Privacy Policy

Last Updated: September 30, 2026

1. Overview

Meadow is owned and operated by Ostra Health, Inc. (“Meadow,” “we,” “us,” or “our”), based in the United States.

This Privacy Policy explains how we collect, use, store, disclose, transfer, and protect information when you use the Meadow mobile app (the “App”), our website at meadow.ostrahealth.com, and related services.

By creating an account, using the App, or using our services, you agree to this Privacy Policy. This Privacy Policy is incorporated into our Terms of Service.

Data Controller: Ostra Health, Inc. is the data controller responsible for personal information processed under this Privacy Policy.

2. Medical Disclaimer

Meadow provides journaling, tracking, organization, and informational features only.

Meadow is not a healthcare provider, medical device, pharmacy, telehealth service, emergency service, or substitute for professional medical advice.

Meadow does not provide medical advice, diagnosis, treatment recommendations, prescriptions, or medication instructions.

Any information provided through the App, including migraine-risk forecasts, insights, chat answers, reports, reminders, and summaries, is an estimate or organizational aid for informational purposes only.

Always consult a qualified healthcare professional before making health-related decisions. If you have a sudden severe headache, a headache unlike your usual attacks, or any emergency, contact emergency services.

3. Key Terms

Personal information means information that identifies, relates to, describes, or could reasonably be linked to a person or household.

Health data means information about your health, including migraine and headache attacks, pain levels, pain locations, symptoms, triggers, medications and doses, menstrual cycle status, notes, forecasts, and similar information you enter or that Meadow generates from it.

Sensitive personal information means information treated as sensitive under applicable privacy laws, including health data, consumer health data, precise geolocation, and account credentials.

Consumer health data means health-related information protected under laws such as the Washington My Health My Data Act, Nevada consumer health data laws, and similar state laws.

De-identified data means data processed so it is not reasonably linked to a specific person. Aggregated data means data combined from multiple users into summary statistics or trends.

4. Where This Policy Applies

This Privacy Policy applies to:

5. Information We Collect

Account Information

We may collect:

• Email address
• Display name, if provided
• Authentication method, such as email and password or Sign in with Apple
• Account ID
• Basic account settings and preferences

We use this information to create and manage your account, authenticate you, sync your data, provide support, and secure the App. Passwords are handled by our authentication provider and are not visible to us.

Onboarding Information

We may collect information you provide during onboarding, such as:

• Your main goal for using Meadow
• How often you get migraines, and how long they usually last
• Your most recent migraine and how painful attacks usually are
• Warning signs and triggers you recognize
• Sex, with “prefer not to say” always available
• Whether you track your menstrual cycle
• Apps you have used before, and how you heard about Meadow
• Your reminder and permission choices

We use this information to personalize the App, set up your journal, and seed your forecast with your history.

Journal and Tracking Data

Meadow collects health-related data you choose to enter, including:

• Migraine and headache attacks: start and end time, duration, and pain level
• Pain type and pain location on the head
• Symptoms, triggers, and the effect on your activities
• Medications taken for an attack, and whether they helped
• Menstrual period and ovulation status at the time of an attack, if you record it
• Your medication list, schedules, protocols, dose check-offs, and quantities
• Symptom logs and notes
• Streaks, levels, and achievements earned in the App

This information is used to provide Meadow’s core journal, medication, insight, forecast, and report features.

Location and Weather Data

If you allow location access, Meadow uses your device’s location to look up weather and barometric pressure where you are. You can instead choose a city by hand, or use Meadow without location.

We store your most recent coordinates, the time they were recorded, and your time zone with your account so your forecast can be calculated. When you log an attack, we save the weather at that time with it: barometric pressure, pressure trend, temperature, humidity, wind, and conditions.

Coordinates and city searches are sent to Open-Meteo to retrieve weather and place names. Your device’s location service may also convert coordinates into a place name. We do not use your location for advertising.

Forecasts and Insights

Meadow generates information from what you log and from the weather: daily migraine-risk scores, the factors behind each score, whether an attack followed, and summaries such as attack counts, severity averages, free days, and top triggers. These are stored with your account and treated as health data.

Chat

The Chat tab answers a fixed set of questions from your own journal on your device. It does not send your journal to an AI provider. Chat with a doctor is not currently available; anything typed there is not delivered to a clinician.

Doctor Reports

Doctor reports are generated as a PDF on your device from your journal. If you share or print a report, you choose who receives it through your device’s share sheet. We do not receive a copy of the report or learn who you sent it to.

Apple Health

Meadow does not currently connect to Apple Health. If we add Apple Health in the future, we will update this policy and follow the commitments in Section 11.

Subscription Information

Subscriptions are processed by the Apple App Store and managed with RevenueCat. We may receive:

• Subscription status and entitlement status
• Product identifier, price, and currency
• Trial and renewal status
• Purchase metadata

We do not receive your full payment card information.

Analytics Data

We use PostHog to understand how the App is used, where onboarding is confusing, and which features help. PostHog receives app usage events tied to your account ID, such as screens viewed, permission choices, subscription events, and achievement events.

Some analytics events include limited health-related information: the onboarding answers listed above (such as migraine frequency, typical pain level, warning signs, number of triggers, and sex), and, when you log an attack, its pain level, its duration, and whether triggers or symptoms were recorded. Analytics events do not include your notes, your medication names, your location, or the specific triggers and symptoms you selected. We treat this information as consumer health data, as described in Section 6.

Session Replay

Meadow does not record your screen. Session replay is turned off in the App.

Website Analytics and Advertising Technologies

Our website does not use advertising pixels or cross-site tracking cookies. Our hosting provider, Vercel, processes standard request logs, such as IP address and browser type, to deliver and secure the website.

Device and Technical Information

We may collect:

• Device type and operating system
• App version and platform
• App lifecycle events, such as installs, opens, and updates
• Crash and performance diagnostics
• Network and request metadata, such as IP address, where processed by service providers for routing, security, fraud prevention, and abuse prevention

Notifications

If you allow notifications, reminders are scheduled on your device. The text of a reminder may name a medication.

Support Communications

If you contact Meadow for support, we collect the information you choose to include in your message.

Please avoid sending unnecessary health information through support requests. If you include health-related information, screenshots, or account details, we treat that information as sensitive where required and use it only to respond to your request, troubleshoot issues, maintain support records, prevent misuse, and comply with legal obligations.

6. Health Data

This section explains how Meadow handles health data and consumer health data.

Washington and Nevada require our consumer health data disclosures to be a separate document. They are, at Consumer Health Data Privacy Policy, which also sets out the consumer health data rights available to you and how to exercise them. This section and that document describe the same practices.

We use health data to:

• Provide Meadow’s journal, medication, and insight features
• Calculate your migraine-risk forecast
• Build the doctor reports you request
• Sync your data across devices
• Personalize your App experience
• Understand how features are used and improve them
• Maintain security and prevent misuse
• Respond to support requests
• Comply with legal obligations

Categories of consumer health data we collect. Migraine and headache attacks, pain levels, pain types and locations, symptoms, triggers, activity impact, medications, doses and schedules, menstrual cycle status, symptom logs, notes, onboarding health answers, forecasts and the weather linked to attacks, and health information you include in support messages.

Where it comes from. Directly from you, when you enter it; and generated by the App, such as forecasts and summaries derived from what you logged and from weather data.

What we share, and with whom. We share consumer health data with the service providers listed in Section 9 that need it to deliver the App: our cloud database provider (Supabase), which stores your journal, and our product analytics provider (PostHog), which receives the limited health-related events described in Section 5.

We do not sell consumer health data.

We do not share consumer health data for targeted advertising.

We do not use personal health data to train AI models.

If we materially expand how we use, disclose, license, sell, or otherwise process consumer health data, we will update this Privacy Policy and provide any notices, consents, written authorizations, opt-outs, or other mechanisms required by applicable law.

7. How We Use Information

We use information to:

• Provide, operate, and maintain Meadow
• Create and authenticate accounts
• Sync data across devices
• Provide journal, medication, reminder, insight, and history features
• Retrieve weather for your location and calculate forecasts
• Generate doctor reports on your device
• Personalize your experience
• Manage subscriptions and entitlements
• Send reminders and notifications you enable
• Respond to support requests
• Improve App functionality and reliability, and fix bugs
• Understand general usage patterns
• Prevent fraud, abuse, and unauthorized access
• Enforce our Terms of Service
• Comply with legal obligations
• Protect the rights, safety, and security of users, Meadow, and others

Reviews and Testimonials

If you post a public review or rating of Meadow, or submit a testimonial to us directly for that purpose, we may use it in our marketing, including the name, username, or initials you included with it. We do not add identifying information that you did not include.

We do not use your private journal, health information, or messages in marketing without your separate, express consent. You may ask us to stop future marketing use of your review at any time by emailing meadowsupport@ostrahealth.com.

8. Future Uses We May Consider

Meadow may consider additional uses in the future, including:

• Research partnerships
• De-identified or aggregated trend analysis, such as how weather relates to migraine across many users
• Product improvement using de-identified or aggregated data
• Business or acquisition-related transfers

We do not currently sell personal information or consumer health data.

Before beginning any future practice that requires notice, consent, written authorization, or opt-out rights, we will update this Privacy Policy and implement the mechanisms required by applicable law.

9. How We Share Information

We share information only as described in this Privacy Policy.

Service Providers

We share information with vendors and service providers that help us operate Meadow. These providers may process information only to provide services to us, subject to contractual obligations and applicable law.

Legal and Safety Disclosures

We may disclose information if required by law, subpoena, court order, legal process, regulator request, or government request, or if we believe it is necessary to protect the rights, safety, property, or security of Meadow, our users, or others.

With Your Consent

We may share information with third parties when you give us explicit consent or direct us to do so, for example when you share a doctor report.

Business Transfers

If Ostra Health, Inc., Meadow, or substantially all of our assets are involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, change of control, or similar transaction, your information may be transferred to the acquiring or successor entity as part of that transaction.

The successor may continue to use your information to operate and improve Meadow, subject to applicable law and this Privacy Policy. If it intends to materially change how personal information or consumer health data is used or shared, it will provide notice and obtain any consent, authorization, or opt-out required by law before those new practices begin. You may delete your account before or after the transaction, subject to legal exceptions.

10. What We Do Not Do

Meadow does not:

• Sell personal information
• Sell consumer health data
• Share personal information for cross-context behavioral advertising
• Share health data for targeted advertising
• Include advertising or attribution SDKs in the App
• Use your location for advertising
• Record your screen with session replay
• Send your journal to AI providers or use it to train AI models
• Provide medical advice, diagnosis, or treatment recommendations
• Use geofencing to target users near health service locations

If any of these practices change, we will update this Privacy Policy and provide notice, consent, written authorization, opt-out rights, or other mechanisms where required by law.

11. Apple HealthKit Commitments

Meadow does not currently read or write Apple Health data. If we add Apple Health, Apple Health data:

• Will not be sold
• Will not be used for advertising or marketing
• Will not be used for use-based data mining
• Will not be shared with third parties except as permitted by Apple and applicable law
• Will only be accessed with your permission, and only for data types relevant to App features

These commitments override any broader future-use or business-transfer language in this Privacy Policy.

12. Where and How We Store Data

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including encryption in transit and encryption at rest with our service providers. Sign-in tokens are kept in your device’s secure storage. The App also keeps some data on your device so it loads quickly; that copy is protected by your device’s own security.

No system can guarantee absolute security. If a data breach requires notification under applicable law, we will notify affected users as required.

13. Data Retention and Deletion

We retain information only as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

You can delete your account in the App. When you delete your account:

• Your account and journal data are deleted from our active systems, generally within 30 days
• Backup copies may persist for a limited period before being overwritten
• Some information may be retained for legal, security, fraud-prevention, tax, accounting, or compliance purposes
• De-identified or aggregated data may be retained
• Data already processed by service providers may remain subject to their retention schedules and our agreements with them

14. Your Privacy Rights

Depending on where you live, you may have rights to:

• Access your information
• Correct inaccurate information
• Delete your information
• Export your information
• Withdraw consent
• Opt out of sale, sharing, targeted advertising, or profiling where applicable
• Limit the use of sensitive personal information where applicable
• Appeal a denied privacy request
• Request a list of certain third parties to whom we disclosed personal information where required by law

You can manage many choices in the App, including editing or deleting entries, turning location off, managing notifications, and deleting your account. For account deletion or privacy requests, contact meadowsupport@ostrahealth.com.

15. California Residents

If you are a California resident, you may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against for exercising those rights.

Categories of Personal Information Collected

In the preceding 12 months, we may have collected:

California Rights

We do not sell or share personal information as defined under California law.

We use sensitive personal information only for purposes permitted under California law, such as providing the services you request.

Verification

We may verify your identity before processing a request, for example by confirming access to the email address associated with your account.

Authorized Agents

You may designate an authorized agent to submit a request on your behalf. We may require proof of authorization and may still ask you to verify your identity directly.

Response Timing

We will respond to verified requests within the time required by law.

Financial Incentives

We do not offer financial incentives in exchange for personal information. Free trials and discounts are not conditioned on the collection or sale of personal information.

16. Oregon Residents

Oregon residents may have rights under the Oregon Consumer Privacy Act, including the right to access, correct, delete, port, request a list of specific third parties to whom data has been disclosed, and opt out of sale, targeted advertising, or certain profiling. To exercise these rights, contact meadowsupport@ostrahealth.com.

17. Washington Residents

Washington residents have rights regarding consumer health data under the Washington My Health My Data Act, including the right to confirm whether we collect, share, or sell consumer health data; access it; delete it; withdraw consent; and receive a list of third parties and affiliates with whom it has been shared. See our Consumer Health Data Privacy Policy.

We do not sell consumer health data, and we do not use geofencing around facilities that provide health services.

18. Nevada Residents

Nevada residents may have rights under Nevada privacy laws, including rights related to the sale of covered information and consumer health data. We do not sell consumer health data. To submit a Nevada privacy request, email meadowsupport@ostrahealth.com with the subject line “Nevada Privacy Request.”

19. Other U.S. State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Montana, Tennessee, and other states may have additional privacy rights depending on applicable law. To exercise them, contact meadowsupport@ostrahealth.com.

20. International Users and Legal Bases

Meadow is operated from the United States. If you use Meadow from outside the United States, your information may be transferred to and processed in the United States and other locations where our service providers operate.

If you are located in the European Economic Area, the United Kingdom, or another region requiring a legal basis for processing, we rely on the following:

Where required, we use appropriate safeguards for international transfers, such as contractual protections with service providers.

Your Rights in the EEA and the United Kingdom

If you are in the European Economic Area or the United Kingdom, you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased
• Restrict how we process your data
• Receive your data in a portable format
• Object to processing based on our legitimate interests
• Withdraw your consent at any time, without affecting processing carried out before you withdrew it

To exercise any of these, email meadowsupport@ostrahealth.com. We respond within one month. You also have the right to lodge a complaint with your local data protection authority.

21. Cookies and Tracking Technologies

The App does not use website cookies.

Our website does not use advertising cookies or cross-site tracking. If we add cookies or tracking technologies that require consent, we will update this Privacy Policy and provide the required consent mechanisms first.

22. Age Requirement

Meadow is intended only for users who are 18 years or older.

We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it as required by law.

23. Third-Party Links and Services

Meadow may link to third-party websites or services. This Privacy Policy does not apply to them, and we are not responsible for their privacy practices.

24. Do Not Track and Global Privacy Signals

There is no uniform standard for browser “Do Not Track” signals, and we do not currently respond to them. Where required by law, we honor legally recognized opt-out preference signals, such as Global Privacy Control, for applicable web-based activities.

25. Appeals

If we deny your privacy request, you may appeal by replying to our response or emailing meadowsupport@ostrahealth.com with the subject line “Privacy Appeal.” If you remain unsatisfied, you may contact your state Attorney General or applicable privacy regulator.

26. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version is always posted at https://meadow.ostrahealth.com/privacy, with the date it took effect at the top of the page. Earlier versions are available on request from meadowsupport@ostrahealth.com.

What counts as a material change. A change is material if it adds a category of personal information or consumer health data we collect, adds a purpose for which we use information we already hold, adds a category of recipient, reduces a right or choice this policy gives you, or changes the legal basis on which we process health data.

How we give notice. For a material change, we will give notice by email, a notice inside the App, or a notice on this page, at or before the change takes effect, and further in advance where the law requires.

Changes that need your agreement. Where the law requires your consent before a change applies, we will obtain it before the new practice begins.

Continued use of Meadow after an updated Privacy Policy takes effect means you accept it, except where additional consent is required by law.

27. Contact Us

Ostra Health, Inc., operator of Meadow

Email: meadowsupport@ostrahealth.com

Privacy Policy: https://meadow.ostrahealth.com/privacy

Terms of Service: https://meadow.ostrahealth.com/terms