Privacy Notice — Now for Women
Legal
Version 2.0 — Effective Date: 20 July 2026
Table of Contents
- Contact & Data Protection Officer
- What Is Personal Data?
- What Categories of Data Do We Process?
- Why Do We Collect Your Data and What Is the Legal Basis?
- Naomi — Our AI Wellness Companion
- Who Do We Share Your Data With?
- Is Your Data Sent Outside the UK / European Union?
- What Security Measures Have We Taken?
- What Are Your Rights?
- How to Exercise Your Rights
- Cookies and Tracking
- How Long Do We Keep Your Data?
- Changes to This Privacy Notice
INTRODUCTION
This Privacy Notice explains how Now for Women collects, uses, and protects your personal data, and what your rights are.
It applies to the NOW for Women digital wellness platform and all related services (the “Platform” or “Services”) offered by:
Now for Women — Simplified joint-stock company (SAS)
Registered office: 36 rue Scheffer, 75016 Paris, France
Registered capital: €30,000
Company registration: Paris Trade and Companies Register, number 940 318 975
(“Now for Women”, “we”, “us”, or “our”)
Now for Women acts as the data controller for all processing activities relating to the Platform.
All personal data is processed in accordance with applicable UK and French data protection law, including:
- The UK General Data Protection Regulation (UK GDPR)
- The Data Protection Act 2018
- The European Regulation (EU) 2016/679 (GDPR)
- French Law 78-17 of 6 January 1978 on information technology, files, and civil liberties (Loi Informatique et Libertés)
1. CONTACT & DATA PROTECTION OFFICER
If you have any questions or requests regarding your personal data, please contact our Data Protection Officer:
Email: admin@now-for-women.com
Post: Data Protection Officer, Now for Women, 36 rue Scheffer, 75016 Paris, France
2. WHAT IS PERSONAL DATA?
Personal data refers to any information relating to an identified or identifiable person — for example, your name, email address, or IP address. This includes data you provide directly, and data collected automatically when you use our Platform.
3. WHAT CATEGORIES OF DATA DO WE PROCESS?
| Category | Type of Personal Data | How It Is Collected |
|---|---|---|
| Identification and Contact Data | Name, email address, phone number, postal code, age | Registration forms |
| Health and Wellness Data (Special category) | Wellbeing check-in responses (physical, emotional, cognitive, sexual health); reproductive health status; medical history and current treatments (if shared); physical measurements; lifestyle factors (sleep, diet, activity, stress); biosensor data from connected devices (optional) | Wellness assessment questionnaire; Platform interactions; optional device integration |
| AI Conversation Data | Questions and topics you raise with Naomi; conversation history; session frequency and duration; wellness concerns mentioned in natural language | Automatically collected when you interact with Naomi |
| Contractual and Payment Data | Service details, subscription tier, account information, billing and payment details, transaction history | Registration, subscription, and payment processes |
| Technical and Usage Data | IP address, device type, browser information, Platform usage patterns, cookies and tracking technologies | Automatic collection via Platform |
| Customer Support Data | Communications with customer support | When you contact us |
| Marketing Data (opt-in only) | Communication preferences, marketing interactions | Consent forms and preference settings |
About our health and wellness data: Your wellbeing information is classified as special category personal data under data protection law. We only process it with your explicit consent and with appropriate safeguards in place.
Optional data: Many questions in our wellness assessment are optional. You can skip any question without affecting your ability to use the Platform or access Naomi. The more you share, the more personalised your experience — but all optional data remains your choice.
Age: We collect your age to confirm you meet our minimum age requirement of 18 years and to provide age-appropriate wellness guidance. We do not knowingly collect data from anyone under 18. If you believe we have done so, please contact us immediately at admin@now-for-women.com.
4. WHY DO WE COLLECT YOUR DATA AND WHAT IS THE LEGAL BASIS?
| Purpose | Legal Basis |
|---|---|
| Managing enquiries from prospective users | Legitimate interest |
| Delivering the NOW Functional Profile wellbeing assessment and results | Performance of contract; explicit consent (health data) |
| Creating and supporting personalised wellness programmes | Performance of contract; explicit consent (health data) |
| Personalisation via Naomi, our AI Wellness Companion | Performance of contract; explicit consent (health data) |
| Improving and optimising Naomi’s performance | Legitimate interest; explicit consent where health data is involved |
| Anonymised and aggregated analysis to understand wellness patterns, improve our services, and contribute to women’s health knowledge | Legitimate interest; explicit consent for research use |
| Traffic statistics and platform analytics | Legitimate interest |
| Cookie management | Legitimate interest (essential cookies); consent (non-essential cookies) |
| Managing your account | Performance of contract |
| Processing orders, transactions, complaints | Performance of contract |
| Managing payments and financial records | Performance of contract; legal obligation |
| Newsletter and marketing communications | Consent |
| Managing the commercial relationship | Performance of contract |
| Customer service | Legitimate interest |
| Satisfaction surveys | Legitimate interest |
| Processing requests to exercise your data rights | Legal obligation |
| Managing disputes and legal claims | Legitimate interest; legal obligation |
A note on anonymised data: We may use anonymised and aggregated data — data that cannot identify you — to better understand how our services perform, to identify trends in women’s wellbeing, and to contribute to broader health and wellness research. Once data is fully anonymised, it falls outside the scope of data protection law. Any use of your identifiable data for research purposes requires your separate explicit consent.
5. NAOMI — OUR AI WELLNESS COMPANION
Powered by AI. Naomi is an artificial intelligence wellness companion. She is not a human, not a healthcare professional, and her responses are not medical advice.
Naomi AI: available at no charge, subject to the features shown in the Platform. Naomi AI Premium is not yet available. Its features and price will be shown in the Platform before purchase.
What data Naomi uses
When you interact with Naomi, we collect:
- The questions you ask and topics you discuss
- How often and how long you use the service
- Wellness concerns or symptoms you mention in conversation
- Symptom tracking entries you choose to log
How Naomi works — in plain English
Naomi uses two types of technology:
- Your personalised wellbeing profile is built using transparent, rule-based logic — not black-box AI decision-making. The rules are fully auditable and traceable. This ensures your profile is built fairly and consistently.
- Naomi’s conversational responses are generated by an AI language model. Before any data reaches the AI, your name, email address, and other personal identifiers are automatically removed. The AI only ever processes anonymised content.
How we make sure Naomi is safe and fair
- No personal identifiers reach the AI. Your name, email, and contact details are never sent to the AI model.
- Bias and accuracy: Our wellbeing assessment rules are regularly reviewed to ensure they work fairly and consistently across users. We do not rely solely on AI for any decisions about your wellbeing profile.
- Human oversight: Naomi’s outputs are informational only. No automated decision produces any legal or significant effect without human review.
- Fail-safe design: If there is an error in our data protection processes , all AI processing stops automatically.
Your control over Naomi data
- You can request deletion of your Naomi conversation history at any time from your account settings.
- You can opt out of having your anonymised conversation data used to improve Naomi.
- All use of health data from your conversations is based on your explicit consent.
Legal basis for Naomi data processing
- Performance of contract — to provide the AI wellness service
- Legitimate interest — to improve service quality and safety
- Explicit consent — where health-related information is extracted from your conversations
6. WHO DO WE SHARE YOUR DATA WITH?
We share personal data only where necessary and only with parties who are contractually bound to protect it.
We never sell your personal data.
Internal access
Authorised team members with role-based access controls, on a strict need-to-know basis.
Service providers acting on our behalf
All third-party providers are carefully selected and contractually required to comply with applicable data protection law (GDPR Article 28 / UK GDPR Article 28).
| Provider Type | Example Providers |
|---|---|
| Cloud hosting and infrastructure | Amazon Web Services (AWS), EU region |
| Database services | Supabase or equivalent (EU data residency) |
| Form and survey providers | Typeform (EU data residency where available) |
| Email and communication | Brevo / Sendinblue (servers in France and EU) |
| Payment processing | Stripe Payments Europe Ltd. |
| AI model providers | Claude by Anthropic or equivalent — personal identifiers removed before any AI processing |
| Analytics and marketing | Meta Platforms (Instagram / Facebook) |
| Customer support tools | As required to operate the service |
| Professional advisers | Accountants, lawyers |
Connected device providers (optional)
If you choose to connect a health tracking device or app (such as Apple Health, Fitbit, Garmin, Oura, WHOOP, or Withings), we receive data from those providers with your authorisation. These providers act as independent data controllers for data processed within their own platforms and are subject to their own privacy policies. You can revoke access at any time from your account settings. We recommend reviewing their privacy policies before connecting.
Sharing wellness data with research partners
We may use and share fully anonymised, aggregated wellness data with academic and scientific research partners to advance women's health science. Because this data cannot be traced back to any individual, your consent is not required under data protection law for this type of sharing - it is no longer personal data once anonymised.
If we ever wish to involve your identifiable personal data in a specific research project or clinical trial, we will ask for your explicit consent at that time, before any such sharing takes place. You will never be required to participate.
Business transfers
In the event of a merger, acquisition, investment round, or sale of all or part of our business, personal data may be transferred to prospective buyers or investors. Any such transfer will be subject to appropriate confidentiality protections. We will notify you if your data is to be subject to a new privacy policy as a result.
Legal and regulatory bodies
Where required by law, we may share data with government bodies, regulators, or law enforcement for tax, compliance, cybersecurity, or legal purposes.
7. IS YOUR DATA SENT OUTSIDE THE UK / EUROPEAN UNION?
We aim to keep your personal data within the UK and the European Economic Area (EEA). Where service providers are based within the EU or EEA, no additional cross-border transfer safeguards are required.
Some providers may process data outside the UK/EEA:
- Marketing data: Meta Platforms (Instagram / Facebook) may involve transfers to the United States, governed by the EU–US Data Privacy Framework and its UK Extension.
- AI processing: AI model providers receive only fully anonymised, de-identified content — no personal identifiers are transferred.
All international transfers are subject to appropriate safeguards including Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA) where applicable."
You can request further information about international transfers by contacting admin@now-for-women.com.
8. WHAT SECURITY MEASURES HAVE WE TAKEN?
We implement comprehensive technical and organisational measures to protect your personal data.
Technical measures
- Encryption of data in transit (TLS 1.2 or higher)
- Encryption of sensitive data at rest (AWS KMS)
- Regular security assessments and penetration testing
- Monitoring and anomaly detection
- Secure development practices and code review
- Personal identifiers excluded from system logs wherever possible
Organisational measures
- Role-based access controls and least-privilege principles
- Multi-factor authentication for administrative access
- Data minimisation and pseudonymisation where appropriate
- Staff training on data protection
- Privacy by Design and Privacy by Default in product development
- Data Protection Impact Assessments (DPIAs) for high-risk processing
- Regular backups and disaster recovery procedures
- Vendor due diligence and contractual safeguards
Data breach notification
In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the relevant supervisory authority (CNIL for EU; ICO for UK) within 72 hours, and we will notify you without undue delay where the breach poses a high risk.
9. WHAT ARE YOUR RIGHTS?
Under UK and EU data protection law, you have the following rights. References to specific articles below refer to the General Data Protection Regulation (GDPR) and UK GDPR — the external legal frameworks that give you these rights.
| Right | What It Means |
|---|---|
| Right of Access (Art. 15) | Request a copy of the data we hold about you |
| Right of Rectification (Art. 16) | Correct inaccurate or incomplete data |
| Right to Erasure (Art. 17) | Request deletion of your data where it is no longer needed, consent is withdrawn, or it has been unlawfully processed |
| Right to Object (Art. 21) | Object to processing based on legitimate interest; object at any time to direct marketing |
| Right to Restrict Processing (Art. 18) | Pause use of your data without deleting it |
| Right to Data Portability (Art. 20) | Receive your data in a portable, machine-readable format |
| Right Not to be Subject to Automated Decisions (Art. 22) | Not to be subject to decisions based solely on automated processing that significantly affect you, without human review |
| Right to Withdraw Consent (Art. 7(3)) | Withdraw consent at any time; this does not affect processing already carried out |
| Right to Delete Naomi Conversation History | Delete your conversation history at any time from your account settings |
| Right to Delete Your Account | Delete your account and associated data directly in account settings |
| Right to Define Post-Mortem Instructions (French law only) | Under Article 85 of French Law No. 78-17, you may issue instructions about your data after your death. This right does not apply under UK GDPR. |
| Right to Lodge a Complaint (Art. 77) | See below |
How to complain
France — CNIL
Website: https://www.cnil.fr/fr/plaintes
Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
United Kingdom — ICO
Website: https://ico.org.uk/make-a-complaint/
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, UK
10. HOW TO EXERCISE YOUR RIGHTS
Contact us at any time:
Email: admin@now-for-women.com
Post: Now for Women, Data Protection Officer, 36 rue Scheffer, 75016 Paris, France
We will respond within one month. For complex or multiple requests, we may extend this by a further two months and will inform you within the initial month. Requests are handled free of charge.
11. COOKIES AND TRACKING
We use cookies and similar tracking technologies on our Platform. For detailed information about the cookies we use, their purposes, and how to manage your preferences, please refer to our https://now-for-women.com/cookies-policy available on our website.
You can manage your cookie preferences at any time using the cookie settings tool on our website.
12. HOW LONG DO WE KEEP YOUR DATA?
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, including:
- Legal obligations: Compliance with accounting, tax, and statutory retention requirements (e.g. financial records kept up to 6 years)
- Contractual obligations: Duration of the contract plus applicable legal limitation periods
- Legitimate interests: Establishment, exercise, or defence of legal claims
- Consent-based processing: Until consent is withdrawn
After the relevant retention period, personal data is securely deleted or fully anonymised. Anonymised data may be retained indefinitely for research and analytics purposes.
A full internal Retention Policy is maintained and reviewed regularly.
13. CHANGES TO THIS PRIVACY NOTICE
We may update this Privacy Notice from time to time. We will notify you of material changes by:
- Posting a prominent notice on our website (https://now-for-women.com)
- Sending an email notification (where you have provided your email address)
Continued use of our services after changes are posted constitutes acceptance of the revised Privacy Notice.
© 2026 Now for Women. All Rights Reserved. Version 2.0 — Effective Date: 20 July 2026
© 2026 Now for Women. All Rights Reserved. Version 2.0 — Effective Date: 20 July 2026
This Privacy Notice complies with UK GDPR, EU GDPR, and French data protection law (Loi Informatique et Libertés).