Privacy Policy

Last updated: 23 October 2026

This Privacy Policy explains, in plain English, how that works and the few limited things taluvu handles only when you choose to use them.

It covers both ways of using taluvu: the iPhone app from the App Store, and taluvu on the web at app.taluvu.co.uk. Most of it is the same for both. Where the two differ, for example in who takes your payment, this policy says which one it is talking about.

taluvu is operated by TALUVU LTD, a company registered in England and Wales (company number 17383663), registered office 128 City Road, London, United Kingdom, EC1V 2NX. For the purposes of applicable data protection law, TALUVU LTD is the data controller. For privacy questions, contact support@taluvu.co.uk.

1. Your private notes stay on your device

taluvu stores your private notes locally on your device.

taluvu does not keep a central server copy of your journal, check-ins, symptom notes, mood notes, Calendar entries, doctor preparation notes or Asha conversations.

Because this information lives on your device, keeping your device secure is the best way to keep it private.

2. Messaging Asha

When you message Asha, your message is sent securely to Anthropic, the AI company whose model generates her reply. taluvu does not keep a copy of that conversation on our servers. The first time you meet Asha, at the end of setup, the answers you have just given are sent in the same way so that she can write her first reply.

So that Asha can reply like someone who knows you, relevant context from your device is sent along with your message. Depending on what you have shared with taluvu, this can include:

• your first name;
• the conditions you have added, and anything you have written in a condition profile, for example your story so far, what a hard day looks like, and what you wish people understood;
• what you told us matters most to you, and your goal;
• your energy or capacity today, and recent energy patterns;
• your check-in answers: your mood, sleep, energy and pain, the symptoms you track and the severity you gave each one, and anything you typed in your check-in such as your intention for the day or a small win;
• things Asha remembers from earlier conversations (what has helped, what has made things harder, fears you have shared, wins you have had, and the topics you have talked about before), all of which you can review, edit or delete in Me › What Asha Knows;
• short extracts from your recent journal entries, and recent events you have logged in the app, including flares or crashes and the note you added;
• if you have turned on cycle tracking, where you are in your cycle: your current phase and cycle day, your usual cycle length, when your next period is estimated, and whether recent periods have been heavier;
• the recent messages in the conversation itself.

Your medication list, your care contacts, your appointments and the notes you prepare for them, your Doctor Summary and your weight are never sent to Asha’s AI provider. They stay on your device.

This context is sent only to generate that reply. taluvu does not store it anywhere else, and it is not used to build a profile of you. Everything Asha remembers lives on your device with the rest of your data, so deleting your taluvu data also clears what she remembers.

If there is something you would rather Asha never see, keep it out of your chats with her and out of what you save for her. The rest of the app never sends your notes anywhere.

Each message to Asha also tells taluvu’s server which country your help numbers are set to, so that her replies give the right emergency and helpline numbers for where you live. It is used only for that, is not stored, and is not passed on. You can see or change the country in Me › Privacy & Support.

3. Photographing a medication

If you use the camera to add a medication, that photo is sent securely to the same AI company that writes Asha’s replies, to read the name and dose off the packaging. The result is shown to you to confirm or correct before anything is saved.

taluvu does not store the photo, and it is not used for anything else.

This is optional. You can always type a medication in instead.

4. The limited information taluvu handles

taluvu only handles information beyond your device when you choose to use a feature that needs it:

• Optional usage signal: off unless you turn it on. If you enable it, taluvu sends a signal about which screens are used and whether a feature worked, to help fix bugs. It never includes your notes, check-in answers, condition names or symptom names. Each device is given a random code so we can count returning visits; it is not linked to your name or email. You can turn it on or off any time in Me › Privacy & Support. That same limited list is stored on our own server for up to 90 days, and it may also be handled on our behalf by PostHog (an analytics company, servers in Frankfurt in the EU) so we can see which parts of the app people use. PostHog never receives anything beyond what is described in this bullet: not your notes, not your check-in answers, nothing you typed. This signal exists only in the iPhone app; taluvu on the web does not have one.
• If you contact us, we receive what you choose to send (such as your name, email and message) so we can reply.
• Optional reminders: if you turn on notifications, your device registers to receive them, and you can turn this off any time.
• Memberships: only if you start a free trial or subscribe. In the iPhone app, your purchase is made through your Apple Account and payment is taken by Apple, and RevenueCat (see section 4a) receives the details of that purchase so taluvu knows whether your membership is active. On the web, you pay on a secure page run by Stripe (see section 4a), which tells taluvu whether your membership is active, and since 2 October 2026 the sale itself is made through Onelink, the merchant of record Stripe provides, so your receipt comes from Onelink and your bank statement shows LINK.COM. On the web, Stripe holds the email address you give at checkout, and we use it for two things only: sending you a sign-in link when you use a new browser or device, and sending the notices about your trial and membership. Our own records hold a scrambled fingerprint of that address, so we can recognise it when you ask for a sign-in link without keeping the address itself, together with your plan and its dates. None of this is joined to anything you record in taluvu or say to Asha, and in either place taluvu never sees your card details.
• Optional email updates: off unless you tick it. During sign-up you can choose to receive occasional product updates and tips by email. This is a separate, unticked box, not something implied by giving us your email. If you tick it, we share your email address and first name with Mailchimp (operated by The Rocket Science Group, LLC, a US company) so it can send that mail on our behalf, never your notes, check-ins or health information. Every email includes an unsubscribe link, and unsubscribing never affects your access to taluvu. See Mailchimp’s own privacy notice for how they handle data they process for us.

Beyond this list and what sections 2 and 3 describe for Asha and medication photos, taluvu does not send your information anywhere, and it does not build a central profile of your health from your notes. The companies named in section 4a act for us, only for the purpose each is named for, under written contracts.

4a. The companies that handle information for us

When something does leave your device, it goes to a company working for us under a written contract, not to anyone free to use it for their own purposes. Before we use a company we check that it gives your information the same or equal protection as this policy, and we keep that under review.

Anthropic writes Asha’s replies, and reads a medication photo when you use the camera. We use its commercial API under its Commercial Terms of Service, which incorporate its Data Processing Addendum. Under those terms it handles what we send only to produce the reply or the reading we asked for, and does not train its models on it.

Netlify, Inc. hosts taluvu’s website and the server your requests pass through. When you message Asha or send a medication photo, it passes through that server on its way to the AI company, and its content is not stored there. Netlify also stores, for us, the feedback you choose to send, your reminder times if you turn on notifications, anonymous usage counts, the optional usage signals described above if you have turned them on, and a scrambled (hashed) record of an email sign-up so it can be deleted if you ask. It works for us under Netlify’s data processing terms.

RevenueCat, Inc. manages memberships for the iPhone app. When you start a trial or subscribe there, it receives the details of that purchase from the App Store, such as which plan, when it started or renews, and the price, together with a random ID it creates and basic technical details about the app and your device. It uses them only to confirm your subscription is active and to give us anonymous subscription reports. It never receives your name, email address, health information or anything you write in taluvu, and because payment is taken by Apple, neither taluvu nor RevenueCat sees your card details.

Stripe takes payment for taluvu on the web. When you start a trial or subscribe there, you give Stripe your email address and payment details on Stripe’s own page, and Stripe tells us which plan you chose, when it started or renews, and whether a payment succeeded. Stripe never receives your health information or anything you write in taluvu, and taluvu never sees your card details. Stripe also handles payment information under its own privacy policy, for example to prevent fraud.

Onelink is the merchant of record Stripe provides, and since 2 October 2026 it is the seller for your payment on the web. It receives the email address and payment details you give at checkout, sends your receipt, invoice and the notices about your trial and renewal, and handles the sales tax or VAT. It receives nothing you write in taluvu. You can ask Onelink to delete what it holds about your purchases, and Stripe tells us when you do.

Brevo sends the sign-in links and membership notices for taluvu on the web. It receives your email address and the message, and nothing else. We do not track whether you open those emails or click the links in them.

PostHog: optional usage signals from the iPhone app only, and only if you have turned them on. Servers in Frankfurt, in the EU, under PostHog’s data processing terms. PostHog never receives your notes, check-ins or anything you typed.

Mailchimp (The Rocket Science Group, LLC): your email address and first name only, and only if you ticked the optional updates box, under Mailchimp’s data processing terms. Mailchimp never receives your notes, check-ins or health information.

Information leaving the UK. PostHog keeps its servers in the EU, and Brevo keeps your information in the European Union, which UK law treats as protecting it properly. The other companies in this section are based in, or may handle information in, the United States, so using those features can involve the information described above being handled outside the UK and the European Economic Area. Stripe, Netlify and Mailchimp state that they take part in the UK Extension to the EU-US Data Privacy Framework; our contract with Asha’s AI provider uses the UK Addendum to the European standard contractual clauses; and RevenueCat and Onelink handle the purchase details described above under the data-protection terms that apply to each. Email us if you would like the details.

If you would rather nothing left your device at all, you can use taluvu’s journal, check-ins, tracking and Doctor Summary without messaging Asha and without the camera. Asha can be turned off in the app at Me › Privacy & Support, and you are asked before anything is sent for the first time.

5. We do not sell your data

We do not sell your personal information.

We do not use your health-related information for advertising.

We do not share your private notes. They are on your device, not ours.

6. Security

We take reasonable steps to protect the limited information described above, including secure connections.

No app or online service can guarantee complete security.

Because your notes are stored on your device, you are responsible for protecting access to your device.

7. Children

taluvu is not intended for children under 16. Users must be 16 or over to use taluvu.

8. Your control: export and delete

You are always in control. You can export or delete your information anytime.

Deleting your data removes it from this device, and also asks taluvu to delete everything it holds on its server for this device: your reminder registration, your anonymous usage signal and your Asha fair-use counters. On the web, you are asked at the same moment whether to end your membership too. If you choose to, we cancel it so that you are not charged again, delete our own membership record, and ask Stripe to delete the customer record it holds for you. Stripe keeps the payment records it is required by law to keep. If you keep your membership, it carries on as before. If your device is offline at that moment, the app will tell you, and you can email support@taluvu.co.uk to have them removed for you.

If usage reporting was ever switched on in the iPhone app, any copy of those anonymous signals held by PostHog is not removed by the in-app delete. Email support@taluvu.co.uk and we will remove that too.

The anonymous usage signal is in any case deleted automatically after around 90 days.

See Your Data, Export and Deletion for how to export a copy of your information or delete your local taluvu data.

9. Why we may use it, and how long we keep it

TALUVU LTD is responsible for your information under UK data protection law.

Why we may use it. What you send to Asha, and a medication photo you ask us to read, are sent only with your explicit agreement, which you give separately and can take back at any time in Me › Privacy & Support. Reminder times you save are kept only to send the reminders, with the agreement you give when you save them. Optional email updates are sent only if you ticked the box for them, and every one lets you stop them. Your membership details are used because they are needed to give you the membership you asked for: in the iPhone app, the purchase details RevenueCat receives from the App Store; on the web, your email address, your payment customer number, your plan and whether it is active.

How long we keep it. On the web, your membership record is kept while your membership is active and deleted 90 days after it ends, so that we can deal with refunds, payment questions and anyone who comes back. If you delete your data and choose to end your membership too, we end it, remove its record and ask Stripe to delete your customer details. A sign-in link works for 15 minutes. Stripe keeps its own records of payments under its own privacy policy. The anonymous usage signal from the iPhone app is deleted after around 90 days. Everything else described in this policy is either not stored at all or kept only until you remove it, as the section about it says.

9a. Your rights

If you are in the UK or the EU, you have rights over your personal data, including the right to ask for a copy of it, to have it corrected or deleted, and to object to or restrict how it is used.

Most of your information is on your own device, so the fastest route is Me › Privacy & Support, where you can download or delete it yourself. For anything else, email support@taluvu.co.uk.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make important changes, we will take reasonable steps to let users know.

11. Contact

For privacy questions, contact support@taluvu.co.uk.

TALUVU LTD is registered with the Information Commissioner’s Office (ICO), the UK data protection regulator, under registration reference ZC263627.