Privacy Policy

Solu ("we", "us", "our") is a women's wellness platform operated from the United Arab Emirates. Our website is solu.ae and our app helps women track and understand their menstrual cycle, hormonal health, nutrition, fitness, and sleep.

If you have any questions about this policy or how we handle your data, please contact us via our contact form at solu.ae/contact.

We collect data in two ways — directly from you, and automatically when you use our website or app.

**Information you give us directly:** - Email address, when you join our waitlist or contact us - Name, if you choose to provide it when contacting us - Health and wellness data you enter into the Solu app, including menstrual cycle dates and patterns, hormonal symptoms, sleep data, nutrition logs, and fitness and workout data - Any other information you voluntarily provide when communicating with us

**Information collected automatically:** - Website usage data (pages visited, time spent, referring URLs) via Vercel Analytics — this is anonymised and does not identify you personally - Device type, browser, and operating system when accessing our website or app - IP address, collected automatically by our hosting infrastructure

We do not use third-party advertising trackers or sell your data to data brokers.

We use the data we collect to:

• •Provide and improve the Solu app and website
• •Send you waitlist updates and product announcements (email only, and only if you opted in)
• •Personalise your wellness insights and recommendations within the app
• •Respond to your questions and support requests
• •Understand how our website and app are used so we can improve them
• •Comply with legal obligations

We will never use your health data for advertising purposes, and we will never sell it to third parties.

Menstrual cycle data, hormonal health information, and other health-related data you enter into Solu are considered sensitive personal data under applicable data protection laws.

We treat this data with the highest level of care:

• •Health data is used solely to power your personal Solu experience and provide you with relevant insights
• •We do not share individual health data with third parties, advertisers, employers, insurers, or any other organisations
• •Health data is encrypted in transit and at rest
• •You can request deletion of your health data at any time by contacting us

We may use aggregated, fully anonymised health data (where no individual can be identified) to improve our models and develop new features.

We share your data only in the following limited circumstances:

**Service providers** — we work with trusted third-party companies that help us operate Solu. These include: - Vercel (website and app hosting, based in the USA — covered by standard contractual clauses) - Tally (waitlist and contact forms — your email is stored in Tally when you submit a form)

Our service providers are contractually required to process your data only on our instructions and to keep it secure.

**Legal requirements** — we may disclose your data if required by UAE law, a court order, or a lawful request from a government authority.

**Business transfers** — if Solu is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you before your data is transferred and a different privacy policy applies.

We do not sell, rent, or trade your personal data to any third party.

We keep your data for as long as necessary to provide our service and comply with our legal obligations:

• •Waitlist emails are kept until you unsubscribe or request deletion
• •App account data is kept for the lifetime of your account plus 30 days after deletion, to allow for recovery
• •Health data within the app is deleted within 30 days of account deletion
• •Support and contact enquiries are kept for up to 2 years
• •Anonymised, aggregated analytics data may be kept indefinitely as it cannot identify you

You can request deletion of your data at any time — see Section 8 for your rights.

Solu is based in the UAE. Some of our service providers (including Vercel) are based in the United States. When your data is transferred outside the UAE, we ensure it is protected by appropriate safeguards, including standard contractual clauses approved by the relevant data protection authorities.

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and applicable privacy regulations, you have the following rights:

• •Access — you can request a copy of the personal data we hold about you
• •Correction — you can ask us to correct inaccurate or incomplete data
• •Deletion — you can ask us to delete your personal data (subject to legal obligations)
• •Restriction — you can ask us to stop processing your data in certain circumstances
• •Portability — you can request your data in a machine-readable format
• •Withdrawal of consent — where we process data based on your consent, you can withdraw it at any time

To exercise any of these rights, please contact us via our contact form at solu.ae/contact. We will respond within 30 days.

We take the security of your data seriously. We use industry-standard measures including:

• •TLS encryption for all data in transit
• •Encryption at rest for sensitive health data
• •Access controls that limit who within our team can access personal data
• •Regular security reviews of our infrastructure

No method of transmission over the internet is 100% secure. If you believe your data has been compromised, please contact us immediately via solu.ae/contact.

Our website uses Vercel Analytics, which collects anonymised data about how visitors use our site. This data is not linked to you personally and does not use cookies that track you across other websites.

We do not use advertising cookies or third-party tracking pixels. If we introduce additional analytics tools in the future, we will update this policy and seek your consent where required.

Solu is not intended for anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

We may update this privacy policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email.

We encourage you to review this policy periodically. Your continued use of Solu after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests relating to this privacy policy or your personal data, please reach out via our contact form at solu.ae/contact.

We take all privacy enquiries seriously and will respond within 30 days.