Privacy Policy

FND Assist is a project supporting people affected by Functional Neurological Disorder (FND). We operate the website at fndassist.co.uk and the FND Assist companion app (together, our "services").

For the purposes of UK GDPR, FND Assist is the data controller for personal information collected through both the website (such as signup, review and contact details) and the app (such as your account, profile and health-tracking information). Unlike a purely on-device app, the FND Assist app stores your data in a secure database that FND Assist operates, so that it stays with your account, works across your devices, and can be shared with a carer if you choose to set that up. You can contact us at hello@fndassist.co.uk.

This policy applies to:

• Our website at fndassist.co.uk
• The FND Assist companion app and the account/database backend that powers it (symptom & mood journal, appointment diary, medication tracker, pacing log, seizure alarm and carer call)
• Emails and messages you send us, and reviews you submit through the website

Links from our site to other organisations (for example charities, NHS pages or peer support groups) are governed by those organisations' own privacy policies.

Information you give us on the website

• App launch signup: your name, email address and any optional message.
• Reviews: your name, star rating and review text. Reviews are checked by us before publication, and once approved, your name and review text are displayed publicly on our reviews page. Please don't include personal or medical details you'd rather keep private in a review.
• Email or contact form: if you email us or use the contact form, your name, email address and the content of your message.
• Charity recommendations: if you suggest a charity for us to support, the charity's name, website and your reasoning, plus your name and email if you choose to give them so we can follow up.
• Admin accounts: login credentials for the small number of people who help maintain the site.

Information stored in the app

When you create an FND Assist app account, the following is stored in our secure database, tied to your account:

• Account details, such as your name and email address.
• Profile details you choose to add, such as date of birth, blood type, other medical information, emergency contact and phone number.
• Symptom, fatigue, mood and pain journal entries, including notes you choose to record.
• Appointments you add, related notes, and any appointment letters you upload.
• Medications you add, dosages and doses you log.
• Pacing and energy-management logs.
• Carer invitations you send or accept, and the connection this creates between a carer's account and your data.

This information is stored on FND Assist's servers (hosted by our database provider, Supabase) so that it's available across your devices and so features like carer alerts can work. It is not sold, and access is restricted so that only you, and any carer you have specifically linked, can see it — see Section 10 for how this is enforced.

Information collected automatically

• Basic technical data such as device type, browser, and approximate location derived from your IP address, used to keep the service secure and working.
• Essential cookies and similar local storage used to keep you signed in and remember your preferences. We do not use advertising or cross-site tracking cookies.

Your journal entries, symptoms, mood, pain, pacing, medication and profile medical information are "special category" health data under UK GDPR, which requires extra care and a specific legal condition on top of an ordinary legal basis (see Section 6).

We process this data because it is the core purpose of the app: to help you track and manage your FND symptoms, and, where you choose, to share relevant information with a carer. We rely on your explicit consent, given when you create an account and use these features, as our condition for processing it. You can withdraw consent at any time by deleting your account or the specific entries — see Section 8 for what happens to the data when you do.

• To reply to enquiries you send us.
• To let you know when the FND Assist app is available and send launch or early-access updates you have asked for.
• To provide the features of the app: your account and profile, journaling, appointment tracking, medication tracking, pacing logs, seizure logging, and the carer call / alarm feature, including syncing this information to your account so it's available wherever you sign in.
• To display approved reviews publicly on our website.
• To keep our services secure, prevent misuse and fix bugs.
• To comply with our legal and regulatory obligations.

Depending on the activity, we rely on one or more of:

• Consent — for launch updates, for publishing reviews, and (together with the special category condition below) for the health data you record in the app.
• Contract — to provide the account and features you sign up for.
• Legitimate interests — to keep our services secure and improve them, where this does not override your rights.
• Legal obligation — where the law requires us to keep or disclose information.
• Vital interests — where safety features (such as the carer call) need to operate in an emergency.

For special category health data specifically, our Article 9 condition is your explicit consent, given when you choose to record that information in the app.

We never sell your information. We share it only in the following ways:

• With a carer you link: if you send or accept a carer invitation in the app, the information you choose to share becomes visible to that carer's account. You are in control of creating and removing this link.
• With our service providers: our database and authentication provider (Supabase), our website hosting provider (Cloudflare), and any email provider we use to send messages on our behalf. These providers act as our data processors and only handle information on our instructions and under contract.
• Where legally required: for example to comply with a court order, or to protect someone's safety in an emergency.

• App launch signups are kept until the app has launched and for a reasonable follow-up period, then deleted or anonymised.
• Published reviews are kept while relevant to showcasing feedback about FND Assist, or until you ask us to remove one.
• Emails and contact messages are kept for as long as we need to deal with your enquiry.
• App account and health data is kept for as long as your account is active. If you delete your account from within the app, or ask us to at hello@fndassist.co.uk, we aim to delete it from our live database within 30 days, other than anything we must keep for a legal reason (for example fraud prevention or an active legal dispute), which we keep only for as long as that reason requires.

Under UK GDPR you have the right to:

• Ask for a copy of the information we hold about you.
• Ask us to correct information that is wrong.
• Ask us to delete your information.
• Ask us to restrict or object to how we use your information.
• Ask for your information in a portable format.
• Withdraw consent at any time where we rely on consent.

To exercise any of these rights, email hello@fndassist.co.uk. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

We use encryption in transit (HTTPS) across the website and app, and encryption at rest provided by our database provider. Access to app data is enforced with row-level security, which is configured so your account can only read and write your own data, plus data belonging to a carer relationship you have specifically set up — other users' data is not reachable through the app, even by us, without deliberately using administrative access.

A small number of authorised FND Assist administrators can access the underlying database directly for support, maintenance and security purposes. We restrict who has this access and log its use. No system is 100% secure, but we work hard to protect what you share with us, and to respond quickly — including notifying affected users and, where required, the ICO — if something goes wrong.

The FND Assist app is not intended for use by children under 13 without the involvement of a parent, guardian or carer. If you believe a child has provided us with personal information without appropriate consent, please contact us and we will remove it.

Some of our service providers may process information outside the UK or European Economic Area. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or equivalent contractual protections.

Our website uses only cookies and local storage that are needed to make the site work — for example to keep admin users signed in. We do not use advertising cookies or third-party trackers for marketing.

Our resources and support pages link to other organisations, such as charities, the NHS and peer-support groups. Those sites have their own privacy policies and we are not responsible for how they handle your information.

We may update this policy from time to time. When we do, we will update the effective date at the top of the page. For significant changes we will try to let you know by email or through the app.

If you have questions about this policy or how we handle your information, email hello@fndassist.co.uk.

You can also read more about FND Assist on our About page or get in touch via our Contact page.