Privacy Policy

Last updated: October 2026

Overview

Sympta ("we", "our", or "the app") is a personal health journal that helps you log symptoms, meals, medications, mood, sleep and related notes. Your journal is stored on your device and, if you enable it, in your personal iCloud account. A small number of optional features send data off your device, and this policy explains exactly what, where, and why.

Who We Are

The controller responsible for your personal data is:

Niall Canning (trading as Sympta)
Lytchett House, 13 Freeland Park, Wareham Road
Poole, Dorset, BH16 6FA, United Kingdom
Email: support@trysympta.com

EU Representative

We have appointed Prighter EU Rep GmbH as our representative in the European Union under Article 27 GDPR. If you are in the EU, you can contact them about our processing of your personal data instead of, or as well as, contacting us:

Prighter EU Rep GmbH
Schellinggasse 3/10
1010 Vienna, Austria

Information We Collect

• Health Data: Symptoms, severity levels, meals, medications, mood, sleep, energy, stress, water, bowel movements, period flow, and notes you enter. This is stored on your device and in your iCloud account, not on our servers.
• Name: If you enter a name, it is stored on your device only and is used to personalise the app and your exported reports.
• Usage Data: Pseudonymous analytics events (see "Analytics & Attribution" below)
• Subscription Data: Purchase information processed by Apple and by RevenueCat, our subscription management provider

How Your Data is Stored

• All your health entries are stored locally on your device
• If you enable iCloud, your data syncs across your Apple devices using your personal iCloud account
• We do not have access to your iCloud data
• We do not store your health data on our servers

Optional AI Features

Sympta has two optional features that use Google's Gemini AI: Voice + AI and AI Summary. They only run when you use them, you are asked for your consent before each one is used for the first time, and you can turn all AI features off at any time in Settings under Smart features. Turning them off also withdraws your consent, so you will be asked again if you turn them back on.

AI Voice Feature

When you use the Voice + AI feature:

• Your speech is converted to text by Apple's speech recognition service. Depending on your device and iOS version, Apple may process the audio on its servers, under Apple's Privacy Policy. We never receive or store your audio.
• The resulting text transcript is sent to our secure cloud function and forwarded to Google's Gemini AI to extract structured health data (for example symptoms, meals, sleep and mood)
• The extracted data is returned to your device for you to review before anything is saved
• We do not store your transcripts or the AI output on our servers

AI Summary Feature

When you use the AI Summary feature:

• The entries from the period you choose (the last 7, 14 or 30 days) are sent to our secure cloud function and forwarded to Google's Gemini AI to generate a written summary of patterns in your log
• Depending on the trackers you include, this can contain the entry dates, symptom names and severity, mood, sleep hours, meal descriptions, medication names, energy, stress, water, bowel movements, period flow, and the notes you wrote
• You choose which trackers to include or exclude before generating a summary. Anything you exclude is not sent.
• Your name, voice recordings and audio are never sent
• We do not store your health data or the AI-generated summaries on our servers
• Generated summaries are stored locally on your device and in your personal iCloud account

How the AI Requests Are Handled

• Identifier: Each request carries a random app identifier created by Firebase Authentication (Google). It is not linked to your name, email address or Apple ID.
• Usage limits: We store a counter linked to that random identifier to enforce daily limits (10 voice entries and 3 summaries per day). It holds only the current day's count and contains no health data.
• App verification: We use Firebase App Check (with Apple's App Attest) to confirm requests come from the genuine Sympta app. This does not involve your health data.
• No content logging: Our cloud function does not log or store the content of your transcripts, entries or summaries.
• Location: Our cloud functions run on Google Cloud servers in the United States (see "International Transfers" below).

Google Gemini AI

We use the paid Gemini API, under which Google processes your data on our behalf as a service provider. Under these terms Google does not use your prompts or responses to improve its products or train AI models. Google may retain prompts and responses for a limited period solely to detect abuse and meet legal obligations, as described in Google's Gemini API Terms of Service.

Data Sharing

We do not sell or rent your personal data, and we never share your health data with anyone for their own purposes.

• We do not share your health data with advertisers
• We do not share data with healthcare providers unless you export it and share it yourself
• To run the app we use the service providers listed below. They process data on our behalf and only for the purposes described in this policy. Only Google receives health data, and only when you use one of the optional AI features above.

• Google (Gemini API, Firebase, Google Cloud): AI processing, anonymous sign-in, app verification and usage limits
• Apple: iCloud sync, speech recognition, and payments
• RevenueCat: subscription management (purchase status, not health data)
• PostHog and AppsFlyer: analytics and attribution, described below (never health data)

Analytics & Attribution

We use AppsFlyer, a mobile attribution and analytics service, to understand how users discover Sympta and to measure the effectiveness of our marketing campaigns.

• AppsFlyer collects install attribution data (e.g. which channel you came from) and in-app event data (e.g. subscription conversions)
• This data is collected at the device level using Apple's SKAdNetwork framework and does not include your health data
• We do not request access to your device's advertising identifier (IDFA)
• For more information, see AppsFlyer's Privacy Policy

We also use PostHog, a product analytics service, to understand how features are used and where users encounter friction (for example, which onboarding step they reach), so we can improve the app.

• We log only behavioural usage events, such as which screen was viewed, which subscription plan was selected, or that an entry was logged or a summary generated, together with your subscription status
• Events are linked to a random identifier, not to your name, email address or Apple ID
• We never send your health data, symptom details, notes, voice transcripts, or your name to PostHog
• Your analytics data is processed and stored on PostHog's servers in the European Union
• For more information, see PostHog's Privacy Policy

Legal Bases for Processing

If you are in the UK or the European Economic Area, we rely on the following legal bases under the UK GDPR and the EU GDPR:

• Optional AI features: Because these involve health data, we rely on your explicit consent (Article 6(1)(a) and Article 9(2)(a)). You give it in the app before first using each feature, and you can withdraw it at any time by turning off Smart features in Settings. Withdrawing consent does not affect processing that happened before.
• Subscriptions: Processing needed to provide the service you purchased (Article 6(1)(b))
• Usage limits and app verification: Our legitimate interest in preventing abuse and keeping the service secure (Article 6(1)(f))
• Analytics and attribution: Our legitimate interest in improving the app and understanding how people find it (Article 6(1)(f)). These never involve health data.

International Transfers

We are based in the United Kingdom. Some of our service providers (including Google, RevenueCat and AppsFlyer) may process data in the United States or other countries. Where this happens, we rely on the safeguards those providers offer, such as the EU-US Data Privacy Framework (and its UK extension) or standard contractual clauses.

Data Retention

• Your journal stays on your device and in your iCloud account until you delete it
• We do not retain the content of AI requests. Google's retention is described in the Google Gemini AI section above.
• The usage-limit counter holds only the current day's count
• Analytics and attribution data are kept by PostHog and AppsFlyer in line with their retention settings and policies

Your Rights

You have full control over your journal:

• Export: Download all your data as CSV or PDF at any time
• Delete: Remove individual entries in the app. Deleting the app removes the data on your device. If you use iCloud sync, you can also remove Sympta's iCloud data in iOS Settings under your name, then iCloud, then Manage Storage.
• Access: View all your stored information within the app

Depending on where you live, you may also have the right to access, correct, delete, restrict or object to our processing of your personal data, to data portability, and to withdraw consent at any time. To exercise these rights, contact us at support@trysympta.com. Because we do not hold your journal on our servers, the only personal data we can act on directly is the random-identifier usage counter and analytics data. You also have the right to complain to a data protection authority, such as the UK Information Commissioner's Office (ico.org.uk) or the authority in your EU country.

Security

• Data is encrypted on your device using iOS security features
• iCloud sync is protected by Apple's iCloud security. If you turn on Advanced Data Protection for iCloud, it is end-to-end encrypted.
• Data sent to our cloud function is encrypted in transit
• Optional Face ID/Touch ID protection for app access

Children's Privacy

Sympta is not intended for children under 13. We do not knowingly collect information from children under 13. If you believe a child has provided us with personal information, please contact us.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any significant changes through the app. Continued use of Sympta after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or your data, please contact us at:

support@trysympta.com