Privacy Policy - Psar
Psar is a personal health companion for people living with psoriatic arthritis. This policy explains what data we collect, why we collect it, how it is stored, and your rights over it. Psar is not released yet; this policy describes the app as it will launch, and we will update it if anything changes before then.
1. Who we are
Psar is operated by Joseph Brockbank ("we", "us"). If you have any questions about this policy, contact us at joseph.brockbank@gmail.com.
2. What data we collect and why
2a. Account data
- Email address: used to create and authenticate your account.
- Name / preferred name: optional, used to personalise the app.
We collect this when you sign up with email/password, Apple Sign In, or Google Sign In.
2b. Health profile data
You provide this voluntarily during onboarding and can update it at any time:
- Age range, sex, how long you've been diagnosed, and how severe your symptoms usually are
- Whether you have psoriasis now or have had it, and whether your nails are affected
- Where you usually get joint pain, other features of your psoriatic arthritis, and how long your morning stiffness lasts
- Your treatments and how many doses a day you take, smoking status, and the areas you'd like help with
This data is used solely to personalise your experience and, if you agree to AI features, to generate relevant AI insights.
2c. Daily tracking data
Logged by you each day:
- Joint pain, fatigue, skin and itch scores, and how long morning stiffness lasted
- Optionally, which joints are painful or swollen, swollen fingers or toes, sore tendon attachment points, and which skin areas are affected
- Optionally, stress, alcohol units, and whether you were unwell or had an infection
- Exercise done, minutes and type
- Whether you took your treatments, including medicines taken as needed
- Mood, free-text notes
Skin areas include the genital area as an optional choice. It is never sent to the AI.
2d. Skin checks and skin photos
Your weekly skin check: how much of your palms is affected, any nail changes, and notes. These are stored with your account.
Skin photos stay on your phone. If you add photos to a skin check, they are saved only inside Psar on your device. They are never uploaded to our servers, never sent to the AI, and never included in a PDF report. Deleting your data in Psar deletes them. Your phone's own backup (iCloud or Google) may include app files, which is controlled by your phone's settings, not by us.
2e. Flare logs
Start date, end date, severity, whether it affected your joints, your skin or both, the areas affected, anything you think set it off, and notes for any flares you record.
2f. Injections, infusions and treatment reminders
For injections and infusions you record: the medicine name, date given, how often it's due, whether it was an injection or infusion, the injection site, an optional batch (lot) number and notes. For other reminders: the treatment name, dose or note, frequency and reminder time.
2g. Assessment responses
If Psar includes a periodic questionnaire about how psoriatic arthritis affects your life, your answers and scores are stored with the date, to show you your trend over time. Some of its questions may cover mood, anxiety or embarrassment, which is sensitive information. If you agree to AI features, your scores may be used to generate relevant AI insights, and the consent screen says so.
2h. Apple Health and Android Health Connect data (optional)
If you connect Apple Health (iOS) or Health Connect (Android), we only read the following:
- Step count
- Sleep
- Resting heart rate
- Heart rate variability (HRV)
- Workouts
We never write anything to Apple Health or Health Connect. We do not access any other health categories (e.g. weight, blood glucose, reproductive health) even if they exist in your Health app.
Health data is read on your device and stored in our secure database linked to your account. It is used solely to surface patterns relevant to your psoriatic arthritis.
2i. Notification preferences
The time you set for your daily log reminder, and reminder times for any treatments you've set up. No notification content is stored on our servers.
2j. Subscription, app use and feedback
To understand how Psar is used and improve it, we also keep the following with your account. None of it includes your health or symptom data:
- Subscription events: when a free trial or subscription starts, renews, is cancelled or ends, which plan, which store and the price, sent to us by RevenueCat.
- Notification settings: whether your phone allows Psar to send notifications, and which types you have switched on or off.
- Cancellation feedback: if you cancel Premium, the app may ask you once why. Answering is optional. If you do, we keep your reason, whether you would consider coming back, and any comment you write.
We look at this information in aggregate and we never use it for advertising.
3. How we use your data
We use your data for the following purposes only:
| Purpose | Data used |
|---|---|
| Displaying your tracking history and trends | All tracking data you enter |
| Generating personalised AI insights and chat responses | Health profile + tracking data + health app data |
| Sending your daily log and treatment reminder notifications | Notification time preferences |
| Processing subscription payments | Handled by RevenueCat (see below); we do not see your card details |
| Understanding how the app is used and improving it | Subscription events, notification settings and cancellation feedback (looked at in aggregate) |
| Deleting your account when requested | All data is deleted |
We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in Section 5.
Linking your accounts across Valimia apps
Psar is one of several Valimia apps for different long-term conditions (Fibro, Spondy, Mya, Cypps and Psar). If you have an account in more than one of them, we link those accounts together with an internal ID so we can recognise that they belong to the same person.
We match accounts using your Sign in with Apple identifier if you signed up with Apple, and otherwise your email address. We store only the internal ID, which apps you have accounts in, and the value used to match them (your Apple identifier, or a one-way hash of your email address, never the address itself). Your health and tracking data is not copied between apps. Each app keeps its own data in its own database.
We use this link to understand, in aggregate, how many people live with more than one of these conditions, and to build features in future that bring your conditions together in one place. We will tell you in the app before launching any feature that uses data from more than one app. If you delete your account in any app, that account's link is removed within an hour.
4. AI processing
Psar uses Claude, an AI model made by Anthropic, to generate personalised insights and responses in the AI chat.
AI features only run if you agree to them, either during onboarding or later in your profile. Your choice is saved with your account, so it stays the same on a new phone or after reinstalling, and you can change it at any time under AI personalisation in your profile. If you haven't agreed, nothing is sent to Anthropic.
When you trigger an AI feature, relevant portions of your health profile and recent tracking data are sent to Anthropic's API via our secure server-side proxy. This data is used only to generate your response and is not used to train Anthropic's models (we use the API under Anthropic's standard terms, which prohibit training on customer data).
Your data is sent over an encrypted connection (TLS). Anthropic deletes it automatically within 30 days. If Anthropic's automated safety systems flag a request as breaking its usage policy, it can keep that request for up to 2 years, and it may keep data for longer where the law requires.
What is never sent to the AI: your skin photos, and the genital area if you choose it as a skin area. Your AI chat history is kept on your phone, not on our servers.
5. Third-party services
| Service | Purpose | Data shared | Their privacy policy |
|---|---|---|---|
| Supabase | Database and authentication | All account and tracking data (encrypted at rest) | supabase.com/privacy |
| Anthropic | AI insights and chat | Health profile excerpt + recent tracking data | anthropic.com/privacy |
| RevenueCat | Subscription management | User ID, subscription status and purchase history | revenuecat.com/privacy |
| Apple HealthKit / Android Health Connect | Health data reading | None; data flows from Apple Health or Health Connect to us, not the other way | apple.com/privacy · developer.android.com/privacy |
| Firebase | Product analytics (which features are used) | Usage events linked to an internal ID (for example which screens and features are used, onboarding steps and subscription status); no health or symptom data | firebase.google.com/support/privacy |
| Sentry | Crash and error reporting | Technical error details and your account's internal ID, so a crash you report can be found; no health or symptom data | sentry.io/privacy |
6. Data storage and security
- All data is stored in a Supabase database hosted in the EU West (Ireland) region.
- Data is encrypted at rest and in transit.
- Row-level security policies ensure each user can only read and write their own data; no user can access another user's records.
- Your authentication session is stored securely in your device's encrypted secure storage (not in plain AsyncStorage).
7. Data retention
We retain your data for as long as your account is active. If you delete your account, all data associated with your account, including your profile, all logs, skin checks, flares, injections and infusions, assessment responses, treatment reminders, health app data, and AI context, along with your sign-in details, subscription records and any feedback you have given, is permanently deleted from our database within 24 hours. This is irreversible. We keep only an anonymous count of deletions (the date, the app version, how long the account existed, how many days were logged and whether it ever had Premium), with nothing that identifies you.
8. Your rights
Under GDPR and applicable data protection law, you have the right to:
- Access: request a copy of the data we hold about you
- Rectification: correct inaccurate data (you can do this directly in the app)
- Erasure: delete your account and all associated data
- Portability: request your data in a machine-readable format
- Restriction: ask us to restrict processing of your data
- Objection: object to certain types of processing
To exercise any of these rights, contact us at joseph.brockbank@gmail.com. We will respond within 30 days.
9. Children
Psar is not directed at children under 13 and we do not knowingly collect data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.
10. Changes to this policy
We may update this policy as the app evolves. If we make material changes, we will notify you within the app. The "Last updated" date at the top reflects the current version.
11. Contact
Joseph Brockbank
joseph.brockbank@gmail.com