Legal
Privacy Policy
Operated by Megan Hunter
Trading as Nadi
Last Updated: 8 December 2025
Effective Date: 8 December 2025
1. Who We Are
This Privacy Policy explains how Nadi (“we”, “our”, “us”), collects, uses, stores, and protects your personal data.
Nadi is operated by Megan Hunter, acting as an independent individual freelancer, trading as Nadi.
Data Controller:
Megan Hunter (trading as Nadi)
Contact Email: megan@nadi.health
We are responsible for the processing of your personal data in connection with the Nadi website and the Nadi Calendar service (“the Service”).
2. Who This Policy Applies To
This Privacy Policy applies to:
- Visitors to our public website (https://nadi.health)
- Individuals who join our waitlist
- Users of the Nadi Calendar (secure, account-based service)
Age Requirement: Nadi is intended for individuals aged 16 and over. We do not knowingly collect or process personal data from anyone under the age of 16.
3. The Data We Collect
We collect different types of personal data depending on how you interact with us.
A. Data you provide directly
Waitlist & account creation
- Name
- Email address
- Country
- Confirmation you are aged 16 or over
Payment information
- Processed securely by our payment provider. We do not store full card numbers.
Women’s health data (special category data)
Collected only inside the Nadi Calendar, and only with your explicit consent:
- Cycle length
- Period start dates
- Predicted fertile window
- Optional cycle-related information you choose to enter
We do not collect pregnancy data, ovulation test information, or sexual health details unless these features are added in the future and explicitly agreed to.
B. Data collected automatically
When you visit our website, we may collect:
- IP address
- Browser and device details
- Pages visited
- Time spent on the website
- Consent-based marketing and analytics data
Analytics and marketing cookies only run if you provide consent. Authentication cookies used inside the Nadi Calendar are strictly necessary.
C. Data from third parties
We may receive anonymised analytics or support-related information from:
- Google Analytics
- Meta (Facebook/Instagram)
- Gamma (hosting provider)
- Intercom (support tools)
We do not receive or purchase women’s health data from third parties.
4. How We Use Your Data
Public website & waitlist
- To operate, secure, and improve our website
- To process your waitlist sign-up
- To send updates, information, and Nadi announcements
- To improve user engagement and website performance
Nadi Calendar
- To create and manage your account
- To provide personalised cycle insights
- To calculate predicted fertile windows
- To support secure login and authentication
- To process membership payments
- To send service updates and support communications
Women’s health data (special category data)
We process health data only with your explicit consent, and only to:
- Provide your cycle insights
- Tailor your Nadi Calendar experience
We never:
- Share health data with advertisers
- Use health data for marketing
- Sell health data
- Use health data for automated decision-making with legal or significant impact
5. Legal Bases for Processing (UK GDPR / EU GDPR)
| Data Type | Legal Basis |
|---|---|
| Website analytics | Consent |
| Marketing emails | Consent |
| Waitlist & newsletter sign-up | Consent |
| Account creation & login | Contract |
| Payment processing | Contract + Legal obligation |
| Women’s health data | Explicit consent (Art. 9(2)(a)) |
| Security & fraud prevention | Legitimate interests |
| Customer support | Legitimate interests |
6. How We Share Your Data
We only share data with trusted processors who assist in delivering our service:
- Supabase (EU region): secure database & authentication
- GoCardless: payment processing
- Google Analytics: website performance insights
- Meta: advertising performance (no health data)
- Gamma.app: website hosting and security
- Intercom: customer support tools
All processors must use your data only for the purposes we specify and must protect it under GDPR-compliant safeguards.
We never sell your data. We never share women’s health data with advertisers or social platforms.
7. International Data Transfers
Some partners (e.g., Google, Meta, Intercom) may process limited personal data outside the UK/EU.
When this occurs, we rely on:
- Standard Contractual Clauses (SCCs)
- The UK Addendum
- The Data Privacy Framework (DPF, where applicable)
- Additional technical and organisational safeguards
Your women’s health data stored in Supabase is hosted exclusively in the Central EU (Frankfurt)
8. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encrypted databases
- Row-level security controls (Supabase)
- Secure authentication tokens
- HTTPS encryption
- Access controls for authorised personnel
- Regular security reviews
We do not view or access your health data unless you explicitly request support requiring this.
No system can promise absolute security, but we take reasonable and proportionate measures to keep your data safe.
9. Data Retention
| Data Type | Retention Period |
|---|---|
| Website analytics | Up to 26 months |
| Waitlist information | Until you unsubscribe |
| User account data | 1 year after last activity |
| Payment data | 7 years (legal requirement) |
| Women’s health data | Deleted within 30 days of account deletion or withdrawal of consent |
| Backup data | Automatically removed within 30 days |
You may request deletion earlier by contacting us, at info@nadi.health.
10. Your Rights
You may have the right to:
- Access your data
- Correct inaccurate data
- Delete your data
- Restrict or object to processing
- Withdraw consent (including health data consent)
- Request data portability
- Lodge a complaint with the ICO or relevant EU authority
To exercise these rights, email megan@nadi.health.
Withdrawing consent for health data will immediately stop processing and trigger deletion within 30 days.
11. Profiling and Predictions
The Nadi Calendar uses your cycle inputs to generate:
- predicted fertile windows
- cycle length patterns
This is informational only. It does not constitute medical advice or automated decision-making with significant effects.
12. Children’s Privacy (16+)
The Nadi website and Nadi Calendar are intended for individuals aged 16 or older.
We do not knowingly collect personal data from anyone under the age of 16. If we learn that personal data has been collected from a user under 16, we will delete the account and associated data promptly.
Users must confirm they are 16 or over during account creation.
13. Cookies and Tracking
We use cookies on our public website for analytics, performance, and marketing (only with consent). Inside the Nadi Calendar, only strictly necessary authentication cookies are used.
See our Cookie Policy for details.
14. Withdrawing Consent
You may withdraw consent at any time for:
- marketing
- analytics
- women’s health data processing
Withdrawal does not affect the lawfulness of processing before withdrawal.
15. Contact Us
Email: megan@nadi.health
Data Protection Contact:
Megan Hunter
Trading as Nadi