Privacy Notice

Last updated: 15 October 2026.

MySymplyApp is operated by BranchX Limited, a company registered in Ireland. This notice explains what information MySymplyApp collects when you use the app, how we use it, how long we keep it, and the rights you have.

1. Who we are

BranchX Limited operates MySymplyApp. Where MySymplyApp is offered through a partner organisation, the exact responsibilities of BranchX and that partner for your information are being agreed and will be confirmed in the information you receive before you join. You can contact us at info@branchx.ie.

The current MySymplyApp pilot is a product and usability pilot, not a research study. Your diary is not used for research. Any future research stage would be separate, with its own information and choices.

2. Information we collect

Account: email address, display name, preferred name, timezone, country, language, and accessibility settings.
Health diary: voice recordings, transcripts you review, mood tags, symptom notes, medications and their schedules, medication events, videos and photos you upload as evidence, and documents such as letters and prescriptions.
Care circle: invitations you send, permissions you grant to family, carers, or clinicians, and notes carers add to your diary.
Reports and shares: structured reports you generate for appointments and the recipient-facing share links you create.
Operational logs: audit events (who did what, when), signed-in device metadata, and server error logs. We use no analytics or advertising trackers. If you take part in the pilot, we count non-content events (for example, that a report was created — never what it says), and you can switch this off.

3. Why we use it

We use your information to:

provide the app and the features you choose to use;
keep your account and records secure (for example rate limits and audit trails);
keep records where the law requires it.

We only handle your health information after you have given your explicit agreement in the app, and you can withdraw it at any time from Account & Privacy. The formal legal grounds we rely on for each use are being reviewed and will be set out here once confirmed.

4. Automated processing (transcription and document analysis)

Voice transcription runs on your own device. A speech model (Whisper), downloaded to your device, runs inside your browser and produces the text locally; the recording is not sent to OpenAI, the Lovable AI Gateway or any other outside speech-to-text service to create the transcript. Only the resulting text is saved back to your account, where you can review and correct it. The original automatic transcript is kept separately from your corrections, and unreviewed automatic text is never included in approved or shared reports. The recording itself is saved to your private storage, separately from the transcript, so you can replay it. If your device cannot complete the transcription, the recording stays saved and you can retry or type the text yourself — there is no cloud fallback. See the transcription notice for details.

Document analysis (MySymplyApp Scan) is separate and optional. If you turn it on and choose a document to be read, that document is sent via the Lovable AI gateway to an OpenAI model in the United States, not to a voice transcription service. No voice recordings are sent on this route. See the sub-processors page. Nothing is filed into your record until you confirm it.

5. Sharing

We do not sell your data. We share information only in these cases:

With people you explicitly add to your care circle, limited to the permissions you grant them.
With recipients of share links you create — access is time-limited, revocable, and audited.
With our infrastructure and AI sub-processors, listed on the Sub-processors page.
Where legally required (court order, lawful request).

6. International transfers

Your records are stored in the European Union (Frankfurt, Germany). Voice transcription does not involve a transfer, because it happens on your device. If you choose to use document reading (MySymplyApp Scan), that document is processed in the United States; you can leave Scan switched off. Some infrastructure providers may also access systems from outside the EEA for support, and hosting uses a global edge network. Data processing agreements, standard contractual clause evidence and our transfer impact assessment remain under review; retention and no-training terms still need written confirmation. Leaving Scan off does not make all processing EU-only. Legal review remains open.

7. Retention

You control retention for voice audio (delete after you approve the transcript, keep for 7, 30 or 90 days, or keep until you delete it). Transcripts remain until you delete them. Structured data (medications, appointments, notes) is kept for as long as your account is active. When you delete your account, all personal and health data is erased after a 30-day cancellation window; audit logs referencing you are anonymised. Copies can remain in platform backups until the backup period rolls over. We do not automatically delete other health records on a timer today; any such rule would be announced here first.

If you turn on "Keep recording on this device until saved", a recording that has not yet been saved stays in your browser's private storage on that device only, linked to your account, until it is saved, you discard it, or 7 days pass. It is off unless you turn it on and is never sent anywhere until you choose Resume saving.

8. Your rights

Access — export a full copy of your data from Account & Privacy.
Rectification — edit medications, transcripts, notes, and profile fields.
Erasure — request account deletion; grace period of 30 days.
Restriction and objection — withdraw consent for health processing.
Leaving the pilot is separate from all of these and deletes nothing.
Portability — the export bundle is machine-readable JSON plus your files.
Complaint — you may lodge a complaint with your data protection authority (in Ireland: the Data Protection Commission).

9. Security

Access is enforced by row-level security. All connections use TLS. Passwords are checked against the HaveIBeenPwned breach list. Share links use hashed tokens and rate limits. See the Security page.

10. Contact and changes

For privacy questions or to exercise a right, contact us. We will keep this notice up to date and highlight material changes in the app.