Last updated: 22/10/2026
florae is a mobile app for tracking habits and gut/brain health symptoms, which includes an AI assistant called "flo." This Privacy Policy explains what personal data we collect, why, how it’s stored, who we share it with, and the rights you have. florae is not a medical device; it does not diagnose or treat any condition, and it does not connect to any insurance or healthcare billing system.
Eira Wellbeing Ltd, of 82A James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom, is the data controller responsible for your personal data. Contact us at hello@floraeapp.com with any privacy question or to exercise any of the rights below.
Your email address and password (never stored in plain text), as you must verify your email before you can log in. Alternatively, if you sign up with Apple or Google, we collect whatever identity information that provider shares with us; typically, your email address and display name. We store an optional free-text display name you set yourself. If you reset your password, we use the email address already on your account; nothing extra is collected for this.
We collect free-text descriptions of your symptoms, a severity score, and any free-text notes you add. We collect free-text descriptions of what you ate, and the grams of fibre you log for it. We collect names of habits you create, the dates you complete them, and any amounts or progress you log against them.
We also store non-identifying preferences in your account, namely theme, haptics, reduce-motion, and your onboarding status. These can thus follow you if you access florae using a different devices.
florae contains no analytics, crash-reporting, or advertising SDK of any kind. We don't collect a push-notification token and we don't track you across other apps or websites.
We use your data to create and secure your account; let you log and review habits, symptoms, and food entries; power flo's advice and its ability to log entries for you from what you type; manage your subscription, if you have one; prevent abuse of the service; and contact you about your account or material changes to our policies. We do not use your health data for advertising, and we do not sell it.
Storing your health data requires explicit consent, under Article 9(2)(a) of the UK/EU GDPR. Before you can use florae, you must separately confirm you've read this Privacy Policy and that you consent to florae storing your health data. If you decline, your account is deleted immediately rather than created without your consent. We also store account and authentication data, which is necessary to fulfil our contract with you by providing you the app.
flo can automatically log entries based on what you type in natural language.
We share data only with the providers needed to run florae — never with data brokers or advertisers:
Supabase is our database, authentication, and backend provider. It stores your account, health, and habit data in a local server in Ireland; we have a Data Processing Agreement in place. Anthropic is the company providing the API for flo. Whatever you type to flo, and for some features recent conversation context, is sent to Anthropic to generate a response and to parse or classify entries. One feature is deliberately built to exclude your symptom, habit, and food history from what it sends, but the message you actually type is always sent. RevenueCat manages your Pro subscription status, linked to your florae account ID. It signs you out when you sign out, so your subscription can't be mistakenly applied to a different account on a shared device; we have a Data Processing Agreement in place. We share your identity data with Apple or Google if you choose to sign in with them. We never sell your data, and we don't share it for cross-context behavioural advertising.
Anthropic and RevenueCat are US-based, and Supabase hosts your data in Ireland (EU/EEA). Your data will thus be transferred outside your region for processing.
Health, habit, and account data on our servers will be retained for as long as your account is active. Account deletion is immediate and permanent; there is no recovery period or grace window. You are able to export your data before deleting your account, if required.
You can ask us to give you access to your data, correct it, delete it, export it, or restrict or object to how we use it. You can withdraw consent at any time without affecting anything we did before you withdrew it. To exercise any of these, email hello@floraeapp.com.
florae is not a HIPAA-covered entity, and HIPAA's protections don't apply to the data you give us. Even though we're not HIPAA-covered, the FTC's Health Breach Notification Rule can still apply to apps like florae that handle identifiable health information. Section 12 explains how we handle a breach under that rule as well as under GDPR.
Your symptom, food, and habit logs are “sensitive personal information” under California law. You have the right to know what we collect, delete it, correct it, and limit our use of sensitive personal information. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
If you're a resident of Virginia, Colorado, or Connecticut, your health data similarly counts as “sensitive data” under your state's law (the VCDPA, ColoPA, and CTDPA respectively), and you have similar rights to access, correct, delete, and opt out of certain processing.
Washington's My Health My Data Act (MHMDA) defines “consumer health data” broadly enough that it plausibly covers florae's symptom, habit, and food logs, even though florae isn't a clinical product. If you're a Washington resident, we will not sell your consumer health data, and we don't share it for any purpose beyond providing florae's features to you. You have the right to confirm whether we hold your consumer health data, access it, request its deletion, and appeal if we decline a request.
We act as an accountable organisation under Canada's federal privacy law, PIPEDA. We collect your data only for the purposes described in this policy.
Because our partners are based outside of Canada, your data crosses the border for processing; we take reasonable contractual steps to protect it there. If a breach creates a real risk of significant harm, we'll notify the Office of the Privacy Commissioner of Canada and affected users, as required.
If you're in Quebec, Law 25 adds obligations on top of PIPEDA: a designated, published privacy officer contact; a privacy impact assessment before certain transfers outside Quebec; and opt-in consent specifically for sensitive data like health information.
florae does not currently have an age gate or minimum-age confirmation anywhere in signup or onboarding. However, florae is intended for use only by persons over the age of 16.
We use industry-standard measures — including encryption in transit and secure credential storage — to protect your data. No system is completely secure, and we can't guarantee absolute protection.
UK/EU GDPR: we'll notify the relevant regulator within 72 hours of becoming aware of a breach likely to risk your rights and freedoms and notify you directly if the risk is high.
US FTC Health Breach Notification Rule: a breach of your identifiable health information requires us to notify affected users and, in most cases, the FTC, without unreasonable delay.
Washington MHMDA: a breach of consumer health data carries its own notification duty to affected Washington residents.
Canada PIPEDA: we'll report breaches creating a real risk of significant harm to the Office of the Privacy Commissioner of Canada and to affected individuals.
We'll tell you about material changes through the app or by email before they take effect.
Questions or requests about this policy or your data: hello@floraeapp.com