Last updated: 19 October 2026
My Reflux Diary is run by DRS Software Solutions Ltd, a company registered in England and Wales with company number 17189542, at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are the data controller for the personal data described here. We are registered with the Information Commissioner's Office (ICO) under registration number ZC155938.
Contact us about privacy at hello@drssoftwaresolutions.com.
My Reflux Diary is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.
My Reflux Diary is a food, drink and symptom diary. It helps you keep a record and see your own entries counted back to you. It does not diagnose, treat or monitor any condition, and it is not a medical device. Nothing in the app is medical advice.
Account: your name, email address, and, if you sign in with Google, your Google profile image and sign-in tokens. One-time codes used to verify your email.
Sign-in sessions: a session token, its expiry, your IP address and browser type, used to keep your account secure.
Profile: display name, time zone, country, units, and the items you choose to track. Your usual bedtime and wake time, if you enter them.
Your diary (health data): what you eat and drink, when, portions and notes; symptoms, their severity, timing and notes; lifestyle entries such as sleep, exercise, stress, water, smoking, and whether you took medication. Your own saved foods and recipes.
Patterns: counts the app calculates from your own entries, for example how often a symptom followed a type of meal. These are counts shown to you, not decisions about you.
AI assistant: the questions you ask, the answers given, and the sources used.
Consents: which permissions you gave or withdrew, when, and which version of this policy applied.
Plan: whether your account is in its free days, on the free plan or on a paid plan, and the dates. Payment details are held by our payment provider, not by us.
Service records: an audit log of account events (sign-up, deletion and similar), privacy requests you make, and rate-limit counters that may include your IP address.
| Purpose | Legal basis |
|---|---|
| Providing your account and the diary you asked for | Performance of a contract (UK GDPR Article 6(1)(b)) |
| Storing your diary entries, which are health data | Your explicit consent (Article 9(2)(a)), which you give at sign-up and can withdraw |
| Sending your typed text to an AI provider to turn it into entries, describe foods or answer questions | Your separate explicit consent to AI processing, which you can withdraw |
| Keeping the service secure, preventing abuse, and keeping an audit trail | Our legitimate interests (Article 6(1)(f)) |
| Keeping consent records and handling your privacy requests | Legal obligation (Article 6(1)(c)) |
| Marketing emails | Your consent, which you can withdraw at any time |
If you withdraw consent for health data, the app can no longer store your diary, so we will delete your account on request.
When you use a feature marked as AI, the text you typed is sent to Anthropic, our AI provider, after emails and phone numbers are removed from it. Anthropic processes it in the United States under a data processing agreement with standard contractual clauses and the UK addendum. AI answers are general information from reviewed sources, labelled as such, and may be wrong. They are not medical advice. We do not use your data to train AI models.
We use these providers, each under a data processing agreement:
| Provider | What it does | Where |
|---|---|---|
| Vercel | Runs the web app | Servers in Frankfurt; US company |
| Neon | Database | Frankfurt |
| Cloudflare | Encrypted backups (Cloudflare cannot read them); bot check at sign-up | EU storage; global network for the bot check |
| Hetzner | Runs the nightly backup job and the food lookup service | Germany |
| Sentry | Error reports: error type and location only, with no personal data | EU storage |
| Resend | Sends sign-in, verification and account emails | Ireland; US company |
| Only if you choose "Sign in with Google" | Global | |
| Paddle | Takes payment as Merchant of Record and holds your payment details | Global |
| Anthropic | AI features, as described above | United States |
Where a provider is outside the UK, transfers rely on the UK International Data Transfer Agreement or addendum, or standard contractual clauses.
Your diary, profile and AI conversations stay until you delete them or your account. Deleted diary entries can be restored for a short period before being purged. Sign-in sessions and rate-limit counters are kept until they expire. Audit logs are kept for up to 24 months and AI usage records for up to 13 months. Encrypted backups are kept for up to 8 weeks, so deleted data can remain in a backup for that long.
You can, at any time from Settings: export all your data; delete your account and everything in it; withdraw any consent.
You also have the right to ask us to correct data, to restrict or object to processing, and to complain to the ICO at ico.org.uk. To exercise a right that the app does not offer directly, email us at hello@drssoftwaresolutions.com. We will reply within one month.
Each account's data is separated at the database level. Backups are encrypted before they leave the database, with the key held offline. Connections are encrypted. Error reports are scrubbed of personal data. We review and test restores from backup regularly.
We use one strictly necessary cookie, to keep you signed in. See the Cookies page.
We will tell you in the app before material changes to this policy take effect, and ask for consent again where the law requires it.