaluate additional international privacy, transfer, consent, and localization requirements before launch.

22. Children and Teen Privacy

22.1 Children Under 13

NovaBloom is not intended for children under 13. NovaBloom does not knowingly permit a child under 13 to create a standard Account. If NovaBloom learns that it collected Personal Information from a child under 13 through an Account without legally sufficient parental authorization, NovaBloom will take appropriate steps to disable the Account and delete or otherwise handle the information as required by the Children’s Online Privacy Protection Act and other applicable law.

NovaBloom may use an age or date of birth field to apply age appropriate features and restrictions. Users may not misrepresent their age to obtain access to a feature.

22.2 Teen Users Ages 13 Through 17

Teen Users may create individual Accounts and use age appropriate NovaBloom features, subject to applicable law. NovaBloom treats health related information from Teen Users as highly sensitive and applies the same core restrictions against sale, data brokerage, and health based targeted advertising described in this Privacy Policy.

Some states provide additional protections for minors, including purpose limitation, retention limits, restrictions on targeted advertising or profiling, and heightened duties to avoid reasonably foreseeable harm. NovaBloom will apply those protections where applicable and will obtain consent from the person legally authorized to provide it when a particular law requires that consent.

NovaBloom does not collect precise GPS location from Teen Users. NovaBloom does not design the family billing feature to reveal a Teen User’s reproductive wellness activity to the adult payer. Teen Users cannot use adult cycle sharing.

22.3 Requests From Parents or Guardians

A parent or guardian who believes NovaBloom has information about a child under 13 may contact privacy@novabloom.io. For a Teen User age 13 through 17, NovaBloom will not disclose the Teen User’s Sensitive Health Data to an adult merely because the adult claims to be a parent or pays for a family plan. NovaBloom will evaluate the requester’s legal authority, the Teen User’s rights, and the requirements of applicable law before granting access or control.

23. Your Privacy Rights and Choices

NovaBloom provides Account and privacy controls required by applicable law and intends to make core access, correction, export, and deletion controls broadly available to registered U.S. users where technically feasible. The precise legal right, response deadline, verification standard, and available exception depend on your state and the type of information.

Depending on applicable law, you may have the right to:

• Confirm whether NovaBloom processes Personal Information about you.
• Access Personal Information NovaBloom maintains about you.
• Correct inaccurate Personal Information.
• Request deletion of Personal Information.
• Obtain a portable copy or export of certain Account and wellness information, including cycle tracking information, symptoms, moods, and related user inputs.
• Withdraw consent for a processing activity that relies on consent, with effect for future processing.
• Disconnect an optional integration.
• Revoke future access under adult cycle sharing.
• Remove yourself from a family billing plan if you are an eligible Teen User.
• Opt out of marketing email.
• Opt out of sale, targeted advertising, or certain profiling where NovaBloom engages in a practice and applicable law provides that right.
• Appeal a denial of a privacy request where applicable law provides an appeal right.
• Use an authorized agent where applicable law permits.
• Receive nondiscriminatory treatment for exercising a privacy right.

23.1 How to Exercise Rights

You may use available in App controls or email privacy@novabloom.io. Please describe the request and identify the Account or email address involved. NovaBloom may request information reasonably necessary to verify identity, Account ownership, residency, authority of an agent, or the scope of the request.

NovaBloom will not require you to disclose more Sensitive Health Data than reasonably necessary to verify a request. If NovaBloom cannot verify a request with reasonable confidence, NovaBloom may deny or limit the request and explain the basis to the extent required by law.

23.2 Marketing and Notifications

You may unsubscribe from promotional email through the unsubscribe link or by contacting NovaBloom. You may control push notifications through App or device settings. Even after opting out of marketing, NovaBloom may send service, security, legal, Account, or subscription communications that are not marketing.

23.3 Appeals

If applicable state law gives you the right to appeal a privacy request decision, you may submit an appeal to privacy@novabloom.io with the subject line “Privacy Appeal.” NovaBloom will respond within the period required by applicable law and will provide any information about contacting a state attorney general or regulator that the law requires.

24. U.S. State Privacy Disclosures

U.S. privacy laws vary by state. Some comprehensive privacy laws apply only after a business reaches specified revenue or data volume thresholds, while certain consumer health data laws apply more broadly. NovaBloom will apply the rights and restrictions required by the law that applies to the particular consumer and processing activity.

For purposes of state privacy laws, the categories below summarize NovaBloom’s anticipated launch practices. A category is included if NovaBloom may collect it from some users. It does not mean NovaBloom collects every example from every user.

24.1 Sensitive Data Consent and Consumer Health Data

Where state law requires consent before processing sensitive data or Consumer Health Data, NovaBloom will obtain the legally required consent unless an exception applies, such as processing that is strictly necessary to provide a product or service the user requested. A consent will identify the processing it authorizes and will not be bundled with unrelated permissions when applicable law requires a separate choice.

24.2 Sale, Targeted Advertising, and Profiling

NovaBloom does not currently sell Personal Information or identifiable Consumer Health Data. NovaBloom does not use Sensitive Health Data for targeted advertising. NovaBloom does not currently profile users using Personal Information for decisions that produce legal or similarly significant effects such as eligibility for employment, housing, credit, insurance, education, criminal justice, or essential health care.

24.3 Connecticut Consumer Health Data

Connecticut law applies special obligations to consumer health data controllers. NovaBloom limits employee and contractor access to Consumer Health Data to authorized personnel subject to confidentiality obligations, uses processor agreements where required, does not use prohibited health facility geofencing, and does not sell Consumer Health Data without the consent required by law.

24.4 Colorado Minors

For Colorado minors where the applicable law applies, NovaBloom will use reasonable care to avoid heightened risks of harm, conduct required data protection assessments, limit processing to disclosed and reasonably necessary purposes, avoid retention longer than reasonably necessary, and comply with restrictions on targeted advertising, sale, certain profiling, manipulative design, and precise geolocation.

24.5 Maryland Sensitive Data

Where Maryland’s Online Data Privacy Act applies, NovaBloom treats consumer health data and information revealing religious beliefs as sensitive data. NovaBloom limits collection, processing, and sharing of sensitive data to what is permitted by that law and does not sell sensitive data.

24.6 Washington, Nevada, and Connecticut Consumer Health Data Notices

Washington and Nevada impose specific notice, consent, sharing, processor, authorization, and deletion requirements for Consumer Health Data, and Connecticut imposes additional consumer health confidentiality, processor, sale consent, and geofencing restrictions. NovaBloom addresses those requirements through its applicable state specific Consumer Health Data Privacy Notices and related consent or authorization flows.

25. California Specific Disclosures

California residents receive protections under several laws that may apply differently depending on NovaBloom’s size, data practices, and the information involved. Some California Consumer Privacy Act obligations apply only if statutory business thresholds are met. Other California confidentiality and communications laws can apply independently of those thresholds.

25.1 CCPA and CPRA

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to NovaBloom, California consumers may have rights to know or access, correct, delete, obtain information about categories of collection and disclosure, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive nondiscriminatory treatment, subject to statutory exceptions.

NovaBloom does not currently sell Personal Information or share Personal Information for cross context behavioral advertising as NovaBloom understands those terms based on its current launch architecture. NovaBloom does not use Sensitive Health Data for purposes that require a California consumer to invoke a “Limit the Use of My Sensitive Personal Information” mechanism under the current disclosed practices. If those practices change, NovaBloom will implement any legally required notice and opt out or limitation mechanism before or when the law requires.

25.2 California Confidentiality of Medical Information Act

California’s Confidentiality of Medical Information Act (“CMIA”) expressly reaches certain businesses that offer reproductive or sexual health digital services to consumers. When NovaBloom is within that statutory scope, individually identifiable reproductive or sexual health application information maintained by NovaBloom, including menstrual cycle, fertility, pregnancy related, sexual health, and related inferred information, is treated as medical information subject to the CMIA’s applicable confidentiality and disclosure requirements.

NovaBloom does not rely on the absence of HIPAA coverage as a basis to disregard California health confidentiality requirements. NovaBloom evaluates uses and disclosures of California reproductive or sexual health application information under the CMIA’s confidentiality rules, authorization requirements, and statutory exceptions. Where the CMIA requires a valid authorization for a disclosure, NovaBloom will not treat a general Terms acceptance, Privacy Policy acknowledgement, or ordinary feature toggle as a substitute for the legally required authorization.

25.3 California Online Tracking and Communications Privacy

California communications privacy law can impose liability where a third party receives or records protected online communications without legally sufficient prior consent and can also create risk from certain routing, addressing, or signaling information collected through tracking technologies. NovaBloom therefore seeks to avoid third party advertising trackers in sensitive health flows, reviews URLs, headers, referrers, IP address transmission, device identifiers, and similar metadata as part of tracker testing, and obtains prior consent before activating a technology where applicable law requires that consent.

25.4 California Shine the Light

NovaBloom does not disclose Personal Information to third parties for their own direct marketing purposes in the manner addressed by California’s Shine the Light law based on the practices described in this Privacy Policy. California residents may contact privacy@novabloom.io with questions about this disclosure.

26. Legal Requests, Safety, and Government Demands

NovaBloom recognizes that reproductive health information can be especially sensitive in legal or governmental contexts. NovaBloom does not voluntarily disclose Sensitive Health Data to a government agency merely because the information may be useful to an investigation.

When NovaBloom receives a subpoena, warrant, court order, law enforcement request, regulatory demand, or other legal process seeking user information, NovaBloom will evaluate the request for facial validity, legal authority, jurisdiction, scope, and applicable privacy or health confidentiality restrictions. Where legally permitted and reasonably practicable, NovaBloom may seek clarification, narrowing, protective treatment, or judicial review of an overbroad or legally deficient demand.

NovaBloom may disclose information when required by valid legal process or when another legal exception permits or requires disclosure. Where legally permitted and appropriate, NovaBloom may notify the affected user before disclosure or after a legal restriction on notice expires. NovaBloom cannot promise advance notice in every matter, and this section does not interfere with legally binding nondisclosure obligations.

NovaBloom will not interpret a general consent to this Privacy Policy as a blanket authorization for disclosure of reproductive health information to law enforcement, civil litigants, or government agencies.

27. HIPAA and Other Health Privacy Laws

NovaBloom is a direct to consumer wellness service and does not currently provide medical diagnosis or treatment. NovaBloom is not generally operating the consumer Services as a HIPAA covered health care provider, health plan, or health care clearinghouse, and information you enter directly into NovaBloom is not automatically protected health information under HIPAA merely because it concerns health.

HIPAA is not the only law that protects health information. Depending on the state, the user, and the data flow, NovaBloom may be subject to other laws governing reproductive health application information, Consumer Health Data, privacy, confidentiality, wiretapping or communications, data security, breach notification, or unfair and deceptive practices.

If NovaBloom later receives protected health information from or on behalf of a HIPAA covered entity in a capacity that makes NovaBloom a business associate, NovaBloom will evaluate and implement the additional HIPAA obligations applicable to that relationship before engaging in the covered processing.

28. Third Party Services and Links

The Services may link to third party websites, products, stores, merchants, affiliates, integrations, or services. When you leave NovaBloom or intentionally interact directly with a third party, that third party may independently collect information under its own privacy policy and terms.

NovaBloom’s Privacy Policy does not control a third party’s independent processing. Before connecting an integration or providing sensitive information to another service, review that provider’s privacy and security practices.

A third party that acts only as NovaBloom’s processor or service provider for a contracted function is treated differently from a third party with an independent purpose. NovaBloom seeks to use contracts and technical controls appropriate to the sensitivity of the information and the provider’s role.

29. Communications and Notifications

29.1 Service Communications

NovaBloom may send communications necessary to operate the Services, such as authentication messages, security alerts, subscription notices, legal notices, privacy updates, and support responses. These communications are not marketing and may continue while you maintain an Account or transaction relationship.

29.2 Marketing Email

If you subscribe to newsletters, waitlist updates, product announcements, or promotional email, NovaBloom may use Flodesk or another communications provider to deliver those messages and measure limited engagement. You may unsubscribe using the link in the message or by contacting privacy@novabloom.io.

29.3 Push Notifications and Lock Screen Privacy

If you enable push notifications, the content of a notification may be visible on a device lock screen depending on your device settings. Because reminders can relate to menstrual or wellness activity, consider configuring lock screen previews and notification settings in a manner appropriate to your privacy needs. You can disable push notifications through your device or available App settings.

30. Changes to This Privacy Policy

NovaBloom may update this Privacy Policy to reflect changes in the Services, vendors, technologies, legal requirements, or privacy practices. NovaBloom will post the revised Privacy Policy and update the Last Updated date.

If a change is material, NovaBloom will provide additional notice appropriate to the change, such as an in App notice or email to the Account address. If applicable law requires affirmative consent before NovaBloom may collect an additional category of Consumer Health Data, use existing Consumer Health Data for a materially new purpose, or share it with a new category of recipient, NovaBloom will obtain the required consent before that processing begins.

NovaBloom does not rely on silent continued use of the Services as a substitute for a form of consent that applicable privacy or consumer health law requires to be affirmative, express, written, separate, or specific.

31. Relationship to the Terms of Use and Dispute Resolution

This Privacy Policy is a privacy notice. It does not itself create a separate arbitration agreement. NovaBloom’s Terms of Use contain the agreement governing access to and use of the Services, including an arbitration agreement and class action waiver for covered disputes where valid and enforceable.

A privacy rights request does not waive your right to contact a regulator or exercise any nonwaivable statutory right. Nothing in this Privacy Policy expands or contracts the scope of the Terms of Use arbitration provision.

32. Contact Us

Questions, privacy requests, and privacy appeals may be directed to:

Novabloom LLC
Attn: Privacy Matters
181 W Valley Ave Ste 245 #1427
Birmingham, Alabama 35209
Email: privacy@novabloom.io

For a privacy rights request, please use the email address associated with your Account when reasonably possible and describe the request with enough detail for NovaBloom to identify the relevant records without requiring unnecessary Sensitive Health Data.

END OF PRIVACY POLICY