Privacy Policy

Who we are

Endo Protocol (“Endo Protocol,” “we,” “us” or “our”) is an Australian-operated, subscription-based educational platform for women living with endometriosis, PCOS, ovarian cysts and fibroids. Endo Protocol provides an eligibility quiz, educational content, a symptom and habit diary, recipes, community features and paid memberships.

This policy explains what personal information — including health information — we collect through the Endo Protocol website and member portal, how we use and protect it, and the choices and rights you have. It is written to reflect how the Endo Protocol platform actually works.

Endo Protocol is operated by Ariel Honi Beninca (ABN 56 559 277 024), trading as Endoprotocol, a registered Australian business name. Our contact email is support@endoprotocol.com.

Information we collect

We collect information you give us directly, including:

• Account information — your email address, name, password, and an optional profile photo.
• Quiz answers — the conditions you select, your pain rating, free-text answers about how your symptoms affect your life, and answers to safety-screening and contraindication questions (for example, whether you take a blood thinner, are pregnant, or have a history of a hormone-sensitive cancer).
• Diary entries — daily mood, pain level, bleeding or flow, food adherence, which protocol items (herbs, self-care practices) you record as completed, and any free-text notes you choose to add.
• Community content — posts, comments, replies and any photos or video you choose to attach in the forum or on recipes, along with your display name and avatar.
• Membership and billing information — which plan you choose (monthly or lifetime), and billing details collected on our behalf by our payment processor (see Third parties).
• Support and correspondence — anything you tell us if you email or otherwise contact us.

We also collect some information automatically:

• Standard technical information generated by visiting the website or using the portal (such as IP address, browser type, device type, and pages visited), collected in ordinary web server logs.
• Information stored in cookies and your browser’s local storage — see our Cookies Policy for full detail.

We do not currently use behavioural advertising, ad-tracking pixels, or third-party analytics on the platform. If that changes, this policy and our Cookies Policy will be updated first, and diary and quiz free-text health content will never be shared with an analytics or advertising provider.

Health and other sensitive information

Under the Australian Privacy Act 1988 (Cth), information about your health — including the conditions you select in the quiz, your pain ratings, diary entries and any related free-text notes — is sensitive information and is given a higher level of protection than ordinary personal information.

We only collect this health information because you choose to provide it — by completing the quiz or using the diary — and we use it only to provide the Endo Protocol service to you: personalising your protocol track, adjusting which parts of the protocol are shown to you based on your safety and contraindication answers, and giving you your own diary insights. We do not sell health information, and we do not use it to build advertising profiles.

Some diary and quiz data is stored locally in your own browser rather than on our servers — see Where your information is stored below.

How we use your information

We use the information described above to:

• create and administer your member account;
• score your quiz answers and tell you whether Endo Protocol looks like a fit;
• personalise your protocol track and adjust which herbs or practices are shown to you based on the contraindication answers you gave;
• run the diary, show you your own trends over time, and let you export your own diary data;
• operate the community/forum and recipe comment features;
• process membership payments and communicate with you about your subscription;
• send you service emails — for example, password reset emails — and respond to support requests;
• maintain the security of the platform, including an internal audit log of administrator actions on member accounts (see How we protect your information); and
• meet our legal obligations.

We do not use your health information for any purpose beyond providing the Endo Protocol service to you, except where required by law.

Where your information is stored

Endo Protocol is built so that some member data — including diary entries and community posts — is stored primarily in your own browser’s local storage on your device, rather than sent to our servers, unless our optional hosted database is enabled for your account. Where our hosted database is used, diary entries, quiz answers, account details and community content are stored in a database with access controls that restrict each member to their own records.

Because diary content stored only in your browser is not backed up by us, clearing your browser data, switching devices, or using a private browsing window can result in the loss of diary entries that were never synced to our hosted database.

Administrator access to member records (for example, the member directory used to support the community and manage the platform) is restricted to authenticated staff with an administrator role, and significant administrator actions are recorded in an internal audit log.

Third parties and service providers

We use a small number of service providers to run Endo Protocol. Each only receives the information it needs to perform its function, and is not permitted to use your information for its own purposes.

Cookies and tracking

We use a small number of strictly necessary cookies and your browser’s local storage to keep you signed in and to run the diary and community features. Full detail, including how to manage your preferences, is in our Cookies Policy.

When we share information

We share information only:

• with the service providers listed above, to run the platform;
• with other members, where you choose to post in the community or comment on a recipe — your display name, avatar and post content are visible to other signed-in members;
• where required by law, or to protect the safety of you or another person;
• in connection with a business transaction such as a merger, acquisition or sale of assets, in which case we will take reasonable steps to ensure your information continues to be protected; and
• with your consent, in any other case.

We do not sell your personal or health information.

How we protect your information

Passwords are never stored in plain text. Session authentication uses a signed, HTTP-only cookie, and administrator access to member records requires an authenticated administrator account — every significant administrator action against a member record is recorded in an audit log. Where our hosted database is enabled, access to diary, quiz and account data is restricted so that a member can only read their own records, and administrators can only read what the member directory requires.

No method of transmission or storage is completely secure. We take reasonable steps to protect your information, but cannot guarantee its absolute security.

How long we keep information

We keep account, quiz, diary and community information for as long as your account is active, and for a further period afterward as needed to comply with our legal obligations, resolve disputes and enforce our agreements. When you delete your account, we delete your personal and health information straight away. Copies in our backups are removed as the backups expire, within 60 days. We keep payment and tax records for 5 years, as Australian law requires.

Your rights and choices

Subject to some exceptions permitted by law, you can:

• access the personal information we hold about you, by using your account settings or by asking us;
• correct your account details (name, avatar and selected condition) directly in your account settings, or ask us to correct other information;
• export your own diary history from within the diary;
• ask us to delete your account and associated data — see below; and
• make a complaint about how we have handled your personal information — see Contact and complaints.

Deleting your account and data

You can delete your account yourself at any time from your account page (Account, then Delete account), which permanently deletes your personal and health information and cancels any subscription. You can also request deletion by emailing us at support@endoprotocol.com. We will verify your identity and action your request within a reasonable time, subject to information we are required to keep for legal, accounting or dispute-resolution purposes.

Diary entries and community content stored only in your own browser’s local storage can be cleared at any time from your browser or device settings; we have no copy of that information unless it has also been saved to our hosted database.

Children

Endo Protocol is intended for adults. It is not directed at, and we do not knowingly collect personal information from, children under 18. If you believe a child has provided us with personal information, please contact us so we can delete it.

Overseas disclosure

The servers that store your account, quiz, diary and community information are located in Australia. Two of the providers listed above are international companies and may process information outside Australia: Stripe (payments) and Resend (emails), including in the United States. Where this occurs, we take reasonable steps to ensure your information continues to receive a comparable standard of protection.

Changes to this policy

We may update this policy from time to time. If we make a material change, we will update the “last updated” date at the top of this page and, where appropriate, notify members directly.

Contact and complaints

If you have a question about this policy, or want to make a privacy complaint, contact us at support@endoprotocol.com. We will acknowledge and investigate your complaint and respond within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.