Privacy Policy

Aura is the data controller for the personal data processed by this app. If you are in the European Economic Area, United Kingdom, or Switzerland, your data is protected under the General Data Protection Regulation (GDPR).

Account data. Your name and email address, collected when you create an account or are invited. Your role (user or admin) is stored to control access.

Journal entries. The text you write, the mood you select, and automatically derived highlights and traits. Visible only to you.

Session history. The type, duration, and category of wellbeing exercises you complete, used to show your cumulative progress.

Wellbeing check-in results (special category data). If you choose to save a check-in, we store your PHQ-9 and GAD-7 scores, symptom bands, functional impact, and a safety flag. This is health data under GDPR Article 9. We only store it when you give explicit consent, and we record the timestamp of that consent.

Aura Coach conversations. Messages you send to the in-app coach are processed by an external artificial intelligence service in order to generate replies.

Local device data. Your theme preference, progress scores, and (if enabled) your 4-digit app lock are stored on your device.

Providing the service (contract) — to run your account, save your journal and sessions, and show your progress.

Explicit consent (Article 9) — saving wellbeing check-in results is optional and only happens when you press save. You can withdraw consent by deleting the check-in at any time.

Legitimate interests — securing the app, preventing misuse, and improving reliability.

Messages you send to the Aura Coach are transmitted to a third-party AI provider to generate responses. We minimise what is shared and ask that you avoid disclosing sensitive personal or health details in chat. The provider acts as a data processor under a data processing agreement, with appropriate transfer safeguards (such as Standard Contractual Clauses) where data is processed outside the EEA.

Your journal entries, sessions, and check-ins are protected by row-level security: only you can read and change them. App administrators may access records solely for technical support and security, never to review your personal content.

We keep your data for as long as your account is active. You can delete individual journal entries or saved check-ins at any time. "Delete all my data" in Settings removes your journal, sessions, and assessments. Deleting your account removes all associated personal data from our database. Aura Coach conversation history is retained by the AI provider; you may request its deletion by contacting us.

Under the GDPR you have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability (export your data as a structured file from Settings); and withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, use the in-app controls or contact us using the details below.

Aura is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us with personal data, contact us and we will delete it.

We use encryption in transit, access controls, and per-user data isolation. No method of transmission or storage is completely secure, but we work to protect your data using industry standards.

We may update this policy as Aura evolves. Material changes will be reflected by updating the "last updated" date above.

To ask about your data, request export or deletion, or raise a privacy concern, contact Aura support. If you are in the EEA, you also have the right to lodge a complaint with your local data protection authority.