HormoneLog (“HormoneLog,” “we,” “us”) is a perimenopause and menopause symptom, HRT, and cycle tracking app operated by Baker Ventures LLC. This policy explains what data the app handles, where it lives, and what we do and don’t do with it. We wrote it to describe exactly what the app does — not generic boilerplate.
The short version: your logs are stored on your device by default, not on our servers. No account is required to use HormoneLog. We never sell your data, and we never send symptom values to any analytics or advertising service.
Everything you log — symptoms, severity, mood/energy/sleep ratings, period dates, HRT regimen details, notes, and generated reports — is stored in a local database on your phone, and is used to show you your own history and summaries inside the app. Free-text fields that are most likely to contain sensitive detail (log notes and any HRT dose you type in) are additionally encrypted at rest with AES-256-GCM before being written to that database; the encryption key is generated on your device and held in your device’s secure hardware-backed keychain (iOS Keychain / Android Keystore), never transmitted anywhere, including to us.
On iOS, your health log is deliberately kept out of your phone’s own backups. The database is marked as excluded from iCloud Backup, and the encryption key is stored so that it never leaves the handset — it is not synced to iCloud Keychain and is not included in a device backup. The practical consequence is worth stating plainly: if you lose, wipe, or replace your phone, that data is gone, because there is no copy of it anywhere else and no key escrow that would let anyone — including us — recover it. Use the export option in Settings if you want a copy you control.
HormoneLog is designed to support an optional, opt-in cloud backup so you can restore your data on a new device. This feature is not live in the current version — the setting exists in Settings, but turning it on does not yet sync anything anywhere. If and when it ships, it will remain off by default, require an explicit action from you to enable, and will be described here in detail (what’s sent, where it’s stored, and how to delete it) before it goes live.
When you tap “Generate PDF for my doctor,” the already-computed summary shown on that screen — your Symptom Burden Index and its category breakdown, your top symptom frequencies (which symptoms and how often, not your individual daily log entries), and a short text summary of your HRT regimen (form, dose, and schedule, exactly as you typed it) — is sent over an encrypted (TLS) connection to a report-rendering service we operate, which lays it out as a PDF and returns it to your device. That service is stateless: it does not write anything to a database, and keeps nothing after it responds to your request. Your raw daily symptom log, mood/energy/sleep ratings, and free-text notes are never sent — only the aggregate scores and summary described above, and only when you choose to generate a report.
If you grant permission, HormoneLog reads sleep analysis, heart-rate variability, resting heart rate, and body temperature data from Apple Health, to show it alongside your symptom log in Insights. HormoneLog never writes any data back to Apple Health, and this data never leaves your device — it is not sent to us or to any third party. You can deny or later revoke this permission in iOS Settings at any time; the rest of the app works fully without it.
We use a minimal, privacy-conscious analytics setup to understand how people use the app in aggregate — for example, that someone completed onboarding, logged a symptom, or viewed the paywall. The complete list of events we can ever record is fixed in the app’s source code and contains no symptom names, severities, notes, dose text, or any other health content — only that a screen was viewed or an action was taken, plus a randomly generated device identifier that is not tied to your name, email, or Apple/Google account.
Subscription purchases are processed entirely by Apple (App Store) or Google (Play Store) and managed via RevenueCat, a subscription-management service. We receive confirmation that you have an active subscription and which plan it is; we never see or store your payment card details — those are handled directly by Apple/Google.
The only parties that ever receive anything are the ones named above, and only what each needs:
Each of these third parties is contractually required to protect your data to at least the standard set out in this policy. Each is bound by an agreement that permits it to use the data only to provide the service we have asked it for, and forbids it from using that data for its own purposes, from selling it, and from disclosing it further.
Symptom, HRT, and cycle data are “special category” health data under GDPR and UK data protection law. This data is stored locally on your device by default and not transmitted to us as part of ordinary use of the app — the one exception is the brief, stateless PDF-generation processing described in Section 3, which only happens when you explicitly choose to generate a report. If you enable a future cloud backup feature, we will present a specific, explicit consent step before any health data leaves your device, as required by law.
HormoneLog is not directed at, or intended for use by, children. It is rated for users 17 and older due to medical content, per App Store guidelines.
If we make a material change to how HormoneLog handles data, we’ll update the “last updated” date above and, where required, notify you in the app.