Privacy Policy

1. Who we are and how to contact us

MyPKU (“we”, “us”, “our”) is operated at mypku.co.uk. We are the data controller for personal data processed through MyPKU. This policy covers the MyPKU website and the MyPKU mobile app.

Legal entity: MyPKU Ltd, a company registered in England and Wales (Company No. 17196934). Registered office: International House, 55 Longsmith Street, Gloucester, GL1 2HT, United Kingdom. We are registered with the Information Commissioner's Office (registration number ZC139351).

For any question about your data, including a request to see, correct or delete it, email privacy@mypku.co.uk. If you are worried about who can see a record kept for someone else, email support@mypku.co.uk (see section 5).

We have not appointed a statutory Data Protection Officer (DPO) under UK GDPR Article 37, because we have assessed that the conditions that require one are not currently met. We will review this if the scale of our processing changes.

You can also contact the UK Information Commissioner's Office (ICO): ico.org.uk

2. The short version

• MyPKU is a diary for people with PKU and the people who help them.
• We only collect health information with explicit consent. If you keep a record for someone else, such as your child, you give that consent for them. If you withdraw consent, you choose whether to delete your health records straight away or keep them stored without adding new entries.
• Your account, records and photos are stored in the UK. We do not sell your data, use it for advertising, or use it to train AI models.
• Only the people you choose can see a record, and you can remove them at any time.
• Community posts can be seen by other members. A post is only visible outside MyPKU if you turn on sharing for it. Photos work differently: see section 7.
• You can download or delete your data at any time from your profile.

3. What information we collect

Account details. Your email address, your first and last name, and your password when you register. We use your name only to run your account and we never show it to other members. Your password is handled by Amazon Cognito and we never see it. If you turn on two-step verification, Cognito also holds the link to your authenticator app.

Profile details. Your community name (we give you a random one, such as “GentleBirch391”, until you choose your own). This is the name other members see. If you choose to give them, your gender, date of birth and a profile picture. To keep a record for someone else or to accept access to one, you need to give your date of birth so we can check your age (section 5). We no longer collect a postal address or phone number for your profile.

Health information (special category data). With your explicit consent:

• your PKU type and the date you were diagnosed
• your daily Phe or exchange allowance and the diary range you set
• your blood Phe results (date, value, unit, sample type, method and any notes)
• your daily exchange records (the exchanges you log, the day they count towards, when you had them, and any note you add)

Records you keep for someone else. If you add a person you look after, we keep their name, their date of birth (if given) and the same kinds of health information listed above. We also keep who has access to their record, who added each entry, and the consent and declaration you gave for them. See section 5.

Invitations. If you invite someone to help with a record, we keep the email address you give us until they accept or decline, or the invitation runs out after 14 days.

Community content. Posts, comments and photos you publish, and whether you have turned on sharing for each post. The web address of a photo added from October 2026 is random and contains no account identifier. Older photo addresses contain an internal account identifier, which is not your name or email address. Anyone who is given the address can open the photo (section 7).

Foods you add. If you are a food contributor, the food entries and photos you add to the MyPKU food database. Members see them with your community name.

Subscription details. Your plan, how many people it covers, who it covers, and its status. Payments are taken by Stripe (on the website) or Google Play (in the Android app). We never see or store your card details.

Shop orders. Your name, email address, shipping address, what you ordered and how much you paid, so we can send your order and handle returns.

Technical information. Your IP address, browser or device type, and the pages and features you use. Our servers log these to keep MyPKU working and secure.

What you need to give us. We need your email address and a password to create an account. Everything else is optional unless a feature needs it, for example a date of birth for the age checks in section 5, or health information for the diary. If you choose not to give it, that feature will not be available.

Where we get your information from. Mostly from you. We also get information from:

• a parent or guardian, about a person they look after (section 5);
• an owner, who gives us the email address of someone they invite, or of a young person they hand a record to;
• Stripe and Google Play, which tell us the status of a subscription and, for the shop, the details of an order;
• food data sources, about the products you look up (section 9).

4. How we use your information, and our lawful basis

UK data protection law says we need a lawful basis for each use of your data, and an extra condition for health information.

Where we rely on legitimate interests, we have checked that our interest does not override yours. For a person whose plan cover has ended, we give particular weight to the interests of any child involved: the notice names the payer by community name only and records are not affected. For an invited person, for example, we use the address only to send one invitation and to check that the person accepting it is the person invited. The email says who invited them, what it is about and how to say no.

5. Keeping a record for someone else (family accounts)

MyPKU lets you keep a PKU record for someone else, and share a record with people who help. In the app and on the website you can switch between the people whose record you can see. Owners and carers can add, edit and delete entries for the people they look after, and viewers can only read. You can add people, invite others, hand a record over and remove people in the app (People) or on the website (Family). Invitations and hand-overs addressed to your verified email address are also listed in the app, so you can accept or decline them there without the link.

Who it is for

• A person you look after. Usually a child. You add them to your account and they have no login of their own. One account can look after up to 20 people.
• An adult you help. Someone with their own MyPKU account can share their own diary with you. They stay in charge of it and can remove you at any time.

Age checks

• We record each change to the date of birth on your own profile (the old and new date, and when) for 2 years, so that repeated changes made to pass an age check can be seen. It is deleted with your account.
• To add a person you look after, you must be 18 or over. We check this against the date of birth on your own profile, so you need to have entered it.
• Only someone with parental responsibility for the person can add them. When you add them, you choose whether you are their parent, their legal guardian or someone else with parental responsibility, and tick one box to confirm it and to consent to us keeping their health information. We record who ticked it, when, the capacity you chose, and which version of this policy and of that wording applied. Anyone else who helps, such as a grandparent or childminder, joins as a carer when you invite them.
• To accept an invitation as a carer you must be 18 or over. To accept one as a viewer you must be 16 or over. Again, we check your profile date of birth.
• A person can take over their own record from 16 (see below).

We do not use an outside identity or age-checking service. We rely on the dates of birth and declarations you give us, and on the safeguards below if something is wrong.

Who can see and change a record

Anyone with access can remove their own access at any time, except that a record must always have one owner. The owner can remove anyone else. Removal takes effect straight away.

What the people on a record can see about each other

• Each entry shows who added it, by community name. We never show your email address to carers or viewers.
• Everyone with access can see a list of who has access, with their role and dates, including people who used to have access. The owner also sees the email address of anyone invited, and of anyone with access who has not set a community name. Others see “Pending invitation” instead of an invited person's address.
• We keep this access history for as long as the record exists, so a parent can always find out who could see their child's record and when. After a hand-over, the young person can see this history. If someone with access deletes their MyPKU account, their name and email address are removed from the history and they are shown as “Former carer”. When an invitation is declined, cancelled or runs out without being accepted, the invited email address and link code are deleted and only the fact of the invitation stays. After a hand-over, the names and email addresses of the people who lost access are removed from the history too.

Invitations

• Only the owner can invite people. We email the invitation to the address you give us. You are also shown the invitation link, so you can pass it on yourself. Either way, it works only for an account with that email address, and only once.
• In the app, invitations and hand-overs sent to your verified email address are also listed on the People screen. We match them by that address only, and show an invitation to no one else.
• The email gives the inviter's community name in quotes, as a name they chose that we do not check (or a general phrase if they have not set one), and the name of the person the record is about. Names that could be mistaken for MyPKU or its staff are not allowed.
• To invite someone you need a verified email address, a date of birth on your profile and health data consent on the record. You must be 18 or over to invite people to a record you keep for someone else, and 16 or over to invite people to your own record. We send each email address at most 3 of these emails a day, and limit the total we send.
• An invitation runs out after 14 days. When it is accepted, declined or runs out, we delete the invited email address from it. You can cancel an invitation at any time before it is accepted. You can send up to 10 invitations a day. Asking an adult to take over a record counts towards the same 10.

Handing a record over at 16

• When the person is 16 or over (by the date of birth on their record), the owner can hand the record over to them. We email them a link that works only for their email address and runs out after 14 days. We also email everyone else with access to say a hand-over has started. That email has no link and does not give the young person's address.
• The young person accepts from their own account, in the app or on the website. From that moment the record is theirs: everyone else loses access, pending invitations are cancelled, and the young person decides who to share it with. They must tick a box to consent to MyPKU holding the record as their own before they can accept. We record that consent, the date and the policy version. They can withdraw it at any time, even if they have not set up a profile.
• Once a date of birth is saved on a record you keep for someone else, you cannot change it, because hand-over and the age checks depend on it. If it is wrong, email support@mypku.co.uk. We correct it, record why, email everyone with access to say it was corrected, and cancel any hand-over that was waiting.
• If they already keep a diary on MyPKU, we show them what will be added and how many people can already see their diary (not who), and only combine the two if they confirm. We keep the record of who consented for the handed-over person, when, and in what capacity, on the combined record. The people who can already see their diary can then see the combined entries too.
• A hand-over cannot be undone.

Removing a person, or deleting your account

• If you are the owner and want to stop keeping someone's record, you choose either to hand it to another adult or to delete their record completely. The adult must already have owner or carer access, and must accept and confirm that they have parental responsibility for the person. This is the same declaration as when adding a person, and we record the capacity they chose and the version of the wording. Until they accept, the record stays with you and you cannot delete your account. A request lapses if it is not accepted within 14 days. A viewer cannot take a record, and we never choose an adult for you.
• If you delete your MyPKU account while you own other people's records, we ask you the same question first. Your deletion cannot complete for a person until the adult you chose accepts, or you delete their record. If nobody else has owner or carer access to a person, their record is deleted with your account.
• The same applies if your account is deleted because it has not been used for 3 years (section 11): if nobody takes on a record within the 60 days' warning, it is deleted too. During that warning we also email each adult with carer access to a person you look after who has used MyPKU in the last 3 years, and ask whether they want to take the record over. It is the same request, and they make the same declaration, as when an owner asks. The first to accept takes the record, and the other requests are withdrawn. If you sign in before the deadline, the requests are withdrawn. We do not do this for an account with an active paid subscription, which we do not delete for inactivity.
• Entries you added to someone else's record stay in that record, because they are part of their history. Once your account is deleted, they no longer show who added them.

If you are worried about who can see a record

If someone should no longer have access to a child's record and the owner will not remove them (for example after a separation, or for a safeguarding reason), email support@mypku.co.uk with the record's name, your relationship to the child and any supporting evidence. We will review it. We can remove someone's access, correct a date of birth, or transfer the record to another adult aged 18 or over who has a MyPKU account. Our administrators must use an authenticator app to do this and must give a reason, and every action is recorded (section 12). When we transfer a record, we email the previous owner and the new owner.

6. Plans that cover other people

• A Premium subscription can cover more than one person, up to 8. People you look after and adults with owner or carer access to records in your family can each take a place. Viewers do not take a place.
• The person paying chooses who the plan covers. If they do not choose, we cover records automatically, oldest first, starting with the payer's own. An adult is only covered if the payer chooses them.
• If you are an adult covered by someone else's plan, we tell you whose plan covers you, by their community name. You can leave their plan at any time, or buy your own subscription.
• The payer can see the names (community name or email address) of the other adults in their family, which records those adults have access to, and whether they are on the plan. Covering an adult does not let the payer see that adult's own diary. Only the access described in section 5 does that.
• When a plan stops covering someone (for example because the payer cancels, changes who is covered, or deletes their account), we send that person one email and show a note in MyPKU. The email gives the payer's community name, never their email address. We keep the note until they dismiss it, get Premium again, or delete their account, and delete it after 180 days if none of those happens. People who are still Premium another way are not told. Records are not affected: only Premium features stop.

7. Community posts, sharing and photos

• Signed-in MyPKU members can see community posts and comments, shown with the author's community name and profile picture.
• Sharing a post outside MyPKU. Each post has a setting, “Anyone with the link can view this post”. It is off unless you turn it on. When you turn it on we make a link with a long random code in it, which cannot be worked out from the post. When it is on, anyone with the link can see the post, its photo and your own comments on it, without signing in. Other members' comments are not shown. The author is shown by community name only, or as “A MyPKU member”, never by real name, and without a profile picture. To stop sharing, turn the setting off: the link is cancelled and the post page stops working for anyone without an account. Turning it on again makes a new link. A photo's own web address is separate and keeps working (see the next point). You can also delete the post.
• Sharing is for adults. If you are under 18 you cannot turn on sharing. We use the date of birth on your profile to check this, and if you have not given one we treat you as under 18 for this purpose.
• Photos are stored at public web addresses. Photos on community posts and profile pictures are stored at long, random web addresses that cannot be guessed. Addresses for photos added from October 2026 contain no account identifier. Older ones contain an internal account identifier, which is not your name or email address. Anyone who is given one of these addresses can open the photo, whether or not the post is shared outside MyPKU, and even after sharing is turned off. Please do not post a photo you would not want seen outside MyPKU. When you delete a post, we delete its photo. When you change your profile picture, we delete the old one.
• Photo checks. Before a community photo or profile picture is published, an AI model checks it for unsafe content such as nudity, violence, self-harm or hate symbols. It does not judge food or diet. Nothing from the check is kept. You can upload up to 20 photos a day. Adding photos to posts is a Premium feature.
• If you delete your account. Your photos are deleted. When you delete, you can choose “Also delete all my posts and comments”. If you do not, the text of your posts and comments stays so conversations still make sense, but your name is removed and replaced with “[deleted]”. The words themselves may still identify you if you wrote something personal. Sharing is switched off on every one of your posts, so a link you had shared stops working at once. Under our Terms, our licence to show posts left in place continues. To have a single post removed, delete it before you delete your account, or ask us.

8. AI features

Our AI features use Anthropic Claude models, run on Amazon Bedrock in the AWS London region. Anthropic does not receive your data. Amazon Bedrock does not keep what we send it after answering, and does not use it to train AI models. We do not use your posts, diary or any other content to train AI models.

• Ingredient analysis (Premium). We send a product's ingredient list, and nothing about you, to flag ingredients that may matter for PKU. Aspartame, E962 and added phenylalanine are flagged by our own rules whenever they appear in the ingredient text. Results are stored against the ingredient text, not against you, so they can be reused.
• Translation. If a product's ingredient list is not in English, we may send the ingredient text to be translated. Nothing about you is sent.
• Reading an ingredient label (Premium). If you photograph a label, we send the photo to read the ingredients from it. We do not store the photo. You can do this up to 3 times a day.
• Photo checks. See section 7.
• Food database checks. When a contributor adds or edits a food, the food details (not the contributor's details) are checked for mistakes.
• AI summary of blood results (currently switched off). If we switch it on, Premium members will be able to ask for a plain-English summary of their own results. The results, their dates and notes would be sent to produce it, and you would be asked to agree before getting a summary. The summary is not stored and is not medical advice.

AI can make mistakes. Always check the label and follow your metabolic team's advice.

Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our AI photo check can stop a photo being published, and our age checks use the date of birth you give. Contact us at privacy@mypku.co.uk and a person will review it.

9. Who we share your information with

We do not sell your personal data. We share it only with the people you choose (sections 5 and 7) and with the organisations below.

Service providers who act on our instructions

They handle information for us under contracts that protect your data:

• Amazon Web Services (AWS). Hosting, sign-in (Amazon Cognito), photo storage (Amazon S3), server logs (Amazon CloudWatch), email (Amazon SES) and AI (Amazon Bedrock), all in the AWS London region.
• MongoDB Atlas (MongoDB Limited). Our database, which holds your account, records, posts and subscription status, on a dedicated cluster in London.
• Stripe. Takes payment for subscriptions and shop orders on the website. For shop orders, Stripe shares your name, email and shipping address with us. We contract with Stripe Payments UK Ltd. Stripe's Privacy Policy
• Umami Cloud (Umami Software, Inc.). Counts which pages and features are used on the website. Umami receives page addresses, the referring page, browser and operating-system type, and a country worked out from your IP address (the address itself is not stored). It also receives the names of features used and simple counts (for example how many ingredients were flagged), never the values you entered. It never receives your account details, email address, health information or invitation links. Umami sets no cookies. We use it only for statistics, and you can opt out at any time (see the Cookie Policy). If you opt out, your browser stores a note that you did.
• Zoho Mail. Handles the emails you send to privacy@mypku.co.uk and support@mypku.co.uk.

Other organisations that receive information

These decide for themselves how to use the information they receive, under their own privacy policies:

• Stripe, for payments. As well as working for us, Stripe uses payment details for its own purposes, such as preventing fraud and meeting legal obligations. In that role Stripe is responsible for the information itself.
• Google Play. If you subscribe in the Android app, Google takes the payment and tells us about your subscription (a purchase reference and its status). We send Google a pseudonymous account identifier with the purchase, so it can be matched to you. Google handles your Google account details under its own privacy policy.
• Food data sources. Open Food Facts, Edamam and USDA FoodData Central receive the barcode or search words you look up, and nothing about you. When the app or website shows a product photo, the photo is loaded from that source, which sees your device's IP address.
• Professional advisers and a buyer. Our accountants and lawyers, where they need it to advise us, and, if the business is ever sold, the buyer, who would have to protect your information in the same way.

We also share information where the law requires it, for example with the police or a regulator, or to protect someone at risk.

10. Where your information is stored

Your account, health records, posts and photos are stored in the UK, and our AI processing runs in the UK (AWS and MongoDB Atlas in London).

Some providers may process limited data outside the UK:

• Stripe processes payment and customer data through its group companies, including Stripe, Inc. in the United States. These transfers are covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and the UK-US Data Bridge where it applies. They cover your name, email, billing and shipping address and the payment details. Card data goes to Stripe directly and never to us.
• Umami hosts analytics data in the European Union (Germany). Umami Software, Inc. is a US company, and its access is covered by the UK International Data Transfer Addendum in its data processing agreement.
• AWS may use sub-processors outside the UK for supporting services, under its data processing agreement and the UK-US Data Bridge.
• Google processes Play purchases under its own terms.
• Zoho hosts our mailboxes in the European Union and processes the emails you send us under its data processing terms. Sending information to the European Economic Area is not a restricted transfer, because the UK recognises it as adequate.

Each provider publishes a list of its sub-processors. Ask us at privacy@mypku.co.uk for links. You can also ask us for a copy of the safeguards we rely on for these transfers.

11. How long we keep your information

12. How we protect your information

• All connections are encrypted, and data is encrypted where it is stored.
• You can turn on two-step verification with an authenticator app, in the app or on the website in Profile → Two-step verification, where you can also turn it off. You can change your password in the same part of Profile.
• Our administrators must use an authenticator app. Every action they take that changes someone's access or account, including attempts that are refused, and every post or comment they remove, is recorded with who did it, when and what for. A reason is required for changes to someone's access to a record, and is recorded for other actions when one is given. We keep this record for 6 years so we can answer complaints and requests. It holds no health information.
• We limit how often some actions can be repeated, such as invitations and uploads, to prevent misuse.

13. Your rights

Under UK GDPR you have the right to:

• Access. Get a copy of your data. Use Profile → Download my data for a file containing your profile, blood results, exchange records, community posts, comments on other members' posts, and your plan and billing status (not card details). If you are the owner or a carer of someone you look after, it also includes their record. The file does not include the list of who has access to a record, invitations, foods you added, or shop orders. Email us for any of these.
• Rectification. Correct your data in your profile or diary, or by asking us.
• Erasure. Delete entries yourself, or delete your whole account from Profile → Delete my account (see mypku.co.uk/delete-account). You can also choose to delete all your posts and comments at the same time. Deleting your account also cancels any subscription you pay for, and we then ask Stripe to delete your customer record (Stripe may keep payment and tax records under its own obligations). Your data is erased first. If removing your sign-in fails, we tell you, and you can try again.
• Restriction. Ask us to limit how we use your data.
• Portability. Receive your data in a machine-readable file (the download above).
• Object. Object to anything we do on the basis of legitimate interests.
• Withdraw consent. Use Profile → Data & Privacy → Withdraw consent in the app or on the website. If you withdraw your health data consent, you can choose to delete your own health records straight away (your blood results, exchange log and PKU details) or keep them stored without adding new entries. Deleting does not remove people you look after or your community posts. If you keep them, we store them, and do nothing else with them, until you delete them or give consent again. Once your consent is withdrawn, you cannot add new health entries, post in the community or use the AI summary. If you took over a record at 16 and have no profile, you can withdraw from the same place. You can give consent again at any time from the same place. We keep a record of when you gave and withdrew consent, and of your choice about existing records. Withdrawing consent does not make earlier processing unlawful.

Records kept for someone else. The owner or a carer can use these rights on behalf of a person they look after. A viewer cannot. Once a record has been handed over, only the person it is about can use these rights over it.

A young person can contact us about their own record at any age, and we will consider their request directly.

To use any of these rights, email privacy@mypku.co.uk. We will reply within one month. If you can no longer get into your account, email us from the address you registered with.

14. Children and young people

• Under 13: a child must not have their own MyPKU account. A parent or guardian can keep their record for them (section 5). The child has no login.
• 13 and over: a young person can have their own account. When they set up their profile, we ask them to confirm they are 13 or over and, if they are 13 to 17, that a parent or guardian agrees. When you set or change the date of birth on your own profile, it must show you are 13 or over. To keep a record for a child instead, a parent or guardian uses People after signing up. We do not check this with an outside service.
• 16 and over: a young person can take over the record a parent has been keeping for them, and can be given viewer access to someone else's record.
• 18 and over: needed to add someone you look after, to be an owner or carer of someone else's record, to buy a subscription, or to share a community post outside MyPKU.

For young people

• You can have your own account from 13 with a parent or guardian's agreement.
• Only members can see your posts, unless you are 18 or over and choose to share one.
• If a parent keeps a record for you, you can take it over from 16.
• You can email privacy@mypku.co.uk about your own record at any age.

Parents and guardians: we encourage you to tell a child that a record is kept for them, in a way that suits their age.

We do not show advertising or build marketing profiles of anyone, and community posts are visible only to members unless the author chooses to share them.

If you think a child under 13 has their own account, or that a child's information is held without the right permission, use the online reports form (choose “Report someone who seems to be under 13”) or contact us at privacy@mypku.co.uk. You do not need an account to report. If we have credible evidence that an account belongs to a child under 13, we suspend it.

15. Using the MyPKU app

On-device storage. Your daily exchange records are stored on your device so the app works offline, and are sent to our UK servers when you are back online. This copy is removed when you sign out and when you delete your account. The website works differently: its exchange tracker saves each entry straight to our UK servers and stores nothing in your browser, so it needs a connection. We recommend you protect your device with a passcode or biometric lock. Your sign-in details are kept in the phone's secure storage (Keychain or Keystore) and are removed when you sign out. When you download your data, the file is deleted from the phone once you have saved or shared it. It also remembers which version of the community guidelines you have seen, which person you last viewed and, if you turn it on, your unlock preference. Our Cookie Policy lists everything the app stores.

Security on the device. The app can ask for Face ID or your fingerprint to unlock it, if you turn that on in Profile. It checks the identity of our servers (certificate pinning) before sending data, and its data is not included in cloud backups of your phone.

Permissions. The app asks for camera access when you scan or take a photo, and may ask to use Face ID or your fingerprint to unlock it. You can pick a photo from your library through your phone's photo picker. It does not ask for your microphone, location, contacts or files.

App stores. The app is distributed through Google Play (and, in future, the Apple App Store). The store handles your download under its own privacy policy, and we do not receive your store account details. We do not use Google or Apple analytics, advertising or sign-in in the app.

Family accounts. The app keeps an on-device copy of the exchange log of each person whose record you can see, not just your own, so that you can log offline for them. Each copy is removed when you sign out, when you delete your account, and when your access to that person ends. You can add people, invite others, hand a record over and remove people in the app as well as on the website (section 5).

16. Cookies

We use only the cookies and browser storage needed to run the service, and a cookieless analytics tool that you can opt out of. See our Cookie Policy for details.

17. Complaints

Please contact us first at privacy@mypku.co.uk or use our online complaints form so we can try to put things right. We will acknowledge your complaint within 30 days and reply without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113

18. Changes to this policy

We will tell you about important changes by email or in MyPKU. The “last updated” date at the top of this page shows the current version. When you give consent for health information, we record which version of this policy applied. If you consented under an older version, MyPKU shows a notice that you can dismiss, and we record which version you dismissed it for. A change in wording does not ask you to consent again.