Privacy Policy
Privacy Policy
Last updated: 28 September 2026
Introduction
This Privacy Policy explains how CUEPOD LTD, trading as allie ("allie", "we", "us" or "our"), collects, uses, shares and protects your personal data when you use the allie mobile app (the "App") or the allieapp.com website (the "Website") (together, the "Services"). "You" means anyone who uses the Services, including a partner invited by an allie user.
Some features described in this policy are being introduced over time. Where a feature is not yet available to you, we do not collect the data linked to it.
Who we are
CUEPOD LTD is a company registered in England and Wales (company number 12659813). Our address is 26 Alexander Street, London W2 5NT, United Kingdom.
We are the data controller for the personal data described in this policy.
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies to you, the EU General Data Protection Regulation (EU GDPR).
For any privacy question or request, email jo@allieapp.com.
Personal data we collect
Information you give us
- Account information: your email address, password, month and year of birth, country or region, time zone and language. You can also give us a first name or the name you'd like us to use; this is optional.
- Health and hormonal data: your hormonal contraception method, brand, start and stop dates and switching history; side effects and symptoms; menstrual cycle dates; mood; sleep; weight, height, BMI and body temperature; pregnancy-related information; perimenopause and menopause symptoms; medical and family health history; lifestyle factors such as water intake; and any notes you write. Some symptoms may relate to your sex life.
- Support and feedback: messages you send us, survey answers, and reviews you agree we can publish.
- Partner accounts (when available): if an allie user invites you as their partner, your name, email address and month and year of birth.
- Community posts (when available): anything you post in community areas of the App.
Health and hormonal data is "special category data" under UK GDPR. We only process it with your explicit consent (see "How we use your personal data").
Information from connected health apps and wearables (when available)
If you choose to connect Apple Health, Google Health Connect or a wearable device (such as Oura or Whoop), we import the data types you allow. This may include steps, activity, heart rate, sleep, body temperature, weight and height. You can disconnect at any time in the App or your device settings. The provider's own privacy policy governs how they handle your data.
Information we collect automatically
- Device information: device model, operating system and version, App version, device identifiers and push notification token.
- Approximate location: based on your IP address and time zone. We do not collect your precise location.
- Usage information: which features you use and how often, and crash and performance logs.
Payments (when available)
If you buy a paid plan, payment is handled by the Apple App Store, Google Play or our website payment provider. We receive confirmation of your purchase and plan status. We never receive your full card details.
How we use your personal data
We only use your personal data where we have a lawful basis under UK GDPR. For health data, we also rely on your explicit consent (Article 9(2)(a)), except for the clinical safety records described in Table 3.
Your consents
We ask for separate consents. You can give one without the others:
- Consent 1 – Using the App (needed for the App to work): your explicit consent for us to process your health and hormonal data to provide the App's features and personal insights. Tracking this data is what the App does, so it cannot work without this consent. You can withdraw it at any time by deleting your account.
- Consent 2 – Research and improving allie's AI (optional): your separate explicit consent for us to use your pseudonymised data to train and improve our models and for research. This is switched off unless you turn it on. You can turn it off at any time in App Settings, and doing so will not affect how you use the App.
- Consent 3 – Ads based on what you log (optional): your separate explicit consent for us to use your health data within allie to choose which in-app ads you see. This is switched off unless you turn it on, and you can turn it off at any time in App Settings. Your data is never sent to the advertiser.
Table 1: Consent and explicit consent
| What we do | Lawful basis | Example |
|---|---|---|
| Provide the App's core features: logging, cycle and contraception tracking, reminders and educational content | Explicit consent – Consent 1 (Art. 6(1)(a) and 9(2)(a)) | Showing your symptom timeline and suggesting articles relevant to your method |
| Provide personalised insights and patterns over time | Explicit consent – Consent 1 (Art. 6(1)(a) and 9(2)(a)) | Showing how your symptoms changed after starting or switching a contraceptive |
| Import data from connected health apps and wearables | Explicit consent – Consent 1, plus the permissions you grant on your device | Adding sleep and temperature data from your wearable to your timeline |
| Train and improve allie's AI models and carry out research | Explicit consent – Consent 2, optional (Art. 6(1)(a) and 9(2)(a)) | Using pseudonymised data to find patterns across users with similar profiles |
| Show in-app ads based on what you log | Explicit consent – Consent 3, optional (Art. 6(1)(a) and 9(2)(a)) | Showing an ad for a product relevant to a symptom you have logged. The matching happens within allie and your data is not sent to the advertiser |
| Share the information you choose with your partner | Consent (Art. 6(1)(a)); explicit consent for any health information (Art. 9(2)(a)) | Sending your partner the updates you have chosen to share |
| Send marketing emails, offers and recommendations, including from partners | Consent (Art. 6(1)(a)) | Telling you about a subscription discount. We never use your health data for marketing unless you give separate explicit consent |
| Measure how well our marketing works | Consent (Art. 6(1)(a)) | Using a service such as AppsFlyer to see which campaign led to an install. No health data is shared |
| Publish your review or comment | Consent (Art. 6(1)(a)) | Showing your review on our Website |
Table 2: Contract and legitimate interests
| What we do | Lawful basis | Example |
|---|---|---|
| Create and manage your account, and process purchases | Contract (Art. 6(1)(b)) | Signing you in, sending receipts and plan renewal notices |
| Respond to support requests and feedback | Legitimate interests (Art. 6(1)(f)) | Using your email address to reply to your question |
| Keep the Services secure, stop bots and misuse, and fix bugs | Legitimate interests (Art. 6(1)(f)) | Reviewing crash reports and security logs |
| Understand how the App is used, in aggregate, to improve it | Legitimate interests (Art. 6(1)(f)) | Seeing which features are used most |
| Send service and security messages | Legitimate interests (Art. 6(1)(f)) | Asking you to update the App to get a security fix |
When we rely on legitimate interests, we weigh our interests against your rights and only go ahead where they do not override them. You can object at any time (see "Your privacy rights").
Table 3: Legal obligations
| What we do | Lawful basis | Example |
|---|---|---|
| Keep financial, accounting and tax records | Legal obligation (Art. 6(1)(c)) | Keeping purchase records as required by HMRC |
| Respond to lawful requests from regulators, courts or law enforcement | Legal obligation (Art. 6(1)(c)) | Responding to an enquiry from the ICO |
| Keep clinical safety records | Legal obligation (Art. 6(1)(c)); public interest in public health (Art. 9(2)(i)) | Logging and investigating safety issues under NHS clinical risk management standards (DCB0129) |
How allie uses AI
allie uses algorithms, including machine learning and other AI tools, to analyse the data you log and spot patterns over time. For example, we may show how your symptoms changed after you started or switched a contraceptive.
These insights are for information and to help you talk to your healthcare professional. They are not a diagnosis and do not replace medical advice.
No automated decisions about you. We do not make decisions based solely on automated processing that have a legal or similarly significant effect on you. You can ask us how our insights are generated.
Third-party AI providers. Some features may use AI services provided by other companies, for example to process text or voice notes you enter. When we use them:
- they act as our processors under a written contract and may only use your data to provide their service to us;
- we only use providers whose terms do not allow them to use your data to train their own models;
- we send only the data the feature needs and remove direct identifiers where we can; and
- if the provider is outside the UK, we protect the transfer as described in "International transfers".
We will name the AI providers we use in "Who we share your data with" before any feature that uses them goes live.
Pseudonymised and anonymised data
- Pseudonymised data has your name, email and account ID replaced with a code, so it cannot be linked to you without extra information we keep separately and securely. Pseudonymised data is still personal data. Your rights still apply, and we only use it for research and model training if you have given Consent 2.
- Anonymised data is combined and aggregated so that no individual can be identified by any means reasonably likely to be used, following ICO guidance. It is no longer personal data. We may use it to publish research and health trends, share it with academic partners, and develop our products and services, including commercially.
We never share data about you as an individual with advertisers. For specific research studies, we will contact you and ask for your consent separately.
Who we share your data with
We do not sell your personal data.
Service providers
We use trusted providers to run the Services. They process your data only on our instructions, under written contracts that require them to keep it secure.
| Provider | What they do for us | Data involved |
|---|---|---|
| Supabase | Database, account sign-in and data storage | Account, health and usage data |
| Google Firebase | App infrastructure services that help the App run | Device and usage data |
| Resend | Sending account and service emails | Email address |
| Expo, Apple and Google | Delivering push notifications | Device identifiers and notification content |
| Shopify | Hosting our Website | Website visitor data |
| Apple App Store and Google Play | App downloads and payments (when available) | Purchase and plan status |
| AppsFlyer (when used, with your consent) | Measuring marketing campaigns | Device and install data, no health data |
| AI service providers (when used) | Features described in "How allie uses AI" | Only the data the feature needs |
We will update this list when our providers change.
Other sharing
- Legal reasons: where required by law, or to protect the safety of you or others.
- Research partners: anonymised data only, or pseudonymised data where you have given specific consent and a data sharing agreement is in place.
- Business changes: if allie is merged or sold, your data may transfer to the new owner, who must protect it in line with this policy. We will tell you before this happens.
In-app advertising
allie is free to use. We fund this in part by showing ads in the App from brands and partners whose products or services are relevant to our users.
- What advertisers receive: only anonymised, aggregated insights (for example, how many users logged a particular symptom in a month) and combined ad performance figures (for example, how many times an ad was shown or tapped). We share only what is needed to run advertising in the App.
- What advertisers never receive: your name, email address, device identifiers, or any other data that could identify you.
- Ads based on what you log: only if you give Consent 3. Without it, you will still see ads, but they will not be chosen using your health data.
Partner sharing (when available)
If you are 18 or over, you can choose to share certain information with a partner. You control what they see and can stop sharing at any time.
- Your partner has read-only access. They cannot download or edit your information.
- Your partner can only see what you choose to share. They cannot see your personal notes, your calendar from before you started sharing, or any pregnancy, miscarriage or abortion information you have logged.
- Any notifications your partner receives contain only information you have chosen to share.
If you are a partner, we collect your name, email address and month and year of birth to create your account and confirm you meet our minimum age. We do not collect any health data about you.
Community areas (when available)
Please do not post information that could identify you. Anything you post in community areas can be seen by other users and may be used in ways we cannot control. If you want something you posted removed, email jo@allieapp.com.
Social media
When you interact with allie on social media, we may process your username, profile picture and any comments or posts about allie, only to engage with you.
International transfers
Our main database is hosted in the UK or the European Economic Area (EEA). Some of our service providers, such as those for email, notifications and AI, may process data in other countries, including the United States.
When your data leaves the UK, we make sure it is protected by one of the following:
- UK adequacy regulations, which cover the EEA and US companies certified under the UK Extension to the EU–US Data Privacy Framework (the "UK–US Data Bridge"); or
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
For users in the EEA, we use the EU Standard Contractual Clauses or rely on EU adequacy decisions. To ask for a copy of the safeguards we use, email jo@allieapp.com.
How long we keep your data
| Data | How long we keep it |
|---|---|
| Account and health data | While your account is active |
| After you delete your account | Deleted within one month of your request, and removed from backups within 90 days |
| Inactive accounts | Deleted after three years without use |
| Purchase and financial records | As long as UK tax law requires, normally six years |
| Clinical safety records | As long as NHS clinical safety standards require |
| Anonymised data | May be kept indefinitely, as it is not personal data |
Deleting the App from your phone does not delete your account. To delete your account, use App Settings or email us.
If you turn off Consent 2, we stop using your data for future research and model training. Data already used to train a model cannot always be removed from that model, but we will not use your data again.
We may keep some data after deletion where the law requires it, or to establish, exercise or defend legal claims.
When we delete data, we use secure methods so it cannot be recovered, and we tell our service providers to delete it too.
Security
We protect your data with measures suited to health information, including:
- encryption of data in transit and at rest;
- hosting with established cloud providers in the UK or EEA;
- limiting access to people who need it for their role, who are bound by confidentiality; and
- carrying out data protection impact assessments before we launch features that use health data in new ways, and a privacy review in the event of a merger or sale.
Please keep your password private, and consider using a passcode or Face ID on your phone. No system is completely secure, so we cannot guarantee that your data will never be accessed without permission.
If there is a data breach
If a breach is likely to put your rights at risk, we will report it to the ICO within 72 hours where required. If the risk to you is high, we will tell you directly without undue delay. We may also sign you out of all devices or ask you to reset your password.
To report a security issue, email jo@allieapp.com.
Your privacy rights
Wherever you live, you have these rights over your personal data:
- Access: ask for a copy of your data, including in a structured, portable format (JSON).
- Correction: ask us to correct data that is wrong.
- Erasure: ask us to delete your data. Some features that rely on your history may stop working.
- Restriction: ask us to pause using your data, for example while we check its accuracy.
- Portability: ask us to send your data to you or another service in a reusable format.
- Objection: object to us using your data based on legitimate interests, and to direct marketing at any time.
- Withdraw consent: withdraw any consent at any time. This does not affect anything we did lawfully before you withdrew.
- Automated decisions: ask how our insights are generated (see "How allie uses AI").
How to use your rights
Email jo@allieapp.com. You can also delete your account, and manage Consents 2 and 3, in App Settings.
We will reply within one month. For complex requests we may need up to two more months; if so, we will tell you why. Using your rights is free, unless a request is clearly unfounded or excessive.
We will need to confirm your identity, usually by checking that the request comes from the email address on your account. If we are unsure what you are asking, we may contact you to clarify.
Complaints
If you are unhappy with how we use your data, please contact us first at jo@allieapp.com. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the data protection authority where you live.
Age requirements
You must be 16 or over to use allie. We do not knowingly collect data from anyone under 16. If you think someone under 16 is using allie, email jo@allieapp.com and we will delete their account and data. Some features, such as partner sharing, are only available to users aged 18 or over.
Communications and cookies
We send service messages, such as security alerts and account notices, which you cannot opt out of while you have an account. We only send marketing emails and notifications if you have agreed to them. You can unsubscribe using the link in any marketing email, and turn off push notifications in your device settings.
Our Website uses cookies. We only use non-essential cookies if you accept them.
Changes to this policy
We may update this policy from time to time. If we make significant changes, we will tell you by email or in the App. If a change affects how we use your health data, we will ask for your consent again.
Contact us
Email: jo@allieapp.com
Post: CUEPOD LTD, 26 Alexander Street, London W2 5NT, United Kingdom
© 2026 CUEPOD LTD, trading as allie