1. Who we are
Liara ("the App") is provided by Gnosis Health Limited, a company registered in England and Wales (company number 11635640), with its registered office at The Catalyst, 3 Science Square, Newcastle Helix, Newcastle upon Tyne, NE4 5TG, United Kingdom ("Gnosis", "we", "us"). For the purposes of UK data-protection law Gnosis Health Limited is the data controller for personal data processed through the App.
You can reach our data-protection contact at support@gnosishealth.ai.
2. What this policy covers
This policy explains what personal data the Liara mobile app collects, how it is used, who it is shared with, how long it is kept, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
It applies to everyone who uses the App. Some people also take part in our research study, which is separate, by invitation, and entered into through its own consent process. Where processing applies only to research participants, this policy says so; the participant information sheet and consent form you were given govern that processing and take precedence over this policy for it.
3. What data we collect
- Account information — email address, name, date of birth, gender, phone number, user type (patient or care partner) and any profile fields you choose to provide.
- Authentication identifiers — identifiers issued by Firebase Authentication and session tokens stored securely on your device.
- Health and wellbeing data — symptoms you log, medications you record, questionnaire responses, daily notes you write (which are analysed by the AI assistant to add the symptoms you mention to your symptom entries), and voice messages you choose to send to the in-app AI assistant.
- Health Connect data (Android, optional, only if you grant permission) — steps, heart rate, active calories burned, sleep, distance, and exercise sessions.
- Apple Health data (iOS, optional, only if you grant permission) — equivalent metrics where available.
- Chat content — messages you send to and receive from the in-app AI assistant.
- Care-partner linking data — if you link a care partner, we exchange the partner's name, email, and the link relationship between accounts.
- App diagnostics — anonymous usage analytics, crash reports, and performance traces collected via Firebase Analytics, Crashlytics and Performance Monitoring.
- Push-notification identifiers — Firebase Cloud Messaging registration tokens used to deliver medication and symptom reminders.
- Photos and audio — profile photos you upload and voice recordings you send to the AI assistant.
The App does not collect device location, contacts, calendar, files stored elsewhere on your device, financial information, or any data not listed above.
4. Why we use this data (lawful bases)
- To provide the App and its features — lawful basis: performance of a contract / provision of a service. For the health data you enter or choose to share, the additional condition for processing special-category data is your explicit consent, given when you set up your account and withdrawable at any time.
- To deliver our research study, for those who have been invited and have consented to take part — lawful basis: explicit consent and, where applicable, scientific research in the public interest. This applies only to research participants. If you are not taking part in the study, we do not process your data for research.
- To diagnose and fix faults and improve the product — lawful basis: legitimate interests, balanced against your right to expect minimal data collection.
- To detect and prevent abuse — lawful basis: legitimate interests in protecting the platform.
5. Who we share data with
We share personal data only with the following processors, all of whom act on our written instructions:
- Google LLC / Google Ireland Limited — Firebase Authentication, Cloud Messaging, Analytics, Crashlytics, and Performance Monitoring.
- Microsoft Corporation / Microsoft Ireland Operations Limited — Azure cloud hosting and Azure OpenAI, used to power the AI assistant.
- Expo (650 Industries, Inc.) — mobile-app build and over-the-air update infrastructure.
- Apple Inc. — if you use the iOS version, Apple HealthKit and Apple's notification services.
We do not sell your data, share it with advertisers, or use it for marketing purposes.
6. International transfers
Some processors operate outside the UK and the European Economic Area. Where this happens we rely on UK adequacy decisions, the UK International Data Transfer Agreement, and / or Standard Contractual Clauses to safeguard your data. A list of current sub-processors and the safeguards in place is available on request.
7. How long we keep data
- Account data and the health data you enter: kept for as long as your account is open. You can ask us to delete your account at any time from Settings → Your Data. Deletion is scheduled 14 days later, you can cancel it at any point in that window, and after that your personal data is permanently removed.
- Research-study data, if you are a participant: kept for up to 7 years, in line with healthcare and research retention norms, under the terms of the consent you gave. Deleting your app account does not by itself withdraw you from the study — to withdraw, please contact the study team.
- Crash reports and diagnostics: 90 days.
- Push-notification tokens: until you uninstall the App or change device.
8. Your rights
You have the right to access, correct, delete, restrict, or export your personal data, to object to certain processing, and to withdraw consent at any time. To exercise any of these rights, please email support@gnosishealth.ai. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).
9. Security
Data is encrypted in transit using HTTPS / TLS. Tokens and other credentials on your device are stored using the operating system's secure storage (Keychain on iOS, Keystore-backed Encrypted Shared Preferences on Android). Backend data is stored on access-controlled cloud infrastructure with encryption at rest.
10. Children
Liara is for adults aged 18 or over. We do not knowingly collect data from children.
11. Changes to this policy
We will publish updates to this policy on this page and, where the change is material, notify you in the App.
12. Contact
For questions about this policy, please email support@gnosishealth.ai.