Privacy Notice

Last updated: 27 July 2026

Who we are

Epilepsy Mate (the mobile apps, watch apps, web app at app.epilepsymate.com, and this website) is developed and operated by Itixis, the data controller for the personal data described in this notice. For any privacy question or request, contact us at support@epilepsymate.com. This notice explains what data we collect, why, on what legal basis, who processes it on our behalf, and the rights you have over it.

The short version

You log sensitive health information in Epilepsy Mate, and we treat it accordingly: your data is used only to provide the service to you, it is never sold, never used for advertising, and never shared unless you create a share link yourself. You can export or permanently delete everything at any time from the app settings.

What information we collect

Account data: your email address, display name, optional avatar, language preference, and country. Health data you choose to log: seizures and their details, medications and dose history, triggers, auras, side effects, sleep, notes, and related entries. Optional device data: if you enable health sync, the health metrics you authorise from Apple Health (iOS) or Health Connect (Android) — currently sleep and exercise sessions (this stays opt-in per device). Newsletter data: your email address and language if you subscribe on this website. Subscription data: your subscription status and store transaction identifiers — never your card number. Technical data: basic logs needed to run and secure the service, such as IP addresses in server logs. We use no advertising trackers.

Health data is special

The seizure, medication and related health information you log is "special category" data under the GDPR. We process it only because you deliberately enter it in order to use a seizure diary — that is, with your explicit consent, to provide the service you signed up for. We never use your health data for marketing, profiling, or advertising, and we never sell it.

Why we process your data, and on what legal basis

To provide the service — syncing your diary across devices, generating charts and insights, medication reminders (performance of contract; explicit consent for the health data itself). To power the AI Seizure Coach when you use it (explicit consent; see the AI section below). To send transactional emails such as sign-in, password reset, or subscription notices (performance of contract). To send the newsletter you asked for (consent, with double opt-in; withdraw by unsubscribing). To keep the service secure and fix problems (legitimate interest). To meet legal obligations such as tax records on payments (legal obligation).

The AI Seizure Coach

When you ask the AI Seizure Coach a question, the relevant parts of your logged history — events, medication history, and related entries — are sent to our AI provider (Anthropic) together with your question, so the coach can answer with your context without you re-explaining it. Only the minimum necessary data is sent, it is used solely to generate your answer, and it is not used to train the provider's models. If you never use the coach, none of your data is sent to the AI provider.

Who processes your data on our behalf

We use a small set of processors, each bound by data processing agreements: Supabase (database, authentication and storage for your account and diary), Vercel (hosting for the website and web app), Resend (transactional and newsletter email delivery), RevenueCat and the Apple App Store / Google Play (subscription management and billing — we never see your payment card details), and Anthropic (AI processing, only when you use the AI Seizure Coach). If you enable health sync, that exchange happens on your device via Apple HealthKit or Android Health Connect permissions. Our use of Health Connect data complies with the Health Connect Permissions policy, including its Limited Use requirements: sleep and exercise data is read solely to display it in your diary, compute correlations with your seizures, and include it in reports you choose to export — never for advertising, never sold, never shared with third parties.

International transfers

Some of our processors operate infrastructure outside your country, including in the United States. Where personal data leaves the European Economic Area or a country with an adequacy decision, transfers are protected by recognised safeguards such as the EU Standard Contractual Clauses or an applicable adequacy framework.

How long we keep your data

Your account and diary data are kept for as long as you keep your account, including while a subscription is inactive — so your history is waiting if you return. If you delete your account in the app settings, your personal data is permanently deleted, with residual copies removed from encrypted backups within a short technical window. Newsletter data is kept until you unsubscribe. Minimal billing records are retained as required by law.

How we protect your data

Your data is encrypted in transit (TLS) and at rest with our database provider. Access is enforced by row-level security, so only your authenticated account can read your entries. Share links and reports exist only when you create them, and you can revoke them. Internal access to production systems is restricted and logged.

Sharing you control

Nothing about your health is visible to anyone unless you act: creating a read-only report link, exporting a summary for your neurologist, or showing your device to someone. Anyone with a share link you created can view the shared report — treat those links like the sensitive documents they are, and revoke them when no longer needed.

Children and caregivers

Epilepsy Mate accounts must be created by adults (or by minors only where local law permits and with a guardian's involvement). Caregivers — parents, guardians — may log health information about a child in their care; the caregiver remains responsible for that data and can correct or delete it at any time. The simplified kid mode only eases logging on a caregiver's account; it does not create child accounts.

Cookies and tracking

This website does not use advertising cookies or cross-site trackers. The web app stores only what it needs to function on your device, such as your session and language preference. Any privacy-friendly, aggregate analytics we may use do not identify you.

Your rights

Subject to your local law (including the GDPR if you are in the EU/EEA or UK), you have the right to access your data, receive a copy in a portable format, correct it, delete it, restrict or object to processing, and withdraw any consent at any time without affecting past processing. Export and deletion are built into the app settings; for anything else, email support@epilepsymate.com and we will respond within 30 days. You also have the right to lodge a complaint with your data protection supervisory authority.

Changes to this notice

When we change this notice in a meaningful way, we will announce it in the app or by email before it takes effect, and update the date at the top. Earlier versions are available on request.

Contact

Data controller: Itixis. Privacy contact: support@epilepsymate.com. Please include enough detail for us to identify your account (never send passwords). If you are unsatisfied with our answer, you may contact your supervisory authority.