Privacy policy

← Back to TherAIpy

Last updated: July 21, 2026

1. Who we are

TherAIpy is operated by Qualia Health Ltd, a UK-registered company based in Brighton. For privacy enquiries: privacy@qualiahealth.co.uk. General contact: hello@qualiahealth.co.uk.

2. Scope

This policy covers the TherAIpy mobile app, our API services, and this website (theraipy.qualiahealth.co.uk). Qualia Health Ltd's corporate site has a separate policy at qualiahealth.co.uk.

3. What we collect

Account information: email address, display name, subscription status, and authentication tokens.

Therapy content: messages you send during sessions, session metadata (dates, duration, persona), mood entries, and — with Premium and your consent — encrypted therapeutic memory used for continuity across sessions.

Privacy choices: your storage consent, optional transcript-sharing consent, and incognito mode preferences.

Payment information: subscriptions are processed by Stripe (web) or Apple App Store / Google Play (mobile). We do not store full card numbers on our servers.

Technical data: device type, app version, and standard server logs (IP address, timestamps) for security and reliability.

This website: information you submit via the contact form, plus reCAPTCHA tokens processed by Google to prevent spam.

4. How we use your data
  • Provide AI-supported therapeutic conversations and related features
  • Maintain session continuity for Premium users who have given storage consent
  • Process subscriptions and manage your account
  • Improve safety, reliability, and product quality
  • Respond to support and privacy requests

Conversation content is sent to OpenAI to generate AI responses. OpenAI processes this data under their API terms and does not use API data to train their models by default. See OpenAI's privacy policy.

5. Storage and retention by tier

Welcome trial and Free: limited stored access compared to Premium. Session content is handled with a lighter retention approach; we do not offer the full encrypted therapeutic vault. Encrypted in transit (HTTPS/TLS) applies to all users.

Premium: with storage consent enabled, session content and therapeutic memory are encrypted at rest using AES-256-GCM on our servers. Data is retained while your account is active and you maintain consent, unless you request deletion.

After account deletion: we delete your account and associated personal data from our systems, subject to limited records we may retain where required by law (e.g. billing records).

6. Legal bases (UK GDPR)
  • Contract: providing the service you signed up for
  • Consent: optional long-term storage, transcript sharing, and marketing where applicable
  • Legitimate interests: security, fraud prevention, and service improvement (balanced against your rights)
  • Legal obligation: where we must retain certain records
7. Sharing with third parties

We share data only as needed to run TherAIpy:

  • OpenAI — AI response generation
  • Stripe — subscription billing (where applicable)
  • Apple / Google — in-app purchases on mobile
  • Google reCAPTCHA — spam protection on this website's contact form

We do not sell your personal data. Optional transcript sharing (off by default) uses anonymized data only to help improve TherAIpy.

8. Security

All traffic uses HTTPS/TLS. Premium session data stored on our servers is encrypted at rest with AES-256-GCM. Encryption keys are managed by Qualia Health Ltd — you do not hold separate encryption keys. No system is perfectly secure; please use a strong, unique password and contact us if you suspect unauthorised access.

9. Your rights

Under UK GDPR you may:

  • Access, correct, or delete your personal data
  • Withdraw consent for optional processing (e.g. storage, transcript sharing) in the app under Settings → Privacy
  • Request a copy of your data by emailing privacy@qualiahealth.co.uk
  • Delete your account from Settings (or email us if you cannot access the app)
  • Lodge a complaint with the UK Information Commissioner's Office (ICO)
10. Children

TherAIpy is intended for users aged 18 and over. We do not knowingly collect data from children under 18 without verifiable parental consent.

11. International transfers

Some processors (including OpenAI and Stripe) may process data outside the UK. Where this occurs, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms.

12. Changes

We may update this policy from time to time. Material changes will be reflected on this page with an updated date.

13. Contact

Qualia Health Ltd, Brighton, United Kingdom
Privacy: privacy@qualiahealth.co.uk
Support: contact form or hello@qualiahealth.co.uk