Your privacy

1. The short version

• We collect what we need to build and run your daily plan, including health information you choose to share.
• We never sell your information, and we never share your health information with advertisers or use it to target ads.
• Lab reports you scan are read to pull out the numbers, then the file is discarded. Only the values you confirm are saved.
• You can see, download or delete your information at any time.

2. Who we are

Thyrowell (the app at thyrowellapp.com, its website, emails and social media accounts) is run by Madhu Herbals Private Limited, 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051 (“we”, “us”). We are responsible for your personal information under this policy.

Questions about privacy: privacy@getmedhya.com.

3. What we collect

Information you give us

• Account details: your email address, first name and sign-in details.
• Your answers when you set up your plan: for example your age range, gender, thyroid story (such as underactive, overactive, Hashimoto’s, Graves’, after a baby or after surgery), whether you take thyroid medication and the gap you were advised before eating, symptoms you want help with, other health conditions you tell us about, life stage, food preferences, allergies, cooking time, sleep and wake times and movement preferences.
• Daily check-ins: how your energy, digestion and sleep were, whether you used an easier day, and when you ticked your thyroid medicine as taken.
• Lab results: results you type in or confirm from a report (such as TSH, thyroid antibodies, ferritin or vitamin D), with the date, units and the range printed on your report.
• Plan activity: steps you tick, meals you swap, notes you write (such as questions for your doctor).
• Messages: when you email us, or message or comment on our Instagram or Facebook accounts.
• Email sign-ups: your email address and, if you give it, first name, when you ask for a free guide or join the waitlist.
• Payments (when paid plans start): handled by Stripe. We receive your subscription status and the last digits of your card, never your full card number.

Information collected automatically

• Usage information: which screens and pages you open and which buttons you tap, to understand what helps and what doesn’t.
• Device and technical information: browser or device type, operating system, approximate location from your IP address (country or city), and error reports so we can fix problems.
• Where you came from: for example a link in an Instagram message or an email (using tags in the link).

We don’t knowingly collect information from anyone under 18. Thyrowell is for adults only. If you think someone under 18 has signed up, email privacy@getmedhya.com and we will delete their information.

4. Your health information

Much of what makes Thyrowell useful is health information: your thyroid story, symptoms, medication timing, check-ins and lab results. We treat it with extra care:

• We only use it to provide Thyrowell to you: to personalise your plan, show your trends and weekly look-back, and prepare your doctor visit notes.
• We never sell it, never share it with advertisers or ad networks, and never use it to target you with ads.
• We ask for your consent before collecting it, when you set up your plan. You can withdraw consent at any time by deleting the information or your account.
• We don’t interpret your results or tell you whether a number is good or bad. Ranges shown are the ones printed on your own report.

Scanning a lab report

When you scan or upload a report, the file is sent securely to an AI service (OpenAI) to read the test names, values, units, ranges and date. You then check and correct each value before anything is saved. The file itself is not stored by Thyrowell. Under our agreement with OpenAI, data sent through its API is not used to train its models and is kept for no more than 30 days for abuse monitoring, then deleted. Avoid uploading pages that show information you don’t want read, such as your address.

5. How we use information

• To create your account and build, update and personalise your daily plan, meals and content.
• To show your check-ins, trends, lab history and doctor visit notes.
• To send the guides and emails you ask for, reminders you turn on, and important account messages.
• To reply to messages, comments and support requests.
• To understand how Thyrowell is used and improve it, using analytics that are not used for advertising.
• To process payments when paid plans start.
• To keep Thyrowell secure, prevent misuse and meet legal obligations.

6. Legal bases (UK, EU and similar laws)

• Your explicit consent for health information, and for marketing emails.
• To provide the service you asked for (our contract with you): your account and plan.
• Our legitimate interests: keeping Thyrowell secure and improving it, in ways that don’t override your rights.
• Legal obligations: for example keeping payment records.

7. Who we share it with

We share information only with service providers that help us run Thyrowell, under contracts that limit their use of it to providing their service to us:

We may also share information if the law requires it, to protect someone’s safety, or as part of a merger or sale of the business (in which case this policy continues to apply). We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

Your recipes and exercise videos are loaded from our own content services, which don’t receive your health information.

8. Cookies and similar technology

We use essential storage to keep you signed in and remember your plan on your device. We use analytics (PostHog) to see which pages and features are used. We don’t use advertising cookies or ad-tracking pixels in the app, and health information is never sent to advertising platforms.

You can clear or block cookies in your browser settings; the app may not keep you signed in if you do.

9. Where it’s stored and how it’s protected

Your information is stored with our providers, mainly in the United States and the European Union, and may be processed in Singapore and other countries where they operate. Where the law requires, we use safeguards such as standard contractual clauses for international transfers.

Information is encrypted in transit and at rest. Access to your account data is restricted so that only you can read your own check-ins and lab results. No system is perfectly secure, but we work to protect your information and will tell you and the relevant authorities promptly if a breach affects you, as the law requires.

10. How long we keep it

• Account, plan, check-in and lab information: while your account is open. Deleted within 30 days of you deleting your account.
• Scanned report files: not stored by us.
• Email list: until you unsubscribe.
• Payment records: as long as tax and accounting law requires (usually up to 7 years).
• Backups: overwritten within 30 days.

11. Your choices and rights

Wherever you live, you can:

• see and download your information (in the app: You → Your data, or by email);
• correct it (edit your answers in You, or your lab values in My labs);
• delete individual results, or your whole account;
• withdraw consent for health information or emails at any time;
• unsubscribe from emails with the link at the bottom of each one;
• turn off reminders in the app or your device settings.

Depending on where you live (for example the EU, UK, Singapore, California and other US states), you may also have rights to object to or restrict certain uses, to data portability, and to complain to your data protection authority. We will not treat you differently for using your rights. To use any right, email privacy@getmedhya.com; we reply within 30 days and may need to confirm your identity. You can appeal a decision by replying to our answer.

12. How to delete your data

1. In the app: You → Your data. “Delete my health data” removes your check-ins and lab results straight away; “Delete my account” also removes your plan and closes your account within 30 days.
2. By email: write to privacy@getmedhya.com from the email address you signed up with, with the subject “Delete my data”.
3. Instagram or Facebook messages: send us a message saying “delete my data”, or email us with your Instagram or Facebook username, and we will delete the conversation information held by our messaging tools.

We confirm when it’s done, within 30 days.

13. US consumer health data notice

Some US state laws (including Washington’s My Health My Data Act, and laws in Nevada and Connecticut) give extra rights over “consumer health data”. In short:

• What we collect: the health information described in sections 3 and 4 (thyroid story, symptoms, medication timing, check-ins, lab results).
• Where it comes from: you, when you use Thyrowell.
• Why: only to provide and improve your plan and the features you use (section 5).
• Who receives it: only the service providers listed in section 7 that store or process it for us (Supabase, Vercel, OpenAI for report reading, and PostHog for limited product analytics). We do not sell it.
• Your rights: to know, access, delete and withdraw consent, as in sections 11 and 12, and to appeal our decision.

14. Changes to this policy

We will update this page when our practices change and show the new date at the top. If a change is significant, we will tell you in the app or by email before it applies, and ask for your consent again where the law requires.

15. Contact

Privacy questions or requests: privacy@getmedhya.com
Everything else: support@getmedhya.com
Post: Madhu Herbals Private Limited, 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051