CalmCircuit Privacy Policy

Last updated: 26 May 2026

Who we are

CalmCircuit is a symptom-tracking and grounding toolkit for people living with Functional Neurological Disorder (FND) and post-encephalitis recovery. We are not a medical device, and CalmCircuit does not provide medical advice. It is a personal tracking tool designed to complement the care provided by your NHS team.

Data we collect

When you create a CalmCircuit account, we collect:

• Your email address and chosen password (hashed and stored securely)
• Your name (optional)
• Your primary FND symptom and condition type (FND, encephalitis, both, or other)
• Daily symptom entries: energy, mood, fatigue, seizure counts, tremor, weakness, and other symptoms you choose to log
• Grounding session records: which techniques you used and how you rated them
• Reminder preferences (if you enable daily email reminders)

We do not collect device location, contacts, camera data, or any other data beyond what you explicitly enter into the app.

How we use your data

Your data is used exclusively to:

• Provide your personal symptom journal and history
• Generate your pattern insights and weekly summaries
• Power your personalised grounding technique recommendations
• Generate clinician-ready PDF reports at your request
• Send daily email reminders, if you have enabled them

We do not sell, share, or licence your symptom data to third parties. Your data is never used for advertising or profiling.

Data storage and security

Your data is stored on secure servers hosted by our infrastructure provider. All data is transmitted over HTTPS (TLS 1.2+). Passwords are hashed using bcrypt with a cost factor of 12 — they cannot be recovered by us.

Symptom entries are stored with your user account. You can request a complete export of your data at any time by contacting us.

Data sharing

We do not share your personal data with any third parties, except:

• If you explicitly choose to export and share your PDF report with your GP, consultant, or physiotherapist — that action is initiated by you
• If required by law (for example, a valid court order or statutory obligation)

Your rights

Under UK GDPR, you have the right to:

• Access a copy of all personal data we hold about you
• Correct any inaccurate data
• Request deletion of your account and all associated data
• Withdraw consent at any time (contact us to delete your account)

To exercise any of these rights, email support@calmcircuit.polsia.app. We respond to all subject access requests within 30 days as required by law.

Cookies and tracking

CalmCircuit uses a single authentication session cookie (httpOnly, secure, SameSite=lax) to keep you logged in. No advertising cookies, no tracking cookies, no third-party analytics.

We collect anonymised, aggregated usage events (e.g., "signup", "symptom_entry_created") to understand how the app is used. These events contain no personally identifiable information and are used only for product improvement.

Children

CalmCircuit is not intended for use by anyone under the age of 16. We do not knowingly collect data from minors.

Changes to this policy

If we make changes to this privacy policy, we will update the "Last updated" date above and, for significant changes, notify you by email. Continued use of CalmCircuit after any change constitutes acceptance of the updated policy.

Contact

For any privacy concerns or data subject requests, contact us at support@calmcircuit.polsia.app.