Updated: 24 October 2026. This product-specific notice supplements the detailed application notice. Shop orders are covered separately by the shop privacy notice. The application remains described as a development service; this notice is not a medical-service or compliance certification.
SIA Platinium, registration 40203106117, VAT LV40203106117.
Registered office: Meža prospekts 62–8, Jūrmala, LV-2010, Latvia.
Privacy requests: contact@platinium.tech; general enquiries: info@platinium.tech; telephone +371 2022 0929.
Sensitive diary information
Pain, symptoms, medication and cycle records can be health data under Article 9 GDPR. Encryption does not remove the obligations applying to those data. A general shop purchase or contact-form consent is not explicit consent to processing a health diary. Processing health data requires a valid Article 6 basis and a separate applicable Article 9 condition, such as specific, informed, explicit consent under Article 9(2)(a). Do not submit real health records for testing before the relevant service authorisation and information are provided.
What the reviewed application stores
Phone verification, password hashes, account identifiers and optional profile fields support account access. Profile information can include a name, email, address, birth date or doctor where you choose to supply it. Phone and profile data are encrypted on the server with AES-256-GCM but can be decrypted by the service for account functions. They must not be described as end-to-end encrypted.
Diary entries and relevant diary modules use browser-side AES-256-GCM encryption before upload. A separate diary password protects a content-key envelope; the reviewed server does not receive that password or the plain content key. The server still processes the account association, record identifiers, timestamps and encrypted contents. Losing both the diary password and the device-generated recovery code can make existing entries unrecoverable. An SMS login does not replace the diary key.
Optional features and recipients
seven.io receives the phone number and SMS text for verification, not diary contents. Hosting uses JustHost and infrastructure that includes the United States; it is not an EEA-only service. Authorised technical staff can access account and operational information within their permissions. Contact us for hosting recipients and relevant transfer safeguards. An order may involve Mollie; see its privacy notice.
Optional browser speech recognition can send audio to the browser provider and needs a separate choice. Optional push reminders use device subscription addresses, technical keys, schedules and a completion date; the reminder content is neutral. Browser push providers may include Apple, Google or Mozilla. Exports and printed reports are created on your device and must be kept confidential. These optional features are not authorised by merely purchasing the product.
Retention, deletion and withdrawal
The reviewed SMS codes expire after 10 minutes; old verification and attempt records are removed by the application’s scheduled-on-use cleanup rules, normally after 24 hours. Account sessions are configured for up to 30 hours, with a shorter setting available. Diary records stay until deleted or no longer needed for the service. Individual entries can be deleted and exported; profile fields can be changed. Contact us for account closure and to withdraw any consent. Withdrawal affects future processing and does not invalidate earlier lawful processing. Necessary contract, payment and legal-claim records can remain under their separate legal basis. Backup copies expire through the backup cycle.
Your rights and contact
Subject to the GDPR conditions, you can request access, correction, erasure, restriction, portability and information about recipients; object to processing based on legitimate interests; and withdraw consent for future processing. Account deletion does not automatically erase invoices that must be retained by law. Contact contact@platinium.tech. We normally respond within one month and explain any lawful extension. You may complain to Latvia’s Data State Inspectorate or your competent local authority.