LANNAHEALTH

Your Data, Your Control

Privacy Policy

Olanna Health respects your privacy and is committed to protecting your personal information.

Olanna Health (Pty) Ltd
Last updated: 13 July 2026

1. How Olanna values data privacy

At Olanna, we believe technology gives women and people with cycles a powerful way to understand what's happening in their bodies — through their own tracked data. The Olanna app helps you read your cycle, symptoms, and moods with clarity, so you can advocate for your own health.

We also recognize the responsibility that comes with holding such intimate data. Keeping it safe is core to everything we do. Olanna is not currently monetized — we do not run ads, we do not use Google Ads or any advertising network, and we do not have a paid subscription tier at this time. This policy will be updated if that changes, and you will be notified.

We aim to be clear and specific about what we do with your data, even though the digital ecosystem behind an app is never entirely simple. To provide the service, we rely on a small number of third-party providers, described below.

Please read this policy in full. If you have questions, contact us at admin@olanna.health.

2. The types of data we process

Olanna does not require account registration or sign-in. There is no username, password, or login of any kind — you can start using the app immediately. Because of this, we do not process account data (no email address is required to use the app, and none is collected unless you choose to email us directly).

We process two types of data:

Device and usage data: Information about the device you use to access the app (device model, operating system, app version, crash reports) and a device-generated identifier used only to associate optional server-side features with your device (see Section 3). On the website, we collect anonymous page-view counts and, only if you opt in, Google Analytics usage data (pages viewed, approximate location, device type). We do not collect precise location data anywhere.

Health data: Health and cycle-related information you choose to track in the app, including cycle dates and patterns, daily symptom logs, moods and energy levels, health goals you select during setup, and product safety logs if you use that feature. We only process the health data you actively choose to enter — there are no automatic imports or third-party health integrations at this time.

3. How and why we process your data

3.1 To provide our core service

To provide the app's core functionality, we process:

  • Health data — processed and stored locally on your device (encrypted via iOS Keychain / Android Keystore) whenever you track cycle dates, symptoms, moods, or goals, so the app can show you phase insights and patterns.
  • Device and usage data — processed to keep the app running correctly and to fix bugs (crash reports, app version).

Third party providers: None for this purpose. Core tracking happens entirely on-device; we do not send this data to any server or third party.

Legal basis:Processing of your health data for this purpose relies on your explicit consent under section 27 of South Africa's Protection of Personal Information Act (POPIA) (and, where applicable, Article 9(2)(a) GDPR). You give this consent during app setup:

I agree to Olanna processing the health data I track in the app, stored locally on my device, so it can provide cycle and symptom insights.

You can withdraw this consent at any time by deleting your local data or uninstalling the app.

3.2 Partner Mode (opt-in)

If you choose to enable Partner Mode, a limited cycle snapshot — not your full tracked data — is shared with a partner you invite, via our server. You choose exactly what is included, and you can revoke access at any time.

Third party providers: Replit, Inc. (on Google Cloud infrastructure, United States) hosts the server infrastructure that relays this snapshot.

Legal basis: Your explicit consent under POPIA s27 / GDPR Art 9(2)(a):

I agree to a limited snapshot of my cycle data being shared with the partner I choose to invite, via Olanna's server, until I revoke access.

Invite codes expire after 24 hours. Partner snapshots are retained only while sharing is active and are deleted within 30 days of revocation. All partner actions are logged for your review.

3.3 Product Safety Logs (opt-in)

If you use this feature, product names, dates, and reactions you log are stored on our server, associated with your device identifier (not your name or any other identifying detail).

Third party providers: Replit, Inc. (on Google Cloud infrastructure, United States).

Legal basis: Your explicit consent under POPIA s27 / GDPR Art 9(2)(a):

I agree to my product safety log entries being stored on Olanna's server, linked to my device identifier, so I can track reactions over time.

Entries are retained for 24 months, or until you request deletion.

3.4 AI Health Features (opt-in)

When you use AI-powered features, your query is sent to our server, which processes it using OpenAI's API to generate a response.

Third party providers:OpenAI, L.L.C. (United States) processes the content of your query to generate a response. Under OpenAI's API terms, data submitted through the API is not used to train OpenAI's models, and queries may be retained by OpenAI for up to 30 days for abuse monitoring before deletion. OpenAI does not receive your name or device identifier — only the query content necessary to answer it.

Legal basis: Your explicit consent under POPIA s27 / GDPR Art 9(2)(a), given when you first use an AI feature:

I agree to my question being sent to Olanna's server and processed by OpenAI's API to generate a response, and understand this may involve a transfer of my query outside South Africa.

No personal health data is stored server-side beyond the immediate request; query content is retained for no more than 30 days for abuse-prevention purposes.

3.5 To improve Olanna's features with internal research

To understand which features are most useful and improve our health insights, we may analyze tracked health data in de-identified or aggregated form.

Third party providers: None — this analysis is performed internally.

Legal basis:Your explicit consent under POPIA s27 / GDPR Art 9(2)(a), which you can toggle off at any time in Privacy & Data settings:

I agree to my de-identified health data being used by Olanna for internal research to improve app features and insights.

3.6 To respond to your emails

If you contact us by email with a question or feedback, we process the contents of your message and your email address to respond.

Third party providers: None beyond our email provider, used solely to send and receive this correspondence.

Legal basis: Necessary to respond to a request you initiated (POPIA s11(1)(b) / GDPR Art 6(1)(b)-equivalent legitimate interest).

3.7 Website analytics

To understand how visitors use olanna.health, we use:

  • Our own page-view analytics — no cookies, no IP address or device details stored, cannot identify you.
  • Google Analytics — only if you accept cookies via the banner on first visit. Collects pages viewed, approximate location, and device type, with IP anonymization enabled. Declining means Google Analytics is never loaded.

We do not use Google Ads, advertising pixels, retargeting cookies, or any advertising network on the website or in the app. No health information is ever collected by or shared with any analytics service.

Legal basis: Your opt-in consent given via the cookie banner (POPIA s11(1)(a) / GDPR Art 6(1)(a)).

4. Data transfer outside South Africa

Because we use OpenAI (United States) and Replit, Inc. (United States) to provide the features above, some data may be processed outside South Africa. Where this happens, we rely on contractual safeguards equivalent to Standard Contractual Clauses as required by section 72 of POPIA, and equivalent Article 46 GDPR mechanisms where applicable. We choose providers carefully and do not work with processors in jurisdictions where we have concerns about the rule of law with respect to privacy.

5. Your data protection rights

Our products are built to collect only what's needed to provide the service. Key facts:

  • We do not retain identifiable data longer than necessary for the purpose it was collected.
  • Olanna does not engage in automated decision-making or profiling.
  • Server security is reviewed periodically; contact admin@olanna.health with any security questions.

You may, at any time:

  • Export all your data as a file from the app's Privacy & Data settings.
  • Delete specific categories of data or all data at once.
  • Use Anonymous Mode to operate without a profile.
  • Revoke Partner Mode access immediately.
  • Uninstall the app to permanently remove all local data.
  • Request access to, correction of, or deletion of any data stored on our server, by emailing admin@olanna.health.
  • Lodge a complaint with South Africa's Information Regulator if you believe we've processed your data unlawfully.

We will respond to access, correction, or deletion requests within 30 days of receipt.If we need more time, we'll notify you within that period and explain why, with the extension not exceeding a further 30 days.

6. Data security procedures

  • Sensitive data is encrypted using your device's secure storage (iOS Keychain / Android Keystore), stored separately from any server-side data.
  • All network communications use HTTPS/TLS encryption.
  • API endpoints are protected with rate limiting and require authentication.
  • No plaintext secrets are stored in source code.
  • Your data never leaves your phone unless you actively opt in to a server-connected feature.

7. Cookies on olanna.health

We use only:

  • A first-party, cookie-free page-view counter (anonymous, resets daily).
  • Google Analytics cookies, only if you opt in via the banner (see Section 3.7). You can withdraw consent at any time by clearing this site's cookies and site data, which will make the banner reappear.

We do not use advertising, retargeting, or cross-site tracking cookies of any kind.

8. Young users of Olanna

Olanna is not intended for anyone under 13. If we learn that a child's information was collected, we delete it immediately.

9. Law enforcement and government requests

We do not proactively share your health data with law enforcement or government agencies. Because most of your health data is stored only on your device and never reaches our servers, we frequently have nothing responsive to produce even if we receive a request. Where we do hold limited server-side data (Sections 3.2–3.4) and receive a legally valid, binding request (such as a court order or warrant), we will:

  • Scrutinize the request for legal validity before responding
  • Challenge requests we believe are overbroad or improperly issued
  • Notify the affected user where we are not legally prohibited from doing so

We do not sell or voluntarily disclose health data to data brokers or any third party for law-enforcement-adjacent commercial purposes.

10. What we never do

  • We never sell your personal or health data to anyone.
  • We do not use Google Ads or any advertising network — Olanna is not currently monetized.
  • We never share your data with advertisers.
  • We never use your data to target you with ads.
  • We never access your data without your knowledge.

11. Changes to this policy

We may update this Privacy Policy to reflect changes in the law, our data practices, or the app's features. Check the "last updated" date above; if we make changes we consider material, we'll notify you via email (if you've provided one), an in-app notice, or a notice on this website.

12. Responsibility for Olanna's data processing

Olanna Health (Pty) Ltd is built in South Africa. Our Information Officer is reachable at admin@olanna.health. General privacy questions: admin@olanna.health.

13. Medical disclaimer

The content on olanna.health and the insights shown in the Olanna app — including any AI-generated responses — are for educational and informational purposes only. They are not medical advice, diagnosis, or treatment, and they are not reviewed by a clinician before being shown to you. Always seek the advice of your physician or another qualified health provider with any questions you may have regarding a medical condition, and never disregard or delay seeking professional medical advice because of something you have read or seen in the Service. If you think you may have a medical emergency, call your doctor or emergency services immediately.

14. Contact us

Questions about privacy? Email us at admin@olanna.health.

OLANNA HEALTH (Pty) Ltd
Registered in South Africa