Privacy Policy

Your privacy matters

Onni Health is designed to be a calm, private space for tracking your wellbeing. We take your privacy seriously and are committed to protecting your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What we collect

• Account information: your email address, first name, and last name when you register.
• Check-in data: daily wellness tracking entries including pain levels, fatigue, sleep quality, mood, and brain fog scores.
• Journal entries: encrypted at rest using AES-128-CBC (Fernet). We cannot read your journal entries.
• Quiz responses: your wellness assessment answers, used to personalise your experience.
• Community posts: content you choose to share publicly in the community feed.
• Payment information: processed securely by Stripe. We store only your Stripe customer ID, never your card details.

How we use your data

• To provide and personalise your wellness tracking experience.
• To generate AI wellness summaries from your own self-reported data only.
• To send you email notifications about sessions and insights (you can unsubscribe at any time).
• To process your subscription payments via Stripe.

We never use your health data for advertising, sell it to third parties, or use it to train AI models.

AI wellness summaries

Our AI summaries are generated using the Anthropic Claude API. Your check-in data is sent to generate a plain-English summary of your own trends. This data is not used to train the AI model and is not retained by Anthropic after processing.

AI summaries are not medical advice. They simply reflect patterns in your own self-reported data.

Data storage & security

• All data is stored on AWS servers in the eu-west-2 (London) region.
• Journal entries are encrypted at rest using Fernet (AES-128-CBC).
• All connections use TLS 1.3 encryption in transit.
• Passwords are hashed using PBKDF2 with SHA-256.
• We use Cloudflare for DDoS protection and WAF.

Your rights (GDPR)

Under UK GDPR, you have the right to:

• Access: download all your data as a JSON file from your profile settings.
• Rectification: edit your personal information at any time.
• Erasure: delete your account and all associated data from your profile settings.
• Portability: export your data in a machine-readable format.
• Withdraw consent: unsubscribe from emails or delete your account at any time.

Cookies

We use three kinds of cookie and similar browser storage. Only the first is used without asking you first.

• Necessary: signing you in, keeping your session secure, and remembering the cookie choice you make. These cannot be switched off, because the site cannot work without them.
• Analytics (optional): counting how many people use each part of the site, so we can see what to improve.
• Advertising (optional): the Meta pixel, used on Facebook and Instagram advertising, which tells us which advert brought someone to the site and whether they went on to take the quiz or subscribe.

Nothing in the optional categories is loaded until you accept it, and refusing is one click, exactly like accepting. You can change your mind whenever you like: Cookie settings.

We never send health data to an advertising network. Your quiz answers and results, your check-ins, your journal and your insights are never shared with Meta or with anyone like them, and our advertising pages are deliberately given addresses that reveal nothing about anyone's health. If you withdraw your consent, the advertising tools are removed and the click identifiers we captured are forgotten.

Contact

For privacy-related enquiries, please contact us at support@onniapp.io.

Data controller: Mend Collective Ltd (company number 16805268), 30 Stratford Road, Wolverton, Milton Keynes, England, MK12 5LW.