Hey Conscious – Privacy Policy

Version 1.0, last updated 8 October 2026.

1. Who we are and what this policy covers

1.1 Controller. Hey Conscious Ltd (“Hey Conscious”, “we”, “us”), a company registered in England and Wales (company number 16387779), is the controller of your personal data. Contact us at hello@heyconscious.com.

1.2 What this covers. This policy covers the Hey Conscious app, our website at www.heyconscious.com and our related services (the “Services”). It replaces our website privacy policy dated 1 May 2025. It should be read with our Terms and Conditions.

1.3 Laws. We follow the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). The app is available through the UK App Store. If you use it from the EU or elsewhere, we also respect the rights your local law gives you (sections 11 and 12).

2. The short version

• Most of what you tell the app stays on your phone: your first name, your health goals and food preferences (including allergies), your scan history, shopping list and saved results.
• Our servers receive the barcode of each product you scan, the country you are in (worked out from your connection), your account details if you create an account, and technical information needed to run the app.
• We use analytics to improve the app. With your consent, we also use session recordings, with names, emails and health information masked.
• We use AI tools to help fill gaps in our product data. We send it product information and a country, never anything that identifies you.
• We do not sell your data, we do not show adverts, we do not track you across other companies’ apps, and we do not collect precise location, photos, contacts or payment card details.
• You have rights over your data, including access, correction, deletion and objection. See sections 11 and 12.

3. What data we collect

Your data lives in three places: your device, our servers, and our analytics provider. We describe each below.

3.1 Stored on your device only. We do not receive this data, except where stated.

This data stays on your device until you delete the app. Signing out or deleting your account does not erase it. You can delete it by deleting the app.

3.2 What our servers receive and store.

We never receive your first name or onboarding profile.

3.3 Analytics and diagnostics. We use PostHog, hosted in the EU, to understand how the app is used and to fix problems. Everything is attached to the random device ID. We do not link it to your account, name or email.

• Usage: screens, app lifecycle, features used, device model, operating system, locale, timezone, app version.
• Products: barcodes and products you scan, open, rate or add to your list.
• Approximate location from your IP address: such as your country or region.
• Session recordings (section 6).
• Errors, crashes and logs.
• Product research records: the prompts we send to the AI model and its answers, which contain product information but not your personal data.

Our IP-address data is anonymised when PostHog receives it.

3.4 What we do not collect. We do not collect precise (GPS) location, photographs or video (the camera reads barcodes on your device), your contacts, advertising identifiers or payment card details. If you buy Premium, payment is handled by Apple, and we receive only confirmation of your subscription.

3.5 Website. On heyconscious.com we may collect your IP address, device and browser information, pages visited, your email address if you join our newsletter, and anything you send us, such as a message or survey answer. We use cookies as described in section 6.

4. Why we use your data and our legal bases

Under the UK and EU GDPR we must have a legal basis for using your personal data. These are ours.

Where we rely on consent, you can withdraw it at any time (section 6.3). Where we rely on legitimate interests, you can object (section 11). We have considered the balance between our interests and your rights and use only data we need.

5. Allergies and health preferences

5.1 What this is. If you tell the app about allergies, intolerances, dietary choices or health goals, that information is about your health and is a special category of personal data. The law gives it extra protection.

5.2 Where it goes. You enter it in the app and it is stored on your device. We do not send it to our servers or to the AI provider. Only a summary (such as counts and the top value, never the answers themselves) is included in analytics events.

5.3 Your consent. By entering this information you ask us to use it on your device to personalise what the app shows you, and you give your explicit consent for that. You can change or remove it at any time in the app under Account › Privacy. Our Terms explain that you must not rely on the app for allergy safety.

5.4 Session recordings. The app masks your name, email and your onboarding answers, including allergies and health information, in any session recording.

6. Analytics, session recordings, cookies and similar technologies

6.1 Why consent matters. UK and EU rules (PECR and the ePrivacy Directive) require your consent before we store or read identifiers on your device for analytics or session recording, unless they are strictly necessary to provide the service you asked for.

6.2 What we ask. When you first open the app we ask whether you agree to analytics and session recordings. The app works fully if you say no. If you say no, we do not send analytics events or recordings. We still receive the technical data needed to run the service (section 3.2), and error reporting based on legitimate interests.

6.3 Changing your mind. You can change your choice at any time in Account › Privacy. Withdrawing consent does not affect what we did before. To ask us to delete analytics data held under your device ID, see section 11.

6.4 Session recordings. If you agree, we record how the app looks and behaves during your session so we can watch a problem happen and fix it. Recordings keep the console log and, on iOS, the requests the app makes, which name the barcodes you scan. We keep recordings for 30 days. We mask text that identifies you (section 5.4).

6.5 Cookies on our website. Our website uses essential cookies, which do not need consent, and analytics cookies, which do. We ask for your consent in our cookie banner and you can change your choices at any time at [Cookie settings link]. [List of cookies / link to Cookie Notice.]

7. How we use AI

7.1 Where we use it. Our scoring system is built on our own Database, criteria and rules. Where information about a product is missing, and to help find alternatives, we also use AI models from third-party providers (we may use more than one). They read product records and search the web to find and structure product information, and they help assess products against our criteria, flag recognised concerns and draft plain-English summaries, which our rules and formula then process (see our Methodology notice).

7.2 What we send it. We send product records, previous assessments of products and, when finding alternatives, the country you are in. We do not send your name, email, account details, device ID, preferences, allergies or scan history. We do not send anything that identifies you. The AI does not make decisions about you: it helps assess products, assessments are the same for every user, and they have no legal or similarly significant effect on you.

7.3 AI provider’s use of data. Our AI providers do not use the data we send through their APIs to train their models. They keep requests and responses for up to 30 days, to monitor abuse and run the service, and then delete them.

7.4 Accuracy. AI can make mistakes. Our Terms and Methodology notice explain this. If you think an assessment about a product is wrong, tell us.

8. Who we share data with

We do not sell your personal data. We share it only with the providers below, who process it for us under contract and only on our instructions, and in the situations in 8.2.

8.1 Our providers.

8.2 Others we may share with. Professional advisers (lawyers, accountants, insurers), regulators and law enforcement where the law requires, a buyer or investor in a sale, merger or financing of our business (who must honour this policy), and anyone else with your consent. We may share anonymous, aggregated information, which is not personal data.

9. International transfers

Some of our providers are in the United States or operate globally (Cloudflare, our AI model providers, Expo, Google). We also use providers in the EU and France. Where we transfer UK personal data outside the UK, or EU personal data outside the EEA, we use a lawful safeguard:

• an adequacy decision (the UK recognises the EEA as adequate, and the EU recognises the UK);
• the UK-US Data Bridge or the EU-US Data Privacy Framework, where the provider is certified; or
• the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, together with a transfer risk assessment.

You can ask us for a copy of the safeguards in place at hello@heyconscious.com.

10. How long we keep data

We keep personal data only for as long as necessary for the purposes in this policy, unless the law requires us to keep it longer. The periods below are the ones we currently apply.

Deleting your account. Deleting your account in the app removes your user, account and session records from our servers. It does not erase the data on your device (delete the app) and, because your analytics are tied only to a device ID and not to your account, it does not remove analytics and recordings. You can ask us to delete analytics data by sending your Analytics ID (shown in Account › Privacy) to hello@heyconscious.com. Backups and logs are removed on their normal cycle.

11. Your rights in the UK and EU

Under the UK and EU GDPR you have the right to:

• be informed about how we use your data (this policy);
• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• erase your data in certain circumstances;
• restrict how we use it in certain circumstances;
• data portability, to receive your data you gave us in a common format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, where we rely on consent; and
• not be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions.

How to use your rights. Email hello@heyconscious.com. Because most of your data is on your device, and our analytics are tied to a random device ID and not to your name, we may need you to give us your Analytics ID (found in Account › Privacy) so that we can find analytics data about you. If you have an account, we may also need your account email. We will not ask for more than we need to confirm it is you. We respond within one month, which we can extend by two months for complex requests.

Limits. Some rights depend on the legal basis, and we may refuse a request where the law permits, for example where the data is not identifiable to you.

Complaints. You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk, or to the data protection authority in your country in the EU or EEA. We would appreciate the chance to put things right first.

12. Your rights elsewhere

12.1 Other countries. The app is available through the UK App Store. If you use it from elsewhere, you may have rights under local law, such as US state privacy laws, Canada’s PIPEDA, the Australian Privacy Act or Brazil’s LGPD. Email hello@heyconscious.com and we will respond in line with local law. We do not sell personal data or share it for targeted advertising.

13. Children, security, marketing, changes and contact

13.1 Children. The Services are not for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us data, tell us and we will delete it.

13.2 Security. We use appropriate technical and organisational measures, including encryption in transit, access controls and limited retention. No system is completely secure. If a breach is likely to put your rights at risk, we will notify the ICO within 72 hours and tell you where the law requires.

13.3 Marketing. We send our newsletter and marketing emails only if you sign up and agree. You can unsubscribe at any time using the link in each email or by contacting us. We do not send marketing messages from the app.

13.4 Changes. We may update this policy. We will post the new version with a new date and, if the change is significant, notify you in the app or by email before it takes effect.

13.5 Contact. Hey Conscious Ltd. Email hello@heyconscious.com.