Effective date: 07 October 2026

This Privacy Policy explains how nuri health LTD (“nuri”, “we”, “us”) collects, uses, shares and protects your information when you use the nuri mobile app and related services (the “Service”). nuri helps you understand your cycle, body and health patterns. Because that involves sensitive health information, we have tried to make this policy clear and specific. If you have questions, contact us at info@nurihealth.ai.

1. Who is responsible for your data

nuri health LTD, 225 Putney Bridge Road, SW15 2PX, London, is the controller of your personal information. You can reach us at info@nurihealth.ai.

2. Information we collect

Information you give us

• Account information. Your name, email address and sign-in details. If you sign in with Apple or Google, we receive the name and email address (or Apple’s private relay address) that provider shares with us. We do not receive your Apple or Google password.

• Profile and onboarding answers. Your goals, cycle details (such as period dates and cycle length), contraception, symptoms you want to understand, your typical week, sleep and wake times, meal times, training and competition schedule, and other facts you choose to add.

• Health and wellbeing logs. What you record in the app, such as periods and spotting, symptoms, mood, energy, sleep, meals, drinks, digestion, workouts, weight, screen time, lab results, hormone results and protocol tasks.

• Meal photos. If you choose to take or select a meal photo, we send a reduced copy to be read into food log fields. The photo is not stored by nuri after it is read.

• Feedback and support messages you send us through Help or by email.

Information from connected health apps and devices (with your permission)

• Apple Health (HealthKit) and Android Health Connect. If you connect them, we read data such as heart rate, resting heart rate, heart rate variability, steps, distance, floors climbed, active and total energy, workouts, sleep, blood oxygen, respiratory rate and body temperature. You choose which types to share in your device’s settings and can change this at any time. When you first connect, we may read up to 90 days of past data.

• Workout routes. Routes are read from your health app only to draw a map while you are viewing a workout. They are held in memory on your device, are not stored or synced by us, and points near the start and end are removed.

• Other wearable services you choose to connect through their own sign-in. We store the access tokens they issue in encrypted form so we can sync your data.

Information collected automatically

• Device and app information, such as device model, operating system, app version, time zone and language.

• Diagnostics. Crash reports and error information so we can fix problems. We design these reports to exclude your health data.

• Notification tokens if you allow reminders.

We do not use the Service to track you across other companies’ apps or websites, and we do not collect your precise location.

3. How we use your information

3.1 To provide the Service

We use your information to create your account, show your cycle and phase estimates, build your daily insight, patterns, protocols and body summaries, sync your data across your devices, and send reminders you ask for.

3.2 To personalise

nuri compares your data with your own past data and usual ranges so what you see is about you.

3.3 To support, secure and improve the Service

We use information to answer questions, fix bugs, prevent abuse, keep the Service secure, and understand how features are used so we can make them better.

3.4 AI features

Some features use artificial intelligence provided by OpenAI, acting as our service provider. These include reading a meal photo, writing parts of the Patterns and Protocol summaries, and similar features we may add. Before anything is sent, our app prepares a limited, summarised version of the information the feature needs, and does not send your name or email. Our provider processes it to return a result to us and is contractually restricted from using it to train its models. You can avoid photo reading by filling in meals yourself.

3.5 Research and product development

We may use de-identified or aggregated information, which cannot reasonably be linked back to you, to study how cycles, sleep, training and other factors relate, and to develop and improve our models and features. We will ask for your separate consent before using identifiable health information for research shared outside nuri.

3.6 Communications

We may send you service messages (for example about your account or changes to these terms). With your permission, we may also send product updates. You can opt out of non-essential messages at any time.

3.7 Legal reasons

We may use information to comply with law, enforce our Terms, and protect the rights and safety of you, us and others.

Legal bases (EU, UK and similar laws). We process your information to perform our contract with you, based on our legitimate interests (such as security and improvement), to meet legal obligations, and with your consent. We rely on your explicit consent to process health information, which you can withdraw at any time in the app or by contacting us.

4. Our commitments about health data

These commitments apply to your health information, including all data from Apple Health (HealthKit) and Health Connect:

• We do not sell it.

• We do not use it for advertising, marketing or to build advertising profiles, and we do not share it with advertising networks or data brokers.

• We do not share it with third parties except our service providers who help run the Service, or with your explicit permission (for example, if you choose to share a summary with a coach or clinician), or where required by law.

• We do not store HealthKit data in iCloud.

Our use of data received from Health Connect follows Google’s Health Connect permissions policy, including its Limited Use requirements.

5. How we share information

We share information only as described here:

• Service providers that process data for us under contract and only on our instructions, including cloud hosting and database (Supabase), AI processing (OpenAI), crash reporting (Sentry), sign-in (Apple, Google), and email and notification delivery. They must protect your information at least as well as this policy does.

• People you choose to share with. If you share a summary, export or report, it goes to the people you choose.

• Business transfers. If nuri is involved in a merger, acquisition, financing or sale of assets, your information may transfer to the new owner, who must continue to honour this policy for information collected under it, including section 4.

• Legal and safety. When we believe in good faith that disclosure is required by law, legal process or to protect someone’s safety. Where allowed, we will tell you about requests for your data.

• De-identified or aggregated data, which does not identify you, may be shared with research partners or others.

6. Storage, security and international transfers

Your data is stored with our hosting provider in the United Kingdom. We use encryption in transit, encryption of sensitive tokens at rest, access controls so each account can only reach its own data, and limited staff access. No system is perfectly secure, so we cannot promise absolute security, but we will notify you and regulators of a breach where the law requires.

If your information is transferred outside your country, including to the United States, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. How long we keep it

We keep your information while your account is active. When you delete your account, we delete your personal information from our active systems within 30 days and from backups within 90 days, except where we must keep some records to meet legal obligations, resolve disputes or enforce agreements. De-identified data may be kept.

8. Your choices and rights

• Delete your account and data in the app at You, Profile, Delete your data. This deletes your account and the health data linked to it.

• Access, correct or export your information by editing it in the app or contacting us.

• Disconnect health apps at any time in your device’s Health or Health Connect settings, or in the app under Devices. Data already imported stays until you delete it.

• Turn off notifications in your device settings.

• Withdraw consent for health processing by deleting your data or contacting us. This will stop the Service from working for you.

Depending on where you live (for example the EU, UK, California, Washington, Colorado or Virginia), you may have extra rights, such as to object to or restrict processing, to data portability, and to appeal a decision on your request. You can complain to your local data protection authority. Contact us at info@nurihealth.ai to make a request. We will verify your identity and respond within the time the law requires. We will not discriminate against you for using your rights.

Consumer health data (US). Washington, Nevada and some other states give extra rights over consumer health data. We collect and share it only as described in this policy, and you can use the rights above for it.

9. Children

nuri is not intended for anyone under 16. We do not knowingly collect information from children under 16, or under the age required by local law. If you believe a child has given us information, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. We will post the new version with a new effective date and, for material changes, notify you in the app or by email before they take effect. If a change would use your health data in a materially different way, we will ask for your consent first.

11. Contact

nuri health LTD, 225 Putney Bridge Road, SW15 2PX, London. Email: info@nurihealth.ai