My Cancer Journey — your data, your control
My Cancer Journey is operated by My Cancer Journey Limited, a company registered in England and Wales (company number 17318970). If you have any questions about this policy or how your data is handled, please contact us at support@mycancerjourney.co.uk.
Our Data Protection Officer is David Jackson, contactable at the same address.
When you use My Cancer Journey we collect and store:
This is special category health data under UK GDPR Article 9. We only process it because you have given us your explicit consent at sign-up.
Your data is used solely to provide the My Cancer Journey service to you. We do not sell your data, use it for advertising, or share it with third parties except as described below.
Supabase — our database and authentication provider. Your data is stored on Supabase servers. Supabase is our data processor and we have a Data Processing Agreement in place. See supabase.com/privacy.
Resend — used to send transactional emails (invite emails, welcome emails). Only your email address is shared. See resend.com/privacy.
Anthropic — used to power optional AI features (see "AI processing" below). See anthropic.com/legal/privacy.
People you invite — if you invite someone as a Viewer or Contributor, they will be able to see the data sections you have chosen to share.
The app uses artificial intelligence features provided by Anthropic (claude.ai) for the following optional features:
When you use one of these features, the relevant photo or text is sent to Anthropic's API for processing. We do not send any additional identifying information alongside AI requests. Anthropic's API data is not used to train AI models. Because Anthropic is based in the United States, this involves an international transfer of data — this is covered by Anthropic's Data Processing Addendum, which incorporates the UK International Data Transfer Addendum (UK IDTA) and EU Standard Contractual Clauses as the legal safeguard for the transfer.
All AI features are optional. The app functions fully without using them.
We retain your data for as long as your account is active. Items moved to Recently Deleted are permanently removed after 30 days. Invited user accounts with no activity are automatically removed after 37 days. Session logs (records of when you and people you invite have logged in) are kept for 12 months and then automatically deleted.
If you close your account, all personal data is permanently deleted within 30 days. Supabase infrastructure backups may retain data for up to 30 additional days before full purge.
You can delete your account at any time from Settings → Delete My Account, or by emailing support@mycancerjourney.co.uk.
All data is encrypted in transit (HTTPS) and at rest. Access to your data is controlled by row-level security policies — only you and people you explicitly invite can access your information.
We use browser local storage to cache your data for offline use and to remember your preferences. We do not use tracking cookies or advertising cookies.
As a Data Controller processing personal data in the UK, we are registered with the Information Commissioner's Office (ICO). Our registration reference is ZC231074. You can verify this registration at ico.org.uk.
If you are unhappy with how we handle your data, you have the right to complain to the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
In the event of a personal data breach we will: assess it within 24 hours; report to the ICO within 72 hours if required under UK GDPR Article 33; notify affected users without undue delay if there is high risk to their rights; and document all breaches in our internal register. To report a suspected breach, contact support@mycancerjourney.co.uk.
For any privacy-related questions or to exercise your rights, contact us at support@mycancerjourney.co.uk.
Last updated: July 2026