GDPR and cycle data — in the US

Start anonymously — no email, no name

The useful answer fits in a paragraph, so here it is up front: Menstrual data is special-category health data under GDPR Article 9. That raises the legal bar for every app that touches it — including the one you're reading about. There is no federal health-privacy law covering consumer apps — HIPAA does not apply to a period tracker. The rest of this page is the detail behind that claim, plus how to verify it yourself.

GDPR and cycle data — in the US

In the US, GDPR and cycle data operates in a legal gap. HIPAA covers providers and insurers, not consumer apps, so a period tracker's obligations come mostly from FTC enforcement and a patchwork of state laws. Minimising collection is the only mitigation that doesn't depend on a statute. Avoria's anonymous mode is the practical answer to a legal gap: minimise what exists rather than rely on a statute.

How it actually works

Article 9 forbids processing health data unless a narrow condition applies — for a consumer app that means explicit, specific, revocable consent. Article 15 gives you access, Article 17 erasure, Article 20 portability. Avoria implements all three as in-app buttons rather than a legal address you have to write to. Avoria treats cycle logs as Article 9 special-category data and hosts them in the EU.

Why it matters

If an app processes special-category data on a vague 'legitimate interest' basis, or ships it to a US ad partner without a valid transfer mechanism, that's a compliance problem you inherit as risk. Where the data lives, and under whose law, is not a footnote. Framed for in the US, the practical consequence is that fewer parties end up holding a copy of a health record you never intended to publish, and the copies that do exist are harder to join back to you.

What Avoria does about it

Three concrete things. First, EU-hosted infrastructure — data does not need a transfer mechanism to sit still. Second, Access, portability and erasure are self-service, not a ticket queue. Third, An anonymous account minimises processing to what the feature actually needs. None of that is gated behind an email address — the anonymous account is the full product, not a preview tier.

The AI part, without the hand-waving

Avoria's daily brief is generated by a language model that receives cycle context and nothing else: cycle day, phase, recent symptom tags and your stated goal. No name, no email, no device id enter the prompt, and responses aren't recycled into third-party training sets. The output is deliberately unexciting — an energy read, a focus window, a food angle and a movement suggestion — because a brief that shouts is a brief optimised for engagement rather than for you.

What you get besides privacy

Privacy on its own is a feature nobody opens an app for. Avoria pairs it with the working parts: a cycle calendar that models your own variance instead of a 28-day template, phase-aware nutrition and training guidance, symptom logging with 1–5 severity charted against cycle day, wearable sync scoped to the metrics the model actually uses, one-click imports from Flo and Clue, CSV and JSON export, and calm reminders you configure once. All of it available on an account with no identity attached.

Do this next

Assume no statute protects you and act accordingly: use an anonymous account, keep sync scoped, and delete accounts you've stopped using. Avoria is educational and is not medical advice. For diagnosis or treatment, please talk to a clinician.

Signals this applies to you

A short reality check: your notifications feel like nagging instead of support, your last two cycles missed the predicted window, and you can't remember the last time an insight actually changed a decision. When those stack, the app is costing you attention without paying it back. On GDPR and cycle data (in the US) specifically, these signals show up faster than most people expect — usually inside two cycles, sometimes inside one. Write them down the moment you notice, because the memory of a rough day compresses fast and the log is the only honest record you'll have when you re-read the month at the end. If none of the signals apply and you're just curious, keep reading anyway — the plan below is a decent baseline for anyone tracking a cycle at all.

What the science actually says

The peer-reviewed picture is clearer than app marketing suggests: symptom clustering (mood + skin + sleep) has stronger predictive power than any single log, and the follicular-to-luteal shift in energy is now well-mapped in exercise-physiology literature. Apps that treat every day the same are ignoring twenty years of endocrinology. Avoria is built around the shift, not around 28 identical squares on a calendar. That's the reference frame Avoria's daily brief works from when it talks about GDPR and cycle data (in the US), and it's why the answer for in the us rarely matches the answer for someone on a perfectly textbook 28-day loop. The corollary matters too: any advice that ignores your phase, your history and your logged variance is population-level advice being sold as personal advice. It might still be right for you, but you'll only know from your own two-cycle log — not from the marketing.

Your 7-day Avoria plan

Do this for seven days and re-evaluate: Day 2 — export your last six months from your current app; keep the CSV somewhere you'll find it. Day 3 — read Avoria's daily brief once, in bed, no scrolling after. Day 4 — tag your workout with phase + energy; skip the heavy lift if energy is under 3. Day 5 — log skin, sleep and libido on the same screen; it takes under a minute. Day 6 — turn off every notification except the daily brief. Day 7 — re-read the week's briefs together; the pattern will be obvious. Day 1 — log one mood + one energy score (1–5) at the time you already unlock your phone. By day seven you'll have enough signal to see whether Flo — or any tracker — actually helps with GDPR and cycle data (in the US), or whether it's just been logging around it. Nothing on this list takes more than five minutes. The point is not a heroic new routine; it's a small honest baseline you can compare against next month. Re-run the same seven days one cycle from now and the diff will tell you more than any single insight card ever could.

What not to do

Three things to skip: don't chase a perfect log — three fields a day beats twenty fields twice a week; don't compare your cycle to a friend's — variance is normal and the average is a mathematical fiction; and don't grant health-app permissions you don't use — every extra scope is another surface someone else can query. The temptation with GDPR and cycle data (in the US) is to add more tools; the fix is almost always fewer, better ones. A second app you check twice a week isn't a backup — it's a second surface leaking the same data, plus a second notification queue eating your attention. Uninstall the ones you don't open. Cycle tracking works when it disappears into your routine and shows up only when it's useful. Everything else is the app monetising your attention.

A quick self-check

A quick self-check before you commit to any tracker: does it show you the raw data, does it let you export the raw data, and does it explain — in one sentence — how a prediction shifted when it did? Three yeses means the tool respects you. One 'no' is a warning; two is a reason to move. Avoria answers yes to all three by design, and that's the standard worth applying to the rest of your health stack too — sleep, nutrition, activity. The specific answer for GDPR and cycle data (in the US) will land in your daily brief; the pattern for in the us will emerge in the weekly recap. Don't optimise week one — just log honestly.

Avoria is not medical advice. For diagnosis or treatment, please talk to a clinician.