Privacy Policy

Operated by Braw Impact Ltd
Trading as Nadi

Last Updated: 4 July 2026
Effective Date: 8 December 2025

1. Who We Are

This Privacy Policy explains how Nadi (“we”, “our”, “us”), collects, uses, stores, and protects your personal data.

Nadi is operated by Braw Impact Ltd, a company registered in Scotland (company number SC822663), trading as Nadi. Registered office: Clyde Offices 2nd Floor, 48 West George Street, Glasgow, G2 1BP.

Data Controller:
Braw Impact Ltd (trading as Nadi)
Registered office: Clyde Offices 2nd Floor, 48 West George Street, Glasgow, G2 1BP
ICO registration: ZB889841
Contact Email: hello@nadi.health

We are responsible for the processing of your personal data in connection with the Nadi website and the Nadi app (“the Service”).

2. Who This Policy Applies To

This Privacy Policy applies to:

Visitors to our public website (https://www.nadi.health)
Individuals who join our waitlist
Users of the Nadi app (secure, account-based service)
Organisations and individuals who complete our Workplace Scorecard self-assessment

Age Requirement: Nadi is intended for individuals aged 16 and over. We do not knowingly collect or process personal data from anyone under the age of 16.

3. The Data We Collect

We collect different types of personal data depending on how you interact with us.

A. Data you provide directly

Waitlist & account creation

Name
Email address
Country
Date of birth (used to confirm you are aged 16 or over)
Your onboarding answers, including our birth control screening question and what brings you to Nadi. We ask the screening question so we only offer phase estimates where they can be accurate. Your answer is treated as health data and processed only with your explicit consent.

Workplace Scorecard

Work email address
Name and company (optional)
Your assessment answers and scores (information about your organisation's workplace practices — not personal health data)
Whether you opted in to receive marketing emails

Payment information

Processed securely by our payment provider. We do not store full card numbers.

Women’s health data (special category data)

Collected only inside Nadi, and only with your explicit consent:

Your average cycle length and average period length
Your period start dates
The cycle phase estimates we calculate from these inputs (including your estimated ovulatory phase)
Optional cycle-related information you choose to enter

We do not collect pregnancy data, ovulation test information, or sexual health details unless these features are added in the future and explicitly agreed to.

B. Data collected automatically

When you visit our website, we may collect:

IP address
Browser and device details
Pages visited
Time spent on the website
Analytics data (only with your consent)

We use Google Analytics to understand how our website is used. It runs only if you accept analytics cookies, and you can withdraw that consent at any time via the cookie banner. The Nadi app uses strictly necessary session storage to keep you signed in.

C. Data from third parties

We may receive anonymised website analytics information from Google Analytics, and only if you have consented to analytics cookies.

We do not receive or purchase women’s health data from third parties.

D. Calendar integration (Google and Apple)

If you choose to connect your Google or Apple calendar, Nadi creates a separate, dedicated calendar in your account and writes your cycle phase events into it.

For Google, we request the narrowest available permission (calendar.app.created). This means Nadi can only see and edit the calendar it creates for you. We cannot read, access or change any of your other calendars or events.

We store the secure tokens needed to keep this connection working. Tokens are encrypted and are deleted when you disconnect your calendar or delete your account. If you disconnect, you can also remove the Nadi calendar directly in Google or Apple at any time.

Nadi’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We never use calendar data for advertising, never sell it, and never share it with third parties.

4. How We Use Your Data

Public website & waitlist

To operate, secure, and improve our website
To process your waitlist sign-up
To send updates, information, and Nadi announcements
To improve user engagement and website performance

Workplace Scorecard

To show your results and email you a copy
To follow up about Nadi's workplace services
With your consent, to send occasional marketing insights

The Nadi app

To create and manage your account
To provide personalised cycle insights
To calculate your cycle phase estimates from the information you give us
To create and update cycle phase events in the calendar you choose to connect (Google or Apple)
To support secure login and authentication
To process membership payments
To send service updates and support communications

Women’s health data (special category data)

We process health data only with your explicit consent, and only to:

Provide your cycle insights
Tailor your Nadi experience

We never:

Share health data with advertisers
Use health data for marketing
Sell health data
Use health data for automated decision-making with legal or significant impact

5. Legal Bases for Processing (UK GDPR / EU GDPR)

Data Type	Legal Basis
Website analytics	Consent
Marketing emails	Consent
Waitlist & newsletter sign-up	Consent
Account creation & login	Contract
Payment processing	Contract + Legal obligation
Women’s health data	Explicit consent (Art. 9(2)(a))
Workplace Scorecard — results delivery & follow-up	Legitimate interests
Security & fraud prevention	Legitimate interests
Customer support	Legitimate interests

6. How We Share Your Data

We only share data with trusted processors who assist in delivering our service:

Supabase (EU region, Frankfurt): secure database & authentication
Vercel: website and app hosting (nadi.health and my.nadi.health)
Resend: service and account emails
Google Workspace (Google Sheets): secure storage of Workplace Scorecard responses
Google / Apple: your own calendar provider, only if you connect your calendar and only to create your Nadi phase events
Google Analytics: website performance statistics, only with your consent (no health data)
EmailOctopus: newsletter subscriptions, only if you sign up through the form on our site
Our payment provider: payment processing, if or when paid plans launch

All processors must use your data only for the purposes we specify and must protect it under GDPR-compliant safeguards.

We never sell your data. We never share women’s health data with advertisers or social platforms.

7. International Data Transfers

Some partners (e.g., Google, Google Analytics, Vercel, Resend, EmailOctopus) may process limited personal data outside the UK/EU. Your health data is not among it: see below.

When this occurs, we rely on:

Standard Contractual Clauses (SCCs)
The UK Addendum
The Data Privacy Framework (DPF, where applicable)
Additional technical and organisational safeguards

Your women’s health data stored in Supabase is hosted exclusively in the Central EU (Frankfurt).

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

Encrypted databases
Row-level security controls (Supabase)
Secure authentication tokens
HTTPS encryption
Access controls for authorised personnel
Regular security reviews

We do not view or access your health data unless you explicitly request support requiring this.

No system can promise absolute security, but we take reasonable and proportionate measures to keep your data safe.

9. Data Retention

Data Type	Retention Period
Website analytics	Up to 14 months
Waitlist information	Until you unsubscribe
User account data	1 year after last activity
Payment data	7 years (legal requirement)
Women’s health data	Deleted within 30 days of account deletion or withdrawal of consent
Backup data	Automatically removed within 30 days
Workplace Scorecard responses	24 months from completion, or earlier on request
Consent records	Kept after account deletion as evidence that consent was given and withdrawn lawfully (a GDPR accountability requirement). These records contain no health data.

You may request deletion earlier by contacting us, at hello@nadi.health.

10. Your Rights

You may have the right to:

Access your data
Correct inaccurate data
Delete your data
Restrict or object to processing
Withdraw consent (including health data consent)
Request data portability
Lodge a complaint with the ICO or relevant EU authority

To exercise these rights, email hello@nadi.health.

Withdrawing consent for health data will immediately stop processing and trigger deletion within 30 days.

11. Profiling and Predictions

Nadi uses only the cycle inputs you state to generate your four cycle phases (menstrual, follicular, ovulatory and luteal). We do not infer, learn or average from your history.

This is informational only. It does not constitute medical advice or automated decision-making with significant effects.

12. Children’s Privacy (16+)

The Nadi website and the Nadi app are intended for individuals aged 16 or older.

We do not knowingly collect personal data from anyone under the age of 16. If we learn that personal data has been collected from a user under 16, we will delete the account and associated data promptly.

Users must confirm they are 16 or over during account creation.

13. Cookies and Tracking

We use a small number of cookies on our public website, mainly to remember your consent preferences. We use Google Analytics to understand how our website is used. It runs only if you accept analytics cookies, and you can withdraw that consent at any time via the cookie banner. Inside the Nadi app, only strictly necessary session storage is used to keep you signed in.

See our Cookie Policy for details.

14. Withdrawing Consent

You may withdraw consent at any time for:

marketing
analytics (via the cookie banner)
women’s health data processing

Withdrawal does not affect the lawfulness of processing before withdrawal.

15. Contact Us

Email: hello@nadi.health

Data Protection Contact:
Megan Hunter, Director
Braw Impact Ltd (trading as Nadi)
Clyde Offices 2nd Floor, 48 West George Street, Glasgow, G2 1BP
ICO registration: ZB889841