Cycle data is special category data: what that means for you

Many women do not realise that their cycle data legally sits in the same category as a medical record. Under the GDPR, data concerning health is special category data (Article 9). Processing it is prohibited unless an exception applies, and for apps the key exception is explicit consent.

What does that mean in practice?

• Consent must be explicit, freely given and specific. A tick box in a cookie banner or a blanket "I accept the terms" is not enough for health data.
• You must be able to say no. If an app becomes unusable without consent for something the feature does not need, that consent was not freely given.
• Purpose limitation. Data collected to predict your period cannot simply be reused to target ads.
• Data minimisation. An app may not ask for more than it needs. If a cycle app wants your contact list or precise location, be sceptical.

Your four most important rights, and how to use them

• Access (Art. 15). Request a copy of everything a provider holds about you. Response time: one month in principle.
• Data portability (Art. 20). You are entitled to your data in a common, machine-readable format such as CSV or JSON. That is exactly why you can import your history with us: see the step-by-step switching guide.
• Erasure (Art. 17). The right to be forgotten. Note: deleting the app from your phone is not an erasure request. As long as your account exists, your data sits on their servers.
• Withdrawing consent (Art. 7). Must be as easy as giving it. We handle that inside the app.

An email that does the job

"Dear privacy officer, under Articles 15 and 20 GDPR I request a copy of all personal data you process about me, in a machine-readable format. In addition, under Article 17 GDPR I request erasure of my data once the copy has been provided. My account details: [email address]."

No answer, or an incomplete one? You can complain to your national supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

Where we stand

PERIOD. is a Dutch company, with storage in Europe and processors listed publicly on our sub-processors page. You can delete your account and all your data yourself via /delete-account, and request a copy via /delete-my-data. Consent for the AI assistant is separate from the rest of the app.

This article is general information, not legal advice.

Want a cycle app that does not treat your rights as an obstacle? Download PERIOD. on the App Store or on Google Play.