1. Introduction

Ellyra ("we", "us", "our") is a mobile health application designed to support your wellbeing through symptom checking, health tracking, and related services. We are committed to handling your personal data in accordance with the UK GDPR and Data Protection Act 2018.

This Privacy Policy explains what data we collect, how we use it, and the rights you have.

2. Information We Collect

We only collect information necessary to provide our services:

• Personal details – e.g. name, date of birth, email, phone number.
• Health data (special category data) – symptoms, medical history, health surveys, uploaded reports, or photos you provide (with explicit consent).
• Biometrics – if you enable FaceID or TouchID for login (handled securely by your device, not stored by us).
• Technical data – device type, app version, IP address, crash/error logs.
• Children's data – only with verified parental consent for under-17s.

3. How We Use Your Information

• Delivering app features (symptom checker, report insights, health tracking).
• Improving safety, quality, and performance of our service (using anonymised or aggregated data).
• Communicating with you (service updates, reminders, or changes to this policy).
• Regulatory compliance and patient safety reporting (where required).
• Legal obligations or defending claims (if applicable).

We do not sell your data to third parties.

4. Data Security

• All transmissions are encrypted (TLS/HTTPS).
• Health data stored with strong encryption at rest.
• Access limited to authorised staff under strict confidentiality.
• Regular security audits and NHS Digital–aligned standards.

5. Your Rights

You have rights under UK GDPR, including:

• Access your data
• Correct inaccuracies
• Request deletion ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Complain to the ICO (ico.org.uk)

Contact us at privacy@ellyra.health to exercise these rights.

6. Children's Privacy

Ellyra is not intended for children under 17 without parental consent. Parents/guardians must supervise use.

7. Sharing Your Data

We may share data with:

• Service providers (cloud hosting, analytics, support tools) under strict contracts.
• Healthcare professionals (only if you choose to share).
• Regulators or authorities (if legally required).
• Business transfers (e.g., merger/acquisition, with safeguards).

Data is stored in the UK/EEA. If transferred outside, we use legally approved safeguards.

8. Updates

We may update this Privacy Policy from time to time. Major changes will be notified in-app or by email.