Polycystic Ovary Syndrome is a hormonal and metabolic condition affecting roughly 1 in 10 women of reproductive age. It can cause irregular cycles, acne, excess hair growth, hair thinning, weight changes, fatigue, mood changes, and fertility challenges, though symptoms vary widely from person to person.

Josie is a digital health companion for women with PCOS. It helps you track symptoms, understand patterns, prepare for doctor appointments, and manage your condition with evidence-based tools. It is not a generic period tracker. It is built specifically for the complexity and variability of PCOS.

How is Josie different from other PCOS apps?

Most health apps assume regular cycles and focus on fertility. Josie starts from symptoms, supports four different cycle states including absent periods, and generates specialist-specific appointment prep reports. It also includes advocacy tools for women who are still seeking a diagnosis or have been dismissed by their doctor.

Do I need to track my cycle to use it?

No. Many women with PCOS have highly irregular or absent cycles. Josie works just as well if you focus on symptoms, mood, energy, or medication tracking instead. Your cycle is one input, not the centre of the app.

Yes. Your data is stored securely in the EU, encrypted at rest and in transit, and belongs only to you. Josie complies with GDPR, including health data protections under Article 9. You can export or delete your data at any time. We never sell your data.

Is Josie a medical device?

Josie is designed as a Class I Software as a Medical Device under EU MDR 2017/745. It is a tracking and information tool, not a diagnostic or treatment tool. We are pursuing reimbursement through public health insurance pathways in Belgium, France, and Germany.

Can I share my data with my doctor?

Yes. Josie helps you create a clear, specialist-specific visit report you can download, email, or bring to your appointment, making it easier to discuss what has been happening and what matters most.

When can I try Josie?

Josie is currently in development with beta launch coming soon. Join the waitlist to be the first to get access.

Privacy Policy

Note on our legal status: Health Surfers is currently operated by Laure Santolini and Manon Vervaeke, acting as joint data controllers pending the formal incorporation of Health Surfers as a Belgian legal entity. When incorporation is complete, this notice will be updated to name the legal entity as data controller and you will be notified of the change.

1. Who we are

Josie is a digital health platform designed to support adult women living with or seeking a diagnosis of Polycystic Ovary Syndrome (PCOS). The service is operated by:

Laure Santolini and Manon Vervaeke
doing business as Health Surfers
Antwerp, Belgium

For all privacy-related questions, requests, and concerns, contact us at: privacy@josie.care

This policy is written in English, which is the legally binding version. French and Dutch translations are available; in the event of any conflict between versions, the English text prevails.

2. What this notice covers

This notice explains how Health Surfers collects, uses, stores, and shares your personal data when you use the Josie mobile application and associated services (collectively, “Josie” or “the service”). It also explains your rights under the General Data Protection Regulation (GDPR) and how to exercise them.

Please read this notice carefully before using Josie. By creating an account, you confirm that you have read and understood it.

3. What data we collect

3.1 Account and profile data

When you create an account, we collect:

Email address
Password (stored as a cryptographic hash; we never store your password in plain text)
Name (optional)
Date of birth or age range
Country of residence

3.2 Health and symptom data

This is the core data that powers Josie. It includes:

PCOS diagnosis status and phenotype (if known)
Symptom logs: which symptoms you report, their severity, and the date and time of logging
Menstrual cycle data: period start and end dates, flow, and related symptoms
Medication and supplement records: names, dosages, frequencies, and adherence logs
Appointment records: date, specialty, and any notes you add
Laboratory test results and body measurements you choose to enter
Wellbeing tracker responses (five questions, weekly)
Goals and health profile information from onboarding
Wearable health data (if you choose to connect Apple HealthKit or Android Health Connect): derived daily aggregates of sleep duration, daily steps and active minutes, resting heart rate, and workout sessions. Raw wearable samples are never stored; only the computed daily summaries are retained on Josie servers.

This data is Special Category Data under GDPR Article 9 because it concerns health. We apply additional safeguards to this category of data, described in Section 5.

3.3 Usage and analytics data

To improve the service, we collect anonymised and aggregated data about how users interact with Josie. This includes:

Which features you use and how often
Screens visited and actions taken within the app
Session duration and app opens
Crash reports and error logs

Analytics data is collected only with your explicit consent (optional at onboarding). You can withdraw this consent at any time in Profile > Privacy.

3.4 Device and technical data

We automatically collect certain technical data when you use Josie:

Device type and operating system version
App version
IP address (used for security and fraud prevention; not linked to your health data)
Crash diagnostics

3.5 Data you do not have to provide

No field in Josie is mandatory beyond email address and password for account creation. You may leave health fields blank, decline to answer onboarding questions, or skip symptom categories. The more you log, the more useful Josie becomes, but providing data is always your choice.

4. How we use your data

4.1 Providing the service

We use your data to operate Josie: to show you your symptom history, generate pattern insights, produce appointment preparation reports, and deliver the features you use.

Lawful basis: Performance of a contract (GDPR Article 6(1)(b)).

4.2 Processing your health data

Your health data is processed to power the core features of Josie: symptom tracking, cycle analysis, pattern recognition, evidence report generation, and wellbeing tracking.

Lawful basis: Your explicit consent under GDPR Article 9(2)(a). You provide this consent during onboarding. You can withdraw it at any time, which will trigger an account deletion flow.

4.3 Processing wearable health data

If you choose to connect Apple HealthKit or Android Health Connect, we read derived daily aggregates (sleep duration, daily steps and active minutes, resting heart rate, workout sessions) from your device. Raw minute-level samples are never stored. This processing is optional, off by default, and requires separate consent both in Josie and through the OS permission dialog on your device. You can disconnect at any time via Profile > Privacy > Wearable data, with the option to retain or delete the data already stored.

Lawful basis: Your explicit consent under GDPR Article 9(2)(a), collected as a separate consent category.

4.4 Improving Josie

With your optional consent, we use anonymised and aggregated usage data to understand how Josie is being used, identify problems, and improve the product.

Lawful basis: Consent (GDPR Article 6(1)(a)), optional and withdrawable.

4.5 Sending you communications

If you have opted in to marketing communications, we may send you product updates, PCOS health content, and information about new features.

Lawful basis: Consent (GDPR Article 6(1)(a)), optional and withdrawable.

4.6 Research participation

If you have separately consented to research participation, anonymised and aggregated data may be included in a future clinical validation study. This processing uses data that cannot be linked back to you individually. It is never a condition of using Josie.

Lawful basis: Consent (GDPR Article 6(1)(a)), optional and withdrawable, collected as a separate consent category.

4.7 Legal obligations and security

We may process data to comply with legal obligations, respond to lawful requests from authorities, or protect the security and integrity of the service.

Lawful basis: Legal obligation (GDPR Article 6(1)(c)) and legitimate interests (GDPR Article 6(1)(f)).

5. Special category data (health data)

Your symptom logs, cycle data, medication records, test results, and wellbeing tracker responses are Special Category Data under GDPR Article 9. We apply the following additional safeguards to this data:

Explicit consent required. We collect separate, explicit consent for health data processing during onboarding. This consent can be withdrawn at any time.
Encryption at rest and in transit. All health data is encrypted using AES-256 at rest and TLS 1.3 in transit.
EU data residency. Your health data is stored on servers located in the European Union (Ireland, eu-west-1 region). It does not leave the EU in the ordinary course of operations.
Immutable audit trail. Health records older than seven days cannot be altered or deleted except through a formal GDPR erasure request. This protects the integrity of your longitudinal health record.
Access controls. Your health data is accessible only to you. Health Surfers staff cannot access individual user health records except where strictly required for technical incident resolution, under documented access controls.
No sale of health data. Your health data is never sold, rented, or traded to any third party.

6. Data processors

We use the following third-party service providers to operate Josie. Each is engaged under a Data Processing Agreement in compliance with GDPR Article 28.

Processor	Purpose	Data location
Supabase	Database, authentication, file storage, and backend functions	EU (Ireland, eu-west-1)
RevenueCat	In-app purchase and subscription entitlement management (iOS and Android)	US (Standard Contractual Clauses in place); processes purchase tokens and pseudonymous user ID only, no health data
PostHog	Product analytics (optional, consent-gated)	EU (EU Cloud)
Sentry	Crash reporting and error tracking	EU region
Apple Inc.	App Store distribution, in-app purchases, and HealthKit data source (iOS)	Apple’s infrastructure
Google LLC	Play Store distribution, in-app purchases, and Health Connect data source (Android)	Google’s infrastructure

We do not share your health data with any of these processors except as strictly necessary to provide the service. Apple and Google receive only technical and transaction data, not your symptom or health records.

7. Data transfers outside the EU

Your health data is stored in the EU and does not leave the EU in the ordinary course of operations. Where any processor operates infrastructure outside the EU (for example, RevenueCat in the US and some Sentry operations), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

8. How long we keep your data

Data category	Retention period
Account and profile data	For the duration of your account, plus 30 days after deletion
Health and symptom data	For the duration of your account, plus 30 days after deletion
Wearable derived data (if connected)	For the duration of your account, plus 30 days after deletion; deleted immediately on disconnect if you choose the delete option
Consent records	6 years after account closure (legal obligation)
Anonymised research data (if consented)	Retained in aggregate form after account deletion; cannot be linked back to you
Billing records	7 years (Belgian accounting law)
Crash and error logs	90 days rolling

When you delete your account, all personal data is removed within 30 days. Consent records are retained for 6 years as required by law. Billing records are retained for 7 years as required by Belgian accounting law.

9. Your rights under GDPR

You have the following rights in relation to your personal data. To exercise any of them, contact us at privacy@josie.care. We will respond within 30 days.

Right to access. You can request a copy of all personal data we hold about you. You can also export your data directly in the app via Profile > Privacy > Export my data (JSON and PDF formats).

Right to rectification. You can correct or update any data we hold about you. Most data can be edited directly in the app.

Right to erasure. You can request deletion of your account and all associated personal data. This can be done in Profile > Privacy > Delete account, or by writing to privacy@josie.care. Deletion completes within 30 days. For step-by-step instructions, see how to delete your account and data.

Right to withdraw consent. You can withdraw any consent you have given (health data processing, analytics, marketing, research participation) at any time via Profile > Privacy > Consent settings. Withdrawing health data consent will close your account as the service cannot function without it.

Right to data portability. You can receive your data in a machine-readable format (JSON) via Profile > Privacy > Export my data.

Right to restriction. You can request that we restrict processing of your data while we are responding to a complaint or dispute.

Right to object. You can object to processing based on legitimate interests. This right does not apply to processing based on contract performance or legal obligation.

Right to lodge a complaint. If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données): apd-gba.be.

10. Children

Josie is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a person under 18 has created an account, please contact us at privacy@josie.care and we will delete the account promptly.

11. Cookies and tracking

The Josie mobile application does not use browser cookies. On the web (josie.care), we use only strictly necessary cookies required for the website to function. Analytics on our website are subject to a separate cookie consent notice.

12. Security

We apply technical and organisational measures to protect your data, including:

AES-256 encryption at rest
TLS 1.3 encryption in transit
Certificate pinning in production builds
Row-level security on all database tables
Rate limiting on authentication endpoints
Vulnerability scanning via automated tooling

In the event of a data breach affecting your rights and freedoms, we will notify you and the Belgian Data Protection Authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33.

13. Changes to this notice

We may update this notice from time to time. If we make a material change, we will notify you in-app and by email before the change takes effect. The effective date at the top of this page will always reflect the most recent version. Continued use of Josie after an update constitutes acceptance of the updated notice.

14. Contact

For any questions about this policy or your personal data:

Email:privacy@josie.care
Website:josie.care

Health Surfers
Antwerp, Belgium