GDPR & your data rights
Under UK and EU GDPR you have strong rights over your personal and health data. Here's what they are and how to use them at Evymi.
Last updated · 8 July 2026
Your rights, in plain English
- Access — ask for a copy of the data we hold about you.
- Rectification — ask us to fix anything wrong.
- Erasure — ask us to delete your data ("right to be forgotten").
- Portability — get your data in a machine-readable format.
- Restriction — ask us to pause certain uses while we look into a query.
- Objection — object to uses that rely on our legitimate interests.
- Withdraw consent — where we rely on your consent, you can take it back.
- Complain — to the UK ICO or your local supervisory authority.
How to exercise them
Email privacy@evymi.com from the address on your account. We aim to reply within a few days and will complete your request within one month, or tell you if we need more time. Requests are free — we may charge a reasonable fee only if they're clearly unfounded or excessive.
Special-category health data
Cycles, symptoms, medications and journal entries are "special category" data under Article 9. We only process them with your explicit consent, which you can withdraw at any time by deleting your data or your account.
International transfers
Some processors are outside the UK/EEA. We rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses to protect your data when it moves.
Subprocessors
The organisations that help us run Evymi:
| Provider | Role | Region |
|---|---|---|
| Lovable Cloud (Supabase) | Hosting, database, auth, storage | EU / US |
| Apple | iOS push notifications | US |
| Email delivery provider | Transactional email | EU / US |
| AI gateway | Ask Evymi responses (no identifying data attached) | EU / US |
Complaints
You can complain to the UK Information Commissioner's Office at ico.org.uk or your local EU/EEA data-protection authority. We'd appreciate the chance to put things right first — email privacy@evymi.com.