Privacy Policy

1. Overview

Cyclolab is an app for organizing and following cycles, compounds, protectors, doses, lab results and progress photos. Because the service involves sensitive personal data, especially health data, we take privacy seriously: we collect only what is needed to run the Service, we only show your data to the people you authorize, and we never sell your data.

2. Data we collect

a) Sign-up data: first name, last name, username, e-mail address, date of birth and gender. Your password is stored encrypted (hashed), never in plain text.

b) Sign in with Google or Apple: if you sign in with one of these accounts, we receive from the provider the account identifier, your name, your e-mail (Apple may provide a relay e-mail) and, for Google, your profile photo, which may be used as your Cyclolab photo. We never receive your Google or Apple password.

c) Public profile: username and profile photo, which are visible to other people.

d) Preferences: language and app settings, including notification settings.

e) Content recorded in the app: cycles, compounds, protectors, post-cycle therapy (PCT), doses, schedules, injection sites, syringes, needles, stock, product catalog, exam templates, dose logs and the activity history built from them.

f) Health data: in addition to the content above, the lab results you record (name, laboratory, date, price and uploaded files in PDF or image format, up to 5 MB each) and the progress photos you post (images up to 10 MB, caption and the cycles active on the day of the photo).

g) Following: invites sent and accepted, who follows you, whom you follow and the permissions chosen for each person.

h) Technical data: a device identifier generated by the app, operating system and version, device brand and model, app version, time zone, push notification token, access and error logs and IP address, used to operate and protect the Service.

3. How we use the data

• create and authenticate your account, including sign-in with Google or Apple, and sync your data across devices;
• operate the app features (cycles, schedule, logs, stock, lab results, photos and history);
• show your data to the people you allowed to follow you and through the links you share, within the limits you choose;
• send notifications and reminders for doses and lab tests, and following alerts, according to your preferences;
• send transactional and security e-mails (sign-up confirmation, password recovery and change, linking and unlinking Google or Apple accounts);
• keep the Service secure and prevent fraud and abuse;
• improve the Service, based on aggregated and anonymized metrics.

We do not use your data for targeted advertising and we do not sell, rent or trade personal data.

4. Legal basis (LGPD)

Health data and other sensitive data (art. 5, II) are processed based on your specific and highlighted consent (art. 11, I), given so that the Service can store and organize this information and show it to the people you authorize. You can withdraw this consent at any time, which prevents further use of the Service.

Other data is processed based on: performance of a contract and pre-contractual steps (art. 7, V) to operate the Service; compliance with a legal or regulatory obligation (art. 7, II); legitimate interest (art. 7, IX) for security and fraud prevention; and consent (art. 7, I) for push notifications and for analytics cookies on the website (Microsoft Clarity and Google Analytics). Withdrawing consent does not affect processing already carried out. The website language preference only remembers the choice made in this browser.

5. Sharing

Your data may be accessed by:

• People you authorize: those you allowed to follow you see only what you chose — dose logs, cycles, photos and/or lab results — together with your name, @username and profile photo. You can change or end this access at any time;
• Anyone with a link you shared: an exam template link shows the template name, notes and, as you choose, the exams and requirements, until it expires or you end it. It does not show your sign-up data;
• Infrastructure providers that run our systems: Amazon Web Services (hosting, database, file storage and e-mail delivery), Google Firebase Cloud Messaging (push notifications), and Google and Apple when you sign in with those accounts — all bound by confidentiality and security obligations;
• Microsoft (Clarity) and Google (Google Analytics), only if you accept analytics cookies on the website. Without that consent, these scripts are not loaded;
• Authorities, when there is a legal request, a court order, or to protect rights and safety.

6. International transfer

Our servers and some of the providers listed above are located outside Brazil, especially in the United States. Your data may therefore be transferred to and stored abroad. These transfers follow article 33 of the LGPD and are made with providers that offer data protection safeguards compatible with Brazilian law.

7. Website and cookies

The website cyclolab.com.br stores the language preference you choose in this browser. It does not identify you and does not ask for consent.

If you accept, we load Microsoft Clarity, a Microsoft service that records how the page is used: clicks, scrolling and a session recording. Clarity uses cookies and sends that data to Microsoft. We also load Google Analytics, which measures visits and site use and sends that data to Google. Without acceptance, those scripts are not loaded. You can reject them, or change your mind later, from the Cookies link in the footer. The new choice applies on later visits.

The waitlist asks for an e-mail only to announce the launch. The notice sits next to the form.

8. Notifications and e-mails

Push notifications require your consent and use a token associated with your device. They include dose and lab test reminders and following alerts, such as an accepted invite. You can choose the categories or turn them off at any time in the app or operating system settings without losing access to other features; the alerts remain available in the app's notification list.

Transactional and security e-mails (sign-up confirmation, password recovery and change, linking and unlinking Google or Apple accounts) are required to run and protect the account and cannot be turned off while the account exists.

9. Data retention and deletion

We keep your data while your account is active. You can delete your progress photos and lab results at any time in the app. When you delete your account, we delete or anonymize your personal data from our active systems, including lab result files and progress photos; your followers lose access and your shared links stop working. This excludes copies in backups for a limited period and retention required by law.

See how to delete your account, in the app or by e-mail.

10. Security

We adopt technical and organizational measures to protect your data, such as encryption in transit (TLS), hashed passwords, role-based access controls and security monitoring. No system is entirely immune; in the event of a relevant incident, we will notify affected users and the competent authorities as required by the LGPD.

11. Your rights

Under article 18 of the LGPD, you may request: confirmation that processing exists; access to your data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed unlawfully; data portability; deletion of data processed based on consent; information about whom we share your data with; and withdrawal of consent.

You can exercise some of these rights directly in the app: correct your data in Settings, see and remove followers in Sharing, delete photos and lab results and delete your account. For the others, write to contato@cyclolab.com.br. We will respond within the legal deadline and may ask for information to confirm your identity.

12. Users under 18

The Service is not intended for anyone under 18, and we do not knowingly collect data from this population. If we identify an account belonging to a minor, it may be terminated.

13. Changes to this Policy

We may update this Policy to reflect changes in the Service or in the law. The current version will always be published on this page, with its update date, and relevant changes may be announced in the app.

14. Contact

For privacy questions or to exercise your rights, contact our data protection officer (DPO) at contato@cyclolab.com.br.