Last updated: 28 July 2026
This Privacy Notice explains what data Asclepiad holds about you, what we do with it, and what you can ask us to do with it. The controller is Asclepeion Ltd (Company No. 15830285, England and Wales; ICO registration ZB723138).
We do NOT collect: your real name, email address, full date of birth, exact age, address, phone number, or biometric identifiers.
Asclepiad uses the following third-party services. All are contractually bound not to train on your content:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Account and transcript storage | UK |
| Anthropic Ireland, Limited | Language model — generates AI character replies | Ireland |
| ElevenLabs | AI voice synthesis; transcription of spoken reflections | US |
| Cloudflare | Edge processing and audio storage | Global |
| PostHog | Anonymised product telemetry | EU-hosted |
| Sentry | Crash reports (PII-scrubbed) | US |
| RevenueCat / Apple / Google | Subscription billing | US |
Everything is encrypted in transit (HTTPS / TLS 1.2+) and at rest (Supabase AES-256 for the database; Cloudflare R2 server-side encryption for audio recordings). Asclepiad does NOT apply end-to-end encryption — the AI characters must be able to read your text to generate their replies.
| Data | Retention |
|---|---|
| Voice recordings | 30 days, then deleted automatically |
| Transcripts and insights | Until you delete your account |
| Personalization notes | Until you delete your account |
| Synicon recipient records | Until you archive the recipient + 90 days, then deleted |
| Subscription state | Until you delete your account |
| Coin transaction records (amounts and timestamps) | Kept after account deletion in anonymised form — no link to you — for accounting and chargeback obligations |
| Crash reports | 90 days |
| Product telemetry | 12 months |
| Consent records (timestamp, version, scope) | 7 years post-deletion, anonymised |
We use your data to deliver the service to you. We do not sell it. We do not use it for marketing. We do not use it to train AI models. We do not share it with advertisers or data brokers.
Which basis we rely on depends on what we are doing. To provide the service you signed up for — your account, your sessions, and the reflections and stories we generate — our basis is performance of our contract with you. To send your words to the AI services that generate those replies, our basis is your consent, which we ask for separately and which you can withdraw at any time by contacting us. To keep the service working and secure — crash reports, error logs, abuse prevention — our basis is our legitimate interests, weighed against your rights. To keep consent records for the period set out in section 3, our basis is our legal obligation and our legitimate interest in defending legal claims.
The voices you hear — Maia, Hortus, and the other Asclepiad characters — are AI. They are generated by language models and voice-synthesis services. They are not human. They are not clinicians. They are companions for reflection — not therapists, not doctors.
Asclepiad does not currently run automated analysis of your reflection content to detect crisis or distress signals. Your safety net today is a visible SOS option, available throughout every session, offering country-appropriate crisis resources whether or not you use it. This is for your safety; it is not clinical care. If automated detection is added in future, we will update this notice before it goes live.
Under UK GDPR you can:
Note: individual session records are kept together as part of your reflection history. Account deletion removes all of it. We do not currently support deleting one session at a time. When you delete your account, all content and metadata are removed; consent records are retained anonymously for seven years for legal compliance (UK Limitation Act 1980), but contain nothing that can identify you.
Your data may be processed in the United States. We use UK International Data Transfer Agreements (IDTAs) and EU Standard Contractual Clauses (SCCs) for all such transfers.
Asclepeion Ltd
Company No. 15830285 (England and Wales)
ICO registration: ZB723138
compliance@asclepeion.org