Lisah (“Lisah,” “we,” “us,” or “our”) is a consumer health information platform that helps women understand how hormonal changes influence mood, cognition, energy, sleep, and physical symptoms over time. We translate user-reported signals, optional wearable data, and scientific research into explanations, pattern recognition, near-term forecasting, and lifestyle-level guidance. Lisah is designed to make women’s biology legible – not to medicalize it. We support women across all lifestages, including puberty, cycling years, postpartum, perimenopause, and menopause. This Privacy Policy describes how we collect, use, disclose, store, and protect your personal information when you access or use the Lisah mobile application and any related services (collectively, the “App”). This Privacy Policy is incorporated into and forms part of the Lisah Terms of Use (“Terms”).
IMPORTANT: LISAH IS A CONSUMER WELLNESS AND EDUCATION PLATFORM. IT IS NOT A MEDICAL DEVICE, DIAGNOSTIC TOOL, TREATMENT SYSTEM, OR EMERGENCY SERVICE. LISAH DOES NOT PROVIDE MEDICAL DIAGNOSES, PRESCRIBE MEDICATIONS, PERFORM CLINICAL RISK SCORING, OR PROVIDE EMERGENCY CARE. IF YOU ARE EXPERIENCING A MEDICAL OR MENTAL HEALTH EMERGENCY, PLEASE CALL 911, YOUR LOCAL EMERGENCY NUMBER, OR THE 988 SUICIDE & CRISIS LIFELINE IMMEDIATELY.
All insights, forecasts, and guidance provided by Lisah are for informational and educational purposes only. They are not a substitute for professional medical advice, diagnosis, or treatment.
Lisah is built on four foundational privacy principles:
Lisah collects data in the following manner. You choose what to share.
You may voluntarily log the following signals through taps, short text entries, or voice input:
All user-reported signals are voluntarily provided. You may skip any input at any time.
If you connect a compatible wearable, Lisah may receive:
Compatible platforms: Oura, Apple Health, Fitbit. Connections are optional and revocable.
Lisah uses peer-reviewed research and public medical guidelines. This is not personal data.
We do not collect IDFA or any advertising identifier. Apple ATT does not apply to Lisah.
We explicitly do not collect:
This section addresses compliance with various state privacy and medical health privacy laws, including, but not limited to:
Lisah does not sell consumer health data. Shared only with:
Contact: privacy@lisah.com or in-app settings.
This section provides the disclosures required under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”), Cal. Civ. Code § 1798.100 et seq. The information below covers the preceding twelve (12) months. The following table describes the categories of personal information we collect, using the CCPA’s enumerated categories under § 1798.140(v), along with examples, sources, purposes, disclosure recipients, and whether each category is sold.
| Category | Examples | Collected? | Sources | Business / Commercial Purpose | Disclosed To | Sold? |
|---|---|---|---|---|---|---|
| A. Identifiers | Randomized internal user ID; optional account-recovery email address; IP address; device identifiers | Yes | From user (optional email at account setup); automatically (IP address, device ID) | Account management; service delivery; security; analytics (with consent per §9) | Infrastructure service providers | No |
| B. Customer Records (Cal. Civ. Code §1798.80(e)) | Name, address, SSN, insurance, payment card number, bank account | No | N/A | N/A | N/A | N/A |
| C. Protected Classification Characteristics | Life-stage selection (e.g., perimenopause, postpartum, cycling years); sex/gender (implied by platform focus on women’s health) | Limited; voluntarily provided | Directly from user (life-stage selection during onboarding) | Personalized, stage-appropriate insight generation and pattern recognition | Not disclosed to third parties | No |
| D. Commercial Information | Purchase records, consuming histories | No (app store handles purchases; Lisah does not receive payment data) | N/A | N/A | N/A | N/A |
| E. Biometric Information | Heart rate; heart rate variability (HRV); skin temperature trends; sleep stages and duration | Yes (optional; only if wearable connected) | From wearable devices user connects (Oura, Apple Health, Fitbit) | Pattern recognition; forecasting; insight generation | Infrastructure service providers | No |
| F. Internet or Other Electronic Network Activity | App usage events (screen usage, feature adoption, session duration); crash logs; performance data | Yes (analytics require consent per §9) | Automatically from the App | Product improvement; quality assurance; performance monitoring; bug fixes | Infrastructure service providers | No |
| G. Geolocation Data | Precise or approximate geographic location | No | N/A | N/A | N/A | N/A |
| H. Audio, Electronic, Visual, or Similar Information | Voice input for symptom logging (only if user chooses voice entry method) | Yes (optional; only if voice input used) | Directly from user (voluntary voice logging) | Natural language processing for symptom logging; insight generation | Infrastructure service providers (for processing) | No |
| I. Professional or Employment-Related Information | Job title, employment history, employer | No | N/A | N/A | N/A | N/A |
| J. Non-Public Education Information (per 20 U.S.C. §1232g; 34 C.F.R. Part 99) | Education records, grades, transcripts | No | N/A | N/A | N/A | N/A |
| K. Inferences Drawn from Personal Information | Cycle trends; mood patterns; energy forecasts; symptom predictions; sleep pattern analysis; productivity/cognitive metrics | Yes (derived internally) | Derived from Categories A, C, E, F, and H above | Personalized insights; pattern recognition; near-term forecasting; lifestyle guidance; aggregate model learning (with separate consent per §10) | Infrastructure service providers | No |
| L. Sensitive Personal Information | Self-reported health symptoms (mood, energy, sleep, stress, pain, focus, menstrual cycle data); wearable health metrics (heart rate, HRV, temperature); optional account-recovery email | Yes | Directly from user (voluntary self-reporting); wearable devices (if connected); user-provided email (optional) | Core App services: insight generation; pattern recognition, forecasting, lifestyle guidance | Infrastructure service providers | No |
Lisah does not sell personal information as defined under CCPA § 1798.140(ad). No category of personal information listed above has been sold in the preceding twelve (12) months or at any time.
Lisah does not share personal information for cross-context behavioral advertising as defined under CCPA § 1798.140(ah). We do not use ad networks, retargeting pixels, or cross-app tracking technologies.
Because Lisah does not sell or share personal information for cross-context behavioral advertising, a “Do Not Sell or Share My Personal Information” link is not currently required. However, if our practices change in the future, we will: (i) update this Privacy Policy with at least thirty (30) days’ advance notice; (ii) place a conspicuous “Do Not Sell or Share My Personal Information” link in the footer of our Site and in the App settings; and (iii) honor all opt-out requests submitted through that link.
Lisah collects sensitive personal information (Category L) solely as necessary to provide the core services of the App – personalized insights, pattern recognition, forecasting, and lifestyle guidance. We do not use sensitive personal information for purposes beyond what is necessary to provide these services. A “Limit the Use of My Sensitive Personal Information” link is available in the footer of our Site and in the App settings (Profile → Privacy). If you exercise this right, we will restrict our use of your sensitive personal information to the minimum necessary to provide the services you have requested.
California residents have the following rights under the CCPA. For detailed instructions on exercising these rights, see Section 20 (Your Privacy Rights):
To protect your privacy and security, we will verify your identity before fulfilling any consumer rights request. Verification may include confirming your account-recovery email address, randomized internal user ID, or other identifying details associated with your account. Because Lisah accounts are anonymous or pseudonymous, verification may be limited to confirming that the requestor controls the account in question.
You may designate an authorized agent to submit a CCPA request on your behalf. The authorized agent must provide written permission signed by you and must verify their own identity with us. We may also require you to verify your identity directly and confirm the agent’s authorization.
We will respond to verified consumer requests within forty-five (45) calendar days of receipt. If additional time is reasonably necessary, we will inform you of the reason and the extension period in writing. The response period may be extended by an additional forty-five (45) calendar days (for a total of ninety (90) days) with notice to you.
Lisah will not discriminate against you for exercising any CCPA right. We will not:
Lisah does not offer financial incentives, price differences, or service differences in exchange for the retention or sale of personal information.
Lisah collects anonymized, bucketed product-usage analytics to understand how the App is used and to improve the product experience. Analytics events include screen usage, onboarding completion, feature adoption, and session duration.
IMPORTANT: The analytics event stream does NOT contain health data. No mood, symptom, cycle, wearable, or any other health-related information is included.
Lisah may use de-identified symptom and cycle patterns from consenting users to improve global prediction models. This is a separate, secondary use requiring its own consent, independent of analytics consent (Section 9) and general consent to use the App.
YOUR PERSONAL INSIGHTS ARE NOT AFFECTED BY THIS CHOICE. This consent only controls whether your de-identified patterns contribute to the shared model.
Lisah accounts are anonymous or pseudonymous. We do not require your legal name, phone number, date of birth, or real-world identifier.
Only minimum data necessary for core functionality.
Health data stored separately from account-recovery info. Not cross-linked.
Health data used for model learning (with consent per Section 10) is de-identified before entering the pipeline.
Lisah does not integrate with EHRs, clinical providers, health plans, or any healthcare entity.
Lisah is not a HIPAA-covered entity. It does not operate as a healthcare provider, health plan, clearinghouse, or business associate. No PHI is collected or stored.
Lisah is a consumer wellness platform, not a medical device (21 U.S.C. § 321(h)). It does not diagnose, treat, cure, mitigate, or prevent any disease. AI is used for pattern recognition and lifestyle-level explanations only.
Apple ATT does not apply. No IDFA, no ad networks, no third-party sharing. App Store Privacy Nutrition Label discloses “Usage Data / Analytics.”
Lisah does not sell personal information or consumer health data. No sharing with advertisers, data brokers, or marketing companies. Lisah may disclose data to certain parties as follows:
Cloud hosting under strict contractual obligations.
Oura, Apple HealthKit, Fitbit. Data flows to Lisah only - not sent back.
As required by law, regulation, or valid legal process.
In connection with merger/acquisition, with advance notice to you.
Lisah has no ad-supported revenue model. No ad networks, retargeting pixels, or cross-app tracking.
Delete via Profile → Privacy → Delete My Data / Delete My Account.
Deletion removes all historical patterns, insights, and forecasts. A new account starts fresh.
Lisah is for individuals 18+. We do not knowingly collect data from children under 18. Contact privacy@[domain] if you believe a child has provided data.
Note: While Lisah supports all life stages including puberty, the App is designed for adult users. Minors should use it only under parental/guardian supervision and consent.
Lisah is operated from the United States. Data may be transferred to and processed in the U.S. This App is not intended for users outside of the United States.
⚠ WARNING: LISAH IS NOT AN EMERGENCY SERVICE. LISAH DOES NOT PROVIDE EMERGENCY CARE, CRISIS INTERVENTION, MEDICAL DIAGNOSES, OR CLINICAL TREATMENT OF ANY KIND.
IF YOU ARE EXPERIENCING A MEDICAL EMERGENCY including chest pain, difficulty breathing, severe bleeding, loss of consciousness, stroke symptoms, severe allergic reaction, or any life-threatening condition – CALL 911 (or your local emergency number) IMMEDIATELY.
IF YOU ARE EXPERIENCING A MENTAL HEALTH CRISIS including suicidal thoughts, self-harm urges, or severe emotional distress – CONTACT THE 988 SUICIDE & CRISIS LIFELINE BY CALLING OR TEXTING 988. You may also text HOME to 741741 (Crisis Text Line).
Nothing in the App constitutes medical advice, a diagnosis, or a treatment recommendation. By using Lisah, you acknowledge that: (i) Lisah is not a healthcare provider; (ii) you will not rely on Lisah for emergencies or clinical decisions; and (iii) you will seek professional care and call emergency services when needed.
Depending on your jurisdiction, you may have the following rights:
To exercise rights: privacy@lisah.co or in-app (Profile → Privacy). Response within 45 days, extendable 45 days with notice. Authorized agents accepted with verification.
At least 30 days’ advance notice via in-app notification and email (if account-recovery email provided).
Posted with updated “Last Modified” date. Effective upon posting.
Continued use after the effective date constitutes acceptance. Remedy: discontinue use and delete account.
If you have questions about this Privacy Policy:
We respond to all privacy inquiries within applicable legal timeframes. You may also lodge a complaint with a supervisory authority in your jurisdiction.