Privacy notice

1. Who is responsible for your information?

Your Biological Pension Pot Ltd is the data controller responsible for the personal information processed through this service.

For privacy questions or to exercise your data-protection rights, contact:

yourbiologicalpensionpot@gmail.com

2. Who may use the service?

The service is currently intended only for people aged 18 or over. By continuing beyond this page, you confirm that you are at least 18 years old.

3. Information we collect

Depending on how you use the service, we may process:

• Your email address, account identifier and authentication information.
• The lifestyle activities and choices you submit for assessment.
• Your Bio Credit scores, balance, categories, explanations, tips and transaction history.
• Personal context supplied during onboarding, such as goals, usual activity, mobility or accessibility needs.
• An optional broad location, such as your town, city or county, if you choose to add one for local suggestions and weather-aware guidance. We do not ask for your street address or precise location.
• Health information that you voluntarily choose to include in your personal context or other information you submit.
• Daily check-in questions or messages, the AI responses provided to you, and the dates and times associated with those check-ins.
• The titles and web addresses of sources returned when live web search is used for a local or weather-related response.
• Technical information necessary to operate and secure the service, which may include IP address, browser information, request times and security logs.
• Information contained in emails you send to us.

Please do not provide detailed medical records, an exact home address or information about another person.

4. Why we use your information

We use personal information to:

• Create and secure your account.
• Save your balance and transaction history.
• Assess lifestyle entries and produce motivational scores, explanations and tips.
• Personalise assessments using information you provide during onboarding.
• Answer daily check-in questions and provide manageable, personalised suggestions.
• If you request local or weather-aware recommendations and have supplied a broad location, find current public information and show the supporting source links.
• Respond to support and data-rights requests.
• Prevent abuse, investigate errors and protect the service.
• Meet applicable legal and regulatory obligations.

We do not sell your personal information and do not use it for targeted advertising.

5. Our legal bases

Under UK data-protection law, we rely on:

• Contract: where processing is necessary to create your account and provide the service you request.
• Legitimate interests: where necessary to secure, maintain and improve the service, provided those interests do not override your rights.
• Legal obligation: where we must process information to comply with the law.
• Consent: where you choose to provide optional information for personalisation.

Information about health is special-category data. Where you voluntarily provide health information for personalisation, we rely on your explicit consent under Article 9(2)(a) of the UK GDPR in addition to the applicable Article 6 basis.

You may withdraw that consent by contacting us. Withdrawal does not affect processing that lawfully occurred before withdrawal. Features that depend on personalised information may no longer be available after consent is withdrawn.

6. AI personalisation

When you request an activity assessment or submit a daily check-in, the relevant text and saved personal context are sent securely from our server to the OpenAI API. OpenAI produces the response used by the service. For an activity assessment, the application converts the returned classification into Bio Credits.

If a daily check-in asks for current local or weather-related information, the service may use OpenAI's live web-search feature. The search request is limited to the optional broad location you supplied and a general description of the requested activity or information. Your complete personal profile, health details and full check-in message are not used as the live web-search query.

We may save the resulting source titles and web addresses with your daily check-in so you can see what supported the response. Search results may be incomplete, outdated or incorrect. A source link is not an endorsement by Your Biological Pension Pot Ltd. If you follow a source link, the third-party website may receive ordinary technical information from your browser and will apply its own privacy policy.

The AI may take account of the circumstances you provided, but it can make mistakes. Its output is motivational information only and must not be treated as medical advice or a professional assessment.

OpenAI's current API documentation states that data sent to the Responses API is not used to train its models and may be retained for abuse monitoring, generally for up to 30 days, subject to account settings, configured data controls and documented exceptions.

You can read more in OpenAI's API data-controls documentation.

7. Service providers

We use service providers to operate the website. These currently include:

• Supabase: authentication, account identifiers, database storage and related infrastructure.
• OpenAI: AI classification, daily check-in responses, personalised tips and live web search where relevant.
• Resend: delivering account and authentication emails.
• Google Gmail: processing emails sent to our contact address.
• Our website-hosting provider: delivering and securing the website, including necessary technical logs.

Providers may process information only as required to supply their services and under their applicable contractual and legal obligations.

Live-search results may refer you to external websites that are not our processors or service providers. Those websites are responsible for their own content and privacy practices when you choose to visit them.

You can review Supabase's privacy information.

8. International transfers

Some providers may process information outside the United Kingdom. Where required, international transfers must be protected by an applicable adequacy regulation, contractual safeguard or another lawful transfer mechanism under UK data-protection law.

9. How long we retain information

Account information, profiles, balances, transactions, daily check-ins, AI responses and saved source links are normally retained while an account remains active and while reasonably necessary to provide the service.

If you use a feature that clears daily check-ins, those check-ins and their saved source links are removed from the active database, subject to temporary protected backups and provider security logs.

If you make a valid deletion request, we will delete information from active systems unless it must be retained for a legal, security or dispute-related reason. Limited residual copies may remain temporarily in protected backups or provider logs.

The privacy-acknowledgement cookie lasts for up to one year unless you remove it sooner. A new version of this notice may require you to acknowledge it again.

10. Cookies

We currently use only cookies necessary to operate the service:

• A privacy-notice cookie that remembers the notice version you acknowledged.
• Supabase authentication cookies that keep you securely signed in.

We do not currently use advertising or non-essential analytics cookies. If that changes, this notice and the website's cookie controls must be updated before those cookies are used.

11. Automated assessments

The service uses AI to classify entries and calculate motivational Bio Credits. These assessments do not produce legal or similarly significant decisions about you.

Do not use a Bio Credit score to make healthcare, employment, insurance, financial or other important decisions.

12. Your rights

Depending on the circumstances, UK data-protection law may give you rights to:

• Access your personal information.
• Correct inaccurate information.
• Request deletion.
• Restrict certain processing.
• Receive portable copies of information.
• Object to certain processing.
• Withdraw consent where processing relies on consent.

To exercise a right, email yourbiologicalpensionpot@gmail.com. We may need to verify that the request relates to your account.

Signed-in users can also download a copy of their account details, onboarding profile (including any optional broad location), transaction history, daily check-ins, AI responses and saved source links from the account settings page.

You may also complain to the Information Commissioner's Office.

13. Security

We use reasonable technical and organisational measures designed to protect personal information. No online service can guarantee absolute security.

Never enter passwords, payment-card information, national identification numbers or detailed medical records into an activity description, daily check-in or personal profile. Do not enter an exact home address; use only a town, city or county if you choose to enable local suggestions.

14. Changes to this notice

We may update this notice when the service, providers or legal requirements change. If a material change is made, we may ask you to acknowledge the new version before continuing.