Phea · Privacy
Last Updated: October 2026
Phea Health LLC, an Ohio limited liability company (“Phea,” “Us,” “We,” or “Our”) operates Phea, a women’s health application delivered primarily through SMS text messages, featuring an AI chatbot companion (“Phea”) that sends check-ins and generates predictive, AI-generated wellness content (the “Services”). Phea is a consumer wellness product. It is not a medical device, does not provide medical advice, diagnosis, or treatment, is not a crisis intervention or emergency service, and is not intended as a substitute for professional medical or mental-health care. Phea is not currently regulated as a “covered entity” or “business associate” under HIPAA, and Phea is an artificial intelligence chatbot, not a licensed healthcare provider. This Privacy Policy explains what information We collect, how We use and protect it, and Your choices. Phea does not sell Your personal information for monetary compensation.
By using the Services, You are consenting to the information collection, use, and sharing practices described in this Privacy Policy, as modified from time to time by Us. If You do not agree with this Privacy Policy, please stop using the Services.
Given the sensitivity of the information Phea collects, certain information is separately and specifically addressed in Our Health Data Privacy Policy, available at getphea.com/health-data-privacy, which describes Our practices under Washington’s My Health My Data Act, California’s Confidentiality of Medical Information Act (as extended by AB 352), and similar laws. As a matter of company policy, We apply the protections described in that policy to all users, regardless of state of residence. In the event of any conflict between that policy and this Privacy Policy regarding the categories of information it covers, the Health Data Privacy Policy controls.
Phea uses a number of third-party service providers (“Subprocessors”) to operate the Services, including, without limitation: Twilio (delivery of SMS messages and related SMS data processing); Supabase (database, authentication, and storage); Render (application hosting); Lovable (application development platform); GitHub (source code and infrastructure management); Anthropic’s Claude API (AI processing that powers Phea’s check-ins and responses); and Resend (transactional email); and Stripe (payment processing and subscription billing). Stripe receives billing information only (such as Your name, email address, payment method, and subscription status), and it is Our policy not to send Stripe Your check-in content, Cycle Data, Onboarding Preferences, or Health Conditions information; Stripe may also independently collect device and fraud-prevention information in accordance with its own privacy policy. These Subprocessors receive only the information reasonably necessary to perform their function and are contractually restricted from using Your information for their own independent purposes. This Privacy Policy applies only to the Services owned and operated by Phea; it does not govern the privacy practices of these third-party providers, and We recommend You review their respective privacy policies.
The Services are currently directed to United States residents only. The Services are not directed at, marketed to, or available to individuals in the European Union or United Kingdom, and are not designed or intended to comply with the General Data Protection Regulation (“GDPR”) or similar non-U.S. data protection laws. Compliance with those laws is deferred to a potential future phase. If You access the Services from outside the United States, You do so at Your own risk.
We collect personal information that You provide directly to Us (including through Your SMS check-ins with Phea), information collected automatically through Your use of the Services, and information generated through the operation of the Services’ automated systems. As part of registration, You must confirm You are eighteen (18) years of age or older by checking a box on the onboarding consent screen. Phea collects Your specific date of birth separately, after Your account is created, and does not condition initial account creation on providing it. The Services are not directed at, and We do not knowingly collect personal information from, children.
For purposes of this Privacy Policy, “Personal Information” means information that can be used to identify You, such as Your name, phone number, or check-in content.
We collect the following categories of information:
Phea uses Anthropic’s Claude API to power Phea, the AI chatbot that sends check-ins and generates responses to Your messages. Phea’s first onboarding SMS message will disclose that Phea is an artificial intelligence chatbot and not a medical professional. Phea’s check-ins and responses are predictive and AI-generated; they are not reviewed by a human as a matter of routine practice, though Phea personnel may access check-in content in defined circumstances, such as to respond to a legal request, investigate suspected abuse or fraud, provide customer support at Your request, or review and improve the safety of Phea’s crisis-response functionality described in Section 3.2. Phea does not use Your check-in content to train Anthropic’s or any other provider’s general-purpose models. AI-generated content is provided for general wellness and informational purposes only and is not medical, psychological, or diagnostic advice.
Phea is designed to recognize language in Your check-in messages that may indicate a risk of self-harm and to respond by directing You to crisis resources, such as the 988 Suicide & Crisis Lifeline, Crisis Text Line, and 911. This detection is automated and is not a substitute for professional crisis intervention: it may not identify every instance of risk, and Phea does not provide ongoing monitoring, emergency response, or crisis counseling. If You are experiencing a medical or mental-health emergency, contact 911 or a crisis line directly; do not rely on Phea or the Services. Messages associated with a crisis-resource response are stored in a segregated database table separate from Your ordinary check-in data, with access restricted to what is reasonably necessary to operate, review, and improve this safety functionality, and are not used to generate Patterns or other predictive outputs.
After You have used the Services for approximately two to three menstrual cycles, the Services may have enough data to generate “Patterns”, which are predictive, AI-generated observations relating Your energy levels, symptoms, and cycle phase. Patterns are generated from Your ordinary check-in content and Cycle Data; Crisis-Related Messages are never used for this purpose. You can also view Your own raw check-in history within the Services, organized by cycle, phase, or theme (such as feeling, nutrition, or symptoms). Patterns are probabilistic and provided for general wellness and informational purposes only; they are not medical advice and are not guaranteed to be accurate.
It is Our policy not to use heat-mapping or session-recording technology within the Services.
Phea does not currently integrate with any third-party wearable or health-tracking device or platform. Phea may in the future, once a mobile application version of the Services is available, offer an integration with Oura and/or Apple Health. If and when such an integration is introduced, We will update this Privacy Policy to describe the additional information collected and how it is used, and We will obtain any additional consent required by law before enabling it.
Phea implements administrative, technical, and organizational safeguards designed to protect personal information, such as Your check-in content and crisis-related messages from unauthorized access, disclosure, alteration, or destruction. Crisis-related messages are stored in a segregated database table with more restricted access than Your ordinary check-in data. No system can be guaranteed to be completely secure, and We cannot guarantee the absolute security of Your information.
Access to Your check-in content and crisis-related messages is restricted to personnel who need it for a defined purpose described herein, and such access is logged. We do not grant blanket or routine administrator access to this information.
We require the third-party service providers described in Section 1.3 who store or process Your personal information on Our behalf to maintain security measures appropriate to the sensitivity of the information they process for Us.
In the event of a breach of security compromising Your personal information, We will notify You and any applicable regulators as required by applicable law.
By providing Your phone number and opting in, You consent to receive recurring automated SMS messages from Phea, including check-ins from Phea. Message and data rates may apply. You may opt out at any time by replying STOP, and You may resume messages by replying START. Text HELP for help. Consent to receive SMS messages is not a condition of purchasing any goods or services. Twilio processes the underlying delivery of these messages; see Twilio’s privacy policy for information about its practices. It is Our policy that any proactive or unscheduled SMS messages from Phea (that is, messages sent outside Your regular check-in schedule) will be covered by this same consent and opt-out mechanism.
If You are a California resident, You have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Because certain information Phea collects may also constitute “medical information” under California’s Confidentiality of Medical Information Act or “consumer health data” under Washington’s My Health My Data Act, please also see Our Health Data Privacy Policy, which supplements and, for that information, controls over this section.
In the past 12-months, we have collected the following categories of personal information: Identifiers (phone number, name, email address if provided); Commercial Information (subscription status, plan, billing dates, and promotional code used; payment card details are collected by and processed by Stripe); Sensitive Personal Information (check-in content and crisis-related messages, which may constitute medical information as described in Our Health Data Privacy Policy); Geolocation Data (general location and time zone, used solely for SMS timing); Account Credentials; and Customer Communications. We collect this information directly from You (including via SMS) and automatically through Your use of the Services. We disclose personal information only to the service providers described in Section 1.3, acting on Our behalf.
We do not sell personal information for monetary compensation, and We do not share personal information for cross-context behavioral advertising. We do not sell or share the information described in Our Health Data Privacy Policy under any circumstances.
As a California resident, You have the right to: know the categories and specific pieces of personal information We have collected about You; delete personal information We have collected from You, subject to certain exceptions; correct inaccurate personal information; opt out of the Sale or Sharing of Your personal information (We do not engage in either); limit the use of sensitive personal information to purposes necessary to provide the Services, which Phea already limits its own use to as a matter of practice; and not be discriminated against for exercising these rights. To submit a request, contact Us at info@getphea.com. We may need to verify Your identity before processing Your request.
If You are a resident of Washington, Colorado, Connecticut, Virginia, Utah, or another state with a comprehensive privacy or health-data law, You may have similar or additional rights, including rights specific to health-related information described in Our Health Data Privacy Policy. You may exercise these rights by contacting Us at info@getphea.com.
If You have any questions about this Privacy Policy or the Services, please contact Us at:
Phea Health LLC