Privacy Policy

Privacy Policy

Effective date: August 2025 If you have questions, contact us at privacy@letheia.app .

Letheia is a wellbeing app focused on mood check-ins, guided reflections, insights, and optional breathwork exercises. This Privacy Policy explains what we collect, how we use it, and your choices. This Policy applies to the Letheia app, website, and related services (“ Services ”).

Letheia is not a medical device and does not provide medical advice. If you are in crisis, contact local emergency services.

• Account & Contact Data: name, email, password (hashed), preferences.

Account & Contact Data: name, email, password (hashed), preferences.

• Mood & Wellbeing Inputs: mood labels, notes, tags, activities, timestamps, session history (e.g., breathwork cycles/duration), and other entries you choose to log.

Mood & Wellbeing Inputs: mood labels, notes, tags, activities, timestamps, session history (e.g., breathwork cycles/duration), and other entries you choose to log.

• Usage Data: app interactions, device type, OS version, performance logs, crash data.

Usage Data: app interactions, device type, OS version, performance logs, crash data.

• Communications: messages you send us (e.g., pre-registration form) and related metadata.

Communications: messages you send us (e.g., pre-registration form) and related metadata.

• Optional Media: only if you choose to upload (e.g., an avatar). We don’t access photos/microphone without your permission.

Optional Media: only if you choose to upload (e.g., an avatar). We don’t access photos/microphone without your permission.

• Provide and personalize the Services (e.g., show mood history and insights).

Provide and personalize the Services (e.g., show mood history and insights).

• Run optional features like breathwork timers, haptics, or reminders.

Run optional features like breathwork timers, haptics, or reminders.

• Communicate with you about onboarding, updates, support, and pre-registration.

Communicate with you about onboarding, updates, support, and pre-registration.

• Maintain safety, prevent abuse, debug, and improve performance.

Maintain safety, prevent abuse, debug, and improve performance.

• Comply with legal obligations and enforce terms.

Comply with legal obligations and enforce terms.

Where GDPR/UK GDPR applies, we rely on the following bases: (a) performance of a contract; (b) legitimate interests (e.g., app improvement and security); (c) consent (e.g., marketing emails, certain analytics); and (d) legal obligations.

• Service Providers: vendors that help us operate (e.g., cloud hosting, analytics, email delivery such as Mailgun for pre-registration emails). They are bound by confidentiality and data-processing terms.

Service Providers: vendors that help us operate (e.g., cloud hosting, analytics, email delivery such as Mailgun for pre-registration emails). They are bound by confidentiality and data-processing terms.

• Legal/Compliance: to comply with law, protect rights, safety, or prevent fraud/abuse.

Legal/Compliance: to comply with law, protect rights, safety, or prevent fraud/abuse.

• Business Transfers: in a merger, acquisition, or asset sale, data may be transferred as permitted by law.

Business Transfers: in a merger, acquisition, or asset sale, data may be transferred as permitted by law.

We do not sell your personal information.

Letheia offers an optional feature called BuddyLert . If you choose to enable it, you designate one trusted contact (a “Buddy”) and provide that person’s mobile number so we can reach them by SMS on your behalf.

• Consent: You opt in inside the Letheia app by selecting a trusted contact and entering their mobile number. That contact receives a single invitation text with a link and must expressly accept the role on a Letheia web page before any further messages are sent to them.

Consent: You opt in inside the Letheia app by selecting a trusted contact and entering their mobile number. That contact receives a single invitation text with a link and must expressly accept the role on a Letheia web page before any further messages are sent to them.

• Messages we send: a one-time invitation; if you are going through a hard time, an alert asking your Buddy to check on you; a brief follow-up; and occasional status notices. These are transactional messages only. We do not send marketing texts.

Messages we send: a one-time invitation; if you are going through a hard time, an alert asking your Buddy to check on you; a brief follow-up; and occasional status notices. These are transactional messages only. We do not send marketing texts.

• Opt-out: Recipients can reply STOP at any time to stop all messages, and can also step down using the link on the page. Reply HELP for help. Message and data rates may apply, and message frequency varies.

Opt-out: Recipients can reply STOP at any time to stop all messages, and can also step down using the link on the page. Reply HELP for help. Message and data rates may apply, and message frequency varies.

• No sale or sharing for marketing: Mobile phone numbers and SMS opt-in information are used only to operate BuddyLert. We do not sell or share mobile opt-in data or phone numbers with third parties or affiliates for their own marketing or promotional purposes. Numbers are processed by our SMS provider solely to deliver these messages.

No sale or sharing for marketing: Mobile phone numbers and SMS opt-in information are used only to operate BuddyLert. We do not sell or share mobile opt-in data or phone numbers with third parties or affiliates for their own marketing or promotional purposes. Numbers are processed by our SMS provider solely to deliver these messages.

Our website may use cookies and similar technologies to measure traffic and improve UX. In-app analytics may collect aggregated usage and crash data. Where required, we’ll request consent and provide controls to manage your preferences.

We keep personal data only as long as necessary for the purposes described in this Policy, to comply with legal obligations, resolve disputes, and enforce agreements. You may request deletion of your account data (see “Your Rights”). Some anonymized or aggregated data may be retained.

We employ technical and organizational safeguards appropriate to the risk (encryption in transit, access controls, monitoring). No method of transmission or storage is 100% secure; you use the Services at your own risk.

Depending on your location, you may have rights to access, rectify, delete, port, or restrict processing of your data, and to object to certain processing. You can also withdraw consent at any time where we rely on consent.

To exercise rights, email privacy@letheia.app . We may verify your identity before responding. You also have the right to lodge a complaint with your local supervisory authority.

Letheia is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children without appropriate consent. If you believe a child provided data, contact us to delete it.

We may process data in countries other than where you live. When we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses or other lawful mechanisms.

We may update this Policy periodically. We’ll post the revised version with an updated “Effective date” and, where required, provide additional notice. Continued use of the Services after changes become effective constitutes acceptance.

Questions or requests about privacy? Email privacy@letheia.app