Version 3.0  |  Last updated: July 2026

Luna Life Limited ("Luna", "luna", "us", or "we") is the data controller in respect of your personal information. This privacy notice sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by us.

You can also find our Health Data Privacy Notice in the second part of this document.

Please read this carefully to understand our practices regarding your personal information and how it will be treated.

1. About luna and this notice

luna is a teen wellness app covering periods, puberty, mood and growing up. Our users are primarily teenagers and their parents or guardians. Because we process health data for a young audience, we take privacy seriously and apply strict standards across all markets in which we operate.

luna operates in over 170 countries. Different laws apply depending on where you are. This notice explains our practices globally and includes jurisdiction-specific sections where the law requires additional information.

2. Children and parental consent

luna is designed for teenagers. We take our obligations in respect of children's data seriously. We apply the following age thresholds. Below these ages, parental or guardian consent is required before a child can use luna.

Age thresholds by region

United Kingdom

Age threshold: 13

UK GDPR and Age Appropriate Design Code apply.

United States

Age threshold: 18

COPPA applies. Under-18 users require verifiable parental consent.

European Union, Norway and Switzerland

Age threshold: 16

GDPR Article 8 and equivalent national legislation. luna applies age 16 as a single rule across all EU member states, Norway and Switzerland. This is due to the lack of harmonisation on the age of consent across these jurisdictions, where individual member states are permitted to set the age of consent between 13 and 16.

However, luna recognises that some jurisdictions have lower age thresholds for consent. To ensure flexibility and compliance, we have established a procedure to accommodate individuals from these jurisdictions who contact us directly. If you are from a country where the age of consent for data processing is lower than 16, you may be onboarded without parental consent after verifying your eligibility.

If you believe you qualify under these rules and are unable to proceed, please contact us to clarify your situation.

We will review your request and ensure compliance with the relevant local legislation.

Parental consent requirements (EU, Norway and Switzerland)

Where the age of consent is 16 or where users below the applicable age threshold wish to use luna, parental or guardian consent will be required. Parents or guardians will need to provide explicit consent to allow the processing of children's health data in accordance with GDPR regulations.

Canada

Age threshold: 14

Federal PIPEDA threshold is 13. Quebec Law 25 sets threshold at 14. luna applies 14 Canada-wide.

Australia

Age threshold: 15

Privacy Act 1988. Incoming Children's Online Privacy Code (due December 2026) will move to a 13/15 split.

Rest of world

Age threshold: 13

luna default applied globally as baseline.

How we collect age information

All users are required to enter their date of birth before accessing any part of the luna app. No personal data is processed beyond the minimum necessary to determine whether parental consent is required until that determination has been made.

Parental consent flow

If a user's date of birth places them below the threshold for their country, the following process applies:

• The app remains locked. No features are accessible until parental consent is confirmed.
• The user is asked to provide a parent or guardian email address.
• The parent or guardian receives an email explaining what luna is, what data is collected, and requesting their approval.
• The parent or guardian must actively sign up and consent to luna’s collection of data and the activation of their child’s account before the app unlocks.
• If parental consent is not provided within 30 days, the child’s account is suspended and any data collected during the sign-up process is deleted.

Subscription and contractual capacity

Because children below the applicable age threshold lack full contractual capacity, the parent or guardian who completes the parental consent flow becomes the contracting party for any luna subscription. The subscription agreement, including any auto-renewal terms, is entered into by the parent or guardian on behalf of the child. A parent or guardian may request an alternative method of providing consent on behalf of the child by contacting us. 

Pre-consent data processing

To determine whether parental consent is required, we must collect a small amount of information via strictly-necessary cookies or similar technologies and via your input before seeking consent. This is limited to:

• Date of birth (to determine the user’s age).
• Device identifier (to distinguish unique sign-ups and prevent spoofing).
• Country (derived from coarse location or device settings to determine the applicable age of consent in the relevant jurisdiction)

The lawful basis for this limited processing is for luna’s legitimate interests under UK and EU GDPR Article 6(1)(f). Such interests include where it is strictly necessary for us to identify whether parental consent is required and to facilitate the parental consent request and specifically:

• To ensure compliance with varying age of consent laws.
• To provide a safe and compliant onboarding experience for users.
• To process only the necessary data to fulfil our legal and regulatory obligations without collecting excessive or unnecessary information.

In some countries like the US, this processing is explicitly permitted for the purpose of contacting a parent or guardian. This data is used for no other purpose and is deleted if the user does not complete the sign-up process.

3. How and when we collect personal information

We collect and process personal information from various sources such as:

From you directly, when you:

• visit our website or app, including when registering, leaving reviews or comments, or filling in forms such as newsletter sign-ups;
• purchase products or sign up to services through our website or app;
• contact or request information from us;
• participate in research, pilots, surveys or other market research; and
• communicate with us via social networking websites or third party apps.

From personal information we generate about you through your use of our website or app via cookies and similar technologies. 

From third parties such as our service providers who assist with luna. 

4. What personal information we collect

We and our service providers who help us operate our website and app may collect and process the following information:

• contact details such as name, email address and telephone number;
• date of birth;
• password and other authentication information;
• photographs or video and voice clips;
• health and wellbeing information, including menstrual cycle data, mood logs, pain, sleep, energy and motivation tracking, and puberty-related content interactions;
• responses to surveys or market research;
• financial and payment information;
• marketing preferences; and
• purchase history and participation data from events or research projects.

If you contact us with a complaint or question, we may keep a record of any phone number used and details of the query.

Cookies and similar technologies

When you visit our website and app, we may collect information automatically using cookies and similar technologies. This may include:

• information about your device, including unique device identifier, operating system and IP address;
• login information;
• browser type and version;
• information about your visit, including URL, clickstream, length of visits and page interactions; and
• information about your use of our app, to distinguish you from other users and to remember your preferences.

The cookies and similar technologies we use fall into the following categories:

• Session cookies: These link your actions during a particular browser session and expire when you close your browser.
• Persistent cookies: These are stored on your device between sessions and allow preferences or actions to be remembered.
• Strictly necessary cookies: These are essential for you to navigate the site and use its features.
• Performance, analytics and advertising cookies: These collect information about how you use our site and measure the effectiveness of ads. See the third party SDK section below for details of the providers we use.
• Functionality cookies: These remember choices you make such as language and preferences.

If you do not wish for cookies to be installed on your device, you can change the settings on your browser or device to reject cookies. Please note that doing so may affect your ability to use some features of the site.

5. Third party SDKs 

We use the following third party SDKs and service providers. Where a user is below the applicable age threshold and parental consent has not yet been confirmed, data sharing with advertising and analytics providers is restricted as described below.

Adjust (mobile attribution)

We use Adjust for mobile attribution. luna operates Adjust in mixed audience mode. This means:

• For users aged 13 and over outside the EU, Norway and Switzerland, and for users aged 16 and over in the EU, Norway and Switzerland where parental consent has been confirmed, Adjust operates normally. Advertising IDs are collected and attribution data is shared with Adjust.
• For users under 13 in all countries, and for users aged 13-15 in the EU, Norway and Switzerland prior to parental consent being confirmed, Adjust operates in COPPA compliance mode. No advertising IDs are collected. No third party data sharing occurs via Adjust.
• The Adjust SDK is not initialised until a user's date of birth has been confirmed. No data is sent to Adjust before this point.

Other providers

• Mixpanel: Product analytics and user behaviour tracking.
• Firebase (Google): Analytics and app functionality. 
• Facebook SDK: Analytics and advertising measurement. 
• Google Analytics: Website analytics. 

6. Purposes for processing your personal information

We may process your personal information for the following purposes:

• to provide the information and services you have requested;
• to send you marketing and advertising materials you would be interested in, where you have consented to receive these;
• to authenticate your access to our website and app;
• for system administration, troubleshooting, data analysis and testing;
• for research, statistical and survey purposes;
• to distinguish you from other users and remember your preferences;
• to monitor and improve your experience of our website and app;
• to help you with queries or questions;
• to notify you of changes to our services;
• for security and fraud prevention;
• to ensure our website and app are safe and secure; and
• to comply with the law.

7. Legal basis for processing your personal information

We will only process your personal information where we have a legal basis to do so. The basis depends on why we have collected and how we use your personal information.

• Consent: Where you have explicitly consented. This includes use of the health log features in our app, sending you marketing emails, and the processing of special category health data under GDPR Article 9. For users below the applicable age threshold, this consent must be provided by a parent or guardian. You may withdraw consent at any time.
• Legitimate interests: Where it is necessary for us to understand our users, improve our services, and operate effectively, provided this is done in a fair way that respects your privacy. This includes certain analytics activities and the limited pre-consent processing described in Section 2.
• Performance of a contract: Where we need to use your information to provide our services to you, for example to process a subscription payment.
• Compliance with law: Where we are required to process your information by law.

For special category health data (including menstrual cycle data, mood data, and puberty-related information), our primary lawful basis is explicit consent under GDPR Article 9(2)(a) and equivalent provisions under applicable law.

Please note if you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as our terms of use on our website and app), or we may be prevented from complying with our legal obligations (such as verifying your age).    

8. Where we store your personal information

We may sometimes transfer your personal information outside the country in which it was collected, including to countries which may have different data protection laws. Whenever we do this, we take steps to ensure your personal information is protected using appropriate safeguards as required by data protection laws. Such safeguards include: standard data protection clauses, legal exceptions, adequacy decisions, recognised frameworks (e.g. the EU-US Data Privacy Framework and the UK extension to the Framework). If you are located in the UK or Europe, you may contact us for more information on the safeguards we apply.

9. How long we keep your personal information

We only keep personal information for as long as it is necessary for the purpose for which it was collected. After this period it will be deleted or anonymised. We may keep records of complaints or queries for as long as is necessary to protect us from a legal claim.

Where processing is based on consent and we have no other lawful basis to continue, if you withdraw consent we will delete your personal information. Where you unsubscribe from marketing, we will retain your email address solely to ensure we do not contact you again.

10. Security

You must keep your password and authentication information confidential. If you know or suspect that anyone else has access to your credentials, notify us immediately using the contact details below.

The transmission of information via the internet is not completely secure. Although we take steps to protect your personal information, we cannot guarantee the security of information transmitted to our services.

Our website and app may contain links to third party websites. We are not responsible for the privacy practices of those websites. Please review their privacy notices before submitting any personal information.

11. Disclosing your information

We may share your personal information with service providers and business partners who help us operate and improve our services, including the third-party SDKs described above]. We may also disclose your personal information in the following circumstances:

• for research, evaluation and analysis and to improve the effectiveness of our services;
• in connection with a sale or transfer of our business or assets;
• where required by law or to comply with a legal process; and
• to protect luna, our users, or others, and to enforce our terms and conditions.

12. Your rights

In certain circumstances, you have certain rights in relation to your personal information, including the right to:

• access your personal information;
• correct inaccurate information;
• request deletion of your personal information;
• restrict or object to processing in certain circumstances;
• receive a machine-readable copy of your personal information (data portability); and
• withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us using the details in Section 14. We will handle requests in accordance with applicable law.

You also have the right to complain to a data protection authority if you believe we have processed your personal information unlawfully. We ask that you contact us first so we can investigate and resolve your concern.

13. Jurisdiction-specific information

United Kingdom

Luna Life Limited is registered as a data controller with the Information Commissioner's Office. The legal basis for processing special category health data is explicit consent under UK GDPR Article 9(2)(a).

luna complies with the UK Children's Code (Age Appropriate Design Code). This means we apply privacy-protective defaults for child users, collect only the minimum data necessary, and do not use children's data for profiling or targeted advertising.

The age threshold for independent consent in the UK is 13. Users below this age require parental or guardian consent before accessing luna.

We encourage you to raise your concerns directly with us so that we can address them through our internal complaints escalation procedure. To do so, please contact us if you have any questions or concerns regarding your personal data, at hello@weareluna.app 

In the UK, if you are not satisfied with our response, you may escalate the matter via our complaints procedure by contacting us. During this process we will acknowledge your complaint within 30 days, make enquiries into the complaint without undue delay and make an appropriate level of enquiries.

If after the complaints process, you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): www.ico.org.uk    

European Union, Norway and Switzerland

Luna Life Limited is the data controller for users in the EU, Norway and Switzerland. Our legal basis for processing personal data is set out in Section 7. Our legal basis for processing special category health data is explicit consent under GDPR Article 9(2)(a) and equivalent provisions.

luna applies a single age threshold of 16 across all EU member states, Norway and Switzerland. Users below this age require parental or guardian consent before accessing luna.

Norway currently sets its digital consent age at 13 under Section 5 of its Personal Data Act, but the Norwegian government has proposed raising this to 15. luna applies 16 as a single rule across all European markets for simplicity and consistency.

Switzerland is not an EU member state but applies an equivalent threshold of 16 under its revised Federal Act on Data Protection (nFADP), which came into force on 1 September 2023.

You have the right to lodge a complaint with your local supervisory authority. Contact details for EU data protection authorities are available at https://edpb.europa.eu.

United States

luna complies with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13 without verifiable parental consent.

Where a user is under 13, we require verifiable parental consent before collecting any personal information beyond the minimum necessary to facilitate that consent process. Once we have obtained consent, we collect the information described in Section 4 above. We use that information for the purposes described in Section 6 above, we disclose that information as described in Section 11 above, and we retain this information as described in Section 9.

Parents may review, request deletion of, and refuse further collection of their child's personal information by contacting us at hello@weareluna.app. 

Residents of states like Washington and Nevada that have passed consumer health privacy laws: please see the Health Data Privacy Notice below for additional information about your rights in respect of health data.

Canada

luna complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) at the federal level and with Quebec's Law 25 at the provincial level. luna applies an age threshold of 14 across all Canadian provinces. Users below this age require parental or guardian consent before accessing luna.

Australia

luna complies with the Australian Privacy Act 1988. The current age threshold for independent consent in Australia is 15. Users below this age are presumed not to have capacity to consent, and parental or guardian consent is required.

The Australian Children's Online Privacy Code is expected to come into effect by December 2026. luna will update this notice and its practices when the Code is registered.

14. Changes to this notice

We may change this privacy notice at any time. The updated notice will be displayed on our website and app. The date this notice was last updated appears at the top.

15. Contact us

Questions and comments regarding this privacy notice should be sent to: hello@weareluna.app

Luna Life Limited

71-75 Shelton St, London WC2H 9JQ