Privacy Policy
Ovum AI Privacy Policy
Ovum AI Trading Pty Ltd ACN 681 279 149
Last update: 17 August 2026
At Ovum AI, we are passionate about helping to improve the standard of women’s health care, by increasing the longitudinal women’s health data for use in medical research, and AI data models.This way we can begin to improve diagnostics and treatments for women, thereby closing the gender health gap.
Thank you for your participation to help bridge the women’s health data gap. You are trusting us with information that is important to you and your health, and we want to be transparent about how we use it.
In this Privacy Policy (“Policy”), we will describe the privacy practices for our products and services (the “Services”). You will learn about the data we collect, how we use it, the controls we give you over your information, and the measures we take to keep it safe.
What this Policy, we will cover:
Information We Collect
What We Don’t Collect
How We Use Information
How Information Is Shared
Automated Decision-Making
Your Rights To Access and Control Your Personal Information
How to Exercise Your Privacy Rights
Data Retention
Information Security
Our International Operations and Data Transfers
US Disclosures
Changes to This Policy
Who We Are and How To Contact Us
WHAT INFORMATION ARE WE COLLECTING?
From the first moment you interact with Ovum, we are collecting data. Sometimes you provide us with data, sometimes data about you is collected automatically.
Personal Information
For the purposes of this policy, “personal information” is information that identifies, or can reasonably be linked directly or indirectly to, an identifiable person. In plain terms: personal information is anything that could reasonably be used, on its own or together with other information, to work out who you are.
Anonymous, De-Identified or Aggregated Information
Personal information does not include information that is anonymous, de-identified, or aggregated, however, we will also tell you throughout this policy how that information is being used, so that you can make an informed decision on whether to contribute to valuable women’s health data that Ovum collects.
Here’s more information about the data we collect, which falls into three broad categories: 1) information you provide us directly, 2) information we collect about you automatically, and 3) information we collect from others (third parties). We’ll explain what sort of data falls into these three categories below.
INFORMATION YOU PROVIDE US DIRECTLY
ACCOUNT INFORMATION
Some information is required to create an account on Ovum, such as your first name, gender, year of birth, living status (regional, rural or remote).
When you register an account with us, we will issue you with a user identifier , which we will use internally instead of your name wherever possible to allow us to minimise use of your personal information.
ADDITIONAL INFORMATION
To allow you to use certain features of Ovum, you may choose to (but you do not have) provide us with additional information, like height, weight, health symptoms, health tracking (your menstrual cycle, any data you choose to share through integration with Apple Health (optional)), past medical history, antenatal history, number of times you have seen a doctor, smoking and drinking history, diet (Voluntary Information).
We take reasonable precautions to ensure that we de-identify your information, and Ovum includes an automated ‘redaction’ feature, which we highly recommend that you use when uploading any Voluntary Information consisting of images or documents. You must still review Voluntary Information (even when using the redaction feature) to ensure that no personal information which identifies you remains.
You must not include in the Voluntary Information your full name, email address or other identifying information in any input in Ovum other than the account set up stage (this includes free text entry and document or photographic uploads), as it cannot be guaranteed that this information will be flagged as information which may identify you.
Exception: feedback and issue reports: if you choose to send us feedback or report an issue through Ovum's in-app feedback tool, we collect the email address linked to your Ovum account together with your message, so that our support team can respond to you directly. This is different from the rest of your in-app data: unlike your Voluntary Information (which we ask you to keep free of your name, email address or other identifying details, as above), your feedback or issue report is not de-identified, because we need to know who to reply to. We only use this email address to handle your feedback or issue, and it is not linked to your Voluntary Information for the purposes of AI training or research described in this Policy.
INFORMATION WE COLLECT AUTOMATICALLY
USAGE INFORMATION
When you access or use Ovum, we receive certain usage or network activity information. This includes information about your interaction with Ovum, for example, when you view or search content, create or log into your account, when you opt in to connect to Apple Health and any application you have connected to this, for example, a menstrual tracking application, your sleep data, energy expenditure, heart rate, respiratory rate, and body temperature.
INFORMATION WE RECEIVE FROM THIRD PARTIES
If you choose to connect your account on Ovum to your account on another service (such as Apple Health or Android equivalent) (Other Service), we may receive information from the Other Service. You can stop sharing the information from the Other Service with us by removing our access to that Other Service.
For clarity, this is a one-way ingestion of your data from third party services (such as Apple Health or Android equivalent), and we do not share your data with those services.
WHAT WE DON’T COLLECT
You must be at least sixteen (16) years old to use Ovum. So, we do not collect any data of children or minors less than sixteen (16) years old.
HOW DO WE USE THE INFORMATION?
We use the information we collect for the following purposes.
TO ENSURE OVUM IS TAILORED FOR WOMEN
Using the information we collect, we are able to deliver Ovum in a tailored, and personalised manner. For example, we need to use your information to provide you with the most accurate and relevant information based on the symptoms you are reporting, the questions you are asking, and other medical reports or biometric data you are inputting. This will also help us give you customer support.
TO CONSTANTLY IMPROVE OVUM FOR ITS USERS
We use the information we collect to improve Ovum and to develop new features or improve errors. For example, we use the information to troubleshoot and protect against errors; perform data analysis and testing; conduct research and surveys; and develop new features and Services.
We also use your information to make inferences and show you more relevant content. Here are some examples (this is not a full list):
Voluntary Information provided to us, like your height, weight, gender and age, menstrual and antenatal history, past medical history allows us to improve the experience / accuracy of the information Ovum provides you when you have a question about a specific symptom. For example, if you asked Ovum about stomach pain, and you had let Ovum know you were pregnant, it would provide different information to if you were not pregnant and had a history of irregular periods.
Based on your health data inputs (symptoms, biometric data, medical reports), we provide you with customised insights, and recommendations to help you better understand and manage your health. Ovum may provide you with lifestyle suggestions (for example diet plans, or exercise plans), but will not give you treatment advice (for example what medications you should take). However, Ovum can provide you with general information about medications you are already taking. These inferences are suggestions only, and do not constitute specific health or medical advice [see Terms of Use].
For clarity, we do not share your information with services such as Apple Health or Android equivalents, we may access this data if you opt-in to provide Voluntary information, but this is a one-way relationship; data created by Ovum is not shared back to those third parties as part of that integration.
TRAIN AI DATA SETS USING AGGREGATED OR DE-IDENTIFIED DATA
Ovum's mission is to close the gender health gap and improve gendered AI datasets. To do this, we use aggregated or de-identified aspects of the information we hold about you, such as your year of birth, gender, age, location, reported symptoms, past medical history, medication history, allergies, and smoking, drinking or diet history. We share this data with research institutions and with our own and third-party artificial intelligence (AI) providers to help train AI models on women's health data. We also use it to conduct research with partners such as hospitals, universities, health insurance companies and healthcare providers on women's health in general.
In order to protect your privacy, we will restrict the nature of such information shared with third parties so that it will not include any information which identifies you, or poses a risk of re-identification. For example; your name and email address will be replaced with a vector number within our background servers and all data will be aggregated so that it will not be linked to any particular individual. You may opt-out from this use by notifying us within Ovum in the settings menu.
COMMUNICATE WITH YOU
We use your information when needed to send you Ovum notifications and respond to you when you contact us. We also use your information to promote new features or products that we think you would be interested in. You can control marketing communications and most Ovum notifications by using your native notification preferences (in your device settings outside the app) or via the “Unsubscribe” link in an email.
PROMOTE SAFETY AND SECURITY
We use the information we collect to promote the safety and security of Ovum, our users and other parties. For example, we may use the information to authenticate users, protect against fraud and abuse, respond to a legal request or claim, conduct audits and enforce our terms and policies.
We recommend that you use secure login methods, such as Face ID or other device-based authentication to access Ovum, however, we do not access or store this information.
HOW INFORMATION IS SHARED
Depending on which features of Ovum you use, we will process your personal information based on one or more of the following legal bases (we have included some examples):
BASES FOR PROCESSING YOUR INFORMATION
Your consent: During your onboarding to Ovum there will be clear terms and conditions which you can read, that will explain what data is being stored, how it is being used, and the limitations of artificial intelligence. You give us permission to process health data in order to use Ovum. All data will be de-identified or aggregated and encrypted wherever possible, and especially if shared outside of Ovum, meaning it cannot be linked back to a specific user (subject to, and please read the expectation not to include identifiable information in the Voluntary Information in section 1a.ii. above).
Use of AI
Ovum may use AI models hosted within Ovum’s own infrastructure, meaning that it is not shared with third parties to provide support of AI-enabled features within Ovum.
To fulfil our contractual obligations to you in order to provide Ovum to you: We may process your personal information to fulfil our contractual obligation to you such as account management and other administrative purposes.
Legitimate interest: We may process your personal information in relation to our interests in providing Ovum to you, including our interest in protecting the security and integrity of Ovum. If we rely on this basis, our interests will not come before your rights.
Legal obligation: We may be obligated to process some of your personal information to comply with applicable laws and regulations.
For external processing: We may transfer information to our corporate affiliates, service providers, research partners and other partners who process it for us, based on our instructions, and in compliance with this policy and any other appropriate confidentiality and security measures.
Below, we describe the purposes for which we process your personal information and our lawful bases for doing so, including some basic examples:
Purpose of Processing
To support the existing functions of Ovum, including customisation of content and materials you see when you use Ovum.
Legal basis for processing
Consent
Example
We use your health data to track and make recommendations regarding your health, and provide certain suggested articles or materials to read that may be of interest based on your information inputs, noting that Ovum is not a diagnostic tool, nor does it give personalised medical advice.
Purpose of Processing
To respond to your comments, questions, and requests and to provide customer service.
Legal basis for processing
Legitimate interest
Example
We may process your name and email to reply to your support request or to contact you about a specific query or question you have raised.
Purpose of Processing
To monitor and analyse trends, usage, and activities in connection with our Services.
Legal basis for processing
Legitimate interest
Example
We may analyse your browsing activity in Ovum to ensure Ovum functions as it should in response to your interactions, fix issues, and improve your future experience.
Purpose of Processing
To provide de-identified information to artificial intelligence (AI) models, medical research databases and other healthcare businesses to improve access to women' s health data.
Legal basis for processing
Consent
Example
We may share your non-personal, de-identified information (untraceable back to you) to artificial intelligence (AI) models for the purposes of: training the AI models on women’s health data for the purposes of medical research.
(This is subject to the expectation that you do not include identifiable information in the Voluntary Information, see section 1a.i. above).
PRINCIPLES OF PROCESSING
Data minimisation and purpose limitation: We will not process personal information in a way that is incompatible with the purposes for which it has been collected or authorised by you or collect any personal information that is not needed for the mentioned purposes.
No sale of personal information: We never sell the personal information of our users. We do not share your personal information except in the limited circumstances described above.
AUTOMATED DECISION-MAKING
Ovum uses computer programs, including AI models, to generate personalised content for you without a person reviewing each individual output first. This includes the health-related inferences, lifestyle suggestions (such as diet or exercise plans), and general information about medications you are taking that you see within Ovum.
Personal information used: your reported symptoms, biometric data (such as heart rate, sleep, and body temperature), menstrual and antenatal history, past medical history, medication history, and demographic information (age, gender, year of birth).
Decisions made solely by these computer programs: the specific content, inferences, and suggestions generated and shown to you within Ovum in response to your inputs.
These outputs may influence decisions you make about your own health, for example, whether to see a doctor, change a health behaviour, or ask a question about a medication. Ovum's AI does not diagnose conditions or recommend treatment, and its outputs are suggestions only. Always consult a qualified healthcare professional for medical decisions.
YOUR RIGHTS TO ACCESS AND CONTROL YOUR PERSONAL INFORMATION
No matter which country, state or region you live in, we are committed to giving you privacy rights that meet the law of your country of residence. In short: wherever you are, you generally have the right to see, correct, restrict, delete, or object to our use of your personal information, as set out below. Where local law sets a lower standard, we also apply the higher requirements of the European Union's General Data Protection Regulation (GDPR), Singapore's Personal Data Protection Act 2012 (PDPA), and Hong Kong's Personal Data (Privacy) Ordinance (PDPO) (each as at the time of publication).
What are these rights?
Correction of your personal information
If you believe that your personal information is inaccurate, you have the right to contact us and ask us to correct such personal information.
Restriction of processing
You have the right to request that the processing of your personal information be restricted in some circumstances. For example, you have the right to request the restriction of your personal information if you contest the accuracy of your personal information and we need some time to verify its accuracy.
Access to your personal information
You have the right to request information about what personal information we process about you, to access all your personal information, and to receive a copy of it, including in a structured and portable form PDF.
Erasure of your personal information (“right to be forgotten”)
In short: you can delete your data at any time from the Settings menu. You may ask us to erase your personal information if you withdraw your consent to processing, or if you believe such processing is unlawful. Please be aware that erasing some personal information may affect your experience using certain features of Ovum that rely on historical data. You can delete your personal information within Ovum in the settings menu. Please note that deleting Ovum from your device without first deleting your data will not result in your data being fully deleted.
For the purposes of de-identified information only, this data that may be used to train AI models may not be able to be fully erased. However, this is not strictly personal information and does not identify you. We will make best efforts to request that this information is erased, but we do not guarantee that it will be.
Objection to the processing of your personal information
In some cases, you can object to the processing of your personal information, for example, if we process it under the legitimate interest basis, by emailing us at support@askovum.com, or by updating your preferences in Ovum in the settings menu.
HOW TO EXERCISE YOUR PRIVACY RIGHTS
You can update your privacy preferences within Ovum in the settings menu at any time, in which case, the changes will take effect immediately. Alternatively, or if your request relates to any action which is not one of the options available in the settings menu, you may email us at support@askovum.com to exercise your privacy rights.
We will address your request within 20 business days after receipt, either to notify you that it has been actioned, request further information, or to inform you that the request has been denied, or that more time is needed. It can take us longer to action some requests, for example for full erasure of your personal information stored in our backup systems. We will let you know if we need more time and explain the reasons for the delay. If you are located in Singapore and we need more than 30 calendar days to respond, we will write to you within that 30-day window to tell you when to expect a response, in line with the Personal Data Protection Act 2012 (PDPA). If you are located in Hong Kong and are making a Data Access Request or Data Correction Request, we will comply with your request (or explain in writing why we are refusing it) within 40 calendar days of receiving it, as required under the Personal Data (Privacy) Ordinance (PDPO).
Please keep in mind that if we receive a vague request, we may contact you to better understand the request before doing anything. We may also refuse to comply with or charge a reasonable fee for a request that is manifestly unfounded and/or excessive (repetitive) requests.
We will require you to prove your identity as the person who the information relates to before we action a request. Normally, we will verify that the request is coming from the same email that you provided when registering. If we reasonably suspect that your email has been compromised (and the request is not genuinely from you), or you have not registered your account, we may ask you to undergo additional verification checks to ensure we can appropriately respond to you.
In addition to the above, in relation to a request to access personal information, we may refuse to do so, provided our refusal is in line with lawful reasons in your region, for instance, that your request poses a serious threat to life, health or safety of an individual. If we refuse your request, we will give you detailed reasons for our refusal, and you may make a complaint to your local data protection authority if you wish.
You may have the right to lodge a complaint with your local data protection authority about any of our activities, for example, Singapore's Personal Data Protection Commission (PDPC) or Hong Kong's Privacy Commissioner for Personal Data (PCPD), if you are located there, or another relevant authority in your country of residence. If you have any concerns about our privacy practices, please let us know first by emailing support@askovum.com, we'd welcome the chance to put things right.
TYPES OF PROCESSING
Processing to make Ovum run
In some situations, we engage other companies to process your personal data on our behalf. We refer to these companies or service providers as “processors.”
Processors are companies that help us run Ovum, support our communication with you, or perform other Services-related activities. They process certain personal information on our behalf to accomplish the goals related to the functions and deliver Ovum and associated activities. We remain responsible for any acts or omissions of our processors, and we enter into data processing contracts with them to the extent required by applicable law.
Here are some of the main processors we rely on:
Processor name
Type of data it processes
Purpose it processes data for
Open Access A.I.
All de-identified information provided (no information which identifies you); and
Any Voluntary Information entered by you into Ovum after the onboarding stage.
Access to, analysis of and summarising of health information
Provision of personalised and tailored health recommendations
Microsoft Azure
All personal information provided
Storage of all personal data when you use Ovum
De-identified Information
We may aggregate, anonymise, or de-identify your personal information so that it cannot reasonably be used to identify you, and is no longer “personal information”. We may share such data with other third parties such as academic research institutions or use the data for statistical purposes. For example, we may share or use general age and demographic information and aggregate statistics about certain activities or symptoms from data collected to help identify patterns across users in articles, blog posts, and scientific publications. Sharing such data may contribute to the advancement of scientific research on female health.
To ensure all identifying information is properly de-identified, it is important that you do not include in the Voluntary Information any identifying information such as your name, email address or phone number (see section 1a.ii. above).
You can withdraw your consent at any time by emailing us at support@askovum.com, or by updating your preferences within Ovum in the settings menu.
DATA RETENTION
Except as set out below, we will retain your personal information for as long as needed to provide you with Ovum or otherwise fulfil the purposes for which it was collected.
Impact of account deactivation/requests to erase personal data: At any time, you can deactivate your account and erase your personal information by requesting your personal information be deleted within Ovum in the settings menu, or by emailing support@askovum.com. Our data deletions practices are described below:
We will address your deletion request within 20 business days after receipt.
It will take us up to 20 business days in some cases to complete full erasure of your personal information stored in our backup systems. In case of a full erasure request, as noted under “Erasure of your personal information” section above, de-identified data does not identify you and while we may make reasonable efforts to delete this data where possible, we do not guarantee it.
Limitations: You should be aware that although we will anonymise or otherwise de-identify your data where possible, we may retain certain personal information and other information after your account has been terminated or deleted as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.
INFORMATION SECURITY
Our obligations regarding security: We work hard to keep your data safe. We use a combination of technical, administrative, and physical controls to maintain the security of your data.
This includes:
Encryption of your personal data in transit and in rest
Protection of data integrity via information security management processes
Organisational and legal measures: For example, our employees have different levels of access to your personal data and only access your personal data for limited and necessary purposes required for the operation of Ovum. We impose strict rules on our employees for any disclosure, unauthorised access, alteration, destruction, or misuse of your personal data.
Your obligations regarding security of your account: Please protect your password, and for an added layer of protection,when you sign up with Ovum you will be required to set a pin code. Do not share your password or allow others to use your mobile device. You are also encouraged to use secure methods of access available via your device, such as biometric authentication (e.g. Touch ID, Face ID or equivalents) for increased security.
No method of transmitting or storing data is completely secure, however. If you have a security-related concern, please contact support@askovum.com.
What happens in the event of a security breach: If we learn of a security breach or potential personal data breach, we will assess it and take reasonable steps to remedy it and protect you — which may include posting a notice or notifying you by email, logging you out of all devices, resetting your password (and sending you a temporary password to apply), and any other reasonably necessary action, as required by applicable law and this Privacy Policy.
Across Australia, Singapore and Hong Kong, we follow the same process: we assess whether a breach must be notified within 30 days of becoming aware of it, and where notification is required, we notify the relevant regulator and affected individuals. The frameworks differ mainly in how quickly we must act, and — for Hong Kong — whether notification is a legal requirement at all:
Australia: where a breach is likely to result in serious harm (an "eligible data breach" under the Privacy Act 1988), we notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable after forming that view.
Singapore: where a breach is likely to cause significant harm, or affects 500 or more individuals, it is a notifiable data breach under the PDPA; we notify the Personal Data Protection Commission (PDPC) no later than 3 calendar days after we determine it is notifiable, and notify affected individuals as required by law.
Hong Kong: the PDPO does not currently impose a general legal duty to notify the Privacy Commissioner for Personal Data (PCPD) or affected individuals. As a matter of good practice, we follow the same assessment process and will notify the PCPD and affected individuals as soon as practicable where we consider it appropriate.
If you want to report a security incident related to Ovum, please email us at privacy@askovum.com.
OUR INTERNATIONAL OPERATIONS AND DATA TRANSFERS
We are based in Australia. Personal information we collect is transferred to and processed in Australia, the United States (US) and to other countries.
Transfers of personal data outside of the European Union, the European Economic Area, and the United Kingdom
Personal information in the European Union (EU), the European Economic Area (EEA), and the United Kingdom (UK) is protected by the General Data Protection Regulation and Data Protection Act 2018 (GDPR), but some other countries may not necessarily have the same standard of protection for your personal information.
Please review the “Your Rights To Access and Control Your Personal Information” section above for how your account settings and tools allow you to exercise your rights under the GDPR to access and control your personal information.
Transfers of personal data from Singapore
If you are located in Singapore, before we transfer your personal information outside Singapore (including to Australia and the United States, and to our processors such as Microsoft Azure and Open Access A.I.) we take steps to ensure the recipient is bound by legally enforceable obligations that protect your personal information to a standard comparable to the Personal Data Protection Act 2012 (PDPA)'s Transfer Limitation Obligation. We do this through contractual data protection clauses with our processors and affiliates.
Transfers of personal data from Hong Kong
Section 33 of Hong Kong's Personal Data (Privacy) Ordinance, which would restrict transferring personal data outside Hong Kong unless certain conditions are met, has historically not been brought into force. We will update this Policy if that changes. In the meantime, and as a matter of good practice, we apply contractual safeguards with our processors and affiliates consistent with the Privacy Commissioner for Personal Data's recommended model clauses.
United States Privacy Disclosures (applicable to US residents only)
We do not sell your information for monetary gain.
Under certain state laws (including California), if we disclose personal information to a third party for any benefit, this can be considered a “sale” or “share” or personal information, even if the third party does not use the personal information for any other purpose. We “share” personal information if we disclose personal information to a company for purposes of cross-context behavioural advertising.
Request to opt out: While we do not sell your personal information for monetary gain, you have the right to opt out of our “sale” or “sharing” of your personal information (as defined under California or other US state legislation) to our analytics and advertising partners. This statement does not apply to aggregated or de-identified data, which may be shared in this way (but you may still opt out). To exercise this right, you can do so within Ovum in the settings menu, or alternatively, contact us at support@askovum.com.
Limiting the use of sensitive personal information: Sensitive personal information that we process is limited to only those purposes that are necessary to provide products or services to you. We de-identify or anonymise data wherever feasible without affecting our Services.
Request to know/access: In addition to the other rights mentioned in this Privacy Policy, you have the right to request to know (i) the personal and sensitive information we have collected about you and our purposes of use; and (ii) the categories, sources, and third parties involved in personal information we have collected about you or “sold” or disclosed in the past 12 months. You may exercise your right to request to know twice a year, free of charge.
Shine the Light: California residents may also request information from us once a calendar year about any personal information shared with third parties for their own direct marketing purposes. We don’t share information with third parties for their own marketing uses, but please email us at support@askovum.com if you have questions. You’ll need to specify “California Privacy Rights Request” in the subject line of the email, and also include your name, street address, city, state, and ZIP code.
References to “personal information” in this policy include “sensitive/personal information” as defined under California laws.
CHANGES TO THIS POLICY
We will notify you before we make material changes to this policy and give you an opportunity to review the revised policy before deciding if you would like to continue to use Ovum.
WHO WE ARE AND HOW TO CONTACT US
If you have questions about this policy, or need help exercising your privacy rights, please contact privacy@askovum.com.
Our Data Protection Officer for Singapore is [Name / Title — to be confirmed], reachable at privacy@askovum.com, for any questions about how we handle personal data collected from Singapore.
