Privacy

Policy

Dossier Privacy PolicyEffective date: October 5, 2026
Last updated: October 19, 2026Dossier ("Dossier," "we," "us," or "our") is a personal health diary application operated by Pacau Sustainable Solutions LLC, doing business as Dossier Health Diary, a limited liability company organized under the laws of the State of New York, United States.This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have. Dossier is built around a simple principle: your diary belongs to you. We do not sell your data, we do not share it with advertisers, and we display no advertising in the app.Please read this policy carefully. By creating an account or using Dossier, you agree to the practices described here. If you do not agree, please do not use Dossier.1. Who we are and how to contact usPacau Sustainable Solutions LLC (DBA Dossier Health Diary)
7014 13th Avenue, Suite 202, Brooklyn, NY 11228
Email: [email protected]
Website: https://dossierdiary.com2. Information we collectWe collect only the information needed to operate your diary. This falls into three categories.Account information. When you create an account we collect your email address, authentication credentials, and, if you choose to provide one, a display name used only to greet you in the app. The display name can be anything you like and can be changed at any time; previous display names are not retained. If you choose to sign in using a third-party account (such as Google or Apple), we receive basic account information including your name and email address. If you use Sign in with Apple and choose to hide your email, we receive an Apple-provided relay address instead of your real email. We do not receive your password or any other account data from these providers.Health information you choose to record. Dossier is a diary, the substance of what we store is what you write in it. Depending on the features you use, this may include: medications and treatments you track (including names, vial volumes, concentrations, doses, and schedules); injection dates and body sites; menstrual cycle dates, phases, and symptoms; pregnancy or breastfeeding status; hormone therapy details; weight entries; step counts; in-office procedures; supplies; notes; and photos you choose to attach to entries. You control what you record. You may use Dossier without providing any particular category of health information.Technical and usage information. We collect limited technical data necessary to run and improve the app: device type, operating system, app version, and crash reports.We do not collect your precise location. We do not access your contacts. We do not scan your photo library; photos are only uploaded when you explicitly attach them to an entry.Health platform integrations. If you choose to connect a third-party health platform (such as Apple Health or Google Health), we will read only the data types you authorize (for example, step counts) and will use them solely to display your information within your diary. We do not write diary contents back to these platforms without your instruction, and we never use health platform data for advertising or marketing. You can disconnect these integrations at any time in your device settings.3. How we use your informationWe use your information to: provide the diary and its features (including calculations such as remaining doses, supply projections, cycle phase estimates, and reminders you configure); maintain and secure your account; process subscription purchases; respond to support requests; send essential service communications (such as password resets and material changes to this policy); and improve the app through aggregated, de-identified analysis.We do not use your health information for advertising. We do not sell or rent personal information to anyone. We do not use the contents of your diary to train artificial intelligence models.The support assistant. Dossier includes an optional in-app support assistant that answers questions about using the app. Messages you type to the support assistant are processed by Lovable, our application infrastructure provider, to generate replies, and transcripts are stored for up to 12 months to help us improve support, after which they are permanently deleted. The support assistant does not have access to the contents of your diary; your treatments, doses, cycle data, weights, photos, and other health records are never shared with it. Do not include sensitive health details in support messages; if you do, they will be processed as part of the conversation.Notifications. Dossier sends only the notifications you configure, dose reminders, low-supply alerts, and appointment reminders you set up yourself. We do not send marketing or engagement notifications. Notification scheduling is processed on your device and our servers solely to deliver what you asked for.4. Legal bases for processing (EEA/UK users)Where the EU/UK General Data Protection Regulation applies, we process your data on the following bases: performance of a contract (operating your diary); your explicit consent for health data, which you give by choosing to record it and may withdraw at any time by deleting the data or your account; legitimate interests in securing and improving the service; and legal obligations where applicable.5. How your information is stored and protectedYour data is stored with Supabase, our database and authentication provider, on infrastructure located in the United States. Data is encrypted in transit (TLS) and at rest. Access to your diary is restricted by row-level security so that your entries are accessible only to your authenticated account. Photos are stored in access-controlled private storage.No system is perfectly secure, and we cannot guarantee absolute security. We commit to notifying affected users and relevant authorities of any data breach as required by applicable law, including within the timelines required by the GDPR.6. Service providersWe share data only with service providers who process it on our behalf under contractual confidentiality and data protection obligations:Supabase (database, authentication, storage, and transactional email); Apple App Store (subscription billing, we never see your full payment card details); RevenueCat (subscription management); Lovable (application infrastructure and AI-powered support assistant); and Median.co (application delivery infrastructure).We may also disclose information if required by law, court order, or governmental authority, or where necessary to protect the rights, safety, or property of users or the public. Where legally permitted, we will attempt to notify you before disclosing your information in response to legal process.If Dossier or Pacau Sustainable Solutions LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy, and you will retain the ability to delete your account and data before any transfer takes effect.7. International transfersDossier is operated from the United States. If you use Dossier from outside the United States, including from the European Economic Area, your information will be transferred to and processed in the United States and any other regions where our service providers operate. Where required, we rely on appropriate safeguards for such transfers, such as standard contractual clauses.8. Your rights and choicesDepending on where you live, you may have some or all of the following rights: to access the personal information we hold about you; to receive a copy of it in a portable format; to correct inaccurate information; to delete your information; to restrict or object to certain processing; to withdraw consent at any time; and to lodge a complaint with a supervisory authority (such as your local data protection authority in the EEA or UK, or the relevant state Attorney General if you are a US resident with privacy rights under applicable state law).Browser privacy signals. Dossier does not use cross-context behavioral advertising. Where a Global Privacy Control (GPC) or Do Not Track (DNT) signal is detected, Dossier treats it consistently with that practice, meaning no behavioral advertising data is collected regardless of the signal.Dossier builds the most important rights directly into the app: you can export a complete copy of your data and you can permanently delete your account and all associated data from within Settings (export and deletion are live in the app). Deletion is permanent and irreversible; backups are purged within 30 days.We honor these rights for all users regardless of location, not only where the law requires it.California residents: we do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than providing the service. You have the right to know, access, delete, and correct your personal information, the right to opt out of the sale or sharing of personal information (which we do not engage in), and the right to non-discrimination for exercising these rights. Requests may be made to [email protected].9. Data retentionWe retain your information for as long as your account is active. Support assistant transcripts are retained for 12 months from the date of the conversation and then permanently deleted. If you delete your account, your data is permanently deleted within 30 days, except where we are legally required to retain limited records (for example, transaction records for tax purposes). We do not automatically delete accounts for inactivity, a diary keeps its pages even when you step away. If your account has been inactive for an extended period, we may contact you at your account email before taking any action affecting it.10. ChildrenDossier is not intended for anyone under 18 years of age, and we do not knowingly collect information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it. If you believe a minor has provided us information, contact [email protected].11. Consumer health data rights (Washington, Nevada, Connecticut, and similar states)If you live in a state with a consumer health data law (including Washington's My Health My Data Act, Nevada's consumer health data protections, and Connecticut's health data privacy provisions), you have additional rights over the health information you record in Dossier. You may withdraw your consent to our collection of that data, ask for a list of the third parties and service providers that receive it, and ask us to delete it. Dossier collects health data only after you choose to record it and shares it only with the service providers listed in Section 6, each acting on our behalf. Dossier does not sell consumer health data and does not use geofencing around any health care facility. To exercise these rights, contact us at [email protected]. We will respond within 45 days and, if we deny your request, explain why and describe how to appeal that decision.12. Menstrual and reproductive health dataWe recognize that cycle, pregnancy, fertility, and reproductive health information is uniquely sensitive. This includes information related to IVF, fertility treatments, and assisted reproduction. In addition to everything above: we do not disclose reproductive health data to third parties for any commercial purpose; we do not respond to voluntary (non-compulsory) requests from law enforcement for such data; and where we receive compulsory legal process, we will seek to narrow it and to notify the affected user where legally permitted. You may use Dossier's cycle features under any account name; we do not require identity verification.13. Health data, what it is and how we handle itHealth data in Dossier means any information you choose to record about your body and treatments: medication names, doses, vial details, injection dates and sites, menstrual cycle dates and symptoms, pregnancy or breastfeeding status, hormone therapy details (including fertility medications and IVF protocols), anticoagulant and blood thinner therapies, weight entries, step counts, procedures, supplies, photos attached to entries, daily symptoms, and notes.This information is stored in your private account database, accessible only to you through your authenticated session. It is never sent to advertising networks, attribution services, or any AI system other than the in-app support assistant as described in Section 3 (and that assistant never receives diary contents). It is never used to train machine learning models. It is never sold.The only circumstances in which health data leaves your account are: when you explicitly export it using the export feature in Settings; when a service provider needs it to operate a specific feature you are actively using (such as delivering a notification you configured, storing a photo you attached, or processing a subscription); or when we are legally compelled to disclose it, in which case we will seek to limit the disclosure and notify you where permitted by law.Reproductive and menstrual health data receives additional protection as described in Section 11.14. Changes to this policyWe may update this policy from time to time. For material changes we will notify you in the app or by email before the change takes effect. The "Last updated" date at the top reflects the current version. Continued use after the effective date constitutes acceptance.15. ContactQuestions, requests, or complaints: [email protected]. We aim to respond within 15 days and will respond within any timeline required by applicable law.