Back

Apnea Assist · PulmoWise Ltd

Privacy Policy

Effective date: [Effective Date]

This Privacy Policy explains how PulmoWise Ltd ("PulmoWise", "we", "us" or "our") collects, uses, stores and protects your personal information when you use the Apnea Assist mobile and web application and related services (the "App"). We are committed to protecting your privacy and handling your data in an open and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. About us

Apnea Assist is operated by PulmoWise Ltd, a private limited company registered in England and Wales.

  • Company: PulmoWise Ltd
  • Registered office: [Registered Office Address]
  • Company number: [Company Number]
  • Website: [Website URL]
  • Contact email: [Contact Email]

For the purposes of UK GDPR, PulmoWise Ltd is the "data controller" for the personal information you provide through the App.

2. Privacy by design — our commitments

  • No legal name required: you choose a username (display name). We never ask for your real name.
  • No date of birth collected: we only ask for your age in years, which is enough for personalised calculations.
  • Data minimisation: the core profile is limited to username, email, age, height and weight. Everything else is optional.
  • Optional health data: all health metrics (weight, BP, SpO₂, CPAP, symptoms, exercise) are optional. You can use the App without entering any of them.
  • Export: you can download a complete copy of your data at any time from Profile → Privacy & data controls.
  • Delete: you can permanently delete your account and all associated data from the same screen, with no need to contact us.
  • Inactive account deletion: accounts inactive for 24 months are automatically deleted. We email a warning at 22 months.
  • No routine staff access: our staff cannot routinely read your health records. Access is limited to narrow technical maintenance under audit, and requires authorisation.
  • Encryption: data is encrypted in transit (TLS) and at rest on our managed infrastructure.
  • No AI training without consent: we never use your data to train AI models unless you explicitly opt in. Opt-in is off by default.
  • No selling or ad-sharing: we never sell or share your health data with advertisers or marketers.

3. Information we collect

2.1 Information you provide directly

  • Account details: email address and password (stored hashed).
  • A username (display name) of your choice. We do not require your legal name.
  • Profile details: age (in years — we do not collect a full date of birth), sex, height and weight. Waist, activity level and smoking status are optional.
  • Messages you send to our support team.

In line with our data minimisation commitment, only your username, email, age, height and weight are used across core features. All other health information is optional and only collected if you choose to use the related features.

2.2 Health-related information you choose to log

You may voluntarily enter the following health-related information. You are not required to provide it, but doing so improves the educational insights the App can show you.

  • Weight, BMI and waist measurements.
  • Blood pressure and resting heart rate.
  • Oxygen saturation (SpO₂).
  • CPAP usage hours, mask leak and comfort notes.
  • Sleep quality and symptoms (snoring, daytime sleepiness, morning headaches, nocturia, fatigue).
  • Physical activity (type, duration, intensity, estimated calories).

Some of this information is "special category data" (health data) under UK GDPR. We process it only with your explicit consent, which you give by choosing to enter it.

2.3 Information collected automatically

  • Device and technical data (device type, operating system, browser, IP address).
  • Usage data (pages viewed, features used, session duration, error logs).
  • Authentication metadata (sign-in timestamps, email verification status).

3. How we use your information

  • To create and manage your account and provide the App's features.
  • To generate personalised educational and wellness insights.
  • To produce premium wellness reports you request.
  • To send transactional emails (welcome, email verification, password reset, billing).
  • To provide customer support and respond to your enquiries.
  • To improve and secure the App, detect abuse, and prevent fraud.
  • To comply with our legal obligations.

4. AI processing and personalised wellness insights

Apnea Assist uses third-party AI services to generate educational content, coaching responses and personalised wellness summaries based on the data you log. When you use AI features, the relevant data you have entered (such as recent logs and profile details) is sent to our AI provider solely to produce a response for you. AI providers act as processors on our behalf and are contractually prohibited from using your data to train their models. AI-generated content is educational only and does not constitute medical advice.

5. Legal bases for processing

  • Contract: to provide the App and your subscription.
  • Explicit consent: for processing health data and sending marketing communications.
  • Legitimate interests: to keep the App secure, improve features and prevent abuse.
  • Legal obligation: to keep records required by law (e.g. accounting, audit).

6. Data storage and security

Your data is stored on secure cloud infrastructure within the United Kingdom and/or European Economic Area. We use industry-standard security measures including:

  • TLS/HTTPS encryption in transit.
  • Encryption at rest for databases and backups.
  • Row-level security so your records are only accessible to you.
  • Hashed and salted passwords (we never see your password).
  • Email verification and protection against compromised passwords.
  • Access controls and audit logging for sensitive operations.

No system is completely secure. While we take strong measures to protect your data, we cannot guarantee absolute security.

7. Third-party service providers

We share information only with carefully selected providers acting as our processors:

  • Hosting & database: secure cloud hosting and managed database services.
  • Authentication: account creation, email verification, password reset.
  • AI services: large language model providers that generate educational content from your prompts and logs.
  • Email delivery: transactional email from notify.apneaassist.app.
  • Payment processing: third-party merchant of record for subscription billing. We never see or store your full card details.
  • Analytics & error monitoring: aggregated and pseudonymised usage and crash data to improve the App.

8. Cookies and similar technologies

We use a small number of strictly necessary cookies and local storage items required for sign-in, session management and security. We do not use advertising cookies. If we introduce analytics cookies in the future, we will request your consent through a cookie banner as required by UK PECR.

9. International data transfers

Some of our service providers (for example AI providers) may process data outside the UK or EEA. Where this happens, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, Standard Contractual Clauses, or adequacy decisions issued by the UK Government.

10. Data retention

We retain your personal data only for as long as necessary to provide the App and to meet our legal obligations:

  • Account and health log data: while your account is active.
  • After account deletion: data is removed within 30 days, except backups which expire within 90 days.
  • Billing records: retained for 6 years to comply with UK tax law.
  • Disclaimer acknowledgement records: retained for as long as your account exists, as evidence of consent.

11. Your rights under UK GDPR

You have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate or incomplete data.
  • Request deletion ("right to be forgotten").
  • Restrict or object to processing.
  • Data portability (receive your data in a machine-readable format).
  • Withdraw consent at any time for processing based on consent.
  • Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us at [Contact Email]. We will respond within one month.

12. Data deletion

You can request account deletion at any time by emailing [Contact Email]. Once verified, we will permanently delete your account, profile, health logs and associated data, subject to the legal retention periods described above.

13. Children's privacy

Apnea Assist is intended for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided information to us, please contact us so we can delete it.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notice and update the "Effective Date" at the top of this page.

15. Contact us

If you have questions about this Privacy Policy or how we handle your data, please contact:

  • PulmoWise Ltd
  • [Registered Office Address]
  • Email: [Contact Email]