About this policy
This policy explains how Obscura Vertex Pte. Ltd. ("we", "us") collects, uses, shares and deletes consumer health data through the GoBeast apps (iPhone, Android and web) and the gobeast.com website. It is written to meet Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's consumer health data rules. We apply it to every GoBeast user, wherever you live. It works alongside our Privacy Policy.
Consumer health data means personal information that is linked, or reasonably linkable, to you and that identifies your past, present or future physical or mental health. For GoBeast, that includes information about your sexual and reproductive health, your pelvic-floor training, and the fact that you use, or want to use, an app like GoBeast.
Consumer health data we collect
| Category | Examples | Where it is kept |
|---|---|---|
| Onboarding and check-in answers | Your goals, answers about your sexual health, any medication (optional), relationship status, satisfaction, the private self-check every two weeks | Your device only. We never receive it. |
| Safety information | Answers to the pain and medical red-flag checks, whether you're on the relax-first path, Pain-button stops | Your device only. |
| Training and lesson activity | Programs started; lessons, sessions and steps completed, with dates; session length and completion; your "too easy / right / too hard" taps; Kegel level; streak; reminder time | Your device, and our servers (Supabase, EU) while backup is on |
| Subscription status | Whether you have a trial or subscription, the plan, store, renewal date and price | RevenueCat and our servers |
| App usage events, only with your consent | Neutral action names such as "session_completed", timings and app version; programs appear only as codes | PostHog (EU) |
| Identifiers linked to the above | Random account ID; your email if you sign in or ask for reminder emails; push token | Our servers; RevenueCat (account ID only) |
| Waitlist sign-up | Email address and country. Joining can suggest an interest in men's health. | Our servers (Supabase, EU) |
| Support messages | Anything you choose to tell us | Our support inbox |
We do not collect precise location, biometric or genetic data, photos, audio recordings, or data from health devices or other health apps. App lock uses your phone's own Face ID, fingerprint or passcode check; we never receive biometric data. If we ever add an optional link to Apple Health or Health Connect, we will update this policy before it ships.
Where it comes from
- From you, in the app, on the waitlist form or by email.
- From your device, automatically, as you use the app.
- From Apple and Google, through RevenueCat, when you start a trial or subscription.
We don't buy data, and we don't collect it from data brokers or other companies.
Why we collect and use it
- To give you the training plan and the features you ask for: sessions, lessons, levels and reminders.
- To back up and restore your progress while backup is on.
- To run your subscription: reminders before every charge, refunds, and showing your next charge.
- To answer your support requests.
- To understand, in aggregate, how the app is used and to fix problems, only if you allow analytics.
- To keep the service secure and working.
- To tell waitlist members when GoBeast launches and send founding-member codes.
- To meet our legal obligations.
We collect and use consumer health data only as far as these purposes need.
Who we share it with
We share consumer health data only with service providers (processors) that help us run GoBeast, under contracts that limit them to our instructions:
| Provider | Purpose | Consumer health data involved |
|---|---|---|
| Supabase | Database and server functions (EU, Ireland) | Training activity, identifiers, subscription status, waitlist entries |
| RevenueCat | Subscription management | Account ID and purchase details |
| PostHog | Usage analytics, only with your consent | Usage events linked to your account ID |
| Expo | Push notification delivery | Push token and discreet notification text |
| Resend | Email delivery | Email address and reminder content, which shows you subscribe to GoBeast |
| Sentry | Crash reports | Technical crash data, with personal data removed |
| Cloudflare and our email provider | Routing and storing support email | Support messages |
Apple and Google act as independent controllers when they sell and bill your subscription, deliver push notifications or handle an optional sign-in. Their own privacy policies apply to that.
We do not share consumer health data with any affiliate. We may disclose it if the law requires us to, for example under a valid court order, after checking the request and, where allowed, telling you first. If GoBeast is ever sold or merged, the buyer must keep the protections in this policy, and we will ask for your consent where the law requires it.
What we never do
- Sell consumer health data.
- Share it for advertising, or use it to target or measure ads.
- Send it to advertising networks, attribution tools or data brokers.
- Use a geofence around places where people get health care.
- Use it for a purpose not described here without asking you first.
Your consent
Before any health question in onboarding, the app asks whether to use your answers to personalise your plan. If you say no, you get a general plan and the sensitive questions are skipped. Either way, the answers stay on your phone.
Backup of training activity is on by default so your progress survives a lost phone. The app explains it, and you can switch it off at any time in You › Data › Back up progress, which deletes the copy on our servers. Analytics are off unless you allow them (You › Privacy › Share anonymous usage). Waitlist emails need the box on the form to be ticked.
You can withdraw consent at any time. Withdrawing stops future collection; for backup, it also deletes the server copy.
Your rights
You have the right to:
- confirm whether we collect, share or sell your consumer health data (we never sell it);
- access it, including a list of every third party and affiliate we have shared it with, and a way to contact each of them;
- withdraw your consent;
- have it deleted, including by our service providers;
- appeal if we turn down your request;
- be treated the same whether or not you use these rights.
How to use your rights
In the app
- You › Data › Export my data gives you a copy of what's on your phone and on our servers.
- You › Data › Delete everything deletes your account and your data.
- You › Data › Back up progress and You › Privacy › Share anonymous usage withdraw consent for backup and analytics.
By email
Write to support@gobeast.com with the subject "Health data request" and tell us what you'd like. Write from the email linked to your account, or include something that lets us find an anonymous account, such as the order number on your Apple or Google receipt. We check that the request comes from you before we act. An authorised agent can ask for you with your signed permission.
We respond within 45 days. If we need more time, we can extend once by another 45 days, and we will tell you why. Requests are free.
Appeals
If we turn down your request, reply with "Appeal" in the subject line. We answer within 45 days and explain our decision. If you still disagree, you can contact the Washington State Attorney General, the Nevada Attorney General or the Connecticut Attorney General.
Deleting your data
Delete everything in the app deletes your account and all consumer health data on our servers and on your phone, and we tell RevenueCat and PostHog to delete their records for your account. Deleted data can remain in our database provider's encrypted backups for up to 30 days before it is overwritten. Apple and Google keep their own purchase records as the store. Full details, including how to ask by email: Delete your account.
How we protect it
- Your most sensitive data, your answers, never leaves your phone.
- Data is encrypted in transit and at rest. On your phone it is encrypted with a key held in the iOS Keychain or Android Keystore.
- Row-level security means each account can read only its own records.
- Access to consumer health data is limited to the people who need it to run GoBeast.
Changes and contact
When we change this policy, we update the date at the top, and we tell you in the app before important changes take effect. If a change would let us collect or share consumer health data in a new way, we ask for your consent first.
Obscura Vertex Pte. Ltd., Singapore
Email: support@gobeast.com