How we handle your information

Effective 8 August 2026 · Last updated 23 August 2026

1. Who we are

Veya is provided by Ad Astra HoldCo Limited, a company registered in England and Wales (company number 16884640), whose registered office is at 128 City Road, London, United Kingdom, EC1V 2NX.

For the purposes of UK data protection law we are the controller of the personal data described in this policy. You can contact us at support@tryveya.app.

2. Where this policy applies

3. Key terms

• Your health record. Information about your treatment that you provide in the app, including the doses and injection sites you record, your weights and body measurements, the symptoms you record and any notes you add, your dose schedule and dose history, the medicine you are taking and what you spend on it.
• Account information. The information needed to operate your account, being your email address or Apple identifier and your subscription status.
• Anonymised and aggregated information. Information about groups of users, such as counts, averages and distributions, from which identifiers have been removed and which is not intended to be linkable to any individual.
• Product analytics. Information about how the app and this website are used, and about whether they are working correctly.
• Attribution. Measurement of which advertising brought a user to Veya.

4. What we collect, and why

Your health record

We process your health record in order to provide the core features of the app, including your history, your schedule, your reminders and your charts, and so that your record remains available to you if you lose or replace your device.

It is held in two places. On your device, where the app reads and writes it, which is why the app works without a connection. And, once you have an account, in that account on our servers, to which your device sends it when a connection is available. Our database is hosted in the United Kingdom.

Your health record syncs once you have an account, and not before. Until you sign in it is held on your device only. If you lose or replace your device, or delete the app, without first exporting your record, it cannot be recovered and we cannot recover it for you, because we hold no copy of it. When you sign in, the record already on your device is sent to your account and later entries follow.

The copy on your device is held in the app’s private storage, protected by the device’s file encryption, and is included in your device backups where you have enabled them.

Further detail is set out in our Health Data Privacy Policy.

Account information

Emails we send you

We use the email address on your account to send you service messages, such as confirming your account, signing you in, resetting your password, and telling you about changes to this policy or to the Terms. These are part of operating your account and are not marketing.

We also use it to send occasional emails about Veya, covering new features, guidance on getting the most from the app, and offers. These are infrequent, and every one of them contains an unsubscribe link. Unsubscribing stops them and does not stop the service messages above.

Where you give us your email address on this website, such as to be told when the Android app is available, we use it for the purpose you gave it for. We also receive information held in the address of the page you submitted the form from, which indicates which advertising or link brought you to it.

Device and technical information

Operating the app and this website produces authentication records, security and error logs, crash and performance reports, and ordinary technical information such as IP addresses, device and app details, timestamps and identifiers. Our hosting, analytics and attribution providers process this information as part of delivering their services to us.

Payment and subscription information

Subscriptions are purchased and cancelled through the app store, which processes your payment under its own terms. We do not receive your card details. We use RevenueCat to manage subscriptions, which involves a customer identifier linked to your account, your subscription status and related purchase information.

5. Legal bases

Under UK data protection law we must have a lawful basis for our processing. These are ours.

You may withdraw your consent at any time, and withdrawing it is as straightforward as giving it. See §12.

6. What we do not do with your health record

We do not sell your health record. We do not disclose it to our advertising or attribution providers, and it is not used to target advertising to you.

We may use your health record in anonymised and aggregated form to understand how well the app works and to publish general findings, such as the weight change or the symptoms typically recorded by people using Veya over a period. Anonymised information does not identify you, and we do not attempt to re-identify it.

7. Who we share information with

We use the following providers to operate Veya. They are permitted to use what they receive to provide their services to us, under contracts requiring them to protect it. Apple is not acting on our instructions, and our advertising and attribution providers also process data for their own purposes as set out in their own policies.

We may also disclose information where we are required to do so by law or legal process, or where we consider disclosure necessary to protect rights, safety and security. If Veya is involved in a merger, acquisition, financing, reorganisation or sale of assets, information may be transferred as part of that transaction, and we will give notice where the law requires it.

8. Product analytics

We use PostHog to understand how the app and this website are used and whether they are working correctly. PostHog processes this information on our behalf and is not an advertising provider.

It receives information about your use of the app and this website rather than the content of your record: the screens you view, the setup steps you complete and how you interact with them; the fact that a dose, weight or symptom was recorded and when; the medicine type you selected and the band into which your monthly spend falls; sign-in, subscription and purchase events; device and app information such as app version, operating system, device type and the country taken from your device’s region setting; and error reports, from which the error message is removed before it is sent.

The content of your health record is not sent to analytics, including dose amounts, weights, measurements, symptom names, injection sites and notes.

Part of this information is health-related. Records of when you log, the medicine type you selected and the screens you visit each indicate something about your treatment, and we treat that information accordingly.

Before you sign in, analytics is not linked to your identity. When you sign in it is associated with your account identifier. Your email address is not sent to analytics. Reminders are scheduled by your device and there is no notification server.

Your choices.The app’s privacy settings include a control that turns off product analytics, at Privacy and your data → Product analytics. It stops the information described in this section and it is remembered on your device. It takes effect when you turn it on and does not recall information already sent. A separate control turns off advertising and attribution, described in §9.

If you send us a feedback message while product analytics is off, that message still reaches us, because you asked us to send it. It is sent without an identifier and without the analytics tools, and the app says so beside the box.

9. Advertising, attribution and cookies

We advertise Veya, and we measure which advertising works. We use AppsFlyer for attribution in the app, and Meta, Google and TikTok for advertising and measurement.

In the app, these providers receive installation, app-opening and purchase information, together with the identifiers needed to attribute it. Attribution is measured through Apple’s aggregated framework, and the app does not collect your device’s advertising identifier.

On this website, we and these providers use cookies and similar technologies, which may collect browser and device information, cookie identifiers, the pages you view and approximate location inferred from an IP address. They may also use that information for their own purposes, as described in their own policies. The tools on this site run in your browser and the values you enter are not sent to us.

Your choices.The app’s privacy settings include a control that stops advertising and attribution. It takes effect when you turn it on and does not recall information already sent. In your browser, you can control cookies through your browser settings and the controls each provider offers. If you are in a jurisdiction that gives you the right to opt out of the sale or sharing of personal information for advertising, contact us.

No part of your health record is sent to any of these providers.

10. Where your information is held

Our database is hosted in the United Kingdom (London) for all users, in every country in which Veya is available. If you are in the United States, your information, including your health record, is stored in the United Kingdom rather than the United States. We do not separate storage by region.

Several of the companies we rely on operate internationally. RevenueCat, AppsFlyer, Meta, Google, TikTok and Apple are based in the United States, so account, subscription, technical, analytics and advertising information may be processed there or elsewhere outside the United Kingdom. Where that occurs we use the safeguards required under UK data protection law for international transfers, such as the UK International Data Transfer Agreement or the UK Addendum to the standard contractual clauses. If you wish to know which safeguard applies to a particular provider, contact us and we will tell you.

11. How long we keep it

Cancelling your subscription deletes nothing.Your account and your record remain, and export continues to be available. Cancelling restricts the app’s paid features only.

We retain a minimal record of the consent you gave, and nothing more. The law requires us to be able to demonstrate that consent was properly obtained, which we cannot do with a record we have deleted. After deletion we therefore retain a compliance record containing the fact that consent was given, when it was given, and the versions of this policy and of the Terms to which it related. Your identity is removed from that record as your account is deleted: your account identifier is replaced with a one-way fingerprint of it, so that what survives records that a person accepted those document versions at that time rather than identifying you. It is not used to contact you, to profile you, or for analytics or advertising.

12. Your rights

Under UK data protection law you may ask us to:

• Provide a copy of the information we hold, or provide it in a portable form. Export in the app produces a file of your whole record on demand, and remains available after your subscription ends.
• Correct anything inaccurate. Your record is editable in the app, and changing it there changes what we hold.
• Delete the information we hold. See §13.
• Withdraw your consent, including your explicit consent to our holding and using your health record, at any time. Withdrawal stops further processing on that basis and does not affect processing carried out before you withdrew it.
• Stop marketing emails at any time, using the unsubscribe link in any of them or by contacting us. You do not have to give a reason and we will action it.
• Restrict or object to our processing, and ask us to explain it.

Email support@tryveya.app and we will respond within one month. We may need to verify your identity before acting on a request, which will usually mean confirming access to the account in question. If we refuse a request we will tell you why, and you may appeal by replying to that response.

If you are dissatisfied with how we have handled your request you may complain to the Information Commissioner’s Office, the United Kingdom’s data protection regulator. If you are in the United States you may also be able to complain to your state Attorney General.

13. Exporting or deleting your information

Exportis available in the app’s settings and produces a spreadsheet of your whole record on demand, including after your subscription has ended.

The app’s settings also offer two deletion options.

• Delete my data erases your health record from your device and from your account on our servers. Your account is unaffected, so your subscription is retained.
• Delete my account removes your account, your account information and your health record from our servers, retaining only the minimal consent record described in §11, from which your identity is removed as the deletion occurs. The copy on your device is not affected, on the basis that leaving a service is not a request to destroy your own copy of your treatment history. Use both options if you want both removed.

Deleting the app removes the copy on your device. If you have an account, your record remains in it and is restored when you sign in on a new device. If you have never signed in, deleting the app destroys the only copy, so you should export first.

14. Security

We use administrative, technical and organisational measures designed to protect your information and appropriate to its sensitivity. These include access controls that separate each account’s record from every other, encryption in transit, encryption at rest where our providers support it, and limiting access on our side to those who require it in order to operate, secure and support Veya.

No method of transmission or storage is completely secure. If a breach affects your information and the law requires us to notify you, we will.

15. Children

Veya is intended for adults. It is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.

16. Changes to this policy

We may update this policy from time to time. The current version is always available at this address, with the effective and last-updated dates shown at the top.

Ordinary changes, such as a clarification or a new provider within a category already described, take effect when we update the last-updated date, and your continued use of Veya after that date constitutes acceptance of the updated policy. If we make a change that materially affects what you have consented to, we will notify you and ask you to accept the updated policy in the app, because consent to the processing of health information must be given actively and will not be inferred from your continued use.