Privacy Notice

Last updated: 19 July 2026

This Privacy Notice explains what data Asclepiad holds about you, what we do with it, and what you can ask us to do with it. The controller is Asclepeion Ltd (Company No. 15830285, England and Wales; ICO registration ZB723138).

1. WHAT WE COLLECT

A randomly-generated account identifier
Your country (for emergency-resource routing)
Your language preference
Your year of birth (used to confirm you are 18 or older; not your full date of birth)
Your pronouns (optional)
Your gender identity (optional)
Your subscription state
Voice recordings of your reflections
Transcripts and AI-generated insights from those recordings
Any personalization notes you write, to shape how the AI characters respond to you
If you use Synicon, the names, relationships, and brief context notes you share about recipients you nominate
Your responses to end-of-session feedback prompts (text; plus a voice recording only if you choose the public-share option)

We do NOT collect: your real name, email address, full date of birth, exact age, address, phone number, or biometric identifiers.

2. WHO PROCESSES YOUR DATA

Asclepiad uses the following third-party services. All are contractually bound not to train on your content:

Provider	Purpose	Location
Supabase	Account and transcript storage	US (UK IDTA + EU SCC)
Anthropic	Language model — generates AI character replies	US
ElevenLabs	AI voice synthesis; transcription of spoken reflections	US
Cloudflare	Edge processing and audio storage	Global
PostHog	Anonymised product telemetry	EU-hosted
Sentry	Crash reports (PII-scrubbed)	US
RevenueCat / Apple / Google	Subscription billing	US

Everything is encrypted in transit (HTTPS / TLS 1.2+) and at rest (Supabase AES-256 for the database; Cloudflare R2 server-side encryption for audio recordings). Asclepiad does NOT apply end-to-end encryption — the AI characters must be able to read your text to generate their replies.

3. HOW LONG WE KEEP IT

Data	Retention
Voice recordings	30 days, then deleted automatically
Transcripts and insights	Until you delete your account
Personalization notes	Until you delete your account
Synicon recipient records	Until you archive the recipient + 90 days, then deleted
Subscription state	Until you delete your account
Coin transaction records (amounts and timestamps)	Kept after account deletion in anonymised form — no link to you — for accounting and chargeback obligations
Crash reports	90 days
Product telemetry	12 months
Consent records (timestamp, version, scope)	7 years post-deletion, anonymised

4. WHAT WE DO WITH IT

We use your data to deliver the service to you. We do not sell it. We do not use it for marketing. We do not use it to train AI models. We do not share it with advertisers or data brokers.

5. THE AI CHARACTERS

The voices you hear — Maia, Hortus, and the other Asclepiad characters — are AI. They are generated by language models and voice-synthesis services. They are not human. They are not clinicians. They are companions for reflection — not therapists, not doctors.

6. AUTOMATED DECISIONS

Asclepiad uses one automated process: a classifier that reviews your reflection content for signs of crisis or significant distress. If it detects a high-confidence signal, the app surfaces country-appropriate crisis resources (your Personal Wellbeing Plan) — this only ever adds a safety option; it never withholds, restricts, or changes anything else in the app, and no human reviews the flagged content. A visible support option, including country-appropriate crisis resources, is always available whether or not the classifier ever fires.

7. YOUR RIGHTS

Under UK GDPR you can:

Delete your account at any time from settings (right to erasure)
Export your data at any time from settings (right to portability)
Object to processing — contact compliance@asclepeion.org
File a complaint with the UK ICO at ico.org.uk (helpline: 0303 123 1113) or your national data protection authority

Note: individual session records are kept together as part of your reflection history. Account deletion removes all of it. We do not currently support deleting one session at a time. When you delete your account, all content and metadata are removed; consent records are retained anonymously for seven years for legal compliance (UK Limitation Act 1980), but contain nothing that can identify you.

8. INTERNATIONAL TRANSFERS

Your data may be processed in the United States. We use UK International Data Transfer Agreements (IDTAs) and EU Standard Contractual Clauses (SCCs) for all such transfers.

9. CONTACT

Asclepeion Ltd
Company No. 15830285 (England and Wales)
ICO registration: ZB723138
compliance@asclepeion.org