Privacy Policy

Mumvera ("we", "our", "us") is a free wellbeing tool that provides personalised recommendations for mood, movement, and nutrition across reproductive life stages. This policy explains how we collect, use, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We collect only what is necessary to provide the service:

Health data: Questionnaire responses and scores constitute special category data under Article 9 of UK GDPR. We process this data based on your explicit consent (Art. 9(2)(a)), which you provide during the consent flow before any assessment.

• We do not use tracking cookies or third-party analytics
• We do not sell or share your data with advertisers
• We do not send personally identifiable information to AI services
• We do not collect data from users under 13 years of age

• Database: Neon PostgreSQL with encryption at rest and in transit (TLS). Hosted in the London (EU-West-2) region.
• Session data:Stored in your browser's sessionStorage. This is cleared when you close your browser tab and is never sent to third parties.
• Authentication: Magic link tokens are single-use and expire after 10 minutes.

We retain your data only as long as needed:

• Account data: Retained until you delete your account.
• Assessment history: Retained for up to 24 months to show trends, then automatically deleted.
• Consent records: Retained for 6 years after withdrawal for legal accountability.
• Audit logs: Retained for 12 months, then automatically deleted.

You can delete all your data at any time from the Settings page. Deletion is permanent and cannot be undone.

You have the right to:

• Access— download a copy of all your data (Settings > Export Data)
• Rectification — update your profile at any time
• Erasure— delete your account and all associated data (Settings > Delete Account)
• Withdraw consent— change your consent preferences at any time (Settings > Consent Preferences)
• Data portability — export your data in a machine-readable format (JSON)
• Complain— lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

In line with the UK Age Appropriate Design Code (Children's Code) and UK GDPR:

• Under 13: We do not create accounts or collect personal data. Users under 13 are shown informational resources and directed to trusted adults.
• Ages 13–17: Accounts are supported in minor mode with enhanced privacy protections, clear language, and prominent access to support resources (e.g. Childline 0800 1111).
• 18+: Standard account with full features.

All third-party services are bound by data processing agreements. OpenAI is configured in zero-retention mode — no data is stored or used for training.