Effective date: 30 September 2026. Last updated: 11 October 2026. Published by My Eczema Health Limited.

This policy explains what information the myEczema app, the EczemaRank community inside it, and this website collect, why, and what your rights are. We've tried to write it in plain English rather than legal language, because the people reading it are living with eczema, not studying data law. If anything here doesn't match what you see in the app, tell us at hello@myeczemaapp.com and we'll fix whichever one is wrong.

Who we are

myEczema is run by My Eczema Health Limited, a company registered in England and Wales (company number 17117328). Our registered office is 112 Trent Gardens, London, England, N14 4QN, and we're registered with the Information Commissioner's Office (ICO) under number ZC195091. We decide how your information is used, which is what data protection law calls a "data controller".

Our privacy lead is Zaki Qadus. If you have a question about this policy, or want to use any of the rights below, email hello@myeczemaapp.com.

What we collect

In your diary, on your phone. Your symptom scores (itch, redness, dryness and oozing), your daily flare score, mood, stress and sleep; the foods, triggers, creams and treatments you log; notes and skin photos; treatment experiments, appointments and GP referral dates; reminders and settings. Also, only if you choose to use them, your period days (the Period module is off by default) and your postcode, for the NHS wait-time estimate. We don't receive any of this.

If you use the EczemaRank community. Your email address, the ratings and reviews you post, the username you choose if you pick one, a record of the agreements you tick (sharing your votes and reviews with the community ranking, our Terms and this policy, and our community rules), and a record of each time you remove your votes and reviews. Posts are public, so please don't put anything that identifies you in the text.

If you turn on analytics. Basic usage events, described under How we use analytics. Never your health information.

If you turn on AI wording for Pattern Review. Numbers only, described under AI Pattern Review.

On this website. What you send us through the partner form, and what people sent through our beta signup form while it was open, described under This website.

Why we're allowed to use your information

Your diary: we never receive it. It's your own record, kept on your phone.
Your community account: that's the service you've asked us for, so we rely on our contract with you (UK GDPR Article 6(1)(b)).
Adding the votes and reviews you choose to make to the community ranking: your agreement, which you give when you create your account. Ratings of treatments you've tried for your eczema are information about your health, so this is your explicit consent (Articles 6(1)(a) and 9(2)(a)). You can withdraw it at any time in Settings > Remove my votes and reviews.
Analytics, AI wording, Research contact and the beta signup (while it was open): we only do these if you've actively said yes (Article 6(1)(a)), and you can change your mind at any time.
The research pool and AI wording both involve information about your health, so they also need your explicit consent (Article 9(2)(a)).
Keeping a record of the consent choices you make: the law requires us to be able to show that you agreed (Article 6(1)(c)).
Handling reports, stopping abuse and answering partner enquiries: our legitimate interest in keeping the service safe and replying to people who contact us (Article 6(1)(f)).

Where this information stays, and where it doesn't

Your diary stays on your phone. It isn't sent to us when you log symptoms, treatments or photos. We don't run a server that holds it, and we can't see it. You don't need an account to use the diary.

These features all run on your phone, using your diary:

Pattern Review counts how often something you logged appeared on the same days as a higher flare score. It's a count of your own entries. It doesn't diagnose anything, predict anything or recommend anything.
Period prediction, if you turn it on, estimates when your next period starts from the dates you've logged. It doesn't compare your periods with your flare scores, and it isn't a contraceptive or fertility tool.
The NHS wait-time estimate, described below.

The app also keeps a private record, on your phone, of the privacy choices you make and when you made them. That's there so we can show your choices were respected.

Weather. The home screen shows the forecast for the nearest point on our UK city grid. The app sends that coarse location to our server, which gets the forecast from MET Norway. No location is sent to a third party directly from your phone. Pollen levels are based on Copernicus Atmosphere Monitoring Service information. Weather data from MET Norway and pollen information from Copernicus are both available under CC BY 4.0.

AI Pattern Review

AI wording for Pattern Review is an optional extra that may be offered in the app. It's off by default, it only runs if you turn it on, and it's only offered to people who confirm they're 18 or over. It works on both iPhone and Android. Like the rest of myEczema, it's free.

Pattern Review always counts your logs on your phone. If you turn AI wording on, Google's Gemini AI chooses the wording for those counts from a short list of sentences we've written. It can't change the numbers, add anything, predict anything or give advice, and the counts are exactly the same with it on or off. It doesn't diagnose or treat anything, so please talk to your GP or pharmacist about your skin.

What's sent: numbers only. For each row, the app sends a label such as "F1" and two numbers: the number of days a factor and a higher flare were recorded together, and the number of days you logged. The names of your foods, creams, triggers and symptoms never leave your phone. The app puts them back in once the wording comes back. Your notes, photos and period data are never sent, and if anything you've logged looks period-related, nothing is sent at all.

Who receives it: the numbers go to our AI server, which runs on Google Cloud in the United States, and from there to Google's Gemini API. Our server doesn't keep the numbers. Before anything is sent, the app confirms that requests come from a genuine copy of myEczema on a genuine device, using Apple's App Attest on iPhone and Google's Play Integrity on Android. On Android, the app sends our server an integrity token that Google issued for that request, and our server asks Google to check it under Google's own terms. Google's answer says whether the app and the device pass its checks. We use it only to decide whether to accept the request and don't store the token or Google's answer.

What our AI server does keep: your answer to the 18 or over question; whether you've turned AI wording on or off, when, and which version of the explanation you agreed to; and a daily count of requests, so we can limit use. These are stored against an identifier derived from a key that never leaves your phone, not against your name, email address or community account. We delete these records, and that identifier, 12 months after you last used AI wording, turned it on or off, or answered the age question. If you answer that you're under 18, the option is hidden, and we keep only that answer and the date you gave it, so AI wording can't be switched on later from that installation of the app. We keep that answer with no time limit, because it's what keeps AI wording off.

You can turn AI wording off at any time in Settings. It stops straight away and nothing more is sent. We don't use it to make any decision about you. Lawful basis: your consent and your explicit consent for health data (Articles 6(1)(a) and 9(2)(a)).

The EczemaRank community

The Community tab in the app, and the Community page on this website, show treatment rankings and reviews from our EczemaRank service. In the app, you need a free community account and the sharing agreement to see community rankings and discussions. On our website, community rankings and discussions are public to read. Either way, your phone or browser connects to our server, which sees your IP address.

Prescription medicines: we don't rank or rate prescription medicines. Instead, each has a community discussion where people share their own experience. This is community opinion, not medical advice. Talk to your clinician before starting, stopping or changing a prescription. Posts can be reported and are reviewed by our team.

Creating an account, and sharing to the ranking

When you create a community account, you tick two separate boxes. One is to agree that the votes and reviews you choose to make are added to the EczemaRank community ranking. The other is to agree to our Terms and this Privacy Policy. Creating an account shares nothing by itself. Only the votes and reviews you choose to make are added to the ranking, and you never have to make any. Reviews are shown publicly. We never sell them.

This agreement is for the community ranking only. It isn't agreement to research, which is a separate choice (see Research choices below). We keep a record of each box you tick: your account, when you ticked it, and which version of the wording you saw. If you already had an account, we'll ask you once for the sharing agreement at your next sign-in. Until you agree, you won't be able to view, vote on or review community content in the app. Your earlier votes and reviews stay as they are.

Removing your votes and reviews

Settings > Remove my votes and reviews takes all your votes and reviews out of the ranking in one tap. We delete them and recalculate the rankings straight away. You keep your account, and you can keep viewing the rankings. We keep a record that you did it: when, and how many votes and reviews were removed, but never which ones.

Older anonymous posts from before we started linking them to accounts, and anything you posted before you signed in, may not be linked to your account, so they can't be removed this way. Email hello@myeczemaapp.com and we'll help you find them.

Posting

To rate or review, you need to sign in, to have agreed to share your votes and reviews with the ranking, and to agree to our community rules. We store your rating, what you write (title, review, pros and cons, how long you used the treatment and whether you'd recommend it), which version of the rules you agreed to and when, and, in the app, whether you've allowed research use. You can hide your username so your posts show without a name. They're still linked to your account on our side, so we can moderate them and so blocking works, but that link is never shown publicly. Some posts are held for a moderator to check before they appear.

Before sign-in was needed, people could rate and review without an account. Those older posts are stored with a random ID for the phone or browser session they came from, and they're shown without a name.

Signing in

To sign in, you give us your email address and we email you a one-time code, which expires after 10 minutes. You then stay signed in for up to 30 days. You can pick a username, which is shown publicly on your reviews, or choose to stay anonymous. Your email address is never shown publicly. We also record when you last signed in. We never link your ratings or reviews to your diary.

Reports and blocking

If you report a review, we store the report, the reason you picked, any details you add, your account if you're signed in, and a scrambled (salted and hashed) version of your IP address so we can limit abuse of the report button. If you block someone, the block is kept on your phone and, if you're signed in, saved to your account too, so it works wherever you sign in. The saved copy is deleted with your account.

When someone reports a review, we email the reported text and any details they added to our team at hello@myeczemaapp.com, so we can act on it. You can also write to that address about a report.

What we don't show

Reviews of prescription-only medicines aren't shown publicly.

Research choices

The app has two research choices, both off by default:

EczemaRank data-sharing: lets your ratings go into an anonymised research pool as well as the public ranking. Research only, never sold. We store this choice with each rating and review.
Research contact: If you turn on Research contact, we may show you invitations to research studies in the app. We do this with your consent, and you can turn it off any time in Settings. We don't share your details with study teams.

If you delete your community account, or it's deleted after 24 months without a sign-in, your ratings and reviews leave the research pool.

IP addresses

Our servers see your IP address whenever the app or website connects to them. We don't store the address itself. For sign-in codes, reports and website signups we store a salted hash of it, which lets us spot abuse without keeping the address. Our hosting provider's request logs record IP addresses and browser details and are kept for 1 day.

Deleting your account

Go to Settings > Data & Privacy > Delete my account, or email hello@myeczemaapp.com from the address you sign in with and we'll do it for you. This permanently deletes:

your account, the email address you sign in with, and your records of agreeing to the community rules, to share your votes and reviews with the ranking, and to our Terms and this policy;
the people you've blocked;
everything the app keeps on your phone, including your diary, photos, reminders and settings.

Your ratings and reviews stay up and keep counting towards the rankings, but we remove everything that links them to you, and they show as from a "Former member". We don't edit what you wrote, and they leave the research pool. If you'd rather your posts were removed completely, use Settings > Remove my votes and reviews before you delete your account, or email hello@myeczemaapp.com and we'll remove them. If a review has details in it that identify you, report it or email us and we'll hide it.

Anything you posted anonymously before this change, whether or not you were signed in, may not be linked to your account, so it can stay up without a name. Reports you made are kept without your details, and so are the records of any times you removed your votes and reviews. The private record of your privacy choices stays on your phone, so there's proof they were respected.

If you don't sign in for 24 months, we delete your community account automatically. Your posts are handled in the same way as above, and nothing on your phone is touched.

If you never signed in, Settings > Data & Privacy > Clear All Data removes everything on your phone. To ask us to delete anything else we hold, such as anonymous posts, analytics events or a website signup, email hello@myeczemaapp.com and we'll help you find it.

The NHS dermatology wait-time estimate

If you add your postcode, the app estimates how long an NHS dermatology referral might take in your area, using a table built into the app. The lookup happens on your phone, and your postcode isn't sent to us or to anyone else. The figure is an estimate, not a guarantee.

If you tap the button to find a clinic on a map, the app opens Google Maps with your postcode in the search. That search goes to Google, under Google's own privacy policy.

How we use analytics

The app doesn't contain any third-party analytics or advertising trackers. It has a small analytics feature of our own, which is off until you turn it on in Settings > Data & Privacy. If you do, the app sends us which screens you open and which buttons you tap, along with a random ID made on your phone, the app version, whether your phone runs iOS or Android, and the time. It never includes your symptoms, your photos, anything you write or any other health information. The random ID is used only for analytics. It isn't your community account: analytics events are sent without your sign-in details, and we don't link the ID to your account, even when you're signed in.

These events go to our own EczemaRank server, and no analytics company is involved. If you turn analytics off, sending stops straight away and anything waiting to be sent is thrown away. Lawful basis: your consent (Article 6(1)(a)).

Sending emails

We use Resend, an email service based in the United States, to send sign-in codes and report alerts to our own team at hello@myeczemaapp.com. It also sent a welcome email to people who joined our beta list while that form was open. Resend receives the address each email goes to and the message itself. Sign-in codes and welcome emails don't contain your health information. A report alert carries the text of the reported review or comment, the reason picked and any details the reporter added, so it can include what someone wrote about their skin or treatments. It doesn't include the reporter's or the author's account.

This website

Beta signup: this form has closed. While it was open, people who joined the waiting list gave us their name and email address, and we stored those with where they heard about us, their browser details and a salted hash of their IP address. We still hold these details for the people who signed up. Lawful basis: their consent (Article 6(1)(a)). We keep them for up to 12 months, or until the person asks us to remove them.
Partner enquiries: if you contact us on behalf of an organisation, we store your name, work email, organisation and the type of enquiry, so we can reply. Lawful basis: our legitimate interest in responding to an enquiry you started (Article 6(1)(f)).
Community page: works as described under The EczemaRank community.
We don't use analytics or advertising on this website. If you use night reading on our guides, that preference is saved in your own browser. The community news section loads headlines through rss2json.com, which sees your IP address.

Where your information is stored

Your diary and photos are stored only on your phone. Our community database is in London, and our community servers run in London too. These are the other organisations that handle data when you use myEczema:

Neon hosts our database in London (Amazon Web Services, eu-west-2).
Vercel runs our servers and this website.
Resend sends our emails and is based in the United States.
MET Norway provides weather forecasts to our server. Your phone doesn't contact it.
Google runs our AI server (Google Cloud) and the Gemini API in the United States, if you turn on AI wording, and receives your search if you open the clinic map.
Apple and Google distribute the app through their stores under their own privacy policies. Apple also provides the App Attest check on iPhone, and Google provides the Play Integrity check on Android, as described under AI Pattern Review.
rss2json.com loads the news headlines on this website.

We don't sell your data, and we don't share it with advertisers.

There's also an archived copy of our community database from before 28 August 2026, when we moved it to London. It's held in the United States (Oregon) and contains community data only, never diaries or photos, because we never had those. We'll delete it once we've confirmed our London copy is complete.

How long we keep your information

Diary entries and their photos, on your phone: 365 days, then deleted automatically. The same for everyone.
Everything else on your phone: until you delete it, use Clear All Data, or delete the app. Deleting the app removes what's on your phone, but not your community account or posts, which are on our servers.
Sign-in codes and sessions: up to 30 days.
Community accounts: until you delete your account, or 24 months after you last signed in, when we delete it automatically. Your ratings and reviews then stay up as from a "Former member".
Your records of the agreements you ticked when you created your account, or when we asked you after signing in: until your account is deleted.
Records of removing your votes and reviews: kept as a record that the removal happened. When your account is deleted, we remove what links them to you.
Ratings and reviews: while they're published. You can remove them straight away in Settings > Remove my votes and reviews. If you ask us by email to remove them, we'll do it within one month. For what happens when you delete your account, see The EczemaRank community.
Analytics events: 365 days, then deleted automatically.
Banned accounts: if we ban an account for breaking the community rules, we keep a coded record of its email address so it can't be used to join again, even after the account is deleted. If you think a ban was a mistake, email hello@myeczemaapp.com to ask us to review it. If we lift the ban, we delete the coded record of your email address. This relies on our legitimate interest in stopping abuse, described under Why we're allowed to use your information.
AI wording records and the identifier derived from the key on your phone: 12 months after you last used AI wording, turned it on or off, or answered the age question. An under-18 answer is kept with its date only, and has no time limit (see AI Pattern Review).
Website signups: up to 12 months, or until you ask us to remove them.
Emails to hello@myeczemaapp.com (community reports and support emails): 2 years, then deleted.
Our hosting provider's request logs: 1 day.

Exporting your own data

Settings > Data & Privacy > Backup Data makes a file of your diary, including your photos and any period days. The app always asks you to choose a passphrase and encrypts the file with it. You then choose where the file goes (email, a cloud drive, your files).

We never receive your backup. Once you've saved or sent it somewhere, that service's own terms apply, and we can't reach or delete it. We can't open it either, so if you forget the passphrase, we can't recover it for you.

How we protect your information

The app encrypts your diary and your photos on your phone, with keys kept in your phone's secure storage (the iOS Keychain or the Android Keystore). Your diary and photos are also left out of iCloud and Android backups, so a lost phone doesn't put them in your cloud account. That also means that if you lose your phone or delete the app, they're gone unless you've exported a backup yourself, because we can't recover what's on your phone.

Our servers use encrypted connections, we store scrambled versions of sign-in codes and session tokens rather than the real ones, and we don't store IP addresses in readable form. No way of storing or sending information is completely risk-free, and we can't promise perfect security. If something goes wrong that puts your data at risk, we'll tell you and the ICO as the law requires.

Age requirement

You must be 16 or over to use myEczema, which is available in the UK.

The first screen of the app asks whether you're 16 or over. It's a yes or no question, and we don't ask for your date of birth. Your answer is stored only on your phone and is never sent to us. If you answer no, the app shows a screen saying it isn't available, and nothing about you is stored. Signing in to the community also needs a 16 or over answer on the phone. AI wording has its own 18 or over question, described under AI Pattern Review.

We rely on you telling us your age honestly, and we can't check it. If we find out that someone under 16 is using myEczema, we'll delete their community account and anything we hold about them. If you're a parent or guardian and think your child is using the app, email hello@myeczemaapp.com and we'll help.

Your rights

Under UK data protection law, you have the right to:

Access the information we hold about you.
Correct it, if it's wrong or incomplete.
Delete it. Your diary is deleted with Clear All Data or by deleting the app. Your community account can be deleted from inside the app at any time, or by emailing us.
Ask us to stop or limit how we use it, or object to a particular use.
Withdraw your consent at any time, for anything that relies on it, such as analytics, AI wording, Research contact, or sharing your votes and reviews with the ranking (Settings > Remove my votes and reviews). This doesn't affect anything done before you withdrew it.
Get a copy of your information to take elsewhere. Backup Data, above, does this for your diary.

For anything we hold on our servers, email hello@myeczemaapp.com. We'll reply within one month. You don't have to give us any personal information: the diary works without an account, and you only need an email address to sign in to the community. We don't make any automated decisions about you that have legal or similarly significant effects.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We'd appreciate the chance to sort it out first.

Changes to this policy

If we change how myEczema uses your information, we'll update this page and the effective date at the top. If the change is significant, we'll tell you before it takes effect.

Questions

Contact Zaki Qadus, our privacy lead, at hello@myeczemaapp.com, or see our support page.