Privacy Policy

Privacy Notice

Effective: 9 October 2026

Introduction

Welcome to Calmspire LTD’s privacy notice. We respect your privacy and are committed to protecting your personal data.

We (“Calmspire”, “us” or “we”) operate Calmspire LTD, a digital emotional wellness platform. We are a company registered in England and Wales with company number 16429147 whose registered office is at 124 City Road, London, England, EC1V 2NX.

This privacy notice aims to give you information on how we collect and process personal data through your use of this website. We are the data controller in respect of this personal data that we collect. This privacy notice will then inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you.

We have appointed a data protection officer who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact us at hello@calmspire.co.uk.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (https://ico.org.uk/make-a-complaint/). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

This website is not intended for children, and we do not knowingly collect data relating to children.

It is important that you read this Privacy Notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Notice supplements the other notices and is not intended to override them.

The data we collect about you

We collect and process various categories of personal data in order to provide our wellness services.

The types of information we may collect include:

• Profile and Contact Information. When you create an account, we collect information such as your name, email address, phone number, username, and password. This allows us to identify you and communicate with you (for example, to send service updates or respond to support inquiries). We may also collect basic demographics (like age range, gender, or location) if you choose to provide them, to personalise your experience.
• Wellbeing Information and Sensitive Personal Data. Calmspire supports emotional wellbeing by allowing you to record information about your mood, feelings and experiences. Depending on how you use the platform, this may include mood journal entries, responses to questions and information you share through community features or using the AI mood analysis. Our mood tracking and insights features may analyse information you provide to identify patterns in your reported mood and wellbeing over time. Some information, including certain inferences generated through this process, may qualify as health data and therefore be special category personal data under data protection law. Where we process special category personal data, we will do so only where a valid condition under Article 9 of the UK GDPR applies, alongside an appropriate lawful basis under Article 6. Further information about our lawful bases and how we handle personal data is provided in this Privacy Notice.
• Usage Data. We collect data about how you use our app and services. This includes features you interact with (for example, whether you use mood tracking, journaling, or peer support forums), session duration, and frequency of use. We also gather technical information such as your device type, operating system, app version, and anonymised analytics IDs. This usage data helps us understand engagement levels and improve our platform (for instance, identifying which features are most helpful to users). It also powers certain personalised features, for example, detecting patterns in your mood over time to give tailored recommendations.
• Community and Communication Data. If you participate in Calmspire’s community features, we process the content you post or share. Forums are anonymous or use a chosen screen name; however, the content you contribute (e.g. text posts about your experiences or feelings) may contain personal data or sensitive information about you. We moderate these forums to maintain a safe environment, so our moderators (which may include AI-assisted tools and human staff) will review content to enforce community guidelines. We also collect any direct communications you send to us, such as emails or customer support messages, and any feedback you provide (like survey responses or reviews).
• Emergency Contact and Crisis Data. As part of our real-time intervention tools, you may choose to provide contact information for a trusted person (e.g., a family member or friend) to be alerted if you need support, or when the check in feature identifies that you are on “red” in the traffic light system. If our platform detects that you might be at serious risk, we will collect and use the relevant data to initiate support, which might include contacting emergency services or your designated contact. We will only process this data in critical situations and in line with applicable laws to protect vital interests (more on this in Lawful Basis section).
• Third-Party Data Integrations. With your permission, Calmspire can integrate with other tools to enhance your wellness profile. For instance, you might sync data from a wearable device or health app (such as a smartwatch or fitness tracker) with Calmspire. If you choose to do this, we will collect data from that third party, for example, your daily step count, heart rate, sleep patterns, or other relevant wellness metrics, to incorporate into your Calmspire experience. Such data can help provide a more holistic view of your wellbeing (e.g., correlating mood with physical activity or sleep). Any health-related metrics from wearables also count as special category data and will be handled with the same care and consent requirements.
• Marketing and Newsletter Data. If you subscribe to our newsletter or opt in to receive promotional communications, we will collect your name, email address, and communication preferences. We use this to send you news about Calmspire’s product updates, mental wellness tips, events, or offers. We aim to make these communications engaging and relevant, for example, by tailoring content to topics you’ve shown interest in. You can opt out of marketing emails at any time by using the unsubscribe link in the message or contacting us. (Note: We do not use sensitive mental health data for marketing purposes; marketing communications are based on your general contact info and preferences, not your personal wellness data). According to our business plan, building an email list of interested users and sending customised wellness newsletters is part of our user engagement strategy.
• Website Browsing Data (Cookies). When you visit our website (www.calmspire.co.uk), we may use cookies and similar tracking technologies to collect certain information automatically. This can include your IP address, browser type, pages viewed, and referring website. Cookies help us operate our site (e.g., keeping you logged in, remembering preferences) and understand how visitors use it. We may also use analytics tools that set their own cookies, to gather aggregated usage statistics. Our Cookie Policy provides details on what cookies we use and your choices. You can manage cookie preferences through your browser settings.

No collection of children’s data

Our services are intended for adults and older teens seeking mental wellbeing support and are not directed at children under the age of 18. We do not knowingly collect or process personal data relating to children.

If we become aware that we have inadvertently collected personal data from a child without appropriate consent or legal basis, we will take reasonable steps to delete such data as soon as possible.

If you believe that a child’s data may have been provided to us in error, please contact us immediately at support@calmspire.co.uk.

Special category data

Some of the personal information you provide or that we process through Calmspire is about your mental wellbeing or physical health, for example, your mood journal entries, self-reported symptoms, or any information revealing your emotional state. Under the UK Data Protection Act 2018 and UK GDPR, this is considered “special category” personal data (sensitive data) because it pertains to your health.

We understand the highly sensitive nature of this data and apply safeguards to protect it, including:

• Explicit Consent. We will only process your mental wellbeing information with your explicit consent. When you sign up and provide such data, we make sure you are aware of what data you are sharing and ask you to agree to our handling of it for the purposes described. You have the right to withdraw this consent at any time (which will generally mean we will stop processing that data for the specified purposes going forward). However, note that withdrawing consent for core wellness data might limit our ability to provide certain features of the service to you.
• Confidentiality. All special category data you provide is treated as confidential. For instance, posts in the peer support forums or community are kept anonymous or under a pseudonym. Our team members who have access to personal data (such as support staff or moderators) are bound by strict confidentiality obligations. We limit access to sensitive information strictly to personnel who need it to operate the service (for example, trained moderators for the forums, or engineers addressing a user-reported issue).
• Encryption and Security Measures. We implement security to protect all personal data, especially sensitive data. This includes end-to-end encryption for data in transit and at rest on our systems. For example, messages or content in the peer support forums or community and any crisis alerts are encrypted so that only intended recipients can read them. We use industry-standard encryption protocols to prevent unauthorised access. Calmspire’s cloud infrastructure is designed with GDPR-compliant security controls and undergoes regular testing and updates. (While we cannot detail all security measures here for security reasons, they include firewalls, access controls, and monitoring for potential vulnerabilities or breaches.)
• Data Minimisation. We only collect data that is relevant and necessary for the purposes of providing our services and supporting your wellbeing. This means our in-app surveys or prompts will only ask for information that genuinely helps personalise your care or ensure your safety. If certain sensitive details are not needed, we won’t collect them. We also strive to present you with options, you can often choose how much detail to share in a journal or whether to skip a question, putting you in control of your information.

By handling special category data with such care, we aim to provide you with a trustworthy platform. User privacy and safety are core to Calmspire’s mission and value proposition, and we understand that maintaining your trust requires rigorous data protection.

How we use your personal data

We use your personal information to operate, improve, and personalise our services, as well as to support you in your mental wellness journey. Below are the specific purposes for which we process data, along with examples for clarity:

• Providing and Personalising the Service. We use collected data to deliver the core functionality of the Calmspire app. This includes creating and managing your account, remembering your preferences, and presenting content tailored to you. For example, if you regularly report feeling unhappy in the evenings, our AI might suggest a calming exercise at that time. We also analyse your in-app activities and mood trends to personalise your experience, such as adjusting the content in your feed or recommending specific self-care routines that fit your needs.
• Mood Tracking and Insights. Calmspire helps you track your mood and uncover trends over time using our AI mood check-in feature, your journal entries, survey answers, and app activity. For instance, if the app notices your mood drops after a restless night, it might recommend sleep-focused wellbeing content. Calmspire is designed purely for general wellbeing and does not provide medical diagnoses or assessments. If you haven't checked in recently, we may send you a gentle reminder. You can easily turn these notifications off in your settings at any time.

Legal basis: Consent - we rely on your consent to analyse your mental wellbeing data for these purposes. You can choose not to use the mood tracking features if you prefer.

• Peer Support/Community Features. If you engage with our anonymous peer support forums, we process your posts, comments, and interactions to facilitate the community. This includes displaying your contributions to other users (under your chosen alias) and sending you notifications (e.g., if someone responded to your post). We also moderate the content to keep the environment safe and supportive, using a combination of automated tools and human review to detect posts that might violate guidelines or indicate someone is in crisis.

Legal basis: For providing the forums and processing your posts, contractual necessity (to provide the service you’ve chosen to use) and consent (you choose to post and thus consent to that information being seen by others in the forum). For moderation and safety checks, our basis is legitimate interests, we (and our user community) have a legitimate interest in ensuring the forums remain a safe space free from harassment or harmful content. When a post contains special category data (like you discussing your health), we treat your act of posting as an implicit consent to make that information public to the community, but we still protect it within the app’s confines (the forums are members-only). You can delete your posts at any time, and we will remove them from view.

• Crisis Intervention and Safety. We offer support features such as wellbeing companion notifications. We use your data to detect when you might need urgent support, for example, unusually low mood scores combined with certain keywords in a journal entry. If you or an automated system prompt an alert, we will use relevant personal data to initiate an intervention. That could mean alerting a pre-designated wellbeing companion you’ve identified or connecting you to emergency resources.

Legal basis: We rely on vital interests as the lawful basis in emergency scenarios. For less urgent proactive check-ins, we rely on legitimate interests (our interest in preventing harm to our users) combined with explicit consent you’ve given for us to track your wellbeing. We will always try to involve you in decisions (e.g., asking permission to alert your wellbeing companion). Note that crisis handling may involve sharing data with third parties like emergency responders, see Data Sharing below.

• Service Improvement and Analytics. We continuously strive to improve Calmspire. We use aggregated and anonymised data about how users interact with our app to identify trends and areas for enhancement. For example, analysing which features are used the most or where users tend to drop off can guide us in making the app more engaging and effective. We might analyse data to answer questions like, “Do users who use the journaling feature report better outcomes?” These analytics help us refine our content, fix bugs, and develop new features that align with user needs. Wherever possible, we use this data in a form that does not directly identify individuals (e.g., general usage statistics).
• Communications and Customer Support. We use your contact information to send you important service-related communications. These include confirmations, technical or security alerts, and updates about changes to our terms or privacy policy. Such communications are necessary for our contractual relationship, and you cannot opt out of receiving them as long as you have an account (except by deleting your account). If you reach out to our support team with a question or issue, we will use your name, email, and the content of your request to assist you. We may also reach out to gather feedback on your experience (for instance, an in-app survey asking how satisfied you are with a new feature).
• Marketing and Engagement. If you have opted in, we use your data to send marketing materials such as our wellness newsletter, promotional offers, or event invitations. These emails might include general tips for mental well-being, news about app features, or promotions. We strive to tailor content to be relevant, for example, if you’ve shown interest in mindfulness, we might highlight new meditation content. We also might use certain non-sensitive data to target or personalize ads (for instance, showing you a Calmspire promotion on social media if you visited our website).
• Compliance and Legal Obligations. Finally, we may process personal data as needed to comply with our legal obligations or to exercise legal rights. This can include maintaining records required by law, responding to lawful requests from authorities, or using data to investigate and prevent fraud or misuse of our services. For example, if required, we might retain certain transaction records for tax or accounting purposes, or we might process data to comply with UK laws on medical device reporting if our features were considered regulated (currently, our app is not a certified medical device, but we abide by relevant guidelines). Also, if you exercise your data protection rights (such as requesting a copy of your data), we will use your information to fulfil those requests.

We will not use your personal data for purposes that are incompatible with the above, unless we obtain your permission or are required/allowed by law to do so. We do not sell your personal data to third parties. We also do not use your personal information to make any solely automated decisions with legal or similarly significant effects on you, without human involvement. Any profiling we do (such as analysing your mood data) is intended to benefit your wellness journey and is conducted with appropriate safeguards, and as noted, either with your consent or under an allowed legal basis. If in the future we introduce more advanced automated assessments, we will update you and ensure compliance with applicable rules (UK GDPR has special provisions for automated decision-making, especially with special category data, so we would only proceed in line with those requirements).

Lawful basis for processing

Under data protection laws (including the UK GDPR), we must have a valid lawful basis for each use of your personal data. We have described the bases in the section above alongside each purpose, but here we summarise the key legal grounds we rely on:

• Consent: We rely on your consent, particularly for processing special category data about your mental wellbeing. By providing information like your mood journal or linking a health app, you are giving us explicit consent to use that data to support your wellbeing. We also obtain your consent for optional activities, such as receiving marketing emails or connecting Calmspire to third-party services. Where we rely on consent, you have the right to withdraw it at any time. Withdrawing consent will not affect the lawfulness of processing done previously, but it means we will stop the specific processing going forward. For example, if you withdraw consent for us to process your mood data, we will stop analysing new mood entries (though we may need to retain past data if required for legal reasons or to maintain service integrity, unless you request deletion).
• Explicit Consent: Because information about your mental well-being may be sensitive, we make sure to obtain explicit consent for this data. This might involve you ticking an additional checkbox or otherwise clearly affirming that we may process your mental wellbeing-related data for the purposes of providing the service. As noted by regulatory guidelines, handling mental wellbeing app data mandates transparent notices and explicit user permission. If at any point you are uncomfortable with our use of your mental wellbeing information, you can manage your consent in the app settings or contact us to discuss options. We want you to feel in control of your data.
• Contractual Necessity: When you sign up for Calmspire and agree to our Terms, a contract is formed. We need to process certain basic personal data to perform this contract, for example, using your login credentials to authenticate you, or processing the data you input to actually deliver the features you request (like showing your journal entries back to you, or calculating your mood trends). If you are an institutional user (e.g., your employer provides Calmspire access), the contract might be slightly different (it could be tripartite or via your employer), but similarly, we process data to provide the agreed service. Without this data, we cannot fulfil the core functionality of Calmspire.
• Legitimate Interests. We process some data under the basis of legitimate interests, either ours, yours, or a third party, provided those interests are not overridden by your data protection rights. We have a legitimate interest in improving our app, ensuring IT security, preventing abuse, and providing a supportive community environment. For instance, it’s in our legitimate interest to monitor for fraudulent or malicious activity on our platform (to protect both our business and users). It’s also in our interest to analyse usage patterns to make Calmspire better. When we rely on legitimate interests, we carefully consider the potential impact on you. We do not use this basis for any processing that involves special category data unless it’s coupled with additional safeguards or conditions (since generally, special category data requires a higher standard, e.g., even if we have a legitimate interest in analysing mental wellbeing trends, we will still seek explicit consent due to sensitivity). One example is forum moderation: we have a legitimate interest in reviewing content to prevent harm, but if any sensitive details are involved, we handle them confidentially and only for that protective purpose.
• Legal Obligation. In certain cases, we must process data to comply with a legal obligation. This could include retaining certain information for tax/regulatory compliance or responding to lawful data requests. Another context is health and safety laws, for example, if a user is in imminent danger, we might have obligations under duty of care principles to act. While Calmspire is not currently a regulated medical service, we align with health data protection standards which effectively treat user safety as paramount. Any mandatory disclosures or processing under legal obligation will be done only after verifying the request or requirement and ensuring it’s lawfully valid.
• Vital Interests (Article 9(2)(c), with Article 6(1)(d)). This basis is used to protect someone’s life in emergency situations. If we believe that you or another person is at risk of serious harm or death (for example, you express intent of self-harm and become unresponsive in the app), we may process and share necessary data under the “vital interests” basis. This can allow us to contact emergency services or your emergency contact without consent, if obtaining consent is not feasible in the moment. This is in line with data protection laws, which permit using personal, and even special category data to save a life in emergencies when you cannot consent. We will only invoke this basis in extreme circumstances.
• Substantial public interest (Article 9(2)(g)). This basis is used where processing is necessary to safeguard people at risk, as permitted by Schedule 1 of the Data Protection Act 2018.

Our default approach is to ask for your consent for anything sensitive or unexpected, and otherwise use your data only as needed to provide the service you signed up for or to meet legitimate needs in a way that respects your privacy. If you have questions about the legal basis for a specific processing activity, please reach out to us support@calmspire.co.uk. We can provide more detail on how decisions are made in line with these principles.

Data sharing and disclosure

We treat your personal data with care and do not share it with third parties except in the following circumstances, and only to the extent necessary:

• Service Providers (Processors). We employ trusted third-party companies to perform certain functions on our behalf in order to run our services. These include, for example, cloud hosting providers (to store and process data securely), data analytics services, email delivery services (to send out verification or newsletter emails), and customer support platforms. These service providers act under our instructions and are bound by data processing agreements to handle your data confidentially and securely. They are not allowed to use your information for their own purposes. We ensure all our processors comply with applicable data protection laws.
• Partner Organisations. If you are using Calmspire through a partnership (such as an offering by your employer, university, or a healthcare organisation), we may share certain data with that partner organisation as needed to fulfil the service for you. For example, if your university has provided Calmspire to students, we might provide the university with aggregated usage statistics or outcomes (like overall student stress-level improvements) to demonstrate the program’s effectiveness. In some cases, with your agreement, we might share identifiable information, e.g., if the service involves referring you to campus counselling, and you consent, we could share your contact details or a summary of your wellbeing status with a designated counsellor. By default, however, we will not share your personal journal entries or specific sensitive information with your institution or employer without your explicit consent. Any data sharing with partners will be made clear to you through the program’s terms or within the app. When we act as a processor for an institutional client, that organisation controls what data is requested from you and who can see it – we simply facilitate the service. We encourage you to also review the privacy notice of the organisation providing you access to Calmspire, as it may have additional details on their handling of your data.
• Emergency Services and Crisis Helpers. If as part of our crisis intervention features, we determine there is a serious and imminent risk to your health or safety (or someone else’s), we may share necessary information with emergency responders or other professionals. For example, if our system flags a credible suicide risk situation, we might contact emergency medical services (dialling 999 in the UK, for instance) and provide them with data like your location (if known), your age, and information about the situation (e.g., “user has expressed intent to self-harm, last activity within our mental wellbeing app indicates severe distress”). We may also reach out to a wellbeing companion you have on file. We will limit what we share to only what is needed to obtain help, typically, this might be some of your identifying information and a brief description of the concern. This kind of sharing is done under the vital interest/legal necessity basis discussed above, and only when truly warranted. We document any such disclosures and handle them with utmost sensitivity.
• Law Enforcement or Legal Requests. We may disclose personal data when required to do so by law or in response to valid requests by public authorities. If we receive a court order, subpoena, or warrant, or an order under applicable law compelling the disclosure of user data, we will assess its validity and scope carefully. If we have a good-faith belief that disclosure is necessary to comply with a legal obligation or to protect our rights or the rights, property, or safety of our users or others, we may disclose the requested information. For example, this could occur in situations involving investigation of fraud, security threats, or if mandated under public health laws (though that’s unlikely for us as a private wellness service). Wherever possible and lawful, we will notify users about such requests before disclosing their data (for instance, if a government seeks access to your data, we might give you notice and a chance to object, unless we’re legally barred from doing so).
• Business Transfers. If we undergo a business transaction such as a merger, acquisition by another company, or sale of some or all assets, user personal data might be among the assets transferred. Should this happen, we will ensure that the new owner will continue to respect your personal data in line with this Privacy Notice (or we will provide notice if any changes to processing are proposed). We will also notify you, via the app or email, of any change in ownership or use of your personal data, as well as any choices you may have regarding your information as a result.
• Professional Advisors. We may share information with our professional advisors (lawyers, accountants, auditors) on a need-to-know basis. For example, during an audit or due diligence process, limited data might be reviewed under strict confidentiality, or legal counsel might review particular instances of data handling to provide us advice. Such sharing will be governed by duties of confidentiality.
• Aggregated or Anonymised Data. We may share aggregated, anonymised information publicly and with third parties. For instance, we might publish a report or insights about mental wellbeing trends (e.g., “X% of our users reported improved mood after 4 weeks”). This data will not identify any individual and is used to highlight the effectiveness of our platform or contribute to mental wellbeing research. In some cases, we might collaborate with academic or clinical researchers; if that involves any of your identifiable data, we would only do so with your consent or after anonymising the data.

We do not sell personal data to third-party companies for their independent marketing or business purposes. We also do not share your content from the app (like your journal entries or forum posts) with social media or advertisers. Any third-party content sharing (for example, if you choose to share a quote or achievement from Calmspire to your own social feed) is under your control.

Whenever we share data with third parties, we ensure its protected. Our contracts with processors impose strict data protection standards. We also review third parties’ security practices. If you’d like more details about third parties we use, feel free to contact us for a current list of our key sub-processors or partners.

International data transfers

Calmspire is based in the United Kingdom. Our main hosting infrastructure is located in the EU, and the UK recognises the EEA as providing an adequate level of data protection. Where personal data is transferred outside the UK, we make sure it is protected by the safeguards described in ‘International transfers’ below.

Where a transfer of personal data is subject to the UK GDPR's international transfer rules, we will ensure that the transfer is permitted under applicable data protection law. Depending on the destination and the circumstances of the transfer, this may involve:

• Adequacy regulations: Transferring personal data to countries or territories covered by applicable UK adequacy regulations, where the relevant conditions are met.
• Appropriate safeguards: Where an adequacy regulation does not apply, using an appropriate safeguard where required, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another legally recognised mechanism. Where required, we will assess the risks associated with the transfer and implement any additional measures necessary to protect personal data.
• Specific exceptions: Where appropriate safeguards are not available or applicable, relying on a statutory exception only where the relevant legal conditions are satisfied.

We will also take appropriate steps to protect personal data when working with service providers and other organisations involved in delivering our services.

You can contact us at support@calmspire.co.uk to request further information about international transfers involving your personal data and the safeguards applicable to those transfers. We will provide information or copies of relevant safeguards where legally permissible.

Personal data processed in another country may be subject to the laws of that country, including laws permitting access by public authorities. Any access request or disclosure will be handled in accordance with applicable law.

Data security

Key security practices include:

• Encryption. We use strong encryption protocols. All data transmitted between your device and our servers is encrypted. Within our systems, sensitive fields are encrypted at rest. For particularly sensitive features like community, peer support messages or crisis alerts, we use end-to-end encryption, meaning the data is encrypted in such a way that not even Calmspire staff can read the raw content without specific authorisation. This ensures privacy even in the event of network interception or other threats.
• Access Controls. We limit access to personal data strictly to authorised personnel who need it to perform their job. Different parts of data are compartmentalised, for example, an engineer troubleshooting a technical issue might see error logs with user IDs, but not the content of your journal entries. Administrative access to systems requires multi-factor authentication. We also maintain an audit trail of who accesses sensitive data and when, to detect any improper access.
• Secure Infrastructure. We utilise modern cloud infrastructure known for its security features. We take advantage of built-in security services like firewalls, network isolation, and continuous monitoring. Regular backups are made to prevent data loss, and those backups are encrypted.
• Testing and Compliance. We conduct routine security assessments, including vulnerability scanning and penetration testing by qualified experts, to uncover and fix potential weaknesses. Our development process includes code reviews and security testing for new features. We follow industry best practices and frameworks for cybersecurity.
• Incident Response. We have a data breach response plan in place. This means if there is any suspected or actual security incident involving personal data, we will respond promptly to contain it, investigate the scope and cause, and mitigate any harm. In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority (e.g., the UK Information Commissioner’s Office) within 72 hours, and inform affected users without undue delay, as required by law. We will also take steps to prevent future recurrence.
• User Responsibilities. We also urge you to take steps to protect your own data security. Use a strong, unique password for your Calmspire account and do not share it with others. Be cautious about what you share in the community forums (remember that even though they are anonymous within the app, you should avoid posting personal identifiers). If you suspect any unauthorised access to your account, let us know immediately.

For additional information on our security practices, you may contact us at hello@calmspire.co.uk.

Data retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law. In practice, this means:

• Account data. We keep your account information and the data you create in Calmspire for as long as your account is active. You can delete your account at any time in the app settings or by contacting us at support@calmspire.co.uk. We will delete your personal data within one month of your request or tell you if we need more time. We may keep limited information where the law requires it, for example (payment records for tax purposes) or where needed to deal with legal claims, and only for as long as necessary.

If you do not log in for 24 months, we will email you at your registered address to let you know your account will be closed in 30 days unless you log in. After that, we will delete your personal data. Deleted data is removed from our backups, and we ask our service providers to delete it too.

Where we keep information for statistics or service improvement, we first remove anything that could identify you, so it can no longer be linked to you.

• Wellness Journals and Content. Content you create is stored for your reference and our service delivery. If you delete a specific entry or post, it will no longer be visible in the app; we then proceed to remove or anonymise it on our servers within a short period, unless it is subject to a legal hold (e.g., related to an investigation) or it was flagged and needs to be kept longer for safety reasons (we would inform you if that’s the case, unless we’re legally prevented). If you delete your account entirely, all your personal content and data will be deleted or anonymised in our production systems, with the exception of any data we are required to keep longer (see below).
• Analytics Data. Aggregated analytics or log data may be retained to help us improve the service, but this data will not be identifiable to you personally once your account is deleted. We often strive to aggregate or anonymise usage data as soon as possible, and we may keep such data indefinitely since it no longer refers to an individual.
• Communications. If you contact support or send us communications, we may retain those communications for a period of time in case we need to reference them. Customer support records are kept for a few years unless you request their deletion sooner and we have no ongoing need for them. We keep them to understand past issues you faced or for training and quality purposes.
• Legal Requirements. We might need to retain certain data for compliance with legal obligations or dispute resolution. If we had to address a safety incident or received a legal order, we would keep the relevant data as long as necessary to cooperate with law enforcement or to resolve the matter. Also, if you exercise a right like opting out of marketing, we may need to keep a minimal record of that request to ensure we honour it going forward.

We aim to outline specific retention periods where feasible, but these may vary based on context and evolving legal standards. In setting retention, we consider the sensitivity of the data, the potential risk of harm from unauthorised use, the purposes of processing, and whether those purposes can be achieved by other means.

Once the retention period expires or the purpose is achieved, we will delete or irreversibly anonymise the data.

If you have questions about how long we keep a particular type of data, please contact us. We can provide more details tailored to your situation.

Your legal rights

Under certain circumstances, you have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This allows you to have any incomplete or inaccurate data corrected, although we may need to verify the accuracy of new information provided.
• Request erasure of your personal data. You can ask us to delete or remove your personal data where there is no lawful reason for us to keep it. This right also applies where you have successfully objected to processing, where your data has been unlawfully processed, or where we are required to erase it to comply with legal obligations. Please note that we may not always be able to comply with your request for specific legal reasons, which we will explain at the time.
• Object to processing of your personal data where we rely on a legitimate interest (or those of a third party) and you feel it impacts your fundamental rights and freedoms. You also have the right to object where we process your personal data for direct marketing purposes. In some cases, we may demonstrate compelling legitimate grounds that override your objection.
• Request restriction of processing of your personal data in the following situations:
• if you want us to verify the data’s accuracy;
• where our use is unlawful, but you do not want us to erase it;
• where you need us to retain the data to establish, exercise or defend legal claims; or
• you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds.
• Request the transfer of your personal data to you or to a third party. We will provide your data in a structured, commonly used, machine-readable format. This right only applies to data processed by automated means under your consent or to perform a contract.
• Withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of processing before the withdrawal. If you withdraw your consent, we may be unable to provide certain services. We will inform you of this at the time, if applicable.

If you wish to exercise any of the rights set out above, please contact us at support@calmspire.co.uk

We may need to verify your identity before executing certain requests, to ensure we do not disclose or delete data to the wrong person. Verification might involve confirming details we already have on file or requesting additional information as needed.

If you are accessing our app via an institutional provider (like your employer or university), some of these rights might also need to be exercised through that organisation if they are the primary data controller. We will assist you and the organisation in handling such requests.

Finally, you also have the right to lodge a complaint with a data protection supervisory authority if you believe we have processed your data unlawfully or have not upheld your rights. In the UK, this is the Information Commissioner’s Office (ICO).

Time limit to respond

We aim to respond to all legitimate data subject requests within one calendar month.

If your request is particularly complex or if you have made multiple requests, we may need additional time to respond. In such cases, we may extend the response period by up to two further months, as permitted under the UK General Data Protection Regulation (UK GDPR).

If an extension is necessary, we will notify you within the initial one-month period and keep you informed of our progress throughout.

Changes to this privacy notice

This version of the Calmspire Privacy Policy was last updated in October 2026.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

We may update this privacy notice from time to time. If we make material changes to how we collect, use, or share your personal data, we will notify you either by:

• Email (if you have provided one), or
• A prominent notice on our website

We encourage you to review this policy periodically to stay informed about how we are protecting your data.