Privacy Policy

Ryma is a menopause health companion. It helps you understand, track and navigate your own menopause experience.

Data controller:

Ryma Health ApS
CVR 46626834
Henrikshave 58, 2950 Vedbæk, Denmark

Contact:

• General enquiries: [email protected]
• Privacy enquiries: [email protected]

If you have questions about how we handle your personal data or wish to exercise your rights under the GDPR, please contact us at [email protected]. We will respond within 30 days.

This policy explains what personal data Ryma as data controller processes when you use the Ryma app or the Ryma website (ryma.health), why we process it, who we share it with, and what rights you have.

Where Ryma is available. The app can be downloaded from app stores in a number of countries, but we currently open and support Ryma in the EU/EEA and the United Kingdom only. This policy is written for users in those markets. We do not market Ryma in the United States and Ryma is not offered as a service to consumers there.

If you are in the United Kingdom, the UK GDPR applies to our processing of your data, and you may complain to the Information Commissioner's Office as well as to the Danish Data Protection Authority. See section 6.

We take the protection of your health information seriously. What you share in the app is used to give you a better, more personalised experience in Ryma and for the purposes set out in this policy, and for nothing else. What the website records, and what it is used for, is set out in section 1.2.

1.1 When you use the Ryma app

1.1.1 When you create an account

You create your account with your mobile phone number. We send a six-digit code by SMS and you enter it in the app. This confirms that you have access to that phone number. It is not an identity check, and we do not verify your identity.

During onboarding we also process the name you give us and your language preference.

We process an email address where you give us one, for example if you write to our support address, or if you provide one in the app. The app does not ask you for an email address at the time of writing. Some accounts created through our earlier WhatsApp and web service do have an email address stored.

Legal basis: Performance of contract (Article 6(1)(b) GDPR), as processing of your personal data is necessary to provide the service.

1.1.2 When you have conversations and share information with the app

You can have conversations and share information with the Ryma app. You decide what you share with Ryma.

Ordinary personal data. Some of it we ask for during onboarding, and some of it you may choose to tell us in conversation. Realistic examples:

• your first name or the name you prefer to be called
• your age and date of birth
• who you talk to about your menopause: your doctor, your family, friends, a therapist, or nobody yet
• how it affects your daily life, for example your work, your sleep or your relationships
• your goals and concerns, written in your own words
• lifestyle factors such as smoking, alcohol, exercise and diet
• how you heard about Ryma, and which clinic you came through, if any
• your language, your preferred check-in time and your quiet hours
• your mobile phone number
• your device type, operating system version and app version, when you turn on notifications
• anything else you choose to write or say, including where you live, what you work with, your family situation, the name of your doctor or clinic, and appointments you have coming up

The conversations you have with Ryma are stored, so that Ryma can remember your history, track patterns over time and give you relevant, personalised responses. Your messages are stored as you wrote or spoke them. We do not filter or edit them. Voice notes are stored as the text they are transcribed to, and the audio file itself is kept for 30 days after transcription (see section 5); the only correction we make in the text is the spelling of the name Ryma when it has been misheard.

Health data. Ryma's core purpose is to help you track and understand your menopause experience. To do that, we also process the health information you share with us. This can include:

• your menopause stage and related symptoms, for example hot flushes, sleep, mood and brain fog
• hormone replacement therapy (HRT) or other medication and supplements you use, including dose and how long you have been on it
• surgical or medical history you choose to share
• family history of illness, including breast cancer, cardiovascular disease and osteoporosis. Note that this is information about your relatives, not about you. Only share it if you consider it appropriate to do so.
• lifestyle factors, goals and concerns you tell us about
• voice notes and their transcripts, when you record a voice message in the app
• photos or images you choose to send, for example of a medication label
• your answers to the Menopause Rating Scale and other structured questions
• symptoms, appointments and actions that Ryma derives from your conversations, including short notes written in your own words

We only process your health data with your explicit consent, which you are asked to provide when you first use the app. The consent reads: "Yes, I give my consent for Ryma to process the health information I share in the app, so I can follow my symptoms, gain insight through reports, and share them with my doctor or a clinic." You can withdraw this consent at any time. See "Your rights" below.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR) for processing of ordinary personal data, and performance of a contract and explicit consent (Article 9(2)(a) GDPR) for processing of your health information.

1.1.3 If you connect Apple Health

You can choose to connect Ryma to Apple Health. If you do, we process the health measurements you release to us, which may include sleep duration and awakenings, wrist temperature change, respiratory rate, resting heart rate, heart rate variability, and cycle and flow data. We record when you gave that consent and the wording you agreed to. You can disconnect at any time in the app. Disconnecting also deletes the measurements we had received from Apple Health; what remains is the record that you connected and later disconnected.

If you do not connect Apple Health, none of this data reaches us.

Legal basis: Explicit consent (Article 9(2)(a) GDPR) and performance of a contract (Article 6(1)(b) GDPR).

1.1.4 Your notification preferences

If you allow push notifications, we store a notification token for your device so we can send you scheduled check-in reminders, together with your device platform, operating system version and app version. What is sent through Apple contains no health information: a generic reminder text ("You have a message from Ryma") and two random reference numbers. Once the notification reaches your phone, the app uses the reference to fetch the actual text directly from us, so the words you read never pass through Apple. That text is the reminder or check-in question itself, for example the name and time of an appointment you asked Ryma to remind you of, or a question about how your week has been. Like any notification, it can be read on your lock screen by whoever is looking at your phone; you decide in your iPhone's notification settings whether previews are shown on the lock screen.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR). Our legitimate interest is supporting user engagement with the app by delivering timely reminders that help Ryma users maintain their chosen check-in routine.

1.1.5 Session, service and security data

Our own application code does not log your IP address.

However, the sign-in and session service we use (Supabase Auth) records, for each session, your IP address, the user agent your device sends, and your app build and operating system version, linked to your user account. This is how a session is kept alive and how sign-in abuse can be detected. An example of what a user agent string looks like: Ryma/27 CFNetwork/3860.600.12 Darwin/25.5.0.

We also record sign-in events, and our hosting and CDN providers keep short-lived server logs in the ordinary course of operating the service.

How long we keep it. Session records are deleted automatically 90 days after the session is created. The routine has been running since 8 September 2026. We do not use any of this data for profiling.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR). We have a legitimate interest in ensuring an appropriate level of security for the service, its users and the personal data processed through it.

1.1.6 If you link your account to a partner clinic

If you have received an access code from a clinic, you can enter it in the app. Entering the code links your account to that clinic. It does not share anything.

Sharing is a separate decision that you make on the Deling med din klinik (Sharing with your clinic) screen in the app. Until you actively say yes there, the clinic sees nothing about you.

If you do say yes, the clinic can see:

• the symptoms you register, including severity, when they occurred, and short notes in your own words, which Ryma writes from what you have told it. Your five most recent notes are shown on your page in the clinic portal.
• your treatment: what you are taking, the dose, and how long you have been on it
• your Menopause Rating Scale scores
• your age and the health context you gave at onboarding
• consultations recorded with that clinic
• the questions Ryma has prepared for you to bring to your doctor
• your name

The clinic never sees your conversations with Ryma, neither what you write nor what Ryma replies.

You can withdraw sharing at any time on the same screen, with immediate effect and with no change to your access to Ryma. Every grant and every withdrawal is recorded with a time stamp.

Legal basis: Explicit consent (Article 9(2)(a) GDPR) and consent (Article 6(1)(a) GDPR).

1.1.7 Analytics and crash reporting in the app

The Ryma app contains no analytics SDK, no advertising SDK, no tracking tool and no crash-reporting tool. We do not operate crash or performance monitoring inside the app, and no third-party analytics provider receives data from the app.

If you have turned on sharing with app developers in your device settings (Settings → Privacy & Security → Analytics & Improvements → Share With App Developers), Apple collects crash and performance diagnostics from your device under Apple's own terms and shows them to us in aggregated form in App Store Connect and Xcode. Apple is the controller for that collection. Ryma receives aggregated figures only and nothing that identifies you. Sources: Apple's "App Analytics & Privacy" (https://www.apple.com/legal/privacy/data/en/app-analytics/) and Apple's documentation on crash reports (https://developer.apple.com/documentation/xcode/acquiring-crash-reports-and-diagnostic-logs), both checked 14 September 2026.

1.2 When you use our website (ryma.health)

1.2.1 Cookies and similar technologies

This section is accurate as at 21 September 2026.

Before you choose. When you arrive on ryma.health, no cookies are set and no analytics or advertising tools load. You are shown a cookie dialogue that you have to answer before you can use the site (except in the clinic portal, see below). It shows three categories: Necessary, which is always on and cannot be switched off, and Statistics and Marketing, each of which you can accept or decline. You can choose Necessary only, Accept all, or tick the boxes yourself and press Save my choice.

One thing does happen before you choose: we record anonymously with our statistics provider, PostHog (EU Cloud, Germany), that the dialogue was shown, and afterwards whether you accepted all categories or not. This is the only thing sent to PostHog before you choose; ordinary statistics start only after you accept them. The event carries a random number that exists only in your browser's memory while the dialogue is open, is never stored, and cannot be linked to you or to a later visit. Besides your choice it contains the page address and any campaign parameters from the link you arrived through. No cookie is set and no profile is created. We do this only to know how many people accept.

Cookies we set

The durations of the statistics and marketing cookies are the vendors' own defaults, not values we set ourselves. Checked 14 September 2026: the PostHog cookie expires after 365 days according to PostHog's documentation (https://posthog.com/docs/libraries/js/persistence). _fbp has a lifespan of 90 days according to Meta's own cookie description (https://www.meta.com/help/quest/681948573016913/), and _fbc is set with a 90-day expiry according to Meta's developer documentation (https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc/).

We also store two things in your browser's local storage rather than in a cookie: your choice in the cookie dialogue with its time stamp (key ryma-consent), and PostHog's own share of its identifiers.

What our statistics tool records. Our statistics provider is PostHog, on their EU Cloud in Germany, reached through our own domain so that its cookie is a first-party cookie. On our project today:

• Session recording is enabled only if you have accepted statistics, and it is masked: all text and all input fields are hidden in the recording, so what you type cannot be read.
• No recording takes place on the pages behind sign-in (your overview and the pages under it), nor on the sign-in page, during sign-up, on your data page, on a report you open from a link, or in the clinic portal. The public pages, such as the front page and the blog, can be recorded if you have accepted statistics, whether or not you are signed in.
• Browser console logs are not captured.
• When you are signed in on the web, your activity is tied to your Ryma user id, but not to your email address.
• Recordings are deleted automatically after 30 days.

What our advertising tool records. The Meta Pixel loads only after you have accepted marketing. It loads Meta's script, registers a page view on each page you open, and sends that event, together with the identifiers above and your IP address, to Meta Platforms, Inc. in the United States. This is advertising and measurement across sites.

Joint controllership with Meta. For the collection of event data on ryma.health and its transmission to Meta, Ryma Health ApS and Meta Platforms Ireland Limited are joint controllers under Article 26 pursuant to Meta's "Controller Addendum", which forms part of the Meta Business Tools Terms. Meta is the sole controller for its subsequent processing of the data. The essence of the arrangement is: Ryma and Meta Ireland have allocated the responsibilities for the joint processing between them; Ryma is responsible for providing you with this information; Meta Ireland is responsible for enabling your rights under Articles 15 to 20 with regard to the data Meta stores after the joint processing, and you can exercise them directly against Meta Ireland. The arrangement is available at https://www.facebook.com/legal/controller_addendum, and information about Meta's processing, Meta's legal basis and your rights against Meta is in Meta's Privacy Policy at https://www.facebook.com/about/privacy (both checked 14 September 2026). Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (status "Active, re-certification under review", checked on dataprivacyframework.gov on 14 September 2026).

The app and the clinic portal. The Ryma app sets no cookies at all. It is a native app that authenticates with a token, not with cookies. The clinic portal at ryma.health/klinik does not show the cookie dialogue. If you have not answered it elsewhere on ryma.health, no statistics or advertising tools load in the portal and only the session cookie is set. If you have accepted statistics or marketing on ryma.health, your choice applies in the clinic portal too, without session recording, and you can change it via Cookies at the bottom of the page.

Legal basis.

• Strictly necessary cookies: stored without consent under the Danish Cookie Order, because they are necessary to deliver the service you have asked for. The associated processing of personal data rests on our legitimate interest in operating and securing the service (Article 6(1)(f) GDPR).
• Statistics and marketing cookies: stored and read only with your consent under the Danish Cookie Order. The associated processing of personal data rests on your consent (Article 6(1)(a) GDPR).

How to change your choice or withdraw your consent. Press Cookies at the bottom of the page. The dialogue opens again with your current choice, and you can change it at any time. If you decline a category you had previously accepted, we remove that provider's cookies and local storage from your browser at once, and the provider is not loaded again. Withdrawing does not delete statistics already collected. To ask us to delete data already collected about you, write to [email protected].

1.3 When you contact support

If you contact us by email, we process the information you provide to us. We use it only to respond to your enquiry and to debug the relevant issues. Our support mailboxes are hosted on Google Workspace. Enquiries to [email protected] and [email protected] are deleted 30 days after the enquiry is closed. See section 5.

If you use the support link inside the app, your Ryma user id is filled into the message for you, so that we can find your account and answer you properly. You can delete it before sending.

Legal basis, split by what we do with it:

• Answering an enquiry about your own use of Ryma (your account, a fault, a request about your data): performance of contract (Article 6(1)(b) GDPR), because handling it is part of delivering the service you have with us.
• Answering a general enquiry from someone who is not a user, and investigating and fixing the underlying technical fault: legitimate interests (Article 6(1)(f) GDPR). Our legitimate interest is being able to respond to people who contact us and to keep the service working correctly.
• Any health information you choose to include in your message: explicit consent (Article 9(2)(a) GDPR). You decide whether to include it. We do not need it in order to answer you.

1.4 Research and improvement of Ryma

One question covers both. When you start using the app, we ask you one question: "May Ryma use your information in anonymised form for research in women's health and to make Ryma better?" Under the question it says: "It matters to Ryma to contribute anonymous data to research in women's health, so we can build a better basis for treatment for all women. It can never be traced back to you, and Ryma works the same way whatever you answer." You answer yes or no, and your answer is recorded with a time stamp. Saying no changes nothing about how Ryma works for you, and you can change your answer at any time in the app under Profil → Data og privatliv (Profile → Data and privacy).

Your health data. Anonymising your health data is itself a processing of that data. We therefore only anonymise your health data, for research in women's health and to make Ryma better, if you have answered yes to the question above. Only the anonymised data, which cannot be traced back to you, is used for research and improvement.

Legal basis: Explicit consent (Article 9(2)(a) GDPR) and consent (Article 6(1)(a) GDPR) for the anonymisation of your health data. You can withdraw the consent at any time under Profil → Data og privatliv. See section 6.

Ordinary personal data. Anonymised data about your use of the Ryma app that is not health data is used to improve the AI assistant and the app.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) for the processing and anonymisation of your ordinary personal data, as we have a legitimate interest in improving and developing the Ryma app, including to enhance functionality, optimise performance, improve the user experience and support the development of new features.

1.5 If you use the clinic portal as a clinician

If you work at a partner clinic and use the Ryma clinic portal, we process your login credentials and, for each sign-in attempt and each patient record you open, your IP address, the time, and which record you opened. This is an access log. It exists so that a woman can be told who looked at her data.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR). Our legitimate interest, and the clinic's, is being able to demonstrate who accessed health data and when.

How long: access-log entries are deleted after 730 days (two years). Failed login attempts are deleted after 24 hours.

Ryma uses artificial intelligence to generate personalised responses. When you send a message, your conversation history and health profile are sent securely to an AI language model (provided by Anthropic or OpenAI, see section 3) to generate a reply.

What this means in practice:

• The health information you share with the app is included in the request sent to the AI provider.
• Each request includes a summary of your profile: your name, age, menopause stage, symptoms, how it affects your daily life, who you talk to about it, your treatment and dose, how long you have been on it, other medication and supplements, your goal in your own words, your check-in preferences, your language, and when you joined.
• Each request also includes up to your last 200 messages, so that Ryma has your history. If you used Ryma on WhatsApp or iMessage before, those older messages are part of that history.
• Anthropic is our primary provider. OpenAI is the automatic fallback: if the request to Anthropic fails for any reason, the same content is sent to OpenAI instead. Both are established in the United States. See section 4.
• Voice notes are sent as audio to Speechmatics for transcription.
• AI providers process this data as data processors on our behalf. The prohibition on using your data to train their models is stated in the providers' commercial terms: Anthropic's Commercial Terms of Service, section B ("Anthropic may not train models on Customer Content from Services", https://www.anthropic.com/legal/commercial-terms), and OpenAI's Services Agreement, section 4.2 (OpenAI will not use customer content to develop or improve its services unless the customer explicitly agrees, https://openai.com/policies/services-agreement/) together with OpenAI's API data policy (data sent to the API is not used for training unless you explicitly opt in, https://developers.openai.com/api/docs/guides/your-data). All three checked 14 September 2026. Our contracting parties are Anthropic Ireland, Limited and OpenAI Ireland Ltd, the entities that contract with customers in the EEA.
• Zero data retention is a target, not yet a fact. We are working to enable "zero data retention" settings with both providers, which would mean they do not store your data after generating a response. This is not enabled today. We will update this policy when it is.
• We do not use your data for automated individual decision-making or profiling in a way that produces legal or similarly significant effects on you. Article 22 GDPR does not apply to Ryma's current use of AI.

We do not sell your personal data. We do not share it with third parties for their own marketing purposes, with one exception: the Meta Pixel on our website. It runs only if you accept marketing cookies, and Meta also uses what it receives for its own purposes, as described in section 1.2.1.

We use the following third-party service providers who process personal data on our behalf. Each is contractually bound to process your data only as we instruct and to implement appropriate security measures. The one row that is not a processor is Meta: for the pixel data, Meta is a joint controller with us for the collection and transmission and the sole controller for what it does with the data afterwards, see section 1.2.1. The table covers the tools the app and the website use today.

We may disclose personal data to authorities if required to do so by law.

Your primary data is stored in the EU. Our database, file storage and backend hosting run in EU data centres in Frankfurt, and our statistics provider runs on EU infrastructure in Germany.

Transfers out of the EU/EEA nevertheless happen, and you should know where:

• Every message you send goes to an AI provider in the United States, because that is where Anthropic and OpenAI process it. This includes health data.
• Voice notes are processed by Speechmatics, a UK company, in Speechmatics' EU region, for transcription.
• Push notifications are delivered through Apple. Apple receives a device token, a generic reminder text with no health information, and two random reference numbers, see section 1.1.4.
• Your one-time sign-in code is delivered by Twilio in the United States.
• If you accept marketing cookies on our website, the Meta Pixel sends your page views to Meta in the United States.
• Our content delivery network, Cloudflare, operates a global edge network.

These transfers rest on one or more of the following:

• The European Commission's adequacy decision for the United Kingdom (renewed 19 December 2025, valid until 27 December 2031), for Speechmatics' own access as a UK company.
• The EU-US Data Privacy Framework (DPF), where the US provider is certified. As at 14 September 2026 this is the case for Render, Cloudflare, Twilio, PostHog, Google, Meta and Brevo's US group entity.
• Standard Contractual Clauses, together with a transfer impact assessment, for providers that are not DPF certified. As at 14 September 2026 this applies to Anthropic, OpenAI, Supabase and Brevo's Indian group entity. The Standard Contractual Clauses are incorporated in the four providers' public data processing agreements, see section 3.
• Apple: Apple publishes no separate transfer mechanism for the push service. What Apple receives from us is a device token, a generic reminder text with no health information and two random reference numbers, see sections 1.1.4 and 3.

The transfer mechanism has been checked for every provider in the provider's public agreements, and our transfer impact assessments for the providers outside the EU/EEA were documented internally on 14 September 2026. We review them again when a provider changes its terms, and at the latest after one year.

You have the right to obtain a copy of the relevant transfer safeguards by contacting us at [email protected].

We delete your information when it is no longer necessary for the purpose or purposes for which the information was collected and processed.

Your account information is stored for as long as you are active and is deleted within 30 days of account deletion.

Bookkeeping material is deleted 5 years from the end of the financial year to which such material relates.

Beyond that, these are the specific periods that apply:

Where this table says a period is not yet enforced automatically, that is a commitment we are implementing, and we have said so rather than describing it as something that already happens.

Under the GDPR, and under the UK GDPR if you are in the United Kingdom, you have the following rights in relation to your personal data. You can exercise any of them by contacting us at [email protected]. We will respond within 30 days.

• Right of access (Article 15). You can ask us for a copy of the personal data we hold about you. You can also get this yourself in the app, under Profil → Data og privatliv → Få en kopi af mine data (Profile → Data and privacy → Get a copy of my data).
• Right to rectification (Article 16). You can ask us to correct inaccurate data.
• Right to erasure (Article 17). You can with certain limitations ask us to delete your account and all associated personal data. You can do this yourself in the app, under Profil → Data og privatliv. Deletion is immediate and there is no undo.
• Right to restriction of processing (Article 18). In certain circumstances, you can ask us to pause processing your data while a dispute is resolved.
• Right to data portability (Article 20). You can ask for a copy of your data in a commonly used, machine-readable format. The export in the app is in that format.
• Right to object (Article 21). You can object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds.
• Right to withdraw consent (Article 7(3)). Where processing is based on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing before withdrawal. See the table below.
• Right to lodge a complaint. If you believe we are not handling your data correctly, you can complain to a supervisory authority. See below.

What survives an erasure, and why. So that you know exactly what "with certain limitations" means:

• A pseudonymised minimal record of your account is kept. Your name, phone number, email, and all health and behavioural data are removed. What remains is the account's technical id, the dates it was created, last changed and deleted, the clinic that covered your account if any, whether you had given research consent and when, and your language, preferred channel, quiet hours and a flag showing whether it was a test account. The record exists so that we can settle with the clinic that paid for the seat and reconcile a research extract. Legal basis: legitimate interests (Article 6(1)(f) GDPR) in settling correctly with clinics and reconciling research extracts. How long: at most 5 years from the end of the financial year in which the account was deleted, matching the period for bookkeeping material.
• The clinic access log is kept for 730 days, as described in section 1.5, so that the record of who looked at health data survives the deletion of the account.
• The consent ledger, recording that a consent was given or withdrawn and when, is kept for 3 years after the deletion of the account, because it is our evidence that the processing was lawful. See section 5.

How to withdraw a consent in practice:

Complaining to a supervisory authority:

• Denmark: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk, [email protected], +45 33 19 32 00.
• United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, www.ico.org.uk.
• You can also complain to the supervisory authority in the EU/EEA country where you live or work.

We take the security of your health data seriously. Key measures include:

• All data in transit is encrypted using TLS.
• All data at rest is encrypted at the storage layer, in our EU database.
• Our database uses row-level security policies, so that you, signed in as a user, can only reach your own data. A clinic reaches your record only through the clinic portal, and only if you have actively said yes there (next point).
• Access to our production systems is restricted to a small number of authorised team members.
• The clinic portal logs every access to a patient record, and a clinic can only see women who have actively said yes.
• We are working to enable zero-data-retention settings with our AI providers. See section 2 for the current status.

If you discover a security vulnerability, please contact us immediately at [email protected].

We will notify you of material changes to this policy via email or an in-app notification before the changes take effect. The date at the top of this document shows when it was last updated.

• Privacy enquiries: [email protected]
• General enquiries: [email protected]
• Postal address: Ryma Health ApS, Henrikshave 58, 2950 Vedbæk, Denmark

Supervisory authorities:

Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, www.ico.org.uk