Privacy Policy

Effective Date: April 30, 2025
Version: 2.0

At March Health, your privacy, dignity, and trust are at the heart of everything we do. Endometriosis Master Care is an educational program designed to empower you with information and self-management tools. We do not provide medical advice or treatment recommendations. We strongly encourage all participants to consult their licensed healthcare providers for any medical evaluation or treatment decisions.

This Privacy Policy explains in detail how we collect, use, share, and protect your personal information, and outlines your rights under applicable privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA), the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA).

Information We Collect

We collect information to provide you with the best possible educational experience and personalized support. We adhere to the principle of data minimization, meaning we only collect the minimum necessary information required to deliver our services effectively. The categories of information we collect include:

Personal Information: Such as your full name, email address, profile image, phone number, and other contact details.
Health Information (Special Category Data/Protected Health Information): Including daily symptom check-ins, pain and mood tracking, reproductive history, and responses to health-related questionnaires.
Technical Information: Such as your IP address, device ID, browsing behavior within the app, and session metadata (e.g., clicks, navigation behavior).

All health-related information is classified as “Special Category Data” under GDPR and “Protected Health Information” (PHI) under HIPAA. We use AES-256 encryption for data at rest and TLS 1.3 encryption for data in transit.

We want you to feel confident: We will never sell your health information for advertising or marketing purposes.

Legal Basis for Processing

We collect and process your personal data based on:

Consent: You provide explicit consent through a checkbox and clear consent form during registration.
Contractual Necessity: Certain information is required to deliver the educational services you signed up for.

You may withdraw your consent at any time by deleting your account at https://march.health/delete-account/. We process withdrawal requests within 30 days.

How We Use Your Information

We use your information to:

Deliver personalized educational content, tools, and resources tailored to your needs.
Support you through your assigned Health Coach.
Enhance service design, improve platform performance, and maintain security standards.
Communicate important updates and educational resources.
Showcase success stories or testimonials, only with your prior explicit consent.

Access to your sensitive information is restricted to authorized personnel based on strict role-based access controls, monitored through detailed logging and audits. All data is encrypted during transmission and storage.

Testimonials: Consent can be withdrawn at any time by deleting your account.

Sharing Your Information

We share your information only in limited, transparent ways:

Health Coach Access: Limited to providing individualized support.
Trusted Service Providers: Secure, reputable vendors under Business Associate Agreements (BAAs) where applicable. See the Trusted Providers List below.
Marketing and Testimonials: Only with explicit prior consent.
Legal Compliance: When legally required.
Third-Party Marketing Platforms: To promote March Health and reach new users, we may share limited non-health personal information (e.g., IP address, device identifiers like IDFA, age group, subscription status) with trusted marketing platforms, such as AppsFlyer, under strict data processing agreements. These platforms help us:
- Analyze promotional campaign performance.
- Reach you or similar users on platforms like social media (e.g., Pinterest, Google Ads) with relevant information about March Health.
- Remind you to revisit the app if you stop using it.

We do not share health information (e.g., symptom tracking, health questionnaire responses) for marketing purposes. You may opt out of this data sharing at any time by contacting [email protected] or deleting your account at https://march.health/delete-account/, processed within 30 days. All data sharing complies with GDPR, CCPA, and HIPAA requirements, where applicable.

We never sell, rent, or otherwise share your health or non-health information for advertising or commercial purposes. You can opt out of non-essential data sharing by deleting your account at https://march.health/delete-account/.

International Data Transfers

For users in the EEA or UK, your data may be transferred to the United States. Safeguards include:

Annual Data Transfer Impact Assessments (DTIA): We conduct DTIAs to assess and mitigate risks, with details available upon request at [email protected].
Supplementary Measures: We apply enhanced encryption (AES-256, TLS 1.3) and pseudonymization to minimize risks.

For DTIA details, contact [email protected]

Data Storage and Security

We safeguard your information with:

AES-256 encryption for data at rest and TLS 1.3 for data in transit.
Use MongoDB Client-Side Field Level Encryption and aws KMS.
Role-based access controls, multi-factor authentication, continuous monitoring.
Quarterly security audits following SOC 2 and ISO 27001 standards.
Incident response plans with notification within 72 hours.

We retain data only as long as needed or required by law. Upon deletion request, data is erased within 30 days.
March Health is registered at 16192 Coastal Hwy, Lewes, Delaware 19958, and acts as the Data Controller.

Your Rights

You are empowered to:

Access your personal information.
Correct inaccurate or incomplete information.
Request Deletion of your data (processed within 30 days).
Withdraw Consent without penalty.
Request Data Portability.
Object to certain types of processing.
Request Restriction of processing.
Lodge a Complaint with a data protection authority.
Request a Copy of this Privacy Policy.
To exercise your rights, email [email protected].

Cookies and Tracking Technologies

We use only essential cookies for secure operation and session management, stored for up to 30 days. We do not use non-essential cookies for profiling or advertising.

Analytics tools process only anonymized, non-personal data with health information fully masked.

You can manage cookie settings through your browser.

California Residents: Your Privacy Rights

California residents have rights under CCPA/CPRA, including:

Right to Know
Right to Delete
Right to Opt-Out of sale/sharing
Right to Non-Discrimination
Right to Limit Use of sensitive information

Submit requests via email [email protected].

Children’s Privacy

Our services are intended for users 18 years and older. We verify age during registration. If underage data is detected, it is deleted within 30 days.

Health Connect Integration

Health Data Integration

If you use our mobile app, you may choose to integrate it with Health Connect (on Android devices) or Apple Health (on iOS devices) to access health and fitness data. This section outlines how we handle sensitive health data accessed through these platforms:

Data Access: We may access health data such as physical activity, menstrual cycle data, heart rate, sleep patterns, and other health metrics, only with your explicit consent, to provide personalized health insights (e.g., symptom tracking, cycle calendar) and enhance app functionality.
Data Collection and Use: Health data is collected solely to support app features (e.g., symptom tracking, health coaching, AI recommendations) and improve user experience. We do not use this data for unrelated purposes, such as advertising or marketing.
Data Sharing: We do not share Health Connect or Apple Health data with third parties except as necessary to provide services (e.g., with HIPAA-compliant vendors under Business Associate Agreements) or as required by law.
Data Protection: Health Connect and Apple Health data is protected with AES-256 encryption for data at rest and TLS 1.3 for data in transit, per our Data Storage and Security standards.
Data Deletion: You may request deletion of Health Connect or Apple Health data at any time via https://march.health/delete-account/ or [email protected], processed within 30 days.
Consent: Access to Health Connect or Apple Health data requires your explicit consent, which you can withdraw at any time through app settings.
Compliance: Our practices align with Google Play Store Data Safety labels, Apple App Store guidelines, and applicable laws (e.g., HIPAA, GDPR, CCPA).

For questions about Health Connect or Apple Health integration, contact [email protected].

Trusted Service Providers List

Our trusted service providers include:

AWS (Amazon Web Services): Encrypted cloud data storage.
Hetzner (Server): Our host for our services.
Azure (Microsoft): AI content generation and secure data processing.
Firebase (Google): App infrastructure and push notifications.
Stripe: Payment processing and subscription management.
Smartlook: Session recordings for service improvement.
UXCam: Session recordings for service improvement.
Brevo: Email communication management.
MixPanel: Non-health analytics.
ipgeolocation.io: Region detection.
Branch.io: Deep linking and attribution.

All providers comply with HIPAA, GDPR, and CCPA/CPRA standards.

Changes to This Privacy Policy

We update this policy as needed. Significant changes require active consent via checkbox; minor changes are notified via email or in-app notice.

Continued use after updates constitutes acceptance.

Data Protection Officer

Our DPO oversees GDPR compliance and can be reached at [email protected]

Contact Us

For privacy questions, please contact: [email protected]

Thank you for trusting March Health. Your health journey matters deeply to us, and we are honored to support you with compassion, clarity, and care every step of the way.