Privacy Policy
Joii UK Limited · June 2026
This Privacy Policy describes what personal data we collect, how we handle it, why we need it and who we share it with. We may supplement it with additional data-protection notices where appropriate.
Who we are
We are Joii UK Limited (“Joii”, “we”, “us”), a company registered in England and Wales under company number 13513353. Our registered office is 8 Beauvale, Ferdinand Street, London, NW1 8EY. Joii is the data controller for the personal data and special-category personal data covered by this Privacy Policy.
Key definitions
Personal data means any information relating to an identified or identifiable individual — someone who can be identified directly or indirectly, for example by name, an identification number, location data, an online identifier, or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
Special-category personal data includes data concerning health, genetic and biometric data, and data concerning a person’s sex life or sexual orientation, among other categories. Information about your menstrual health is special-category (health) data, and we treat it with the additional protections this requires.
Data controller means the entity that determines the purposes and means of processing personal data. Joii is the data controller for the data covered by this policy.
The data we collect and why
Depending on how you use Joii, we may collect:
Contact details — e.g. first name, last name and email address, when you contact us, order an evaluation pad, or sign up to our mailing list.
Account and usage information — information needed to operate your account and the app.
Menstrual health data — the information you record in the app about your cycle, fluid measurements, clots and symptoms.
Pad images — photographs of evaluation pads that you take and submit through the app for analysis.
Wider health information — information you choose to provide about your medical history, medications, and doctor or healthcare appointments.
Under UK GDPR, we must have a lawful basis for processing your personal data, and — for special-category (health) data — an additional condition.
For ordinary personal data, we rely on:
Performance of a contract — to provide the Joii app and services you have signed up for, and to fulfil orders for evaluation pads.
Consent — for optional activities such as marketing communications and participation in research, which you can withdraw at any time.
Legitimate interests — for purposes such as keeping our app and website secure, preventing fraud, and improving our products, where these interests are not overridden by your rights.
For special-category (health) data — including the information you record about your cycle, fluid measurements, clots, symptoms, pad images, medications, medical history and appointments — we rely on your explicit consent (UK GDPR Article 9(2)(a)). You provide this when you choose to record health information in the app, and you can withdraw it at any time. Where you choose to contribute to research, we process your health data on the basis of your separate explicit consent for that purpose.
Research and aggregated data
If you choose to contribute to menstrual health research, your participation is voluntary and based on your explicit consent. Where data is used for research, it is pseudonymised — direct identifiers are replaced with a unique code, so it is not directly identifying, though it remains personal data and is protected accordingly.
Where we use data in our own public-awareness or marketing materials, it is presented only in aggregate form (for example, average fluid levels by age group), from which individuals cannot be identified.
Cookies and analytics
Our website uses only the cookies necessary for it to function. We do not run advertising trackers or non-essential website cookies. Within the Joii app, we use Firebase (Google) for in-app analytics and diagnostics — for example, to understand how the app is used, detect crashes, and improve performance. This helps us run and improve the app and is not used for advertising.
How long we keep your data
We keep personal data and special-category data only for as long as necessary for the purposes for which it was collected, and to meet legal, tax and regulatory requirements. In practice:
Account and health data (including cycle information, fluid measurements, pad images, symptoms, medications and medical history) is kept while your account is active. If your account becomes inactive or you ask us to close it, we delete or anonymise this data within 24 months.
Order and payment records for evaluation pad purchases are kept for 6 years, to meet UK tax and accounting requirements.
Marketing and contact data is kept until you unsubscribe or ask us to delete it.
Research data is retained for the period set out in the relevant study information and consent.
When you ask us to delete your data, we will action this within one month, though it may take longer to remove from secure backups. We may retain limited data where the law requires it (for example, to handle legal claims or meet regulatory obligations).
Sharing your data
We do not sell your personal data. We share it only with service providers who process it on our instructions, under contracts requiring them to keep it secure and confidential, and only where necessary to operate our services. These include:
DigitalOcean — secure hosting of our application and database, where your account and health data is stored.
Cloudflare — content delivery, security, and object storage (including storage of the pad images you submit).
Firebase (Google) — app infrastructure, crash reporting, diagnostics, and in-app analytics.
Apple App Store and Google Play — distribution of the Joii app and related services.
Shopify — processing of orders and payments for evaluation pad purchases.
Some of our service providers are based outside the UK (for example, in the United States). Where your data is transferred outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an equivalent approved mechanism.
Your rights
Under UK GDPR you have the right to: access the data we hold about you; have inaccurate data corrected; have your data erased in certain circumstances; object to or restrict certain processing; data portability; and, where processing is based on consent, to withdraw that consent at any time (without affecting processing carried out before withdrawal).
To exercise any of these rights, contact us using the details below. We may need to confirm your identity first, as a security measure to ensure data is not disclosed to anyone without the right to receive it.
Complaints
You have the right to lodge a complaint about our processing of your data with the UK supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk.
Data security
We have put in place appropriate technical and organisational measures to prevent your data from being lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to those who have a business need, under a duty of confidentiality. We have procedures to deal with any suspected data-security breach and will notify you and the relevant regulator where we are legally required to do so.
Children’s data
The Joii app is intended for users who are at least 13 years of age. If you reside in the European Union, the United Kingdom, or Canada, you must be at least 16 years old to use the app, in line with local data-protection laws. Users who are minors in the jurisdiction in which they reside must have the permission of a parent or guardian before using the app.
We do not knowingly collect personal data from anyone below the minimum age that applies to them. If we become aware that we have collected data from a child below the applicable age without appropriate consent, we will take steps to delete it. If you believe a child has provided us with personal data, please contact us at hello@joiicare.com.
Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be posted here and take effect when posted. Please review it each time you use our website or services. This policy was last updated on 29 June 2026.
How to contact us about data protection
You can contact us about data protection by email at hello@joiicare.com or by post at 8 Beauvale, Ferdinand Street, London, NW1 8EY.