Privacy Policy

Last updated: August 2026

This is a working draft, not a final, attorney-reviewed policy. It accurately describes what we actually collect and do today, but hasn’t yet been reviewed by a privacy or health-data lawyer — which matters here specifically because we handle reproductive and mental health information, and states like Washington (My Health My Data Act) impose specific requirements beyond a standard privacy policy. Treat this as an honest description of current practice, not a final compliance document.

Who we are

Arte & Cera (arteandcera.com) is a women’s health education site built by Dr. Angel, a practicing OB/GYN. We provide educational content, self-assessment tools, and tracking tools. We are not your healthcare provider, and using this site does not create a doctor-patient relationship.

Information we collect

Account information. If you create an account, we collect your name and email address through our authentication provider, Clerk.

Health and wellness information you choose to provide. If you use our tools while signed in, we store what you enter: self-assessment answers (including a depression screening tool that flags responses about self-harm for your own follow-up), cycle tracking logs (period, symptoms, pain, medication, temperature), maternity companion data (pregnancy dates, weight, visit notes, mood check-ins), a demographics/interests survey, and your birthday (month and day only). Providing any of this is always optional. Before any of it is saved to your account, we ask you to affirmatively check two separate boxes — one agreeing to the collection itself, one agreeing to the sharing described below — the first time you sign in; see “Your state privacy rights” below for how that works.

Wearable data. If you choose to connect an Oura Ring, we receive temperature deviation and sleep score data from Oura’s API and store it alongside your cycle log. You can disconnect this at any time, which stops future syncing (past synced data remains until you delete it).

Messages and submissions. Contact form messages and feedback, including any email address you provide with them. Ask Dr. Angel questions are tied to your account rather than a submitted email, and are private — only Dr. Angel sees your question, and only you see the answer.

Chat widget questions. We log the text of questions asked to our site chat assistant (powered by Anthropic’s Claude) to understand what people are looking for. We do not log the assistant’s replies or tie questions to your identity.

Usage data. Which articles and tools you use, for the purpose of the optional rewards/points feature and to understand what content is useful.

How we use your information

To provide the tools you use — save your assessment results, show your cycle history, track your maternity data.
To send transactional emails: account/welcome emails, a follow-up email if a mental-health or hormone-therapy assessment result suggests it’s worth checking in, birthday reward emails, and coupon-code emails.
To respond to messages, feedback, and questions you submit.
To improve the site — e.g. seeing which education content is actually read.

We do not sell your personal or health information. We use a product analytics tool (PostHog) to understand how people use the general, non-health parts of the site — things like the homepage and the rewards page. It runs on an allowlist, not a blocklist: any page where you view or enter health information (assessments, the cycle tracker, the maternity companion, labs, your account) is excluded by default, not just by policy, so a new page we add later can’t accidentally start sending data before we remember to exclude it. That includes individual education articles and supplement pages — a specific article title (e.g. which mental-health or reproductive-health topic you’re reading) is itself the kind of information this promise covers, so only the general education and supplements hub pages are tracked, never a specific article or stack. See our privacy scorecardfor exactly how that’s enforced in code, not just described here.

Who we share information with

We use the following service providers to run the site. Each processes data only to provide their specific service to us, not for their own marketing purposes:

Clerk — authentication and account management.
Neon (Postgres) — our database, where your data is stored.
Resend — sends the transactional emails described above.
Anthropic — powers our chat widget; your chat questions are sent to Anthropic’s API to generate a response.
Vercel — hosts the site.
Oura — only if you choose to connect a Ring.
PostHog — product analytics, limited to an allowlist of non-health pages (see above). Never receives anything from a page where health information is viewed or entered.

Our supplement stack pages link out to Fullscript, a separate company that handles its own checkout and payment — we don’t see or store your payment details, and Fullscript has its own privacy policy.

We may also disclose information if required by law, or to protect the safety of you or others. See “Government and law enforcement requests” below for what that actually means in practice.

Government and law enforcement requests

We know this is a real, specific fear for a lot of people using a reproductive health app, especially since federal protections have changed — so here’s a plain-language description of where we actually stand, not just a generic legal clause.

We do not proactively share your data with law enforcement, immigration authorities, or any government agency. We are not aware of ever having received a request of this kind.
Like any US company, we can be legally compelled to disclose data by a valid subpoena, warrant, or court order — no privacy policy can promise otherwise, and we won’t pretend ours can. What we can control is minimizing what exists to hand over in the first place, and being transparent about that.
We don’t collect location or geolocation data, so there is nothing in our systems that could place you at a specific clinic, pharmacy, or provider visit.
Because most of what this site stores is “consumer health data” under Washington’s My Health My Data Act, out-of-state legal process seeking that data faces real, specific legal hurdles that don’t apply to most consumer apps — see “Your state privacy rights” below.
Where legally permitted to do so (i.e., not under a gag order), we will make a reasonable effort to notify you if we receive legal process seeking your data.
You can withdraw data consent or delete your account at any time — see “Your choices” below — which reduces what’s in our systems going forward, even though it doesn’t erase what was already stored without a separate deletion request.

This section, like the rest of this policy, is a working description of current practice rather than a final, attorney-reviewed legal commitment — see the notice at the top of this page.

Your choices

You can download a full copy of your data anytime from your Account page.
You can withdraw your data consent anytime from the “Privacy & consent” card on your Account page — this immediately stops new health data from being saved to your account. It doesn’t erase what’s already stored; for that, contact us to request deletion.
You can request that we delete your account and associated data by contacting us — see below.
Newsletter emails include an unsubscribe link.
Anything you enter without signing in stays local to your device and isn’t sent to us.

Your state privacy rights

Washington’s My Health My Data Act treats most of what this site stores as “consumer health data” and requires us to get your affirmative, opt-in consent before collecting it, and separate, distinct consent before sharing it with the service providers listed above — not just a link to this policy. That is why, the first time you sign in, we show you two separate checkboxes (collection and sharing) that you have to actively check before any signed-in tool will save data to your account; browsing and using tools anonymously doesn’t require this. You can review what you agreed to, or withdraw that consent at any time, from the “Privacy & consent” card on your Account page. We do not sell consumer health data, so the Act’s separate sale-authorization requirement doesn’t apply to anything we do. If you’re a California resident, you may have similar rights under the CCPA/CPRA. To exercise any of these rights, or if you have trouble using the controls on your Account page, contact us using the form on our homepage — we’ll respond within 45 days.

Children’s privacy

This site is not directed at children, and we don’t knowingly collect information from anyone under 18.

Security

We use industry-standard practices (encrypted connections, reputable infrastructure providers) to protect your information, but no system is completely secure, and we can’t guarantee absolute security. For specifics — including where we fall short and what we’re still working on — see our privacy scorecard, where we graded ourselves against the same criteria Mozilla’s *Privacy Not Included guide uses to review period-tracking apps.

Changes to this policy

We may update this policy as the site changes. We’ll update the date at the top when we do.

Contact us

Questions about this policy, or want to access, export, or delete your data? Use the Contact Us form on our homepage.