Skip to policy
Quenie

Quenie Consumer Health Data Privacy Policy

Last updated: 22 October 2026

Who we are and when this notice applies

Maria Santos operates Quenie and is responsible for the personal information described in this notice.

Quenie is operated from Portugal. Contact support@quenie.app for health-data questions, requests or appeals. This separate notice supplements our Privacy Policy. Applicable state-law rights depend on your location and the processing involved; the practices described here also explain what happens in the current beta.

The current TestFlight beta is for adults aged 18 or over, with explicit consent for on-device health features. The current internal build permanently removes Partner Mode and app-usage analytics. No Quenie account is required and health records are not uploaded to Quenie. Earlier installed test versions are not changed by this notice. The intended future public audience is 13+ in the United States only where the necessary conditions can be supported; that plan does not admit children to the current beta.

Health-data categories, sources and purposes

Information and source Purpose and processing
Period dates, flow, symptoms, moods, energy, notes, preferences and drafts you enter Stored on your device for history, check-ins and cycle features. A preferred name can be associated with these records. Ordinary logging does not upload the history to our server.
Phase, cycle day, period status, estimated dates/windows, patterns and discoveries inferred from entries On-device insights and predictions. These can reveal reproductive, physical or mental-health information and can be inaccurate.
Calendar events you permit Quenie to access through iOS On-device planning and overlaps with estimated periods. All available calendars may initially be included until you narrow the selection.
Text transcribed from optional voice input On-device logging; no audio recording is saved or sent away for transcription. Full transcript and extracted remarks have independent default-off retention choices.
Health details you choose to include in support, feedback, exported files or share cards Responding to your request or delivering the content you choose to send. Apple handles TestFlight feedback; support uses Zoho Mail EU. Review attachments before sending.
Consent and eligibility evidence Recording your choices, controlling access and processing withdrawal. Beta consent evidence includes your self-declared age range, declaration time and notice version; it does not require your birthday or residence for its local-only route.
Partner-service records from earlier testing Selected alerts, inferred details, labels, pairing credentials, consent scope, message identifiers and timestamps support delivery, access control and removal. The new privacy release contains no partner uploader. Earlier records may remain until removal is verified.
Analytics records from earlier testing Earlier feature-use events and pseudonymous installation metadata may imply use of reproductive-health features. The new privacy release contains no analytics collector or uploader. Earlier records may remain until removal is verified.

Quenie does not sell consumer health data or share it for targeted advertising. The app does not collect precise location to create geofences around health facilities. We do not buy health profiles from data brokers.

Choices and disclosure

Your data export and deletion remain available from the subscription screen without an active subscription. Subscription expiry does not delete your local health records. Health-processing consent is separate from terms and this notice. You may decline; health tracking stays paused. In Privacy, you can Export my records and then Delete my health records. Deletion also withdraws health-processing consent and removes the app's local health inventory and related drafts, insights, widget state and notifications. It does not erase Apple backups, exported files or copies held by recipients, or cancel Apple subscriptions.

Partner sharing and app-usage analytics have been removed from the current internal build. Upgrading removes local partner caches and queued usage events. It does not erase records previously sent to a service or copies retained by a recipient. The new app does not retry old server-removal requests. For earlier records or pending requests, contact support@quenie.app; do not include health history or live pairing codes in your initial message.

Recipients and purposes

Quenie has no affiliated companies to which it provides consumer health data. Any legally required disclosure is assessed for the specific request and applicable law; we do not promise immunity from valid legal process.

How long health information remains

Your device cycle history remains until you remove it; server schedules do not automatically erase it. Copies you export or keep in Apple backups are separate.

For partner records held on the configured service, recipient access to stale snapshots expires after 30 days from the server-recorded sender update. Alerts expire after first acknowledgment plus 24 hours or 30 days from server receipt, whichever is earlier. Pairings lose access after 90 days without authenticated sender activity. Daily cleanup removes expired rows; a sender can read their own stale snapshot until cleanup. Acknowledged revocation removes active snapshots and alerts. Server consent receipts are removed 24 months after recorded revocation; minimal identifiers remain while necessary to prevent reuse of revoked credentials. The receiving app has separate 30-day local expiry, which cannot guarantee immediate clearing while offline or erase recipient-made copies.

Analytics cleanup uses server receipt date: the receipt day and preceding 89 days remain, so delayed offline events can be older. Installation metadata expires after 90 days without uploads; deletion-prevention hashes remain 180 days.

Our support retention policy is 12 months after resolution and 24 months for minimal closed privacy-case evidence, removing unnecessary sensitive content sooner. Mailbox-wide automatic cleanup and pruning of all historical local consent receipts are not implemented as automatic guarantees. Provider logs and backups have separate handling; we do not promise every backup disappears immediately. The Privacy Policy explains these distinctions.

Your rights and requests

Where applicable, you may ask whether we process your health information; request access, correction, portability or deletion; withdraw consent; and request information about recipients. Washington rights include an applicable list of third parties and affiliates and an active contact method. We do not unlawfully discriminate against you for exercising your rights.

Email support@quenie.app with your request in your own words. No account is required. We may request proportionate information to authenticate you or a representative; do not send a health history, identity document or live pairing code initially. We cannot retrieve records stored only on your phone, but can explain the local export/deletion controls. A reading code does not authorise access to someone else's private records. If a request concerns data that is not held, we will explain that rather than create an identity link to find it.

We assess required processor and recipient deletion notifications as part of a valid request. If backup deletion must be deferred under an applicable exception, we explain the handling and comply with the relevant limit. This does not remove duties relating to copies within our control.

Applicable law Response and appeal timing
Washington Response without undue delay and within 45 days of receipt; a permitted additional 45 days requires notice. Appeal decision within 45 days of receipt.
Nevada Response without undue delay and within 45 days after authentication; a permitted additional 45 days requires notice. Covered active-record deletion and recipient notification have a separate 30-day deadline after authentication. Appeal decision within 45 days.
Connecticut Response normally within 45 days; a permitted additional 45 days requires timely notice. A reasoned appeal decision is provided within 60 days.

Other applicable laws may provide additional or shorter requirements. Requests are ordinarily free, subject only to legally permitted exceptions. Washington and Nevada statutory backup-deletion delays, where applicable, cannot exceed their six-month limits; these are not our default retention periods.

To appeal a refusal, reply to support@quenie.app asking for a privacy appeal. We review the decision and explain the result and any available regulator route. You can contact the Washington Attorney General, Nevada Attorney General or Connecticut Attorney General, as applicable. You may also raise a complaint directly with us.

Changes

We date changes to this notice and explain material changes through appropriate service notices. New data categories, purposes or disclosures requiring consent will not be authorised merely by updating this page.