Privacy Policy

1. Who we are (data controller)

The data controller responsible for your personal data is:

Rayscent Ltd is registered with the UK Information Commissioner's Office (ICO) and pays the statutory data protection fee as required by the Data Protection (Charges and Information) Regulations 2018.

2. What data we collect

2.1 Account data

• Email address (required to create and recover your account)
• Authentication credentials (password hash, or OAuth token from Google / Apple)
• Premium subscription status and activation code
• Date of account creation and last sign-in timestamps

2.2 Health data ("special category data" under UK GDPR Article 9)

• Blood test results: Hb, HbS%, HbF%, HbA%, ferritin, WBC, platelets, reticulocytes and related markers
• Daily symptom check-ins (pain, fatigue, breathlessness, other wellbeing scores)
• Crisis and hospitalisation episodes (severity, triggers, duration, notes)
• Medication records, doses, and hydroxyurea adherence logs
• Hydration and vaccination logs
• Appointment history and reminders
• Medical profile: sickle cell genotype, baseline Hb, weight, hospital, haematologist, analgesia protocol
• Messages you send to the SicklySense AI assistant (see section 5)

2.3 Technical data

• Limited redacted product analytics events, such as app opens, page visits, view changes, feature-use counts, and premium conversion events, without message contents or health form values
• Limited redacted crash diagnostics needed to investigate frontend errors, such as page path, app version, error type, and redacted stack context
• Crash and error reports with redacted diagnostics for frontend monitoring

2.4 What we do not collect

• NHS number, National Insurance number, or any national ID
• Precise location / GPS data
• Contacts, photos, microphone, or camera access
• Advertising identifiers
• Card or bank details (handled by Stripe, not us)

3. Why we process your data (lawful basis)

Under UK GDPR we must identify a lawful basis for every category of processing. Because health data is special category data, we need a basis under both Article 6 and Article 9:

4. Who we share data with (processors)

We use the following carefully selected third-party processors. Each one has a data processing agreement with Rayscent Ltd and processes data only on our documented instructions.

We do not share your data with advertisers, data brokers, or marketing networks under any circumstances.

5. SicklySense AI assistant

The SicklySense AI assistant is powered by Anthropic's Claude model. When you use it:

• Your messages are forwarded via our secure proxy to Anthropic's API
• We do not attach your name, email, account ID, or profile to the request
• Anthropic does not train on your data (per their API terms)
• Messages are not permanently stored on our servers — only on your device
• Do not include NHS numbers, date of birth, or other government identifiers in AI messages

The AI assistant is opt-in: a separate consent checkbox is shown before you can use it for the first time. You can disable it at any time from Settings → Privacy.

6. International transfers

Some of our processors (Anthropic, Stripe, Resend, Vercel US edge, push providers) are based in the United States. When personal data leaves the UK, we rely on one of the following legal safeguards:

• The UK's adequacy regulations where they apply (e.g. the UK–US Data Bridge for certified US companies)
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, signed with each processor

You can request a copy of the safeguards in place for any specific transfer by emailing privacy@mycrescent.app.

7. How long we keep your data (retention)

8. Your rights under UK GDPR

You have the following rights over your personal data. We will respond to requests within one calendar month.

• Right to be informed — this policy
• Right of access (Art. 15) — request a copy of the data we hold about you, in a readable format
• Right to rectification (Art. 16) — correct inaccurate data; most data is editable directly in the app
• Right to erasure (Art. 17) — delete your account and all associated data via Settings → Account → Delete account, or by emailing us
• Right to restrict processing (Art. 18) — ask us to pause processing while a dispute is resolved
• Right to data portability (Art. 20) — export your data in CSV / JSON format via Settings → Data → Export
• Right to object (Art. 21) — object to processing based on legitimate interests (e.g. security or fraud prevention)
• Right to withdraw consent — withdraw your consent for health data processing at any time via Settings → Privacy → Consent
• Rights relating to automated decision-making — we do not make automated decisions that produce legal or similarly significant effects about you

To exercise any of these rights, email privacy@mycrescent.app. We will verify your identity before releasing any data. Requests are free unless clearly unfounded or excessive.

9. How to complain

If you are unhappy with how we handle your data, please contact us first at privacy@mycrescent.app — we will always try to resolve concerns directly.

You also have the right to complain to the UK Information Commissioner's Office:

10. Data security

We take the security of your health data seriously. Our technical and organisational measures include:

• Encryption in transit — TLS 1.2+ for all network traffic
• Encryption at rest — AES-256 on Supabase (managed) and Vercel KV (via our own AES-256-GCM wrapper for sensitive fields)
• Optional on-device encryption — set a passphrase in Settings to encrypt local data with AES-256-GCM (PBKDF2, 600,000 iterations)
• PIN lock — optional 4-digit PIN that re-locks the app after 2 minutes in the background
• Row-level security — Supabase RLS policies ensure only you can read your own data
• Authentication — Supabase Auth with magic links, email verification, and OAuth (Google/Apple)
• Rate limiting and abuse protection — on all public API endpoints
• Regular security review — dependency updates, code review, vulnerability scanning
• SOC 2 Type II processors — both Supabase and Vercel maintain SOC 2 compliance

11. Breach notification

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, as required by UK GDPR Article 33. Where the risk is high, we will also notify you directly by email without undue delay.

12. Children and young people

Sickle cell disease often begins in childhood, so we recognise that children and their carers may want to use myCrescent.

• Children aged 13 or over may create their own account and consent to health data processing (the digital age of consent in the UK under Art. 8 UK GDPR).
• Children under 13 may not create an account. A parent or legal guardian may instead create a "carer profile" on their own account to track the child's data. In that case, the carer is responsible for the data and for obtaining any necessary consent from the child as they grow.
• We ask for date of birth at signup to enforce this. If we become aware that a child under 13 has created an account directly, we will delete it.

13. Cookies

myCrescent does not use tracking cookies, advertising cookies, or cross-site fingerprinting. The app uses browser localStorage and IndexedDB only to hold your data locally. PostHog analytics and monitoring are configured with in-memory identity only rather than persistent cookies.

14. Changes to this policy

We will update this policy when our processing changes or when the law requires it. The "last updated" date at the top will change and, for significant changes (new processors, new purposes, changes to retention), we will notify you in the app and by email before the change takes effect.

15. Contact us

For any privacy question or to exercise your rights:

• Privacy enquiries: privacy@mycrescent.app
• General support: support@mycrescent.app
• Postal: Rayscent Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Rayscent Ltd is a company registered in England and Wales under company number 17120455. ICO registration ZC117860.