Last updated: 22 July 2026.
The Fatigue Management Journal ("FMJ", "the app") is provided by The Brain Injury Therapist(the "controller"). This notice explains how we handle your personal data under the UK GDPR and the Data Protection Act 2018. If you are in the EU/EEA, the equivalent EU GDPR provisions apply.
What we collect
- Account: name (or nickname), email address, authentication provider (email/password or Google).
- Health-related data you choose to enter: energy levels, sleep timing, mood, symptoms, medications you mention in notes, activities, triggers, locations, and personal reflections.
- Usage data: which pages you visit inside the app, timestamps of logs, and technical logs needed to run the service securely.
- Payment data (if you subscribe): handled by Stripe. We store only the subscription status and period, never your card details.
Legal basis
- Account & service data: performance of a contract with you (UK GDPR Art. 6(1)(b)).
- Health-related data (special category): your explicit consent (Art. 9(2)(a)), given at signup and withdrawable at any time by deleting your account.
- Security logs: our legitimate interest in keeping the service safe (Art. 6(1)(f)).
Who processes your data (subprocessors)
We use the following processors to run FMJ. Each acts only on our instructions and under appropriate data-processing or service terms.
- Lovable — application hosting, deployment, and Cloud infrastructure. DPA: requested from Lovable support (support@lovable.dev). Sub-processors: see Lovable's sub-processor list.
- Supabase — database, authentication, and storage (EU region). DPA and sub-processors: supabase.com/legal.
- Stripe — payment processing (only if you subscribe). DPA: covered by Stripe's services agreement and data processing terms at stripe.com/legal/dpa.
- Google — only if you choose "Continue with Google" for sign-in. Terms and data processing: cloud.google.com/terms.
Where your data is stored
Primary storage is in the European Union. Some subprocessors (e.g. Stripe, Google) may transfer data outside the UK/EEA under Standard Contractual Clauses or the UK Addendum.
How long we keep it
Your data is kept for as long as your account is active. If you delete your account, all your logs, plans, reflections, discovery entries, and profile are permanently removed within 30 days. Payment records retained by Stripe follow their own retention rules for tax and fraud-prevention purposes.
Your rights
Under UK/EU GDPR you can:
- Access a copy of your data — use "Export my data" in Settings.
- Erase your data — use "Delete my account" in Settings.
- Rectify inaccurate data — edit any entry directly, or contact us.
- Withdraw consent — deleting your account withdraws health-data consent.
- Object or restrict processing, or request portability.
- Complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
Cookies and tracking
We use only the strictly-necessary cookies/localStorage entries required to keep you signed in and to remember your accessibility preferences. No advertising or third-party analytics cookies are set.
Admin access
A single administrator (Natalie Mackenzie, The Brain Injury Therapist) can view aggregate engagement information (signup date, last active, streak counts) for the purpose of supporting users. Every admin view is recorded in an internal access log.
Children
FMJ is not intended for anyone under 16. You must confirm you are 16 or older at signup.
Contact
Data controller: The Brain Injury Therapist. Questions or to exercise your rights, please contact us.