The strongest privacy promise is not a policy, it is an architecture that makes the promise unnecessary. Aura has no account and no server, so there is no history anywhere for anyone to request.
Last updated: July 21, 2026
Nothing. Apple defines collecting as transmitting data off the device in a way that lets us or a partner access it. Aura has no account system, no backend, no analytics SDK, no crash reporting and no advertising identifier.
You can check this without trusting us. Put the phone in Airplane Mode: every feature except an App Store purchase works normally, because nothing was ever going anywhere.
HIPAA protects information held by healthcare providers and their partners. It does not cover consumer apps, which is how a period tracking app came to be fined by the FTC in 2021 for sharing user data with advertisers. For a stigmatised condition, an app that stores your history on a server is a risk no policy language can remove.
So Aura does not store it on a server. That decision also costs you something, and we would rather say so: there is no cloud backup, so moving to a new phone means exporting your data yourself.
If you enable the optional weather signal, the app requests a forecast. That request carries a coarse location and nothing about you, your log or your condition. Leave it off and the app makes no network requests at all beyond App Store purchases.
Apple handles any purchase. We never see your name, email or card. The app asks Apple whether a valid purchase exists and unlocks accordingly.
Requests to access, correct, export or delete personal data are usually answered by a company searching its database. We have no database. You hold everything: export it whenever you like, and erase all of it from within the app or by deleting the app.
Aura is intended for adults. It is not directed at children under 13, and because it collects nothing, it holds no data about anyone.
Questions about this policy: customer-care@velorahealth.io. We reply within 2 business days.