OVARIANA®ovariana.jp website privacy policy
Version dated 22 October 2026.
1. Controller and contact
The controller is MEDAI sp. z o.o., ul. Prof. dr Mieczysława Michałowicza 12, 43-300 Bielsko-Biała, Poland; KRS 0000827308, NIP 5472217169, REGON 385526755. For privacy matters and rights requests, email privacy@ovariana.app or write to our registered address.
This policy covers the public website and contact with its publisher. Accounts, the symptom journal and payments at app.ovariana.app have a separate privacy notice. Reading the website does not require an account; it has no waitlist form.
2. Data, purposes and legal bases
Page delivery and security. Connections transmit technical data such as IP address, request time and address, browser information and response status, and may include the referring page address. Hosting and traffic protection services process these data to deliver the website, prevent abuse and diagnose errors. The basis is our legitimate interest in operating a secure website (GDPR Article 6(1)(f)).
Email contact. We process the sender's address, message and voluntarily provided data to reply and handle the matter. The basis is our legitimate interest in communication (Article 6(1)(f)), pre-contractual steps at your request (point (b)), or compliance with legal duties, including GDPR requests (point (c)). Providing data is voluntary, but we cannot reply without a reply address. Contacting us does not subscribe you to marketing. Do not send test results, medical records or health data; email is not a medical consultation service. We minimise or remove unnecessary health data while handling the matter.
Website settings. After your selection, we store appearance and contrast preferences locally to restore the settings you requested. Topic search runs on your device; website code does not send its queries to MEDAI. When you follow a link to the app, the page language and appearance mode are passed in the address to preserve these settings. See the cookies and storage notice.
Pricing country. We use available hosting or Cloudflare information about the country of the connection to display a price and currency. Page language does not determine country or currency. Current pricing has no manual country selector and does not store the country in browser storage. If we cannot determine the country or display a price, we show guidance to check the price in the app. Following a link to the app does not initiate a payment.
Statistics and performance. We use Cloudflare Web Analytics for aggregate visit and performance statistics. RUM measurement is disabled for EU visitors. Cloudflare's documentation states that this mechanism does not use cookies or browser storage for measurement and does not track people across websites. The purpose is to assess website performance; insofar as personal data are processed, the basis is Article 6(1)(f). We do not use Google Analytics, Meta Pixel or session recording tools.
3. Providers and transfers
We use LH.pl sp. z o.o. for website hosting and contact email, and Cloudflare for traffic delivery and protection and the statistics described above. Data may also be available to authorised website operators, IT support providers, advisers and legally authorised public bodies, as necessary for their tasks. We do not sell data or share them for others' marketing.
Cloudflare uses international infrastructure, which may involve processing outside the EEA, including in the USA. Its published data protection terms provide standard contractual clauses for transfers requiring these safeguards. See the Cloudflare Customer DPA and Cloudflare privacy policy. Contact MEDAI for information about safeguards applying to your data or to obtain a copy.
4. Retention
We retain ordinary support correspondence without health data for up to 24 months after closing the matter, or less if no longer needed. We minimise or remove unnecessary health data and attachments; longer retention requires a separate legal basis.
Technical-data retention depends on its purpose: handling the connection, diagnosing an error or investigating an incident, the active service and the provider's retention cycle. We do not use it to create health profiles. Necessary evidence of correspondence, complaints and data-rights requests may be retained for a statutory period or until the relevant limitation period for claims expires. You can ask the controller about retention for a particular matter.
Browser preferences remain until you change your selection or clear site data.
5. Your rights
Subject to the GDPR, you have rights of access and a copy, rectification, erasure, restriction, and objection to processing based on legitimate interests on grounds relating to your particular situation. Portability applies to automated processing based on consent or a contract. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.
Send requests to privacy@ovariana.app. We normally respond within one month and will notify you of a justified extension under the GDPR. You may complain to the Polish President of the Personal Data Protection Office (uodo.gov.pl) or another competent supervisory authority.
6. Links and changes
We do not use website data for solely automated decisions with legal or similarly significant effects or for health profiling. Links to the app and other websites lead to services with their own privacy terms. We publish the current policy and date on this page.