Privacy Policy

Last updated: 24 October 2026

DadaCoach is a women’s health app. This policy explains what personal data we collect, why, who else receives it, where it goes, how long we keep it, and your rights under the Kenya Data Protection Act 2019 (KDPA). If you live in the EU, EEA or UK, the GDPR also applies and gives you the same rights.

Who we are

The data controller is DadaCoach Limited, Riara Road, Kilimani, Nairobi, Kenya (“DadaCoach”, “we”, “us”). For anything about your data, email privacy@dadacoach.app.

Data Protection Officer: we have not yet appointed one. Until we do, messages to privacy@dadacoach.app go to the person at DadaCoach Limited responsible for data protection. We will name our Data Protection Officer here once appointed.

What we collect

Account details: your name and email address, or your Google account’s name and email if you sign in with Google. Your age or date of birth and life stage, so the app fits you.
Health data you choose to log: period and cycle dates, symptoms, mood, conditions, contraception, pregnancy details and notes. This is sensitive personal data under Kenyan law.
Ask Dada conversations: the questions you ask and the answers.
Community content: forum posts, replies, stories and reports you make.
Technical data: device type, browser, app version, IP address and error reports, to keep the app secure and working.
Usage data: anonymous page-visit counts; detailed feature-usage events only if you opt in.

Why we use it, and our legal basis

Purpose	Data	Legal basis
Running your account and signing you in	Name, email, sign-in details	Contract — needed to provide the app you signed up for
Cycle predictions, insights, doctor reports and personalised content	Health data you log	Your explicit consent (health data is sensitive personal data)
Answering your Ask Dada questions	Your question and a summary of your recent logs	Your explicit consent
Reminders and notifications	Device push address, notification settings	Your consent — only if you switch them on
Keeping the app and community safe (security, abuse prevention, forum moderation)	Account ID, IP address, forum posts and reports	Legitimate interests — protecting you and other users
Counting page visits (Plausible)	Anonymous page visits, no cookies	Legitimate interests — knowing which parts of the app are useful
Detailed feature-usage analytics (PostHog)	Feature-usage events, no health data	Your consent — off unless you opt in
Fixing errors (Sentry)	Error reports with health fields removed	Legitimate interests — keeping the app working
Tax and financial records, when payments are on	Payment amount, reference, phone number	Legal obligation (Kenyan tax law)

We do not sell your data. We do not share your health data with advertisers, employers, insurers or data brokers, and we do not use it for advertising.

Ask Dada and AI

Ask Dada is an AI assistant. To answer you, we send your question, the conversation so far and a summary of your last 30 days of logs (cycle, symptoms, conditions) to Anthropic, the company that makes the Claude AI model, in the United States. We do not send your name, email or phone number. Under its commercial terms Anthropic does not use this data to train its models, and keeps it only for a limited time under its own policy. Ask Dada gives general health information, not a diagnosis, and it does not make decisions about you that have legal or similar effects.

Who receives your data

These service providers process personal data for us, only to run DadaCoach:

Supabase (Database and sign-in) — receives: Your account and everything you log. Where: Ireland (EU).
Vercel (Runs the app) — receives: Every request you make, including the health data it carries; it does not keep your health data. Where: Servers in Dublin, Ireland; requests travel through its global network.
Anthropic (The AI behind Ask Dada) — receives: Your question, the conversation, and a summary of your recent cycle, symptoms and conditions — no name, email or phone number. Where: United States.
Resend (Sends our emails) — receives: Your email address and the email we send you. Where: United States company; our email is sent from its Ireland region.
Upstash (Rate limiting (stops abuse)) — receives: Your account ID or IP address and a request count. Where: Outside Kenya (US or EU).
Google (Sign in with Google, if you choose it) — receives: Google tells us your name and email when you sign in. Where: United States.
Push services (Google, Apple, Mozilla, Microsoft) (Deliver notifications to your device) — receives: Your device push address and the notification text — no health details when Privacy Mode is on. Where: Depends on your browser maker; mostly United States.
Sentry (Error monitoring) — receives: Error reports with health fields stripped. Where: Outside Kenya (US or EU).
Plausible (Anonymous page-visit counts) — receives: Cleaned page addresses; no cookies, nothing that identifies you; nothing on a device in Discreet Mode. Where: European Union.
PostHog (Feature-usage analytics — only if you opt in) — receives: Anonymous feature-usage events; no health data, no session recording. Where: United States.
Cloudflare and Google (Gmail) (Deliver email you send to our @dadacoach.app addresses) — receives: Whatever you write to us. Where: United States.
Telegram (Internal alerts to our team) — receives: At most an account ID when something breaks — never health data. Where: Outside Kenya.

Sharing you choose: if you create a partner share link, the person with the link sees only what you switch on, until you turn it off. A doctor report goes only where you send it. Forum posts and stories are visible to other DadaCoach members.

Inside DadaCoach: a small number of authorised team members can see account data when it is needed to help you when you ask, to keep the community safe, or to meet a legal duty. Your health data is protected so that, in the app, only your own signed-in account can read it.

Where your data is processed

On your device: a copy is kept for offline use. If you turn on encryption in Settings, sensitive health fields are encrypted (AES-256) on your device.
Our database: Supabase, in Ireland (EU).
Our servers: Vercel, in Dublin, Ireland.
Ask Dada, email, sign-in with Google and notifications involve providers in the United States, as listed above.

Your data therefore leaves Kenya. The KDPA (sections 48–50) requires these transfers to be protected. We rely on your consent, given when you sign up, and on each provider’s data-processing terms. Data is encrypted in transit. You can ask us at privacy@dadacoach.app for details of the protection that applies to any provider.

How long we keep it

While you have an account: we keep your account and the data you log so the app keeps working for you.
Ask Dada conversations are deleted automatically 12 months after your last message in that conversation (90 days if you are under 18). You can delete one conversation, or all of them, at any time from the Ask Dada screen. The AI provider that answers Ask Dada deletes what it receives within 30 days.
When you delete your account (Profile → Delete Account, or Settings → Delete All My Data — they do the same): your account, health data, Ask Dada conversations, posts and stories are deleted straight away. If a step fails we tell you and finish it; it is always complete within 30 days. Copies in our database backups are overwritten within 7 days.
Records we must keep: payment and tax records are kept for 5 years as Kenyan tax law requires, and security logs are kept, but both are disconnected from your name and account when you delete it. We keep a note that a deletion happened (date only, no details about you).
Error reports are kept by Sentry for no more than 90 days.

Your rights

Under the KDPA (and the GDPR where it applies) you have the right to:

Be informed about how your data is used — this policy.
Access your data — download a copy any time from Profile → Export My Data (or Settings → Privacy & Data), or ask us.
Portability — that download is in a machine-readable format (JSON).
Correct inaccurate data — edit it in the app, or ask us.
Delete your data — Profile → Delete Account (or Settings → Delete All My Data), or ask us.
Object to processing based on legitimate interests, and to direct marketing at any time.
Restrict processing — ask us to pause using your data while a concern is looked into.
Withdraw consent at any time, for each purpose separately: analytics in Settings → Privacy & Data; notifications in Settings or your phone settings; Ask Dada by not using it; and health data by deleting it, deleting your account, or asking us. Withdrawing doesn’t affect what was done before.
Not be subject to automated decisions with legal or similar effects — we don’t make any.
Complain to the regulator: the Office of the Data Protection Commissioner (ODPC), Kenya — www.odpc.go.ke. If you are in the EU or UK, you can also complain to your local data protection authority.

To use any of these rights, email privacy@dadacoach.app. We reply within 7 days, and we may ask you to confirm it’s really you before sharing or changing data.

Cookies and storage on your device

We use only what the app needs: a sign-in cookie, a note that you’ve seen the cookie notice, your Discreet Mode setting, and the offline copy of your data. We use no advertising cookies. Plausible sets no cookies. PostHog runs only if you opt in.

Discreet Mode

Discreet Mode changes the app’s name and icon on your device to “My Planner”, to protect your privacy on a shared phone.

Children

Under the KDPA (section 33), people under 18 need a parent or guardian’s consent for their data to be processed. You must be 18 or older to create an account yourself. If you are under 18 and created an account, please ask a parent or guardian to contact us at privacy@dadacoach.app, and we will delete it.

Security

Data is encrypted in transit, and access to the database is limited by account. To report a security vulnerability, email security@dadacoach.app. We take every report seriously and reply within 48 hours.

Changes to this policy

If we change this policy, we will update the date above and tell you in the app. If a change affects how we use your health data, we will ask for your consent again before it applies to you.

Contact

DadaCoach Limited, Riara Road, Kilimani, Nairobi, Kenya
Privacy: privacy@dadacoach.app
Help with the app: support@dadacoach.app