Privacy Policy

Introduction

Muna is committed to protecting your privacy and safeguarding your personal and health-related information. This Privacy Policy aligns with applicable privacy laws and explains how we collect, use, store, and protect your information when you use our website or app. We design our practices with consideration for privacy and security standards, including health-related regulations, to protect your sensitive data. By accessing or using our services, you signify that you have read, understood and agree to our collection, storage, use and disclosure of your information, as applicable, as described in this Privacy Policy, the Website's Terms and Conditions and/or Terms of Use.

Information We Collect

We treat reproductive health information, menstrual cycle data, symptom information, fertility information, and similar health-related issues as sensitive personal information. We may collect:

• Period dates, ovulation predictions, symptoms, notes, and activity logs
• Account information including name, email, username, password, and profile details
• Payment information processed securely through third-party providers
• Messages, inquiries, or support requests you send to us
• AI Journal entries: free-text journal entries and chat messages you enter into the AI Journal feature, including any symptoms, mood, or energy levels you describe in your own words
• Optional condition information: if you choose to tell us you have PMDD, PCOS, or another condition affecting your cycle
• Technical and device information: such as your IP address, browser type, device type and operating system, and app diagnostic or usage data, collected automatically when you access our website or app
• Aggregated or de-identified information derived from the categories above, which does not on its own identify you

We only collect information necessary to provide and improve our services.

How do we collect your data?

You directly provide us with most of the data we collect. We collect and process data when you:

• Access this Site
• Register online or create an account on our Site
• Place an order for any of our products or services
• Voluntarily complete a customer survey or provide feedback on any of our message boards or via email

How We Use Your Information

We use your information to:

• Provide and improve app functionality including cycle tracking and insights
• Communicate with you about updates, support, and optional marketing emails
• Process payments and subscriptions
• Maintain security and comply with applicable legal obligations
• Monitor, maintain, and improve the security, reliability, and performance of our website and app, using the technical and device information described above
• Power the AI Journal feature: your journal and chat entries are used to log symptoms, compare your reported mood and energy against research-informed expectations for your current cycle phase, and generate personalized, non-diagnostic suggestions such as food, movement, or task-planning ideas

If you've told us about a condition (PMDD, PCOS, etc.), AI Journal recommendations are scoped to that condition. If you haven't, Muna defaults to assuming typical PMS patterns. The AI Journal never diagnoses you. If your logged symptoms show a pattern that doesn't match what you've told us, Muna may suggest you talk to a healthcare provider, but it will not tell you that you have a specific condition. The AI Journal is optional; you can log symptoms and tasks manually at any time without using it.

Important: Muna provides informational insights only and does not offer medical advice. Users should consult a licensed healthcare professional for medical concerns.

Data Sharing and Third-Party Services

Muna does not sell your personal data. We do not share your health information with advertisers. We do not use your cycle data for targeted advertising.

Analytics Services

We use Google Analytics 4 (Google LLC) and Mixpanel (Mixpanel, Inc.) to understand how people use Muna so we can improve the product.

Google Analytics receives only page paths (e.g. /dashboard), never your name, email, or health data.

Mixpanel receives anonymised health patterns, such as which symptoms were logged, their severity, your energy level, and your current cycle phase, linked to a random internal user ID. This helps us understand, for example, which symptoms are most common in each phase and where to focus product improvements. Your name, email address, cycle dates, and any directly identifying information are never sent to Mixpanel. This data cannot be used to identify you as an individual.

Page URLs sent to either service contain only the path and never include query parameters or authentication tokens. You can opt out of Mixpanel data collection at any time by contacting us at privacy@usemuna.com. Google Analytics data can be blocked using the Google Analytics Opt-out Browser Add-on.

How do we store your data?

We take precautions to protect your information. When you submit sensitive information via the Website, your information is protected both online and offline according to generally accepted industry standards. Wherever we collect sensitive information (such as credit card data), that information is encrypted and transmitted to us in a secure way.

Only employees who need the information to perform a specific job (for example, billing or customer service) are granted access to Personal Information data. The computers/servers in which we store Personal Information data are kept in a secure environment.

No method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security. If you have questions about security on our Website, contact us at privacy@usemuna.com.

What are your data protection rights?

Every user is entitled to the following:

• The right to access: You have the right to request copies of your personal data.
• The right to rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• The right to erasure: You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The right to object to processing: You have the right to object to us processing your personal data, under certain conditions.
• The right to data portability: You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.
• The right to opt-out: You may opt out at any time where we are relying on consent to process your Personal Information. If you withdraw your consent, we may not be able to provide certain products or services to you.

If you would like to exercise any of these rights, please contact us at privacy@usemuna.com. We have one month to respond to your request.

Calendar Integrations

If you choose to connect Google Calendar, Outlook, or Apple Calendar, Muna writes cycle phase labels and optionally reminder events to your chosen calendar. This data transfer occurs on your behalf, under your calendar account's own privacy settings. We do not read the contents of your calendar beyond confirming that sync events were written. You can disconnect any calendar integration at any time from Profile > Calendar Connections.

Cloud Infrastructure and Data Storage

Your data is stored with Base44, our application platform provider, which encrypts data in transit and at rest. We take reasonable steps to ensure all third-party providers handle your data responsibly.

AI Journal Processing

Journal and chat entries you submit to the AI Journal feature are processed by Claude, an AI model from Anthropic, accessed through Base44's LLM integration layer. Interactions with this feature are also logged for quality and reliability purposes through Langfuse, a logging service. Your data is never used to train any AI model. This is contractually prohibited under Base44's data processing agreements with its sub-processors, which permit use of personal data only to provide the service or in anonymised/aggregated form.

If something you share in the AI Journal suggests you may be in crisis or having thoughts of self-harm, the feature is designed to recognize this and respond with crisis-resource information rather than a general wellness suggestion.

AI-generated responses may occasionally be inaccurate, incomplete, or inappropriate. Users should independently evaluate any suggestions and should not rely upon AI-generated content for medical, psychological, or emergency decision making.

Cookies

A “cookie” is a small text file that is downloaded onto your device when you access our Website. Our website may use cookies and similar technologies (such as local storage) to keep the site secure, remember your preferences, and understand aggregate site usage. We do not use cookies to serve third-party advertising, and we do not sell information collected through cookies. You can stop your browser from accepting cookies by configuring your browser's cookie settings. If you choose to disable cookies, you may face limitations on functionality and a deteriorated user experience.

Data Security

Muna is a direct-to-consumer app, not a healthcare provider, health insurer, or healthcare clearinghouse. This means HIPAA does not legally apply to us. The same is true of most consumer wellness and period-tracking apps.

Rather than relying on a legal obligation we do not have, we have chosen to implement protections that exceed what most consumer apps offer because we believe your reproductive health data deserves better than the legal minimum:

• Optional client-side encryption: your period dates and symptoms can be encrypted on your device before being stored, so not even Muna can read them without your passphrase
• Encryption of data in transit and at rest
• No health data sent to advertising platforms or data brokers
• Anonymised-only health patterns sent to analytics, linked to a random ID not your identity
• Full data deletion available instantly from within the app
• Consent timestamped and recorded at sign-up
• Global Privacy Control (GPC) signals honoured

If we become aware of a security incident affecting your personal information, we will investigate promptly and provide any notices required under applicable law.

To ask about your data or request deletion, contact: privacy@usemuna.com

Marketing & Communications

We may send newsletters, updates, or promotional emails. You can unsubscribe at any time. Opting out of marketing does not affect core service functionality.

Protecting the Privacy of Children

Persons under 18 years old are not the target audience for our Website. No one under age 18 may provide any Personal Information to or on the Website. We do not knowingly collect Personal Information from children under 18. If we learn we have collected or received Personal Information from a child under 18 without verification of parental consent, we will delete that information.

If you believe we might have any information from or about a child under 18, please contact us at privacy@usemuna.com.

U.S. State Privacy Rights

Applicability

Residents of certain U.S. states are entitled to specific privacy rights under applicable state privacy laws, including:

• California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA)
• Colorado Privacy Act
• Connecticut Data Privacy Act
• Delaware Personal Data Privacy Act
• Indiana Consumer Data Protection Act
• Iowa Consumer Data Protection Act
• Kentucky Consumer Data Protection Act
• Maryland Online Data Privacy Act
• Minnesota Consumer Data Privacy Act
• Montana Consumer Data Privacy Act
• Nebraska Data Privacy Act
• New Hampshire Privacy Act
• New Jersey Data Privacy Act
• Oregon Consumer Privacy Act
• Rhode Island Data Transparency and Privacy Protection Act
• Tennessee Information Protection Act
• Texas Data Privacy and Security Act
• Utah Consumer Privacy Act
• Virginia Consumer Data Protection Act

As additional state privacy laws become effective, Muna intends to honor applicable consumer rights in accordance with those laws without requiring material revisions to this Privacy Policy.

Your Privacy Rights

Subject to applicable law, you may have the right to:

• Right to Know: Request information regarding the categories of Personal Information collected, the purposes for processing, the categories of third parties receiving your information, and the sources from which Personal Information was obtained.
• Right of Access: Request access to the Personal Information we maintain concerning you.
• Right to Correct: Request correction of inaccurate Personal Information.
• Right to Delete: Request deletion of Personal Information or Consumer Health Data that we maintain, subject to exceptions permitted by law.
• Right to Data Portability: Receive certain Personal Information in a portable, machine-readable format where required by applicable law.
• Right to Opt Out: Where applicable, you may opt out of sale of Personal Information, targeted advertising, and profiling in furtherance of decisions producing legal or similarly significant effects. Muna does not sell Consumer Health Data or reproductive health information.
• Right to Withdraw Consent: Where processing is based upon your consent, you may withdraw that consent at any time.
• Right to Limit Sensitive Personal Information: Where applicable, you may request limitations on our processing of Sensitive Personal Information beyond that reasonably necessary to provide the Services.
• Right to Appeal: If we deny your request, you may appeal our decision where applicable law provides that right.

Universal Opt-Out Preference Signals

Where required by applicable law, Muna recognizes legally valid Universal Opt-Out Preference Signals, including Global Privacy Control (GPC), as requests to opt out of processing activities covered by applicable state privacy laws. We do not require users to create an account solely to exercise legally protected opt-out rights.

Sensitive Personal Information

Because Muna processes reproductive health information and other Consumer Health Data, we obtain affirmative consent whenever required by applicable law before collecting or processing sensitive information. We do not process Sensitive Personal Information for purposes materially inconsistent with those disclosed in this Privacy Policy without first providing any required notice and obtaining any legally required consent.

Exercising Your Rights

You may exercise your privacy rights by:

• Using available controls within the Muna application
• Submitting a request through your account settings
• Emailing us at privacy@usemuna.com

To protect your privacy, we may verify your identity before responding.

Authorized Agents

Where permitted by law, an authorized agent may submit requests on your behalf. We may require proof of the agent's authority, verification of your identity, and confirmation that the request was authorized.

Response Time

We will acknowledge and respond to verified requests within the time periods required by applicable law. Where an extension is permitted, we will notify you of the reason for the extension.

Non-Discrimination

We will not discriminate against you for exercising any privacy rights granted under applicable law. However, certain features of the Services may become unavailable if the requested processing is necessary to provide those features.

California Residents

California residents may also have rights under California's “Shine the Light” law regarding disclosures of Personal Information for direct marketing purposes. California residents may contact us using the information below to exercise those rights.

Nevada Residents

Nevada residents may request to opt out of certain sales of covered information as provided by Nevada law. Although Muna does not currently sell Personal Information as defined under Nevada law, Nevada residents may submit requests using the contact information below.

Contact for U.S. Privacy Requests

Email: privacy@usemuna.com

Mail: Diamond Simpson, 3000 S. Hulen Street, Ste 124 #1333, Fort Worth, TX 76109

European Union: GDPR

Additional provisions apply to Personal Information collected by Muna from European Union residents. You may access, update, delete or request we cease the use of your Personal Information for marketing purposes by contacting us at privacy@usemuna.com. Exceptions may apply for data maintained:

• Pursuant to any legal or contractual obligation
• In relation to resolving, defending or enforcing our rights
• For accurate business and financial reporting

Any questions concerning our GDPR policies may be directed to privacy@usemuna.com. Requests must include “GDPR Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and postcode.

International Data Transfers

Your information may be processed in countries outside your own. Where personal information is transferred internationally, we implement appropriate safeguards, including contractual protections where required by applicable law.

Payments

Payments are processed securely through third-party providers. We do not store full payment details.

Limitation of Liability

Muna does not guarantee specific results. We are not responsible for medical decisions made based on app insights. We are not liable for indirect losses including data loss or service interruptions.

The AI Journal provides informational, non-diagnostic suggestions only. It is not a substitute for professional medical, psychiatric, or psychological care. If you are experiencing a medical or mental health emergency, including thoughts of self-harm, contact 911 or the 988 Suicide & Crisis Lifeline (call or text 988) immediately. Do not rely on the app in an emergency.

Policy Updates

We may update this Privacy Policy from time to time. The updated version will be reflected by the revised effective date.

Contact

If you have any questions about Muna's Privacy Policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.

Founder: Diamond Simpson
Email: privacy@usemuna.com