Consumer Health Data Privacy Policy — Cloister

Effective date: October 4, 2026 · Last updated: October 4, 2026

B1. Consumer health data we collect, and why

Cloister is a diary. Anything you choose to write may reveal health information, for example your mood, a diagnosis, medication, therapy, pregnancy, or thoughts of self-harm. This includes:

• Entries you write, and their earlier versions (kept privately for 90 days after an edit, longer while a report about your account is open or a legal hold applies).
• Messages you send.
• Reports you submit, if you mention health in them.
• Emails you send us, if you mention health in them.

Why and how it is used: only to provide the diary and messaging you asked for, and to keep Cloister safe:

• storing and showing your entries;
• delivering your messages;
• reviewing reports;
• meeting legal obligations.

We don't use it for advertising. We don't infer health conditions about you, and we don't sell it.

Before you can write in Cloister, we ask for your consent to process health information in what you write and send: when you create your account, this is its own checkbox, separate from accepting our Terms. If your account was created before we asked, the app asks you once before you continue (Privacy Policy, section 12).

B2. Sources

• From you: what you write and send.
• From other users: messages they send you, reports they make, and anything they write about you.

We don't buy consumer health data, and we don't receive it from anyone else.

B3. Consumer health data we share

• With other Cloister users, at your direction. Entries are visible to everyone signed in to Cloister. Messages go to the person you send them to.
• With service providers that process data for us, only to run Cloister (B4).
• With NCMEC or law enforcement, only as described in our Privacy Policy, section 8.

We do not sell consumer health data.

B4. Third parties and affiliates

We have no affiliates. The third parties that receive consumer health data are:

• Supabase, Inc.: database, sign-in and hosting;
• Google (Gmail): our support mailbox;
• NCMEC and law-enforcement agencies: only when the law requires or permits.

B5. Your rights and how to use them

You can ask us to:

• confirm whether we collect, share or sell your consumer health data;
• give you access to it, together with a list of the third parties and affiliates that received it and how to contact them;
• delete it;
• withdraw consent to its collection or sharing. Because this data is what you write, withdrawing consent means we delete your account (Privacy Policy, section 12).

• How: email growevolve.business@gmail.com with the subject "Health data request". There is no fee.
• Verification: we will take reasonable steps to confirm the request comes from you, for example by writing to the email address linked to your Cloister account and asking you to reply.
• Timing: we respond within 45 days. We may extend this once by up to 45 days and will tell you why.
• Deletion: removes the data from our systems, including what our service providers store for us. Copies in backups and server logs are deleted when those expire, within 7 days and never later than six months.
• Exceptions: data we must keep under section 9 of our Privacy Policy, for example material reported to NCMEC or information needed to investigate harassment or illegal activity.
• Appeal: if we decline your request, reply with the subject "Appeal". We answer in writing within 45 days. If we deny the appeal, our answer explains how to contact your state's attorney general.

We will not discriminate against you for using these rights.

B6. Contact

Zeyneddin Hasan Erdönmez, doing business as NewEvolve · growevolve.business@gmail.com · Osmangazi Mah., Dr. Cemil Özbal Cad., Çamlıca Evleri A Blok, No: 31 A, 27560 Gaziantep, Türkiye