Privacy Policy

1. What data we collect

We collect only the data needed to run the service:

• Account data — email address, password hash, name (optional).
• Check-in responses — your answers to wellbeing questions. These are stored against your account, not against any individual child's identity.
• Family configuration — child year group, age band, and household structure (e.g. co-parent). No child names or dates of birth are required.
• Usage data — page views, feature usage, and performance metrics collected via Vercel Speed Insights. This data is aggregated and not linked to your account.

2. How we use your data

• To provide and improve the Pulse service.
• To generate wellbeing scores, trends, and AI-powered insights.
• To send transactional emails (account verification, weekly digest) when you opt in.
• We do not sell, share, or use your data for advertising.

3. AI processing

Pulse uses Claude (Anthropic) to generate narrative summaries and coaching suggestions. We pass only anonymised numerical scores and anonymised response labels to Claude — no names, email addresses, or identifiable information are included in AI prompts.

4. Data storage and security

All data is stored in the European Union via Supabase (PostgreSQL). Data is encrypted at rest and in transit (TLS 1.2+). Access is controlled by row-level security policies — your data is only accessible to your account.

5. Data retention

We retain your data for as long as your account is active. Free accounts inactive for 24 months are automatically deleted. You can delete your account and all associated data at any time from Settings → Privacy Centre.

6. Your rights (GDPR)

Under UK GDPR you have the right to:

• Access — request a copy of all data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — delete your account and all data permanently.
• Portability — export your data in machine-readable format.
• Object — object to processing based on legitimate interest.

To exercise any of these rights, email privacy@earlylight.health. We will respond within 30 days.

7. Cookies

We use only essential session cookies required for authentication. We do not use tracking or advertising cookies. See our Cookie Policy for details.

8. Changes to this policy

We will notify you by email of any material changes to this policy. Continued use of Pulse after notification constitutes acceptance of the updated policy.

9. Contact

EarlyLight Health Ltd, registered in England and Wales.
Data enquiries: privacy@earlylight.health