NeuroDay helps people living with a brain tumour, and the people who support them, organise everyday life. Because you may add health information, we treat privacy very seriously. This policy explains what we collect, why, who sees it, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018). We’ve tried to keep it in plain English.
Who we are
NeuroDay is run by Arnold Onea in the United Kingdom, and is the “data controller” for the information described here. You can contact us at hello@neuroday.co.uk.
What we collect
- Account details: your name (or nickname), email address and password (stored securely, never in readable form).
- Information you choose to add: daily check-ins, symptoms, medicines you record, appointments, treatment journey entries, seizure notes, questions for your doctor, care information and contacts, requests for help, notes, and documents or photos you upload. Much of this is health information, which the law calls “special category data”.
- Care Circle details: who you’ve invited, what you’ve chosen to share with them, and the tasks they’ve accepted.
- Technical information: basic information needed to run and secure the service, such as when you signed in and error logs. We don’t use advertising or analytics trackers in the app.
Why we use it, and our legal basis
- To provide NeuroDay to you (your account, records, sharing and reminders): this is necessary to provide the service you asked for (UK GDPR Article 6(1)(b)).
- For your health information, we rely on your explicit consent (Article 9(2)(a)). You can withdraw consent at any time by deleting the information or your account.
- To keep the service secure and prevent misuse (legitimate interests, Article 6(1)(f)).
We do not sell your information, use it for advertising, or use it to make automated decisions about you. We don’t use your health information to train AI models.
Who can see your information
- You.
- People in your Care Circle, only for the categories you switch on. By default they see nothing except requests for help that you share with them. You can change this or remove them at any time, and their access ends straight away. Anything they have already seen or copied can’t be taken back.
- Our service providers (below), only to run NeuroDay for us and under contract.
- Authorities, only where the law requires it.
Our service providers
- Supabase: database, sign-in and file storage. Your information is stored in the EU (Ireland).
- Resend: sends emails such as Care Circle invitations and account emails. Invitation emails never include health information.
- Apple: provides the App Store and TestFlight, and delivers notifications you’ve turned on.
- Expo (EAS): builds the app for distribution.
- Vercel: hosts this website.
Some providers may process information outside the UK, for example in the United States. Where they do, we rely on safeguards the law recognises, such as the UK’s adequacy regulations or standard contractual clauses.
How long we keep it
We keep your information while you have an account. If you delete your account, we delete your account, records and uploaded documents. Short-term backups held by our providers for recovery are overwritten on a rolling basis. Expired invitation codes and sign-in attempt records are cleared regularly.
Your rights
You can ask to see your information, correct it, delete it, restrict or object to how we use it, take a copy of it (data portability), and withdraw consent at any time. In the app you can download your data and delete your account yourself under My Space, then Account. For anything else, email hello@neuroday.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
Security
Access is protected by strict database rules, so people can only see information they’re allowed to see. Documents are kept in private storage and opened using links that expire after about a minute. Sign-in details are held in your iPhone’s secure storage. No system is perfect, but we work to protect your information and will tell you and the ICO if there is a serious breach, as the law requires.
Reminders and notifications
Reminders are created on your own iPhone. To protect your privacy, they use general wording and don’t show the names of your medicines on the lock screen. You can turn them off in iPhone Settings.
Children
NeuroDay is for adults aged 18 and over.
Changes to this policy
If we make important changes we’ll tell you in the app or by email before they take effect.