Privacy

Privacy Policy

Effective from 22 September 2026.

This privacy policy explains how Seaglass Projects Ltd (“we”, “us”, “our”) collects, uses, stores, shares and protects your personal information when you use the Nova fertility companion mobile application and the Nova website (together, “Nova” or “the Service”). Nova is a fertility patient experience platform that helps people track treatment cycles, record their journey, connect with supporters, and review fertility clinics.

Nova processes health data — specifically, information about fertility treatment. Under UK data protection law this is special category data. Under Australian law it is sensitive information. Under Washington State law it is consumer health data. We treat all of it at the highest level of protection, regardless of where you are.

Data controller: Seaglass Projects Ltd, registered in England and Wales (company number 17396371), registered office 16 Eastchurch Road, Cliftonville, Margate, CT9 3EN, United Kingdom. You can reach us at privacy@heynova.org.

We are registered with the Information Commissioner’s Office under ZC232038.

1. What we collect and why

We collect only what is needed to provide and improve Nova. We do not collect data for advertising or sale to third parties. We have no advertising SDKs and no third-party trackers in the app. We collect limited, anonymised usage analytics to improve the app’s design — these are never joined with your health data. See section 1.2 for details.

1.1 Information you provide directly

Data	Purpose	Lawful basis (UK GDPR)
Name, email address	Account creation, communication	Contract (Art. 6(1)(b))
Treatment protocol (e.g. IVF, FET, egg freezing, IUI)	Personalise your experience to your treatment type	Explicit consent (Art. 9(2)(a))
Cycle dates, stages, outcomes, donor arrangement, transfer details	Track your current and past treatment cycles	Explicit consent (Art. 9(2)(a))
Medications: drug name, dose, form, injection site, schedules, dose tracking	Medication management and reminders	Explicit consent (Art. 9(2)(a))
Appointments: dates, times, clinic locations, attendance, notes	Appointment tracking	Explicit consent (Art. 9(2)(a))
Treatment milestones: trigger, transfer, progesterone timing and instructions	Track key treatment dates and changes	Explicit consent (Art. 9(2)(a))
Treatment events: stage moves, results (e.g. blood test results, scan results)	Record and review treatment progress	Explicit consent (Art. 9(2)(a))
Journal entries: mood, symptoms, free-text personal writing	Private reflective journalling	Explicit consent (Art. 9(2)(a))
Symptoms	Track physical symptoms during treatment	Explicit consent (Art. 9(2)(a))
Embryo records: grade, PGT result, storage location, renewal date	Manage embryo bank across cycles	Explicit consent (Art. 9(2)(a))
Egg batches: counts, maturity, method, age at freezing, storage, consent dates	Manage frozen egg inventory	Explicit consent (Art. 9(2)(a))
Photographs of clinic paperwork you choose to upload, and the name you give each one. A photograph of a clinic letter commonly contains your full name, date of birth, NHS number, home address, consultant and treatment details, and may contain a partner’s or donor’s details. We never read, scan or extract text from these images — we store them, show them back to you, and nothing else.	Keep your clinic’s own paperwork with the cycle it belongs to	Explicit consent (Art. 9(2)(a))
Clinic contact details (phone, email)	Your personal reference	Contract (Art. 6(1)(b))
Clinic call and result notes	Your personal reference	Explicit consent (Art. 9(2)(a))
Clinic reviews: ratings across dimensions, treatment type, outcome, free-text comments	Publish clinic reviews to help other patients	Explicit consent (Art. 9(2)(a))
Support network: who you invite and what categories you share with them	Allow chosen people to follow parts of your treatment	Contract (Art. 6(1)(b))
Display name you choose	Publish your review under a name you choose, and your community posts when those features open	Consent (Art. 6(1)(a))

1.2 Information we generate or collect automatically

Data	Purpose	Lawful basis (UK GDPR)
Push notification subscription (device endpoint, encryption keys)	Deliver medication reminders you have enabled	Consent (Art. 6(1)(a))
Timezone	Schedule reminders at the correct local time	Legitimate interest (Art. 6(1)(f))
Security events (connect, disconnect, rate-limit events)	Protect your account from unauthorised access	Legitimate interest (Art. 6(1)(f))
Deletion receipts (table names and row counts only, never content)	Prove that account deletion was carried out completely	Legal obligation (Art. 6(1)(c))
Invite codes (multiple per account)	Enable partner linking	Contract (Art. 6(1)(b))
Rate-limit records	Prevent abuse of the linking system	Legitimate interest (Art. 6(1)(f))
App usage patterns: screens visited, time spent, feature interactions, drop-off points. Never joined with your health or treatment data. Collection is off by default; you choose whether to enable it.	Understand how people use Nova so we can improve its design and usability	Explicit consent (Art. 9(2)(a))

1.3 What we deliberately do not collect

We never ask you for a date of birth, home address, phone number or national health identifier (e.g. NHS number, Medicare number). There is no field for any of them anywhere in Nova. If you choose to photograph a clinic letter (section 1.1), that image may well contain them — you decide whether to upload it, we never read it, and you can delete it at any time.
Payment card or bank details. Subscriptions are taken by Stripe as merchant of record (section 3). Your card details go from you to Stripe and no part of them reaches Nova at any point — we cannot see a card number, and there is nowhere in Nova that one could be stored. What we receive back is whether a subscription is active and an identifier for it.
Location data on our servers — your device’s location is never sent to us and is never stored. Nova can ask your browser for it, with your permission, to sort clinics by distance and to choose which currency the plans page opens in; the coordinates are used on your device and stay there. A photograph normally carries the place it was taken inside it; before any image leaves your phone Nova re-encodes it, which removes the location, the device and the capture time, and then checks the result and refuses to upload it if anything is still there. No location data reaches us.
Device identifiers beyond a push notification endpoint
Third-party analytics services (e.g. Google Analytics, Mixpanel), advertising SDKs, or cross-app tracking of any kind. The anonymous usage patterns we collect (section 1.2) are processed entirely within our own infrastructure and are never shared with third parties.
Cookies (the app does not use cookies)

2. How we use your data

We use your data for the following purposes and no others:

To provide the Nova service: tracking your treatment cycle, managing medications, recording results, and displaying your journey
To deliver discreet reminders you have opted into (medication reminders via push notification)
To enable your chosen supporters to see the categories of information you have explicitly shared with them
To publish clinic reviews you have submitted
To display aggregated clinic scores (individual reviews are attributed to a name you choose, or to no name at all)
To understand how people use Nova in aggregate (e.g. which features are used most, where users encounter difficulty) so we can improve the app — only if you have opted in to share usage data in Settings. This analysis uses anonymous usage patterns only and is never combined with your health data.
To produce anonymised, aggregated statistical reports about platform-wide trends (e.g. treatment-type distributions, cycle progression rates). These reports contain no individual-level data and can never identify any individual. No statistic in these reports is produced from fewer than 5 data points.
To protect account security (detecting and rate-limiting abuse)
To comply with legal obligations (e.g. responding to data access requests, maintaining deletion records)

We do not use your data for: serving you advertising, profiling you for third-party marketing, automated decision-making, or training machine learning models. We never sell or share your individual personal data with third parties.

3. Who we share your data with

We share your data only with the following parties, and only to the extent necessary to operate Nova:

Recipient	What they receive	Why
Supabase (database and hosting provider, a subsidiary of Supabase Inc.)	All data stored in Nova and server-side functions, including any photographs of clinic paperwork you upload. These are held in a private storage area in the same UK/EU region as the database; they are not public, they have no shareable web address, and each viewing uses a link that expires after five minutes. Supabase processes data on our behalf under a data processing agreement.	Database hosting, authentication, file storage
Browser push service (Google FCM, Mozilla Push Service, or Apple Push Notification Service)	Encrypted notification payload and device endpoint	Delivering medication reminders you have enabled. The payload is encrypted end-to-end; the push service cannot read the reminder content.
Sold through Link, LLC — a Stripe company, and the MERCHANT OF RECORD for your subscription. A UNITED STATES entity; see section 4.	Your email address, and the billing and tax details it needs to take the payment and charge the right VAT or GST — typically a country and a postcode. Your card details go from you to Stripe directly. WHAT DOES NOT GO: no treatment or health data of any kind — no cycles, medications, appointments, results, journal entries or symptoms — and no card number, which Nova never sees or stores. We receive back only whether a subscription is active, and an identifier for it.	Selling you the subscription, and charging and remitting VAT and GST. Under merchant of record your purchase contract is with Sold through Link, LLC rather than with Seaglass Projects Ltd — the Terms of Service set out both agreements.
Stripe Payments UK, Ltd — our own payment services provider, in the United Kingdom	The same payment and tax data, processed to operate the payment service we contract for. No treatment or health data, and no card number reaches us at any point.	Our payment services agreement. That contract is between us and Stripe rather than something you are a party to, and is named separately because it is a different company, in a different country, from the seller above.
Google or Apple (if you use social sign-in)	Your email address	Authentication only. We receive a token confirming your identity; no health data is shared with Google or Apple through sign-in.
Your chosen supporters	Only the specific categories you have enabled (e.g. medications, appointments) — never journal entries, which have no sharing toggle and cannot be shared	The support network feature you control. You can revoke access at any time.
Healthcare organisations, researchers, or fertility industry partners	Anonymised, aggregated statistics only — never individual-level data, never data derived from fewer than 5 data points	To support fertility research and improve industry understanding of patient experience. No recipient can identify any individual from these reports.

We do not sell your personal data. We have never sold any individual’s personal data and will never do so. We do not share data with advertisers or data brokers. We may produce anonymised, aggregated statistical reports about platform-wide trends and make these available to healthcare organisations, researchers, or fertility industry partners. These reports contain only aggregate numbers (e.g. average cycle counts, treatment-type distributions) and can never identify any individual user.

4. Where your data is stored

Your data is stored on Supabase’s infrastructure, which runs on Amazon Web Services (AWS). The specific region is eu-north-1 (Stockholm, EU). Data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher.

Cross-border transfers. Supabase Inc. is headquartered in the United States. Where data is processed outside the UK or Australia, it is protected by standard contractual clauses (UK International Data Transfer Agreement) and Supabase’s data processing agreement, ensuring a level of protection equivalent to UK GDPR and the Australian Privacy Principles. Under the Australian Privacy Principles (APP 8), we take reasonable steps to ensure overseas recipients handle your data in accordance with the APPs, and we remain accountable for their compliance.

Payments, and the transfer to the United States. Your subscription is sold to you by Sold through Link, LLC, a Stripe company acting as merchant of record (section 3). It is a United States entity, so the limited payment and tax data it needs is transferred outside the UK. That transfer is covered by Stripe’s standard contractual clauses and data processing agreement, including the UK International Data Transfer Addendum, giving a level of protection equivalent to UK GDPR. Under the Australian Privacy Principles (APP 8) we take reasonable steps to ensure it handles your data in accordance with the APPs, and we remain accountable for its compliance.

What is transferred, and what is not. It receives your email address and the billing and tax details needed to take the payment and charge the correct tax. No treatment or health data is sent — nothing about your cycles, medications, appointments, results, journal entries or symptoms leaves Nova for this purpose. And no card number reaches Nova: your card details go from you to Stripe directly, and there is nowhere in Nova one could be stored. That is what keeps the statement in section 1.3 true.

Our own payment services agreement is separately with Stripe Payments UK, Ltd, in the United Kingdom. That contract is between us and Stripe rather than something you are a party to, and it is named here because it is a different company, in a different country, from the one you buy from.

5. How we protect your data

Given the sensitivity of fertility treatment data, we apply the following safeguards:

Row-level security on every database table — your data is isolated to your account at the database level, not just the application level
Encryption at rest (AES-256) and in transit (TLS)
Journal entries have no sharing category and cannot be shared through any setting — there is no toggle to get wrong
Medication reminders are discreet by default: the notification says “You have something due” without naming the medication. Detailed notifications are opt-in.
Error logs carry no row data — an error records the shape of the problem, never the content, so health information cannot leak into logs
Deletion receipts hold counts and table names only, never the content of deleted records
Security events (account linking, rate limiting) contain no health information — this is verified by automated tests
Partner access is granular and default-off: every category that reveals something about you — medications, appointments, cycle updates, mood — must be individually enabled by you, and nothing is shared until you enable it. Messaging is the one thing switched on for anyone you invite: it is how the two of you talk to each other, not a view of your record
The service-role database key is never exposed to the browser — all client access uses the anon key with row-level security enforcement
Usage analytics are stored in a separate schema with no foreign key to treatment data, ensuring they cannot be joined with health information by construction
If we produce anonymised aggregate reports, the anonymisation process is irreversible — individual records cannot be reconstructed from the published statistics. Reports that leave Nova are never generated from cohorts smaller than 5, to prevent re-identification through small sample sizes.

6. How long we keep your data

We retain your data for as long as your account is active. Treatment journey records (past cycles, embryo records, egg batches) are retained indefinitely while your account exists because their value to you grows over time — fertility treatment can span years, and a complete history is clinically useful.

When you delete your account, we delete all of your data. This is not an archive or a soft delete — it is a real, cascading deletion across every table. Specifically:

All treatment records (cycles, medications, schedules, doses, appointments, milestones, events, journal entries, symptoms, embryos, egg batches, clinic contacts, clinic logs) are permanently deleted
Your authentication identity is deleted — you cannot sign back in
Any active partner links are severed — your supporter immediately loses access
Push notification subscriptions are removed
A deletion receipt is created recording that the deletion occurred, which tables were affected, and how many rows were removed. The receipt contains counts only, never the content of what was deleted
Your individual usage analytics events are permanently deleted. Any anonymised, aggregated statistics that were already computed from platform-wide data are retained — these contain no record of any individual and cannot be traced back to you.
Clinic reviews you have written are deleted, published or not. Clinic scores are recalculated without them.
Any display name used for writing reviews or taking part in the community is deleted.
Every photograph of clinic paperwork you uploaded is deleted from storage, not only the record describing it. The deletion receipt counts them alongside everything else.

Deleting one document. You can delete any photograph on its own, at any time, without deleting your account. The image is removed from storage as well as the record of it — there is no archived copy and it cannot be recovered.

Backups. Supabase maintains automated database backups for disaster recovery. Deleted data may persist in backups for up to 7 days before those backups are rotated out. We do not access backups to retrieve deleted data, and we will not restore deleted data on request.

Photographs are not in the backup. The automated backups above cover the database. They do not cover uploaded files, so any photographs of clinic paperwork you have added are not included in them and could not be recovered if something went wrong. Please keep your clinic’s original letters — Nova is somewhere to have them to hand, not somewhere to keep the only copy.

7. Your rights

You have the following rights regardless of where you are located. Where a specific law grants additional rights, those are noted.

7.1 Rights available to all users

Access: You can request a copy of all personal data we hold about you.
Correction: You can correct inaccurate personal data at any time through the app, or by contacting us.
Deletion: You can delete your account and all associated data at any time from within the app. Deletion is immediate and permanent. You can also request deletion by contacting us.
Withdraw consent: Where processing is based on your consent (which includes all health data processing in Nova), you can withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. The simplest way to withdraw consent for all health data processing is to delete your account.
Data portability: You can export your data in a machine-readable format from within the app. The export includes any photographs of clinic paperwork you have uploaded — as the actual image files, saved alongside the data file and named with the names you gave them, not as links. A link would expire and would stop working altogether once the account was deleted, which is exactly when the copy matters.
Usage analytics: Usage data collection is off by default. You can enable it in Settings to help us improve Nova, and disable it again at any time. This does not affect any other part of the service.

7.2 Additional rights under UK GDPR

Right to restrict processing: You can request that we limit how we use your data in certain circumstances.
Right to object: Where processing is based on legitimate interest, you can object. We will stop processing unless we have compelling legitimate grounds.
Right to complain: You can lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

7.3 Additional rights under the Australian Privacy Act

Access and correction: Under APPs 12 and 13, you can request access to your personal information and ask us to correct it. We will respond within 30 days.
Right to complain: You can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

7.4 How to exercise your rights

You can exercise most rights directly in the app (account deletion, data export, sharing controls, usage analytics toggle). For anything you cannot do in the app, email us at privacy@heynova.org. We will verify your identity before acting on a request. We will respond:

UK: within one month. We may extend this by up to two further months if the request is complex or if you have made several; we will tell you within the first month if we need longer.
Australia: within 30 days.
Washington State: within 45 days, extendable once by a further 45 days.

If a request is manifestly unfounded or excessive — for example, because it repeats one we have already answered — we may charge a reasonable fee based on our administrative costs, or decline to act. We will explain why and tell you how to complain. If you ask for further copies of information we have already given you, we may charge a reasonable fee for those copies.

8. Consent

Because Nova processes special category health data, we rely on your explicit consent as the lawful basis for processing fertility treatment information under UK GDPR Article 9(2)(a). Under the Australian Privacy Act, we obtain express consent before collecting sensitive information (APP 3).

You give that consent by an express statement at a dedicated screen, shown the first time you sign in and before any treatment information can be entered. The screen states what Nova stores and what it is used for, and carries two separate tick boxes: one consenting to us collecting and storing your fertility treatment information, and one confirming you are 18 or over. Neither is ticked for you. You cannot reach the rest of the app until you have given consent, and declining takes you to account deletion.

We record the date you consented and the version of the statement you agreed to. Consent is:

Informed — the screen states what is collected and what it is used for, and links to this policy
Specific — consent applies to the purposes stated in this policy and no others
Freely given — use of Nova is voluntary, and declining is offered as plainly as agreeing
Unambiguous — you make an express statement of consent by ticking a box that says so; nothing is inferred from your using the app

You may withdraw consent at any time by deleting your account, which permanently removes every record rather than archiving it, or by contacting us. Because your treatment record cannot lawfully be held without this consent, there is no option to withdraw it and keep the account. If we wish to collect or use your data for any new purpose not described in this policy, we will seek your consent before doing so.

Anonymised, aggregated statistical reports are derived from data that has been irreversibly anonymised and do not constitute personal data. The production of such reports does not require individual consent. Usage data collection is off by default; if you have enabled it, you can disable it again at any time in Settings or by contacting us at privacy@heynova.org.

9. Children

Nova is for people aged 18 and over. The first time you sign in you confirm that you are 18 or over, on the same screen where you give consent for us to hold your treatment information. We do not verify age beyond that declaration.

We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us personal data, email privacy@heynova.org and we will delete it. We will confirm once we have.

10. Clinic reviews

When you submit a clinic review you are choosing to publish your assessment of a clinic’s care. Reviews are rated across six dimensions — communication, waiting times, cost transparency, feeling informed, dignity and respect, emotional support — each scored from 1 to 5.

Your treatment outcome is not part of the calculation. A clinic’s score is the average of your six ratings. We do not incorporate your treatment outcomes into the clinic’s overall score. You can choose to have your treatment outcome published alongside your review, which will also allow a clinic’s reviews and scores to be broken down by outcome once a category has enough reviews. You may also decide not to publish your treatment outcome.

You choose whether your review carries a name. You can publish a review under a display name you choose, or with no name at all, and you decide separately for each review. We never publish your email address or your treatment profile. Your review shows the information you provide in the review submission flow — the treatment type, the year of treatment, your six ratings, your title, what you wrote, the outcome where you chose to publish it, and, if your review is linked to a cycle recorded as current at that exact clinic in Nova, a badge reading Tracked with Nova. That badge is not verification: we have not checked the record with the clinic, and the sentence saying so is published beneath every review that carries it. We hold a link between your account and your review internally, so that you can edit or withdraw it and so we can act if someone reports it. That link is never published.

Before you create or save a review, we ask for explicit consent to store and process its health information. Drafts are private. Before submission, we separately ask for explicit consent to public publication of the review shown in your preview, including treatment details and comments. Outcome-statistics choices are separate. We record your consent wording, version and time. You can delete drafts or withdraw and delete submitted reviews in the Reviews Hub. An alias does not guarantee anonymity, and we cannot guarantee removal of copies others have already made. Reviewing is optional.

A display name also links your reviews to each other: somebody reading one can find the others you have published under the same name.

Your written review is published in full on the Nova website and in the app, and search engines can find it. Please write about your own care. Anything you write about somebody else, such as a partner, a donor or a child, is published too. Leave out their names, dates and anything else that would identify them, and please do not identify a donor. This applies to your outcome as well: if you write about the outcome in your review body, it will be published as part of the review, regardless of what you chose for the outcome question.

A person reads every review before it appears. We may ask you to change something, or decline to publish. Every published review carries a link to report it and a link to our moderation policy, and the clinic is always given a right of reply, shown directly beneath the review it answers. You can edit your review for 30 days after it is published, and withdraw it at any time. Withdrawing permanently deletes the review and its associated replies, reports, helpful votes and edit history; it does not delete your account or treatment records.

Small samples are suppressed. A clinic’s headline score is not published until it has at least 5 moderated reviews, and an outcome breakdown is not published until that category has at least 8 moderated reviews. Below the threshold, reviews will not be published.

11. Support network and data sharing

Nova allows you to invite supporters (partners, family members, friends) to follow parts of your treatment. Sharing is controlled entirely by you:

Each sharing category (including medications, appointments, cycle updates, doses, mood/today) must be individually enabled
All categories default to off until you toggle them on to share
Journal entries cannot be shared — there is no sharing category for them
You can revoke a supporter’s access at any time, and it takes effect immediately
If you delete your account, all supporter access is severed immediately

Supporters see only what you have explicitly chosen to share. They cannot see your full profile, your journal, your embryo records, your egg batches, or any category you have not enabled.

12. Push notifications and reminders

If you enable medication reminders, we store a push notification subscription (device endpoint and encryption keys) so we can deliver reminders when the app is closed. Reminders are:

Opt-in only — they are never enabled by default
Discreet by default — the notification says “You have something due” without naming the medication
Detailed notifications (showing the medication name) are available but require you to opt in separately
You can disable reminders at any time, and we immediately mark the subscription as revoked

Reminder delivery records note whether a reminder was sent, failed or skipped, and why. They never contain the name of a medication or the content of the reminder — a record refers to your medication by an internal reference, and the reason is an operational code such as “already sent” or “no device accepted”. Only you can see your own delivery records. We do not record whether you opened a notification.

13. Data breaches

In the event of a personal data breach that poses a risk to your rights, we will:

Notify the ICO within 72 hours of becoming aware of the breach (UK GDPR)
Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights
Notify the OAIC as soon as practicable where the breach is likely to result in serious harm (Australian Notifiable Data Breaches scheme)
Take immediate steps to contain and remediate the breach

14. Changes to this policy

We will update this policy if our data practices change. If we make material changes — particularly any change to the categories of data we collect, who we share data with, or the purposes of processing — we will notify you within the app before the changes take effect and, where required, seek your renewed consent.

The effective date at the top of this policy reflects the most recent revision.

15. Contact us

If you have any questions about this privacy policy, want to exercise your rights, or have a complaint about how we handle your data:

Email: privacy@heynova.org
Post: Seaglass Projects Ltd, 16 Eastchurch Road, Cliftonville, Margate, CT9 3EN, United Kingdom

If we have not resolved your concern, you have the right to complain to your local supervisory authority:

UK: Information Commissioner’s Office (ICO) — ico.org.uk
Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au