Privacy notice
Amethea is a wellbeing app. You can read its educational material without agreeing to health tracking. If you choose to use the trackers and other features that use health information, you can change that choice at any time.
Who is responsible for your information
Amethea's joint data controllers are Lisa Hoskins and Stuart Currie, trading as System Flow Labs. We decide together how Amethea uses your personal information. You can exercise your privacy rights with either of us. The contact details below are the shared point of contact for privacy requests.
For privacy questions or requests, email support@systemflowlabs.com or write to System Flow Labs, 40 Riders Lane, Havant, Hampshire, PO9 4QJ, United Kingdom. This notice covers the Amethea app, membership, related support, and free downloads such as the Calm Kitchen Starter Kit. The Health Data Notice explains your optional health-data choice when you are asked to make it.
What we collect and why
Account and membership. We use your email address, account identifier, sign-in details, country and account preferences to create and protect your account and provide the service. Country information also helps us show relevant support resources. We use subscription, payment, cancellation and refund information to administer your membership. Stripe collects and processes your payment details and provides the transaction and subscription information we need to manage billing.
App activity. We use lesson, journey and challenge progress to show what you have completed and let you continue where you left off. Where activity reveals health information, we treat it as health data. Information may come from what you enter, what the app records when you use it, or the providers that help us run accounts and payments.
Optional health information. If you choose to save health information, it can include check-ins, symptoms, pain, stiffness, energy, fatigue, sleep, stress, mood, food and drink observations, flare records, quiz responses and results, and personal reflections. It can also include health-related focus choices, journey allocations, lesson and tool responses, appointment notes, and My Plan entries and saved versions. We use these details to save and show your entries, display your plans and progress, and generate your personal reviews and Insights.
Reviews and suggestions. Amethea uses what you record to show patterns in your own entries. Weekly and Monthly Reviews summarise recorded pain, stiffness, fatigue, mood and sleep separately. A missing entry does not count as zero. Fatigue is not calculated from energy. Quiz or focus answers can be used to suggest relevant content for self-reflection. The app does not diagnose conditions, establish causes, predict flares or make treatment decisions. If you choose to download a summary and share it with your healthcare team, you decide what to share and with whom.
Support and security. We use information in your messages to respond and resolve issues. We use necessary sign-in, connection and service records to keep accounts secure, detect misuse and investigate faults. Please avoid sending unnecessary health information or private information about others. We also keep records where needed for legal obligations such as accounting and tax, and to handle disputes or show how we responded to privacy requests.
Free downloads. If you ask for a free download, such as the Calm Kitchen Starter Kit, we collect your email address and, if you give it, your first name. We use these to send you the download link and to avoid sending duplicate emails. We also record where you came from (for example, which social profile linked you to the page) so we can see which channels people find useful. We do not ask for health information to send a download, and you do not need an account.
If you also tick the box to receive Amethea's food ideas, updates and offers by email, we record that choice, the wording you agreed to and when. That choice is optional and separate from receiving the download. Every marketing email includes a link to unsubscribe, and you can also email us to stop.
You need to provide the required account and payment information to set up an account or take out a subscription. Health information is optional. Features that rely on it cannot save or analyse it without your agreement. Health-data consent is separate from your membership contract and any choice about marketing.
Our legal bases
Where UK or EU GDPR applies, we use the contract basis to take steps you request before joining and to provide and administer the membership, including billing and necessary member support. We also use the contract basis to send a free download you have asked for. We rely on legitimate interests for necessary non-health security, fraud prevention, service diagnostics and responses to other enquiries. Our interests are keeping the service secure and usable and resolving problems. We use the legal-obligation basis where a law requires processing, such as tax record keeping. We may also use necessary information to establish, exercise or defend legal claims.
For optional health features, we rely on your consent under Article 6(1)(a) and your explicit consent under Article 9(2)(a). If you ask us to handle health information for another purpose, such as support, we need an applicable legal basis and special-category condition for that purpose. In a legal dispute, Article 9(2)(f) may apply where health information is necessary for a legal claim. We send marketing emails only with your consent, which we ask for separately. You can withdraw it at any time by unsubscribing, without affecting your membership or any download.
Changing your health-data choice
Use the Health data section in Account to give or withdraw consent. You can also ask for help at support@systemflowlabs.com. After you withdraw, you cannot save new health entries, and we stop using your existing entries for optional health features such as Insights. Withdrawal does not affect processing that was lawful before it. If we no longer have a lawful reason to hold the information, we delete it. You can still request a copy or ask us to delete health information without closing your account. Educational membership content remains available while your access is active.
Cancelling renewal, withdrawing health-data consent and deleting your account are separate actions. Cancelling renewal does not automatically erase your records. Withdrawing health-data consent does not cancel your subscription. For new health-data choices, we record your decision and the version of the notice you were shown. A record of an earlier choice is not treated as agreement to a notice you were not shown.
Who receives information and where it is processed
We use Supabase for the account database and sign-in, Vercel to host and run the app and this download page, Stripe for checkout and billing, and email providers to deliver account messages and free downloads and to handle support. We use Resend to send download and marketing emails, configured to send from its EU (Ireland) region. Our main production database is hosted in London, United Kingdom. Free-download sign-ups are kept in a separate database, also hosted in London. App requests may be processed in the United States, and Resend and some of our other providers are US-based companies. Hosting a database in the UK does not mean all app or supplier processing stays in the UK.
Providers receive information needed for their work. Stripe may also use billing information for its own legal and fraud-prevention obligations. We do not send your health entries or quiz answers to Stripe or use your health records for advertising. Authorised staff can access information where needed for their duties. We may share necessary information with advisers, regulators or authorities where there is a lawful reason.
Contact support@systemflowlabs.com for details about overseas processing, the basis for any restricted transfer and how to obtain a copy of any applicable safeguards.
How long we keep information
We keep account and membership details for as long as needed to provide or administer your account. For an inactive or closed account, we assess whether there is still an active entitlement, a request we need to finish, a legal duty or another specific reason to retain particular information. We do not retain information solely because it might be useful one day.
We keep health entries while needed for the optional features you choose, subject to withdrawal, deletion requests and any specific lawful reason for retaining limited records. We retain billing and tax records for the applicable legal periods. We keep support, security and consent records only as long as needed to resolve the relevant matter, protect the service or demonstrate compliance. We keep only the information needed for those purposes.
If you only asked for a free download, we keep your email address and first name for 12 months after your last request, then delete them. If you agreed to marketing emails, we keep your details while you remain subscribed. When you unsubscribe, we stop marketing to you straight away. We keep a record of your consent and withdrawal for 2 years to show we respected your choice, then delete it.
Deleting an account does not necessarily erase records held by Stripe for its own purposes. A deleted record may remain in a restricted backup until that backup expires. If you have questions about how a deletion request affects information held in backups, contact support@systemflowlabs.com.
Cookies and browser storage
Amethea uses sign-in cookies to maintain your session. Your browser also stores some display preferences, such as whether a tutorial prompt has been dismissed or a section is expanded, and can cache parts of the app interface to help it load. You can clear this storage through your browser. Blocking sign-in cookies can prevent you from using your account. Stripe may use its own technologies on its checkout pages. The free download page does not use cookies or tracking. Any additional browser technologies and the choices available to you are explained in our Cookie Notice.
Your rights and how to contact us
Depending on the law that applies, you may have rights to access, correct, delete or restrict use of your information, receive eligible information in a portable form, object to certain uses or withdraw consent. You may object to direct marketing at any time. You can exercise these rights even after your membership ends. Use the available Account controls or email support@systemflowlabs.com. If a download does not contain the information you need, you can ask us directly for a copy. We may verify your identity before acting and will explain any lawful restriction or refusal and the available routes to challenge it.
You can complain to the UK Information Commissioner's Office at ico.org.uk. If EU GDPR applies, you can complain to the competent data-protection authority, including in the country where you live or work. Depending on the law that applies, you can complain to the Office of the Privacy Commissioner of Canada or the relevant provincial regulator, the Office of the Australian Information Commissioner, or New Zealand's Office of the Privacy Commissioner. If a separate consumer health privacy notice applies where you live, it explains the additional rights and how to exercise them.
Updates to this notice
If we materially change how we use your information, we will explain the change and tell you when it takes effect. We will ask for a new choice where consent is needed. A change to this notice does not by itself change your health-data choice.