Privacy Policy

This Privacy Policy explains what personal data we collect, how we use it, and your rights.

1. What data we collect

Account: first name, last name, email, password (hashed).

Profile: year of birth, gender.

Breathwork training data: sessions completed, duration, exercises, settings, timestamps, progress, reassessments, and any notes you add.

Device/technical: device model, OS, app version, language, IP address (for security), crash logs, diagnostics, and basic analytics.

2. How we use your data

Run the app: create/manage your account; save and display your training history.

Personalise & improve: show relevant features, track trends, fix bugs, secure the app.

Communicate: service messages (login, security, changes).

Marketing (optional): only if you opt in; opt out at any time.

Legal: comply with laws and enforce our terms.

3. Legal bases (UK GDPR / DPA 2018)

Contract (Art. 6(1)(b)): to provide the app.

Legitimate interests (Art. 6(1)(f)): security, analytics, improvement (balanced against your rights).

Consent (Art. 6(1)(a)): marketing notifications and any optional features.

Legal obligation (Art. 6(1)(c)): where required by law.

We don't ask for medical records. Wellbeing-related training data is processed under the bases above and your use of the app.

4. Sharing your data

We share data only with:

Service providers: hosting, analytics, email, crash reporting (under contracts that protect your data).

App stores: for distribution and fraud prevention.

Legal/safety reasons: lawful requests or preventing harm.

Business changes: merger/sale, with protections maintained.

We do not sell your personal data.

5. International transfers

If data is transferred outside the UK/EEA, we use appropriate safeguards such as ICO-approved or Standard Contractual Clauses.

6. Data retention

Account and training data: kept while your account is active.

If you delete your account, we delete or anonymise your data within 30--90 days except where law requires limited retention (e.g., financial records).

7. Your rights

You can access, correct, delete, restrict or object to processing, and request portability.

You can withdraw consent at any time (doesn't affect past processing).

To exercise your rights, email charles@reservoir.health.

You can complain to the UK Information Commissioner's Office (ICO) if you're unhappy with our response.

8. Children

Reservoir is for users aged 16+. We do not knowingly collect data from children.

If you believe a child has used the app, contact us and we will remove the account.

9. Security

We use reasonable technical and organisational measures to protect your information. No system is completely secure.

10. Third-party links

If we link to other sites, their privacy practices apply there.

11. Changes

We may update this policy and will change the date above when we do.

For significant changes, we will notify you in-app or by email.