Privacy Policy | Achoo Documentation

At Achoo, we believe that your health data is yours. We built this app to help you manage your hay fever, not to harvest your personal information. This Privacy Policy explains how we collect, use, and protect your data when you use our iOS app and website.

1. Introduction

Achoo is a hay fever companion app that provides personalised daily pollen forecasts, AI-generated health recommendations, and symptom tracking. Achoo is operated by Yara Labs Ltd, a company registered in England and Wales ("we", "us", or "our").

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Achoo iOS application. It applies to all users of Achoo, including users of the free tier and Achoo+ subscribers.

We are committed to protecting your privacy and processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR) where applicable.

2. Data Controller

Yara Labs Ltd is the data controller responsible for your personal data.

Contact: privacy@achooapp.co.uk

If you have any questions about this Privacy Policy or our data practices, please contact us at the email address above.

3. Data We Collect

We collect the following categories of personal data:

3.1 Account Data

Email address (used for account creation and authentication)
Encrypted password (managed by Supabase Auth — we never store plaintext passwords)
Account creation date and unique user identifier

3.2 Location Data

GPS coordinates or postcode, used solely to fetch local pollen data for your area
Location is processed at the time of your request and converted to an approximate regional zone (approximately 55km² area) — your precise coordinates are not stored
You may choose to provide a postcode instead of GPS location

3.3 Health and Sensitivity Data

We collect data that may constitute special category health data under UK/EU GDPR:

Your selected pollen sensitivities (tree, grass, weed, or 'not sure')
Symptom diary entries including severity ratings (1–5), symptom types (sneezing, runny nose, itchy eyes, congestion, fatigue, headache, skin), and optional free-text notes
Pollen indices recorded at the time of each diary entry

We process this health data on the basis of your explicit consent, which you provide when setting up your profile and logging symptoms.

3.4 Usage and Preference Data

Notification preferences (enabled/disabled, chosen time)
App settings and preferences
Subscription status (Achoo+ or free tier)

3.5 Pollen Forecast Data

Pollen forecast data fetched from the Google Pollen API based on your location
Cached pollen data is stored per geographic region, not per individual user

3.6 Technical Data

Device type and iOS version (collected by Apple and RevenueCat for subscription management)
Crash reports and error logs (anonymised)
Push notification tokens (stored by Apple for notification delivery)

4. Legal Basis for Processing

We process your personal data on the following legal bases:

Consent (Article 6(1)(a) and Article 9(2)(a) UK/EU GDPR): For processing your health and sensitivity data, and for sending you push notifications. You may withdraw consent at any time.
Contract performance (Article 6(1)(b)): For account management, delivering pollen forecasts, and providing the features you have requested.
Legitimate interests (Article 6(1)(f)): For improving app performance, preventing fraud, and ensuring the security of our systems, where these interests are not overridden by your rights.
Legal obligation (Article 6(1)(c)): Where we are required to process data to comply with applicable law.

5. How We Use Your Data

We use your personal data for the following purposes:

Providing personalised daily pollen forecasts tailored to your location and sensitivities
Generating AI-powered health recommendations via Anthropic Claude (Achoo+ only)
Sending daily push notifications with your pollen brief at your chosen time
Analysing your symptom diary to identify patterns and correlations with pollen levels
Managing your account and subscription
Improving the accuracy and relevance of our pollen data and recommendations
Complying with legal obligations

We do not use your data for advertising, profiling for third-party purposes, or any purpose incompatible with those listed above.

6. Data Sharing and Third Parties

We share your data with the following third-party service providers, each of whom acts as a data processor on our behalf:

6.1 Supabase

We use Supabase for our database, authentication, and backend infrastructure. Your account data, profile, and symptom diary entries are stored on Supabase servers located in the eu-west-2 (London) region, ensuring your data remains within the UK.

Privacy policy: https://supabase.com/privacy

6.2 Google Pollen API

We use the Google Pollen API to fetch pollen forecast data. Your approximate location coordinates are sent to Google to retrieve pollen data. We cache pollen data at a regional level to minimise the number of requests sent to Google.

Privacy policy: https://policies.google.com/privacy

6.3 Anthropic

For Achoo+ subscribers, we use Anthropic's Claude AI model to generate personalised health recommendations based on your pollen sensitivity profile and local pollen levels. We do not send your symptom diary entries or identifiable personal data to Anthropic.

Privacy policy: https://www.anthropic.com/privacy

6.4 RevenueCat

We use RevenueCat to manage in-app subscriptions and process payments. RevenueCat receives your Apple App Store receipt data and subscription status. Payment processing is handled entirely by Apple — we never receive or store your payment card details.

Privacy policy: https://www.revenuecat.com/privacy

6.5 Apple

As an iOS app distributed via the App Store, Apple processes data in connection with app distribution, payment processing, push notifications, and crash reporting.

Privacy policy: https://www.apple.com/legal/privacy/

We do not sell, rent, or trade your personal data to any third parties. We do not share your data with advertisers.

7. Data Retention

We retain your personal data for the following periods:

Account and profile data: Retained for the duration of your account, plus 30 days after deletion to allow for recovery if requested
Symptom diary entries: Retained for the duration of your account and deleted immediately upon account deletion
Pollen forecast cache: Retained for 24 hours per region, then overwritten with fresh data
Notification tokens: Retained until you disable notifications or delete your account

When you delete your account through the app, all your personal data is permanently deleted from our systems within 30 days. Anonymised, aggregated data may be retained for analytical purposes.

8. Your Rights

Under UK GDPR and EU GDPR, you have the following rights:

Right of access: You may request a copy of the personal data we hold about you
Right to rectification: You may request correction of inaccurate or incomplete data
Right to erasure: You may request deletion of your personal data ('right to be forgotten')
Right to restriction: You may request that we restrict processing of your data in certain circumstances
Right to data portability: You may request your data in a structured, machine-readable format
Right to object: You may object to processing based on legitimate interests
Right to withdraw consent: Where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing
Rights related to automated decision-making: We do not make solely automated decisions that produce legal or similarly significant effects

To exercise any of these rights, please contact us at privacy@achooapp.co.uk. We will respond within 30 days. You may also delete your account and all associated data directly within the app via Settings → Delete my data.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk (UK users) or your local supervisory authority (EU users).

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

All data transmitted between the app and our servers is encrypted using TLS
Passwords are hashed and never stored in plaintext
Our backend infrastructure is hosted within the UK (eu-west-2 London region)
Access to production systems is restricted to authorised personnel only
Regular security reviews of our infrastructure and code

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected users without undue delay as required by UK GDPR.

10. International Data Transfers

Your primary account and health data is stored in the UK (Supabase eu-west-2 London region) and does not leave the UK/EEA for storage purposes.

Some third-party service providers (including Anthropic and RevenueCat) may process data in the United States. Where data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the relevant supervisory authority.

11. Children's Privacy

Achoo is not directed at children under the age of 13 (or 16 in the EU where applicable). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@achooapp.co.uk and we will take steps to delete such data promptly.

12. Special Category (Health) Data

Symptom data and pollen sensitivity information may constitute special category health data under Article 9 of the UK/EU GDPR. We process this data only with your explicit consent, which you provide when creating your profile and logging symptoms.

You may withdraw this consent at any time by deleting your symptom diary entries or your account. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

13. Cookies and Tracking

Achoo is a native iOS application and does not use browser cookies. We do not use third-party advertising trackers or analytics SDKs that track you across other apps or websites.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the app or by email. The updated policy will be available at achooapp.co.uk/docs/privacy and will show the date it was last updated.

15. Contact Us

Email: privacy@achooapp.co.uk

Website: achooapp.co.uk/docs/privacy

We aim to respond to all privacy-related enquiries within 5 business days and all formal data subject requests within 30 days.