Privacy Policy

The short version

Endii is built by Pause Botanica Inc. Endii helps you track endometriosis-related symptoms, meals, routines, cycle context, and patterns. The website you're on right now (endii.co) tells people about the app, shares research-backed articles about endometriosis, and lets you join the waitlist.

In the app, most tracking data is stored on your device. When you choose AI features, Endii sends only the information needed for that request, such as a meal photo, your message, or a small slice of recent logs, to trusted AI providers so the feature can work.

On the website, the data picture is smaller:

• If you join the waitlist, we keep your email so we can email you when Endii launches.
• If you browse the site, we use analytics cookies (PostHog) to count page views and understand what people read. We do not link this to your real identity.
• If you email us, we keep that thread to answer you.
• That's the whole list for the website.

We do not sell your personal information. We do not share health data with advertisers, brokers, or insurance companies.

1. Who we are

The Endii app and endii.co website are operated by Pause Botanica Inc., a Canadian company registered at:

Pause Botanica Inc.
20 Bay St.
11th Floor
Toronto, ON M5J 2R8
Canada

In this policy, “Pause Botanica,” “we,” “our,” and “us” refer to Pause Botanica Inc. “Endii” refers to the Endii mobile app, the endii.co website, and related Endii services.

For all questions about this policy, your data, or any privacy concern, contact us at support@endii.co or write to the address above. We respond within 30 days under PIPEDA and any other applicable law.

Privacy Officer. Pause Botanica Inc.'s designated Privacy Officer (per PIPEDA s. 4.1) can be reached at support@endii.co with the subject line “Attn: Privacy Officer.”

For users outside Canada. PIPEDA and applicable Canadian provincial laws govern Pause Botanica's data handling. We also honor the rights of users in other jurisdictions (see § 5 — Your Rights), including under the EU GDPR, UK GDPR, California CCPA / CPRA, and Quebec's Law 25.

2. What we collect

Here's what Endii may touch, broken down by what it is, whether it's linked to you, and why we have it.

2.1 Waitlist email

If you enter your email on endii.co to join the waitlist, we store it so we can:

• Email you when Endii launches.
• Send occasional updates about the app (if you opted in).

We do not sell your email. We do not share it with advertisers or data brokers. You can unsubscribe at any time using the link in any email we send, or by emailing support@endii.co.

We keep your waitlist email until you ask us to delete it, or until 24 months after the Endii app fully launches and the waitlist is closed — whichever comes first.

2.2 Analytics — PostHog

We use PostHog (a privacy-focused product analytics tool) to understand which pages people read, what they click, and how they get to the site. Specifically:

• PostHog assigns your browser a random, anonymous ID stored in a cookie. This ID is not linked to your name, email, or any identifying information.
• We see aggregate patterns — “X people read this article today” — not individual people.
• PostHog data is hosted in the United States (PostHog US Cloud) under our data processing agreement.
• We do not use PostHog for cross-site behavioral advertising. We do not run ad networks.

If you want to opt out of analytics on endii.co, you can:

• Block cookies in your browser settings, or
• Use the Do Not Track setting in your browser (we honor it), or
• Email support@endii.co and we'll exclude your IP.

For PostHog's own policy, see posthog.com/privacy.

2.3 Server logs (Vercel)

endii.co is hosted on Vercel. Like any web host, Vercel records standard access logs — IP address, timestamp, requested page, and basic browser info — for security, debugging, and abuse prevention (e.g., blocking bot traffic). These logs are retained per Vercel's standard policy and are not used to identify or profile visitors.

For Vercel's own policy, see vercel.com/legal/privacy-policy.

2.4 What we do NOT collect on the website

endii.co does not collect:

• Your name, address, phone number, or any health data.
• Your symptom logs, cycle, or any tracking data from the Endii app — none of that touches the website.
• Payment information. The website doesn't process payments. Subscriptions happen inside the app via Apple.
• Third-party advertising identifiers, Facebook Pixel, Google Analytics, or any ad-network tracker.
• Data from any social-media login (we don't offer social logins on the website).

2.5 What the app does NOT do

The Endii app does not sell your health data, share your health data for advertising, write data back to Apple Health, or send doctor reports anywhere unless you choose to export or share them.

3. How we use the data

We use the data described above only for these purposes:

• To provide app features. Your logs power symptom tracking, routines, post-meal check-ins, insights, exports, and reminders.
• To provide AI features you choose. Meal photos, chat messages, and recent context are used only to return the analysis or response you requested.
• To run the waitlist. Your email lets us tell you when Endii is ready.
• To improve the site. Aggregate analytics show us which articles people read, which pages confuse people, and which CTAs work.
• To respond to you. If you email support, we keep that thread to answer your question.
• To keep the site secure. Server logs help us spot abuse, bot traffic, and security issues.

We do not:

• Sell your data.
• Share your data with advertisers, brokers, or insurance companies.
• Use your data to train AI models (ours or anyone else's).
• Build a profile that combines your data across sites.

4. Legal basis for processing

4.1 Canadian users (PIPEDA + provincial laws)

Pause Botanica Inc. processes your personal information based on:

• Your consent, expressed when you submit the waitlist form, email us, or continue using endii.co with analytics cookies enabled. You can withdraw consent at any time by unsubscribing or contacting support@endii.co.
• Reasonable necessity to provide the service you requested (PIPEDA Principle 4.3).
• Legitimate business purposes that a reasonable person would consider appropriate — limited to security, aggregate analytics, and abuse prevention.

4.2 Quebec users (Law 25)

If you reside in Quebec, additional protections apply under the Act respecting the protection of personal information in the private sector (“Law 25”). You have the right to:

• Receive prior notice of any new use or disclosure of your personal information (s. 8).
• Receive an explanation of any automated decision-making that affects you (s. 12.1).
• Receive your data in a structured, commonly used technological format (s. 27 — data portability).
• Be informed of any incident involving your personal information that creates a risk of serious injury (s. 3.5).

To exercise these rights, contact support@endii.co with subject line “Attn: Privacy Officer · Quebec.”

4.3 EU / UK / EEA users (GDPR / UK GDPR)

If you are in the EU, UK, or EEA, we process your data on the following legal bases under the GDPR / UK GDPR:

• Consent — for waitlist email and analytics cookies (Article 6(1)(a)).
• Legitimate interests — server logs for security and abuse prevention (Article 6(1)(f)).
• Contract — to fulfill any service you specifically request (Article 6(1)(b)).

Withdrawing consent does not affect the lawfulness of processing that already happened.

4.4 California users (CCPA / CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act / California Privacy Rights Act:

• The right to know what personal information we have about you and how we use it.
• The right to delete personal information.
• The right to correct inaccurate information.
• The right to limit the use and disclosure of sensitive personal information.
• The right not to be discriminated against for exercising these rights.

Pause Botanica Inc. does not sell or share your personal information for cross-context behavioral advertising. To exercise your rights, email support@endii.co.

5. Your rights and choices

You can do the following at any time:

• Unsubscribe from the waitlist. Click the unsubscribe link in any email we send you, or email support@endii.co.
• Request a copy of your data. Email support@endii.co and we'll send you everything we have linked to you (typically just your waitlist email and any support correspondence).
• Request deletion. Email support@endii.co with subject “Delete my data” and we'll erase your email and any associated records within 30 days.
• Opt out of analytics. Block cookies in your browser, enable Do Not Track, or email us.
• Object to processing or request restriction (EU/UK/EEA users). Email support@endii.co.
• File a complaint with the privacy regulator in your jurisdiction:
  • Canada (federal): Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca
  • Quebec: Commission d'accès à l'information (CAI) — cai.gouv.qc.ca
  • Ontario, BC, AB: Their respective provincial privacy commissioners
  • UK: Information Commissioner's Office (ICO) — ico.org.uk
  • EU: Your member-state regulator
  • California: California Privacy Protection Agency

We respond to verifiable requests within 30 days (or sooner where the law requires).

6. Children's privacy

endii.co is not intended for use by anyone under 16 years of age. We do not knowingly collect personal information from anyone under 16 through the website. If we discover a minor has submitted information through the waitlist or any other form on the site, we delete it immediately.

If you are a parent or guardian and believe your child under 16 has submitted information on endii.co, contact us at support@endii.co and we will remove the data within 30 days.

7. International transfers

Pause Botanica Inc. is incorporated in Ontario, Canada. The service providers we use on the website — Vercel (hosting) and PostHog (analytics) — process data on servers in the United States. When your data is transferred outside Canada, we rely on:

• Contractual safeguards that meet PIPEDA's “comparable level of protection” standard (Principle 4.1.3) for Canadian users.
• Standard Contractual Clauses approved by the European Commission for EU/EEA users.
• The UK International Data Transfer Addendum for UK users.
• Adequacy decisions where they exist.

For a copy of the safeguards in place, contact support@endii.co.

8. Security

We protect data with:

• TLS 1.3 encryption for all data in transit to and from endii.co.
• AES-256 encryption for data at rest with our service providers.
• Least-privilege access — only the people at Pause Botanica who need to see waitlist data can see it.
• Regular review of our service providers' security posture.

No system is 100% secure. If you suspect your data may have been compromised, contact us immediately at support@endii.co.

9. Changes to this policy

We may update this policy as the website evolves. When we make a material change (anything that affects your rights or how your data is used), we will:

• Update the Last updated date at the top.
• Post a notice on endii.co the next time you visit.
• For substantial changes, send an email to anyone on the waitlist.

If you keep using endii.co after a change takes effect, that's your acceptance. If you don't agree, you can ask us to delete your data at any time.

10. Contact

• All questions, privacy requests, and Privacy Officer correspondence: support@endii.co
• Mailing address:

  Pause Botanica Inc.
  20 Bay St.
  11th Floor
  Toronto, ON M5J 2R8
  Canada