Privacy Policy - Cypps
Cypps is a personal health companion for people living with CP/CPPS (chronic pelvic pain syndrome). This policy explains what data we collect, why we collect it, how it is stored, and your rights over it.
1. Who we are
Cypps is operated by Joseph Brockbank ("we", "us"). If you have any questions about this policy, contact us at joseph.brockbank@gmail.com.
2. What data we collect and why
2a. Account data
- Email address: used to create and authenticate your account.
- Name / preferred name: optional, used to personalise the app.
We collect this when you sign up with email/password, Apple Sign In, or Google Sign In.
2b. Health profile data
You provide this voluntarily during onboarding and can update it at any time:
- Age range, symptom duration, diagnosis status, and how severe your symptoms usually are
- Pain locations, urinary and sexual symptoms, and what tends to set your pain off
- Treatments tried, related conditions, and the areas you'd like help with
- Your answers to a two-question mood check (PHQ-2)
This data is used solely to personalise your experience and generate relevant AI insights.
2c. Daily tracking data
Logged by you each day:
- Pelvic pain, urinary bother, urgency, and stress scores
- Ejaculation pain, when applicable
- Hours spent sitting, alcohol consumption
- Pelvic floor PT / exercises done, and minutes spent
- Trigger point release, with your pain before and after
- Whether you took your treatments
- Mood, free-text notes
2d. Flare logs
Start date, end date, severity, the areas affected, anything you think set it off, and notes for any CP/CPPS flares you record.
2e. Assessment responses
Your answers to the NIH Chronic Prostatitis Symptom Index (NIH-CPSI), the validated clinical instrument for CP/CPPS (Litwin et al., J Urol 1999). Used to track your symptom profile over time and to generate relevant AI insights.
Your answers to a short self-report version of UPOINT (Shoskes et al., Urology 2009), used to show which of its six domains look active. The result is also used to generate relevant AI insights.
Your answers to the PHQ-2 mood check each time you retake it in Wellbeing, with the date. This is mental health information. It is used only to show you your own trend, and is not sent to the AI.
2f. Treatment reminders
Treatment or reminder name, dose or note, and frequency, for anything you set a reminder for, such as pelvic floor PT sessions or medication.
2g. Trigger-related data
Recent sexual activity and UTI-like symptoms, tracked because a MAPP Research Network case-crossover study found these to be the factors significantly associated with flare onset. Bowel straining is also tracked as a commonly reported mechanical aggravator. These are only recorded if you choose to log them.
2h. Apple Health and Android Health Connect data (optional)
If you connect Apple Health (iOS) or Health Connect (Android), we only read the following:
- Step count
- Sleep duration and quality
- Heart rate, used to work out your resting heart rate
- Heart rate variability (HRV)
- Active energy burned and workouts
- Mindfulness minutes, shown for today only and not stored
We never write anything to Apple Health or Health Connect. We do not access any other health categories (e.g. weight, blood glucose, reproductive health) even if they exist in your Health app.
Health data is read on your device and stored in our secure database linked to your account. It is used solely to surface patterns relevant to your CP/CPPS symptoms.
2i. Notification preferences
The time you set for your daily log reminder, and reminder times for any treatments you've set up. No notification content is stored on our servers.
2j. Subscription, app use and feedback
To understand how Cypps is used and improve it, we also keep the following with your account. None of it includes your health or symptom data:
- Subscription events: when a free trial or subscription starts, renews, is cancelled or ends, which plan, which store and the price, sent to us by RevenueCat.
- Notification settings: whether your phone allows Cypps to send notifications, and which types you have switched on or off.
- Cancellation feedback: if you cancel Premium, the app may ask you once why. Answering is optional. If you do, we keep your reason, whether you would consider coming back, and any comment you write.
We look at this information in aggregate and we never use it for advertising.
3. How we use your data
We use your data for the following purposes only:
| Purpose | Data used |
|---|---|
| Displaying your tracking history and trends | All tracking data you enter |
| Generating personalised AI insights and chat responses | Health profile + tracking data + health app data |
| Sending your daily log and treatment reminder notifications | Notification time preferences |
| Processing subscription payments | Handled by RevenueCat (see below); we do not see your card details |
| Understanding how the app is used and improving it | Subscription events, notification settings and cancellation feedback (looked at in aggregate) |
| Deleting your account when requested | All data is deleted |
We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in Section 5.
Linking your accounts across Valimia apps
Cypps is one of several Valimia apps for different long-term conditions (Fibro, Spondy, Mya and Cypps). If you have an account in more than one of them, we link those accounts together with an internal ID so we can recognise that they belong to the same person.
We match accounts using your Sign in with Apple identifier if you signed up with Apple, and otherwise your email address. We store only the internal ID, which apps you have accounts in, and the value used to match them (your Apple identifier, or a one-way hash of your email address, never the address itself). Your health and tracking data is not copied between apps. Each app keeps its own data in its own database.
We use this link to understand, in aggregate, how many people live with more than one of these conditions, and to build features in future that bring your conditions together in one place. We will tell you in the app before launching any feature that uses data from more than one app. If you delete your account in any app, that account's link is removed within an hour.
4. AI processing
Cypps uses Claude, an AI model made by Anthropic, to generate personalised insights and responses in the AI chat.
AI features only run if you agree to them, either during onboarding or later in your profile. Your choice is saved with your account, so it stays the same on a new phone or after reinstalling, and you can change it at any time under AI personalisation in your profile. If you haven't agreed, nothing is sent to Anthropic.
When you trigger an AI feature, relevant portions of your health profile and recent tracking data are sent to Anthropic's API via our secure server-side proxy. This data is used only to generate your response and is not used to train Anthropic's models (we use the API under Anthropic's standard terms, which prohibit training on customer data).
Your data is sent over an encrypted connection (TLS). Anthropic deletes it automatically within 30 days. If Anthropic's automated safety systems flag a request as breaking its usage policy, it can keep that request for up to 2 years, and it may keep data for longer where the law requires.
5. Third-party services
| Service | Purpose | Data shared | Their privacy policy |
|---|---|---|---|
| Supabase | Database and authentication | All account and tracking data (encrypted at rest) | supabase.com/privacy |
| Anthropic | AI insights and chat | Health profile excerpt + recent tracking data | anthropic.com/privacy |
| RevenueCat | Subscription management | User ID, subscription status and purchase history | revenuecat.com/privacy |
| Apple HealthKit / Android Health Connect | Health data reading | None; data flows from Apple Health or Health Connect to us, not the other way | apple.com/privacy · developer.android.com/privacy |
| Firebase | Product analytics (which features are used) | Usage events linked to an internal ID (for example which screens and features are used, onboarding steps and subscription status); no health or symptom data | firebase.google.com/support/privacy |
| Sentry | Crash and error reporting | Technical error details and your account's internal ID, so a crash you report can be found; no health or symptom data | sentry.io/privacy |
6. Data storage and security
- All data is stored in a Supabase database hosted in the EU West (Ireland) region.
- Data is encrypted at rest and in transit.
- Row-level security policies ensure each user can only read and write their own data; no user can access another user's records.
- Your authentication session is stored securely in your device's encrypted secure storage (not in plain AsyncStorage).
7. Data retention
We retain your data for as long as your account is active. If you delete your account, all data associated with your account, including your profile, all logs, flares, assessment responses, treatment reminders, health app data, and AI context, along with your sign-in details, subscription records and any feedback you have given, is permanently deleted from our database within 24 hours. This is irreversible. We keep only an anonymous count of deletions (the date, the app version, how long the account existed, how many days were logged and whether it ever had Premium), with nothing that identifies you.
8. Your rights
Under GDPR and applicable data protection law, you have the right to:
- Access: request a copy of the data we hold about you
- Rectification: correct inaccurate data (you can do this directly in the app)
- Erasure: delete your account and all associated data
- Portability: request your data in a machine-readable format
- Restriction: ask us to restrict processing of your data
- Objection: object to certain types of processing
To exercise any of these rights, contact us at joseph.brockbank@gmail.com. We will respond within 30 days.
9. Children
Cypps is not directed at children under 13 and we do not knowingly collect data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.
10. Changes to this policy
We may update this policy as the app evolves. If we make material changes, we will notify you within the app. The "Last updated" date at the top reflects the current version.
11. Contact
Joseph Brockbank
joseph.brockbank@gmail.com