🤍 Privacy Policy

Who we are

My Cancer Journey is operated by My Cancer Journey Limited, a company registered in England and Wales (company number 17318970). If you have any questions about this policy or how your data is handled, please contact us at support@mycancerjourney.co.uk.

What data we collect

When you use My Cancer Journey we collect and store:

• Your name and email address
• Health information you choose to enter — cancer type, diagnosis date, medications, food diary, journal entries, appointments and medical documents
• Age range (optional)
• Photos you upload to the app
• Session logs (when you and people you invite last logged in)

This is special category health data under UK GDPR Article 9. We only process it because you have given us your explicit consent at sign-up.

How we use your data

Your data is used solely to provide the My Cancer Journey service to you. We do not sell your data, use it for advertising, or share it with third parties except as described below.

Who we share data with

Supabase — our database and authentication provider. Your data is stored on Supabase servers. Supabase is our data processor and we have a Data Processing Agreement in place. See supabase.com/privacy.

Resend — used to send transactional emails (invite emails, welcome emails). Only your email address is shared. See resend.com/privacy.

People you invite — if you invite someone as a Viewer or Contributor, they will be able to see the data sections you have chosen to share.

Your rights under UK GDPR

• Right of access — you can export all your data at any time from Settings → Your Data → Export My Data.
• Right to erasure — you can permanently delete your account and all associated data from Settings → Your Data → Delete My Account.
• Right to rectification — you can update your name and profile details from Settings at any time.
• Right to withdraw consent — you may withdraw consent at any time by deleting your account. This will not affect the lawfulness of processing before withdrawal.
• Right to lodge a complaint — you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Data retention

We retain your data for as long as your account is active. Items moved to Recently Deleted are permanently removed after 30 days. Invited user accounts with no activity are automatically removed after 37 days.

If you close your account, all personal data is permanently deleted within 30 days. Supabase infrastructure backups may retain data for up to 30 additional days before full purge.

You can delete your account at any time from Settings → Delete My Account, or by emailing support@mycancerjourney.co.uk.

Security

All data is encrypted in transit (HTTPS) and at rest. Access to your data is controlled by row-level security policies — only you and people you explicitly invite can access your information.

Cookies and local storage

We use browser local storage to cache your data for offline use and to remember your preferences. We do not use tracking cookies or advertising cookies.

ICO registration

As a Data Controller processing personal data in the UK, we are registered with the Information Commissioner's Office (ICO). Our ICO registration number will be displayed here once confirmed. You can verify registration at ico.org.uk.

If you are unhappy with how we handle your data, you have the right to complain to the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Data breach procedure

In the event of a personal data breach we will: assess it within 24 hours; report to the ICO within 72 hours if required under UK GDPR Article 33; notify affected users without undue delay if there is high risk to their rights; and document all breaches in our internal register. To report a suspected breach, contact support@mycancerjourney.co.uk.

Contact us

For any privacy-related questions or to exercise your rights, contact us at support@mycancerjourney.co.uk.