Privacy Policy

This Privacy Policy explains how we collect, use, store, and share information when you use the Cora mobile application and related services. This Policy forms part of our Terms & Conditions.

Cora is a wellness and tracking app for people managing polycystic ovary syndrome (PCOS). Cora provides educational information only and is not a medical device and does not provide medical advice, diagnosis, or treatment.

1. Summary

• You can use Cora without an account. Your logs are stored on your device by default.
• Optional cloud backup requires creating an account (Apple, Google, or email).
• Cora Plus features (AI chat, personalized tips, food scanning) send limited data to our servers for processing.
• We use automated models and service providers to power certain features. We do not publicly disclose specific model or vendor names, which may change over time.
• We do not sell your personal information.
• We do not use your data for third-party advertising in the app.
• You can delete all app data from the You tab; if signed in, cloud backup data for your account is deleted too.

2. Information we collect

2.1 Information you provide directly

Depending on how you use Cora, you may provide:

You choose what to log. You may skip many fields.

2.2 Information collected automatically

We do not intentionally collect precise GPS location.

2.3 Information from device permissions

Cora may request:

You can deny or revoke permissions in your device settings. Some features may not work without them.

2.4 Food scan images

When you use food scanning, the image is sent to our servers for analysis. It is processed to return a score, explanation, and estimated nutrition. We design this flow for meal analysis, not for identifying you. Do not submit photos that contain faces or personal identifiers if you want to minimize incidental data.

3. How we use information

We use information to:

• Provide core tracking (cycles, symptoms, habits, weight, medications, workouts)
• Sync and back up your data when you sign in (optional)
• Personalize Cora Plus features (AI chat, check-in coping suggestions, food scanning)
• Process subscriptions and restore purchases
• Send local notifications you configure
• Improve reliability, security, and support
• Comply with law and enforce our terms

We use automated processing — including AI models operated by us and our service providers — to generate educational wellness suggestions based on summarized context from your logs (e.g., mood, symptoms, habits, cycle notes). This processing is not used to diagnose or prescribe. We do not name specific third-party AI models in this Policy; providers may change as we improve the Service.

4. Where your data is stored

4.1 On your device (default)

Most data is stored locally on your device, including daily logs, periods, profile settings, chat history (last 50 messages), and similar app data.

If you do not sign in, this data generally remains on your device unless you delete the app or use "Delete all data."

4.2 Cloud backup (optional)

If you create an account, we sync selected data to our secure cloud infrastructure tied to your user ID, including profile settings, logs, periods, medications, food scans, workouts, and weight entries.

4.3 AI processing

For Cora Plus AI features, we send requests to our servers (and, where applicable, to third-party AI service providers under contract), which process your data to produce responses.

Typical inputs include:

• Check-in / chat: Summarized wellness context (mood, symptoms, habits, cycle notes, recent patterns) and your messages
• Food scan: Encoded meal image

AI outputs (tips, replies, scan results) are shown in the app. Some check-in tips may also be saved locally in your daily log.

5. Service providers

We use trusted infrastructure and service providers to host the app, authenticate users, process payments, deliver AI features, and operate subscriptions. These providers process data only as needed to provide Cora and are bound by contractual obligations to protect your information.

Payment card and billing details are handled by your app store (Apple App Store or Google Play), not stored directly by us.

6. Legal bases (EEA/UK users)

If GDPR applies, we rely on:

• Contract — to provide the app and subscriptions you request
• Consent — for optional features (account, AI, camera, notifications, biometrics) where required
• Legitimate interests — to secure the app, prevent abuse, and improve features (balanced against your rights)

You may withdraw consent where applicable without affecting lawfulness of prior processing.

7. How we share information

We do not sell personal information.

We may share information:

• With service providers who help us operate Cora, under strict confidentiality and security requirements
• When you export or share — e.g., a doctor summary you explicitly share via your device's share sheet
• For legal reasons — if required by law, court order, or to protect rights, safety, or security
• In a business transfer — if we merge, sell assets, or reorganize (you would be notified where required)

We do not share your health logs with advertisers.

8. Data retention

• On-device data: Kept until you delete it, delete the app, or use Delete all data
• Cloud backup: Kept while your account exists and until you delete data or request account removal
• Chat history: Up to the 50 most recent messages stored locally
• AI requests: Processed to generate a response; we retain server-side data only as long as needed to operate the service, comply with law, and resolve disputes
• Subscription records: Retained as needed for billing, tax, and fraud prevention

9. Security

We use reasonable technical and organizational measures (encryption in transit, access controls, secure hosting). No method is 100% secure. You are responsible for securing your device and account credentials.

Optional Face ID adds a device-level lock; we do not receive your biometric data.

10. Your choices and rights

Depending on your location, you may have the right to:

• Access a copy of your personal data
• Correct inaccurate data (edit in app or contact us)
• Delete your data
• Export your data (doctor report feature in app)
• Object to or restrict certain processing
• Withdraw consent for optional processing
• Lodge a complaint with your supervisory authority (EEA/UK)

In the app today

Account deletion: Deleting all data removes your synced wellness data from our systems. To fully remove your login account, contact support@corapcos.com.

11. Children's privacy

Cora is designed for people managing PCOS and is not intended for use by children. It is not directed to children under 13 (or 16 where applicable). We do not knowingly collect personal information from children. Contact us to request deletion if you believe a child provided data.

12. International transfers

If you are outside the country where we operate, your information may be processed in other countries where our service providers maintain facilities. We use appropriate safeguards where required by law.

13. Health information disclaimer

Information in Cora and from Cora AI is general wellness and educational content, with links to public health sources. It is not a substitute for professional medical advice. Always consult a qualified clinician for medical decisions.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version at https://www.corapcos.com/privacy.html and update the "Last updated" date. Material changes may be communicated in-app or by email where appropriate.

15. Contact us

FunnelStrategist LLC
Email: support@corapcos.com
Website: https://www.corapcos.com
Mailing address: 1209 N. Orange St, Wilmington, DE 19801, USA

Read our Terms & Conditions →