Privacy Policy

Who we are

Evymi ("we", "us") is the controller of the personal data described here. You can contact us at privacy@evymi.com.

What we collect

• Account data — email, name, password hash, sign-in provider.
• Health & wellbeing data you log — cycles, symptoms, mood, medications, pelvic-floor sessions, journal entries. This is special-category data under UK/EU GDPR.
• Device & technical data — device model, OS, app version, crash logs, coarse locale.
• Cookies & local storage — see our cookie policy.
• Support messages — anything you send us via email or contact form.

Why we use it & our lawful bases

• To provide the service — performance of a contract with you.
• To store and process your health logs — your explicit consent (Article 9(2)(a) UK GDPR). You can withdraw at any time by deleting your data or account.
• To keep the service secure — our legitimate interest in preventing fraud and abuse.
• To send transactional emails — performance of a contract.
• To measure product use (if you opt in) — your consent.

Who we share it with

We do not sell your data. We share it only with the processors we need to run the service:

• Lovable Cloud — hosting, database, authentication and file storage.
• Apple Push Notification service — delivery of iOS notifications.
• Email provider — transactional email (sign-in links, receipts).
• AI providers — where you ask Ask Evymi a question, the prompt is processed by our AI gateway. We do not send identifying information with these requests.

A current list of subprocessors is available on our GDPR page.

International transfers

Some processors are based outside the UK/EEA. Where that's the case we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

How long we keep it

• Account & health data — until you delete your account. You can request deletion at any time.
• Backups — up to 30 days after deletion.
• Support messages — up to 24 months.
• Anonymous analytics — up to 26 months.

Your rights

Under UK/EU GDPR you can ask us to:

• Access a copy of your data.
• Correct anything that's wrong.
• Delete your account and data.
• Export your data in a portable format.
• Object to or restrict certain uses.
• Withdraw a consent you previously gave.

Email privacy@evymi.com and we'll respond within one month. If you're not happy with our response you can complain to the UK Information Commissioner's Office at ico.org.uk or your local supervisory authority.

Children

Evymi is intended for people aged 13 and over. Users under 16 in the UK (or the equivalent local age) should have a parent or guardian's involvement. If you believe a child has given us data without permission, contact us and we'll remove it.

Security

Data is encrypted in transit (TLS) and at rest. Access is limited to staff who need it. We review access and infrastructure regularly.

Changes to this policy

We'll update the "last updated" date at the top and, for significant changes, notify you by email or in-app.