LYEONS App Privacy Policy

Last updated: September 2026
Company: LYEONS Limited
Company number: 16048419
Registered in: England and Wales
Registered address: 124–128 City Road, London, England, EC1V 2NX
Contact: info@lyeons.com

This policy applies only to the LYEONS App and its associated services.

1. Legal basis and regulatory scope

We process personal data in accordance with:

• The UK General Data Protection Regulation (UK GDPR)
• The EU General Data Protection Regulation (EU GDPR), where applicable

The applicable data protection law depends on where you are located and how the App is offered to you.

The LYEONS App is intended to support wellbeing and quality of life and does not provide medical diagnosis or treatment.

2. Information we collect

When you use the App, we may collect the following categories of information:

• Personal and profile information: name, email address, age and sex (where provided)

• Device and technical data: device identifiers, firmware version, battery status, app usage data, crash and performance diagnostics
• Sensor and device interaction data: device settings, device configuration data, recorded or derived sensor signals generated through use of the device
• Diary and questionnaire data: diary entries, responses to wellbeing questionnaires, goal-setting or reflection inputs
• Community participation data: posts or interactions within in-app community or forum features (if enabled)
• Physiological data: when you use heartbeat scanning, the App may derive pulse or heart-rate estimates and related signal measurements from your device camera. Camera images are processed on your device and are not retained as images.

Physiological data and any diary or questionnaire information that reveals or concerns your physical or mental health are treated as special category health data. We process this data only for the purposes described in this policy, with appropriate safeguards and your explicit consent where that is the applicable Article 9 condition. You may withdraw consent at any time through the App settings where available or by contacting info@lyeons.com. The App does not collect payment-card details.

3. Legal basis for processing

Under the UK GDPR and, where applicable, the EU GDPR, the legal basis depends on the data and purpose:

• Contractual necessity  –  to create and manage your account, provide features you request, connect with the device, synchronise data you choose to upload, and deliver essential App functionality.
• Legitimate interests –  to operate a reliable and secure service, prevent misuse, investigate faults, understand feature performance, and improve safety and user experience, where those interests are not overridden by your rights.
• Consent – for optional features or inputs where consent is the appropriate basis, including optional wellbeing, diary, questionnaire, community, or heartbeat-scanning features.
• Special category health data – where physiological data or diary and questionnaire content reveals information about your physical or mental health, we rely on the relevant Article 6 basis above and explicit consent under Article 9(2)(a).
• Legal obligation – where processing is necessary to comply with applicable law.

Information needed to create an account, authenticate you, connect a device, or provide a feature you request is required for that feature. If you do not provide it, the relevant feature may not work. Diary, questionnaire, community, and heartbeat-scanning features are optional.

4. How we use your information

We use your information to:

• Provide and personalise the App experience
• Enable device functionality and firmware updates
• Help you track wellbeing trends over time
• Improve the App, device performance, and user experience
• Maintain a safe, respectful, and supportive community
• Respond to support requests and communicate important updates

5. Automated decision-making

LYEONS does not use automated decision-making or profiling that produces legal or similarly significant effects on users.

6. Data storage and sharing

Your data may be processed by trusted service providers supporting authentication, cloud hosting, storage and synchronisation, app diagnostics and crash reporting, customer support, and essential communications. They must process personal data only on our documented instructions and under contracts requiring appropriate data protection and security.

We do not sell your personal data. We may share data only:

• With service providers acting on our instructions
• Where required by law or regulatory authorities
• To protect the safety, rights, or integrity of users, the App, or the company

Public heartbeat sharing: if you choose to create a share link, the information related to your heartbeat scan may be accessible to anyone with the link. Share links are configured to expire after 30 days and may be revoked, but expiry or revocation may not remove copies previously viewed, downloaded, or saved by recipients.

7. Data retention

We keep personal data only for as long as it is needed for the relevant purpose, using the following periods and criteria:

• Local app data: information stored on your device remains there until you delete it, clear app data, or uninstall the App, subject to your device backup settings.
• Cloud-synchronised data: information uploaded through optional sync features is kept while your account is active and until you delete the data or request account deletion. Turning sync off stops future synchronisation but does not automatically delete existing cloud copies.
• Shared heartbeat links: share links are configured to expire after 30 days and may be revoked. Expiry or revocation may not remove copies previously viewed, downloaded, or saved by recipients.
• Diagnostics, security and support records: kept only for as long as needed to investigate reliability, security or support issues, then deleted or aggregated so they no longer identify you.
• Backups: limited copies may remain until they are overwritten or expire through the ordinary backup cycle. They are isolated from routine use and retained only for recovery, security or legal obligations.

Deleting the App or a local record does not automatically delete information already stored elsewhere. To request deletion, use the in-app account settings where available or contact info@lyeons.com. After a verified request, personal data will be deleted or anonymised unless retention is required by law or is necessary to establish, exercise or defend legal claims, prevent fraud, or maintain security. Any retained data will be isolated and used only for that purpose.

8. Your rights under GDPR

If you are located in the UK or European Union, your rights may include the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request erasure of your personal data
• Request restriction of processing
• Receive eligible data in a portable format
• Object to processing based on legitimate interests
• Withdraw consent at any time where processing is based on consent

Your right to object: where we rely on legitimate interests, you may object to that processing. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

To exercise your rights or withdraw consent, use the relevant controls in the App where available or contact info@lyeons.com. Withdrawing consent does not affect processing carried out before withdrawal.

You may also lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority, at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or with the data protection authority in the EU country where you live or work.

9. Age restriction

The LYEONS App is intended for users aged 18 years and over. By using the App, you confirm that you meet this age requirement.

10. International users and transfers

UK users are protected under UK data protection law. Where the EU GDPR applies, users in the European Economic Area receive corresponding protections. Users elsewhere receive the protections required by applicable local law.

Some service providers may process personal data outside the UK or European Economic Area. Where a transfer is not covered by an adequacy regulation or decision, LYEONS uses legally recognised safeguards, such as the UK International Data Transfer Agreement or UK Addendum and, for EU transfers, EU Standard Contractual Clauses, together with transfer-risk assessments where required. To ask for more information or a copy of the relevant safeguards, contact info@lyeons.com.

11. Security measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated within the App or by email where appropriate.

13. Contact us

If you have questions about this Privacy Policy or how your data is handled, please contact:

Email: info@lyeons.com