Privacy

Causal · last updated 2026-07-25 · UK GDPR + UK Data Protection Act 2018 (EU GDPR for EU residents)

⚠ Draft — not yet legally reviewed. Items marked [TO CONFIRM] need the operator's real legal details and a UK data-protection solicitor's sign-off before Causal accepts data from real users. Do not launch to the public with this notice still present.

The short version. Causal reads health information you give us — lab results you upload, the conditions you tell us about, your email — and shows you what the published evidence says about supplements and lifestyle for those conditions. It is a wellness and education tool, not a doctor. Your data is stored in the EU, never sold, and you can delete it at any time.

1. Who we are

Causal is operated by [TO CONFIRM: legal entity name, Companies House no. if a company, registered/service address], the data controller for the information described here. Data-protection contact: [TO CONFIRM: contact email]. ICO registration: [TO CONFIRM: ICO data-controller registration number — required before any processing].

2. What we collect

Health data you provide — lab/biomarker results you upload or paste, conditions, genotype results if you enter them, and lifestyle notes. This is special-category (health) data.
Account data — your email address, used to sign in.
Usage data — basic, privacy-respecting analytics about which pages are used (no third-party ad SDK by default).

Causal does not capture audio, and it is not the Grumble wearable — if you also use that device, its separate privacy policy governs it.

3. Why we can process it (lawful basis)

We rely on your explicit consent (UK GDPR Art 9(2)(a)) to process health data, collected separately and un-pre-ticked, and on performance of our contract with you (Art 6(1)(b)) to run the service. You can withdraw consent at any time; we then stop and delete. We do not claim a medical-care basis, because Causal is a wellness tool, not a medical device.

4. How your data is used

To interpret your results against the evidence graph and show you condition-specific, evidence-ranked options — as information, never as a prescription. With your separate opt-in, anonymised, aggregated outcomes may improve the model; this is never tied back to you and is off unless you choose it.

5. Where it lives and who touches it

Default storage region is the EU (AWS, Ireland). Sub-processors: AWS (hosting), and, only where necessary, [TO CONFIRM: email provider, any others] — each under a data-processing agreement with UK/EU transfer safeguards. We never send your identified data to a third-party AI provider.

6. How long we keep it

Results, interpretations and account data — for the life of your account, deleted within 30 days of account deletion.
Consent records — kept as an audit log for account lifetime + 7 years (ICO guidance).
Security logs — 12 months.

7. Your rights

Under UK GDPR you can access, correct, export, restrict, object to, or delete your data, and withdraw consent — one tap in Profile → Delete account and data cascade-deletes it within 30 days. To exercise any right, contact [TO CONFIRM: contact email]. You can also complain to the ICO.

8. Children

Causal is for adults 18 and over. We do not knowingly collect data from under-18s.

9. Changes

Material changes are notified by email and in-app at least 30 days before they take effect, with an opt-out window — not slipped in via the date above.

← Home Terms Read my results

Educational, evidence-based wellness tool — not a diagnosis or medical device.