Privacy Policy

Data user and controller: Maia Health Limited, Room 1406, 14/F, Yinhe Tower, 303 Jaffe Road, Wan Chai, Hong Kong
Data Protection Officer: Liz Bradford, President and CTO, support@maiahealth.tech

The short version

You’re trusting us with some of the most personal information you have: your symptoms, your cycle, your sleep, your mood, your blood results. Here’s what we promise.

• We never sell your data. Not to advertisers, data brokers, insurers, employers or anyone else.
• We never use your data for advertising.
• Your health data is only used with your consent, and you can withdraw that consent at any time.
• You decide who sees your health data. You choose whether to share it with the Maia care team, and you can stop sharing at any time in the app.
• If your employer or insurer pays for Maia, they never see your health data. They only get combined reports about groups large enough that no one can be picked out.
• Our app runs on pre-programmed rules. Your in-app chat, scores and insights come from fixed questions, responses and scoring set by Maia.
• Any AI we use is kept on a short leash. AI providers we work with can only process your data for us, and can’t use it to train their models.
• Our platform provider can’t use your data for its own purposes. It’s contractually barred from training AI on your data, selling it or using it for advertising.
• You choose how your data helps others. De-identified data helps improve Maia unless you switch it off. Research with medical partners only happens if you opt in.
• You can ask us to delete your data at any time.

1. Who we are

Maia Health Limited (“Maia”, “we”, “us”, “our”) is a women’s health company incorporated in Hong Kong. We help midlife women understand their bodies, access expert guidance and take action on their health.

We’re the data user (or data controller) for the personal data described in this policy. That means we decide how and why it’s used, and we’re responsible for protecting it.

This policy covers everything we offer: our website, our app, the Maia Midlife Clarity Snapshot, our doctor-conversation assessment, our newsletter, our community, our Concierge service, our webinars and events, and Maia memberships paid for by an employer or insurer (together, the “Services”). Not every section applies to everyone. If you’ve only taken the Clarity Snapshot or the doctor-conversation assessment, for example, we only hold your answers and contact details.

2. The laws we follow

We operate in Hong Kong and across Asia. This policy is written to meet the requirements of:

• The Hong Kong Personal Data (Privacy) Ordinance (PDPO), including its Data Protection Principles and direct marketing rules
• The Singapore Personal Data Protection Act 2012 (PDPA)
• Other data protection laws that apply where our members live in Asia

Where these laws set different standards, we apply the stricter one.

Maia doesn’t provide medical treatment and isn’t a healthcare provider. Our insights and guidance support your health. They don’t replace your doctor.

3. The data we collect

• Clarity Snapshot: Your answers (which may include symptoms, wellbeing and lifestyle information), your age range and location, and the name and email address you give us to receive your results.
• Doctor-conversation assessment: Your answers about your symptoms and health, where you live (so your report fits the healthcare system you use), and the name and email address you give us to receive your report.
• Account and profile: Name, email address, date of birth, country of residence, language preference and password (stored only in hashed form).
• Health information: Symptoms, mood, cycle data, body measurements, health goals, lab results and biomarker values you upload, and any medical history you choose to share.
• Connected devices: Only if you connect them: activity, sleep, heart rate and heart rate variability from apps and devices such as Apple Health, Garmin, Oura or WHOOP. These connect to the app through Terra (see section 7).
• In-app chat: Your answers to the questions our in-app chat asks you.
• Messages: What you send us through Concierge (including on WhatsApp), email and support channels.
• Concierge: Only if you’re a Concierge member or take part in a Concierge pilot: your health profile answers, documents you choose to upload such as test results and scan reports, readings you choose to share from wearables or home tests, and notes from your sessions with your coach.
• Payments: Your subscription tier, status and billing history. You can pay for an app subscription through Apple in the app, or through Stripe on our website. Concierge payments go through Stripe. We never see or store your full card details.
• Sponsored membership: Only if your employer or insurer pays for your membership: the name of your employer or insurer, and the details we need to confirm you’re eligible, such as your work email, employee number or policy number.
• Referrals: If you join through a link from a clinic, coach, studio or other partner: which partner referred you.
• Newsletter and marketing: Your email address, your subscription choices and a record of when and how you gave consent.
• Bookings, community and events: Your name, email and booking details when you book a call, register for a webinar or event, or join our community. If you join our Facebook group, what you post there.
• Feedback and testimonials: Your survey and feedback answers. Only if you agree: quotes from your feedback, and photos or videos of you.
• App usage: How you use features, device type, operating system version, session length and crash reports.

We treat all health information as sensitive personal data and protect it to a higher standard.

What we don’t collect

• Your precise location
• Your contacts, photos or other files on your phone, except a document or image you choose to send us
• Your full card details
• Data from anyone under 18

4. How we use your data

We only use your data for the purposes we tell you about when we collect it, or purposes directly related to them. If we want to use it for anything new, we’ll ask for your consent first.

• Give you your Clarity Snapshot results. Data used: Snapshot answers, contact details. Basis: your consent.
• Give you your doctor-conversation report and script. Data used: assessment answers, contact details. Basis: your consent.
• Create and secure your account. Data used: account and profile. Basis: to provide the Services you signed up for.
• Give you personalised scores, insights and recommendations. Data used: health information, connected devices, in-app chat. Basis: your consent.
• Let the Maia care team (coaches and clinicians) support you. Data used: health information, messages. Basis: your consent, which you control in the app.
• Run Concierge, including your plan and check-ins. Data used: Concierge, health information, messages. Basis: your consent.
• Ask for your feedback to improve Concierge. Data used: feedback. Basis: your consent.
• Use your quotes, photos or videos in Maia communications and on social media. Data used: feedback and testimonials, your first name. Basis: only with your separate consent. We show you anything before it’s used.
• Run our community, webinars and events. Data used: profile, booking details. Basis: to provide the Services you signed up for.
• Take payment for your subscription, through Apple or Stripe. Data used: payments. Basis: to provide the Services you signed up for.
• Confirm you’re eligible for a membership paid for by your employer or insurer. Data used: sponsored membership. Basis: to provide the Services you signed up for.
• Give your employer or insurer combined reports on how their group uses Maia. Data used: de-identified data, combined with other members’ data (see section 7). Basis: de-identified data no longer identifies you.
• Pay referral fees to partners who referred you. Data used: referrals. Basis: to provide the Services you signed up for.
• Send service messages about your account. Data used: account. Basis: to provide the Services you signed up for.
• Send you follow-up emails based on your Clarity Snapshot or assessment results. Data used: name, email, Snapshot score tier and highest-strain area, tags based on your assessment results. Basis: your consent (see section 9).
• Send our newsletter and offers. Data used: name, email, preferences. Basis: your consent (see section 9).
• Keep the app working, secure and reliable. Data used: app usage, crash reports. Basis: to operate the Services.
• Improve Maia’s scoring, content and Services. Data used: de-identified data, combined with other members’ data. Basis: on by default. You can switch it off at any time in the app.
• Contribute to women’s health research with medical partners. Data used: de-identified data, combined with other members’ data. Basis: only if you opt in. Off by default.
• Meet our legal obligations. Data used: any, only as required. Basis: legal obligation.
• Protect you in a genuine emergency. Data used: health information. Basis: to protect your life or safety.

De-identified means your name, contact details and anything that directly identifies you are removed, and your data is combined with other members’ so it isn’t used to single you out. Before your data is included in research with a medical partner, we’ll tell you who the partner is. We never sell this data, and we never use data that identifies you for research without asking for your separate consent first.

5. How our scores, insights, chat and AI work

In the app today. Your scores, insights and recommendations are calculated from the data you give us, using fixed scoring rules and content set by Maia. Our in-app chat works the same way: it asks pre-programmed questions and gives pre-programmed responses based on your answers.

How we use AI. We use AI tools, including large language models provided by Anthropic, to help our team run Maia, for example to organise our records, analyse results, draft communications and help our Concierge coaches prepare your plan. We only do this on a business account that doesn’t use your data to train its models. Your coach reviews anything AI helps prepare before it reaches you. We may also add AI features to the Services in future, such as personalised explanations or chat.

Whenever AI is used with your personal data:

• We only use AI providers that process it on our behalf, keep it confidential and don’t use it to train their models
• We only share what’s needed for the task
• We never sell your data to AI companies or let them use it for their own purposes
• AI outputs are for information only, are labelled where you see them, and don’t replace a qualified clinician
• We don’t use AI to make decisions about you that have legal or similarly significant effects

Before any AI feature in the app processes your health information, we’ll update this policy and tell you.

Our scores and insights are for information only. They aren’t medical advice, a diagnosis or a clinical decision. For medical decisions, speak to a qualified clinician. You can ask us how a score or insight was produced, and ask a member of our team to review it with you.

6. Who can see your data

The Maia care team. In the app, you choose whether to share your data with Maia’s care team. If you do, our coaches and clinicians can see your health information so they can support you. You can turn sharing off at any time in the app.

Concierge. If you’re a Concierge member, your coach reads your messages and the health information you share so they can support you. Your health profile and documents are kept in a restricted area that only your coach and our Data Protection Officer can access. Our Chief Medical Officer only sees them if your coach raises a concern about your safety. If you join a Concierge members’ WhatsApp group, the other members will see your name and number. We’ll never raise or share your health information there. What you choose to share is up to you, but other members can see it, and we can’t control what happens to it after that.

Independent clinicians. If you book a consultation with an independent clinician through us, we only share the information you agree to share. Once you’re their patient, they’re responsible for your data under their own privacy policy.

Your employer or insurer. If they pay for your membership, they can’t see your account, your health information or anything that identifies you. Section 7 explains exactly what they get.

Partners who referred you. If you joined through a partner’s link, they may learn that you’ve joined. Section 7 explains what they get.

Everyone at Maia with access to member data is bound by confidentiality obligations and only sees what they need to do their job.

7. Who we share data with

We don’t sell your data, and we never share it with advertisers, ad networks or data brokers. We share it only with the service providers below, who process it on our behalf, and in the limited ways described for employers, insurers and referral partners.

• Kalibra Pte Ltd (Singapore): Our app platform provider. Hosts and runs the Maia app in a separate Maia environment. Data: account, health information, connected devices, in-app chat, messages.
• Terra (through Kalibra): Connects your wearables and health apps to the Maia app, only if you choose to connect them. Kalibra engages Terra on our behalf. Data: connected device data.
• Apple: In-app subscriptions and payment. Apple handles payments under its own privacy policy. Data: payment.
• Stripe: Subscriptions bought on our website, and Concierge payments. Data: payment, name, email, billing country.
• Postmark: Account and service emails. Data: name, email.
• Beehiiv: Newsletter, community and webinars. Data: name, email, preferences, Snapshot score tier and highest-strain area.
• Kit: Email. Data: name, email, preferences, Snapshot score tier and highest-strain area, and tags based on your assessment results.
• ScoreApp: Clarity Snapshot and doctor-conversation assessment. Data: Snapshot and assessment answers, name, email.
• Calendly: Booking calls and onboarding sessions. Data: name, email, booking details.
• Notion: Our contact records, and Concierge health profiles. Data: name, email, how you came to us, Snapshot score tier and highest-strain area, and a summary of your assessment results. For Concierge members, your health profile answers and uploaded documents, kept in a restricted area only your coach and our Data Protection Officer can access.
• Google Workspace: Our team email, documents and video calls. Data: messages you email us, and your video sessions with your Concierge coach.
• WhatsApp: Concierge messages with your coach, and Concierge member groups you choose to join. Data: your messages, and any photos or documents you send. Messages are end-to-end encrypted, so WhatsApp can’t read them.
• Webflow: Our website. Data: website usage.
• Anthropic: AI tools our team uses to work with our records and communications, and to help Concierge coaches prepare your plan. Data: contact records, Snapshot results and assessment summaries, and Concierge health profiles, only as needed for the task.
• Webflow Analyze: Website analytics. Data: pseudonymised website usage.

Facebook. If you choose to join our Facebook group, Meta runs it under its own privacy policy, not ours. Anything you post there can be seen by other group members. Don’t post health information you want to keep private.

Mira. If you’d like a Mira home hormone tracker through Concierge, we send Mira your name and delivery details only, so they can post it to you. Mira handles your data under its own privacy policy, doesn’t share anything about you with us, and we only see the readings you choose to share with your coach.

Our contract with Kalibra requires it to:

• Process your data only on our instructions and only to run the Maia app
• Never sell your data, use it for advertising or use it to train AI models
• Keep the Maia environment logically separate from its own and other customers’ environments
• Protect your data with access controls, least-privilege access, encryption, logging and backups
• Tell us within 48 hours of confirming a data breach affecting your data
• Return your data to us and confirm deletion when our contract ends

Employers and insurers who pay for your membership

Some employers and insurers buy Maia for their staff, members or policyholders. They’re our customers. They aren’t service providers, and they don’t process your data for us.

What they can get:

• Combined reports about how their group uses Maia, such as how many people have activated, overall engagement and broad trends
• Reports only for groups of at least 10 people, so no one can be picked out. If a group is smaller, we combine it with others or don’t report on it

What they never get:

• Your name, or confirmation from us that you personally have activated or use Maia. If they nominated you for a place, they’ll know they offered it to you, but we won’t tell them whether you’ve taken it up
• Your health information, scores, chat, messages or connected device data
• Anything that identifies you, even if they ask

What it’s never used for. Our contracts with employers and insurers bar them from using anything we give them, or trying to work out who our members are, for underwriting, setting premiums, assessing claims or making decisions about your job.

If you leave. Your Maia account is yours. If your sponsored membership ends, you can keep your account and pay for it yourself, or close it and ask us to delete your data.

Partners who refer you

Some clinics, coaches, studios and other partners share a link to Maia, and we pay them a fee when someone they referred becomes a paying member. To work out that fee, we may tell a partner that someone they referred has joined, and which membership tier they chose. We never share your health information, scores, messages or how you use Maia with them.

Other disclosures

We may also disclose data where the law requires it. We review every request, and tell you about it unless the law prevents us.

If Maia is sold or merged, your data could pass to the buyer. The buyer would have to keep the promises in this policy, and we’d tell you before your data moved.

8. Where your data is stored

The Maia app is hosted by Kalibra in Singapore. Some of our other providers store or process data in other countries, including the United States.

When your data is transferred outside Hong Kong, we make sure it receives a standard of protection comparable to the PDPO and PDPA, through written contracts with our providers.

9. Marketing

We’ll only send you our newsletter and offers if you’ve agreed to receive them. We won’t use your personal data for direct marketing, or pass it to anyone else for marketing, without your consent. You can unsubscribe at any time using the link in any email, or by contacting us.

10. How long we keep your data

We keep your data only as long as we need it for the purposes in this policy, or as long as the law requires.

• Account, profile, health information, connected device data and in-app chat: While your account is open. Deleted when you close your account or ask us to delete it, unless the law requires us to keep it.
• Concierge health profile, documents and messages: While you’re a Concierge member, then deleted within six months of you leaving. If you took part in a Concierge pilot and didn’t become a member, six months after the pilot ends.
• Quotes, photos and videos you agreed to us using: Until you withdraw your consent. We then take them down from Maia’s own channels.
• Sponsored membership details: While your sponsored membership lasts, then deleted unless you keep your account.
• Referral records: 7 years, as required by tax law, because they support fee payments.
• Clarity Snapshot and assessment results, and contact records: Until you unsubscribe and ask us to delete them.
• Newsletter subscription: Until you unsubscribe.
• App usage and crash reports: As long as needed to keep the app working and secure.
• Consent records: As long as we hold your data, so we can show you agreed.
• Payment and invoice records: 7 years, as required by tax law.
• Security incident records: 6 years.

Aggregated, de-identified data that can no longer identify you may be kept longer.

11. How we protect your data

• Encryption of data in transit, and at rest where technically feasible
• A separate Maia environment on our platform
• Access controls and least-privilege access, so people only see the data they need
• Logging of access to our platform
• Regular backups
• Concierge health information kept only in restricted areas that your coach and our Data Protection Officer can access, never in group chats or shared folders
• Confidentiality and security obligations on every provider that handles your data

No system is completely secure. If a data breach puts your data at risk, we’ll tell you without undue delay and notify the relevant regulator where required, explaining what happened, what it means for you and what we’re doing about it.

12. Your rights

You can:

• Access the personal data we hold about you
• Correct anything that’s inaccurate
• Withdraw your consent at any time, including turning off sharing with the care team, disconnecting a device, or opting out of model improvement or research. Opting out stops your data being included from then on. Data already de-identified and combined can’t be separated back out.
• Ask us to delete your data
• Opt out of marketing at any time
• Complain to us, or to your local regulator

These rights are yours, even if your employer or insurer pays for your membership. They can’t use them on your behalf or ask to see your data.

To use any of these rights, email support@maiahealth.tech. We’ll confirm your identity and respond within 30 days. If we need longer, we’ll tell you why. We don’t charge for requests except where the law allows a reasonable fee for copies, and we’ll tell you before we charge anything.

Withdrawing consent may mean we can’t provide some Services, such as personalised insights or care team support. We’ll explain what changes before you decide.

13. Cookies and tracking

Our website uses cookies to make it work and to measure how it’s used, including analytics cookies set by Webflow, our website provider. These record visits using a random identifier, not your name. You can block or delete cookies in your browser settings at any time. The website will still work.

We don’t use cookies or trackers for advertising.

14. Children

Maia is for adults only. You must be 18 or over to use the Services. If we find we’ve collected data from someone under 18, we’ll delete it. If you think this has happened, contact us.

15. Changes to this policy

If we make a material change, we’ll tell you by email and in the app at least 14 days before it takes effect. The version number and date at the top always show the current version.

What’s changed in this version:

• How memberships paid for by employers and insurers work, and what they can and can’t see
• Stripe as a way to pay for app subscriptions on our website
• What partners who refer you to Maia can learn, and why
• Our Facebook group
• The doctor-conversation assessment
• Terra, which connects your wearables to the app
• A new contact for privacy requests, support@maiahealth.tech
• How Concierge works: your health profile, who can see it, WhatsApp, video sessions, Mira trackers and how long we keep your information
• How we use AI to help Concierge coaches prepare your plan
• How we ask before using your feedback, quotes, photos or videos

16. Contact us

• Data Protection Officer: Liz Bradford, President and CTO
• Email: support@maiahealth.tech
• Post: Maia Health Limited, Room 1406, 14/F, Yinhe Tower, 303 Jaffe Road, Wan Chai, Hong Kong

You can also complain to your local regulator:

• Hong Kong Office of the Privacy Commissioner for Personal Data (PCPD)
• Singapore Personal Data Protection Commission (PDPC)