Privacy policy

Last updated 19 August 2026

Before launch: replace the placeholders in square brackets below with your registered details, and register with the ICO as a data controller — processing health data almost always requires it. Delete this box once done.

Who is responsible for your data

AsthmaStats is the data controller for the information described here. You can contact us at support@asthmastats.com or by post at [YOUR POSTAL ADDRESS]. Our ICO registration number is [ICO NUMBER].

What we collect

We hold two kinds of information about you.

Account information — your name, email address, password (stored only as a secure Argon2id hash, never in a readable form), timezone, and optionally your height, date of birth and sex. If you use the environmental features we also store the first part of your postcode only, such as SW1A. We never ask for or store your full postcode or street address.

Health readings — the measurements you choose to record: peak flow, reliever doses, preventer doses, blood pressure, heart rate, blood sugar and weight, along with any context tags and notes you add, and the personal best and zone percentages you copy from your asthma action plan.

Why this needs your explicit consent

Health information is special category data under Article 9 of the UK GDPR, which means it gets stronger protection than ordinary personal data. Our lawful basis for holding your readings is your explicit consent, given when you ticked the box at registration. We record the date and time you gave it.

You can withdraw that consent at any time by deleting your account, which erases every reading immediately. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

For your account information — your email address and password — our lawful basis is contract: we cannot provide you with an account without them.

What we do with it

We use your readings for exactly one purpose: to show them back to you, in your stats, your graphs and the summary you can print. We use your email address to send you the emails described below.

We do not sell your data, share it with advertisers, use it to build a profile of you, use it to train any machine learning system, or pass it to insurers, employers or anyone else. There is no advertising on this site and no third-party analytics or tracking.

Emails we send

We send account emails (confirming your address, resetting your password) and, if you turn them on, reminders to take a reading.

No email we send ever contains a health reading. A reminder says it is time to record something and gives you a link — it never includes a value, a figure or any comment on how you are doing. Email is not a secure channel and messages can appear on a lock screen, so we keep health information off it entirely. Every reminder has a one-click unsubscribe link.

Who else can see your readings

Nobody, unless you show them. Your readings are visible only to you when signed in. Site administrators can manage accounts — activating, deactivating, triggering a password reset — but the administration screens contain no way to view anyone's health readings.

A small number of service providers process data on our behalf under contract: our web host [HOSTING PROVIDER NAME], based in [COUNTRY], and our email provider [EMAIL PROVIDER NAME], who handle the delivery of the account emails described above. They act only on our instructions.

Where your data is stored

Your data is stored on servers in [COUNTRY/REGION]. If any provider we use stores data outside the UK, that transfer is covered by the UK International Data Transfer Agreement or equivalent safeguards.

How long we keep it

We keep your readings for as long as your account exists — a health record is only useful if it goes back far enough to show a trend, so we do not delete old readings automatically.

If you delete your account, everything goes immediately: your readings, action plan figures, targets, reminders and account details are erased, not archived. We keep a record that an email was sent, with no name or address attached, for troubleshooting delivery problems.

If an account is never verified we delete it after [NUMBER] days. If an account is inactive for [NUMBER] years we will email you before deleting it.

Your rights

Under UK GDPR you have the right to:

  • Access your data — download everything as CSV or JSON from your account page, instantly.
  • Portability — those same exports are in open formats you can load into other software.
  • Rectification — edit or delete any individual reading, and correct your details, at any time.
  • Erasure — delete your account and all readings permanently from your account page.
  • Withdraw consent — at any time, with the same effect as erasure.
  • Restriction and objection — contact us and we will act on it.

Most of these you can exercise yourself without asking us. For anything else, email support@asthmastats.com and we will respond within one month.

Cookies

We set one cookie, which keeps you signed in during your visit. It is strictly necessary for the site to work, contains no personal information and no tracking identifier, and expires when you sign out or your session ends. There are no advertising, analytics or third-party cookies, which is why you are not being asked to accept anything.

Keeping it secure

All traffic is encrypted with TLS. Passwords are hashed with Argon2id. The site is protected against common web attacks including cross-site request forgery and SQL injection, and sign-in attempts are rate limited. No system is perfectly secure, but if a breach ever affected your data we would tell you and the ICO as required.

Children

Asthma is common in children, and a parent or guardian may use this site to keep a record on behalf of a child. Accounts must be held by someone aged 16 or over. If you believe a child has created their own account, contact us and we will remove it.

Changes

If we change this policy in a way that affects how your readings are handled, we will email you before it takes effect, and where the law requires it we will ask for your consent again.

Complaints

If you are unhappy with how we have handled your data, please tell us first at support@asthmastats.com. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.