Biojrnl

Privacy Policy

Last updated: 7 August 2026 · Effective: 26 May 2026

The short version: your health record is yours. It lives on your device first. Cloud backup is optional, encrypted in transit and at rest, and held in the UK/EU. We do not sell your data and we show no adverts. Nobody sees your record except the services we need to run the app, and every one of them is listed below.

1. Who we are

Biojrnl is operated by Biojrnl Ltd, a company registered in England and Wales under company number 17290325, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are the data controller for the personal data described in this policy. References to "we", "us" and "our" mean Biojrnl Ltd.

For anything privacy related, write to gdpr@biojrnl.com.

2. What Biojrnl is, and what it is not

Biojrnl is a personal health journal. It stores what you choose to enter: symptoms, medications, blood results, vaccinations, appointments and similar records. It is not a medical device, it is not a diagnostic tool, and it is not a substitute for medical advice.

3. The data we hold, why we hold it, and our lawful basis

Your health record

This is special category data under UK GDPR Article 9. Our lawful basis for holding it is your explicit consent, under Article 9(2)(a) together with Article 6(1)(a). You give that consent when you create an account, you can review it in the app's Privacy settings, and you can withdraw it at any time.

Account data

Our lawful basis is performance of our contract with you, under Article 6(1)(b). Without this data we cannot give you an account.

Subscription data

Our lawful basis is performance of our contract, under Article 6(1)(b). We never receive your card details. Payments are handled entirely by Apple and Google, who are the merchants of record.

Crash and error reports

When the app runs into an error, a report is captured automatically and personal data is stripped out of it on your device. Reports reach us only while "Help improve Biojrnl" is switched on in Settings. That switch is off unless you turn it on, and you can turn it off again whenever you like. Our lawful basis is your consent, under Article 6(1)(a).

Invitations

If you invite someone to share a profile, you give us their email address. We use it to send and manage that invitation and for nothing else. Our lawful basis is our legitimate interest in delivering the invitation you asked us to send, under Article 6(1)(f).

Website waiting list

If you left your email address on biojrnl.com before launch, we hold that address, the date you signed up, the date we last saw you, and the IP address the signup came from. We use it for one thing: telling you when the app is ready. Our lawful basis is your consent, under Article 6(1)(a).

We do not collect location data, contacts, browsing history or advertising identifiers, and we run no analytics beyond what is described above.

4. Where your record lives

5. Sharing inside the app

Sharing is off unless you turn it on. If you invite someone to a profile, they see only what your invitation allows, and you can withdraw their access at any time. One profile's data is never shown inside another profile's view.

If you manage a profile for someone else, you must have their consent first, or the legal authority to act for them. We keep a record of the consents given in the app so that there is never any doubt about who agreed to what.

6. Who processes data for us

We do not sell your data and we do not share it with advertisers or data brokers. The following providers process limited data so the service can run:

The current list, with regions, is always at biojrnl.com/subprocessors.

7. Where in the world your data goes

Your health record is stored in the UK/EU, wherever in the world you use Biojrnl. Some providers process limited, non-health data outside the UK. Where that happens, the transfer is protected by a recognised safeguard: for UK users, the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses or a UK adequacy decision; for users in the European Economic Area, the Standard Contractual Clauses themselves or an EU adequacy decision.

You can ask for a copy of the safeguards that apply by writing to gdpr@biojrnl.com.

8. How we protect your data

Your record is encrypted on your device and encrypted again in transit and at rest in the cloud. Access to cloud data is restricted by row-level security, so an account can only ever read its own records and the records explicitly shared with it. Crash reports are stripped of personal data before they leave the device. If you use the app lock, your fingerprint or face never leaves your device.

No system is perfectly secure. If a breach ever puts your rights at risk, we will tell you and the Information Commissioner's Office, as the law requires. Security researchers can reach us at security@biojrnl.com.

9. How long we keep your data

10. Your rights

We apply one privacy standard to everyone, wherever you live: the UK GDPR and, if you are in the European Economic Area, the EU GDPR. If the law of your country gives you rights beyond these, those rights are unaffected. You have the right to:

To exercise any of these rights, write to gdpr@biojrnl.com. We will respond within one month. If your request is complex, or you have made several, the law lets us extend that by up to two further months, and we will tell you within the first month if we need to. There is no charge.

11. Complaints

If you are unhappy with how we have handled your data, you can complain to us directly at gdpr@biojrnl.com. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to a data protection authority, whether or not you have complained to us first. In the UK that is the Information Commissioner's Office at ico.org.uk. If you live elsewhere, you can complain to the data protection authority of your own country.

12. Children

Biojrnl is not intended for anyone under 16, and we do not knowingly collect data from children under 16. If you believe a child has given us personal data, write to gdpr@biojrnl.com and we will delete it promptly.

13. Automated decisions

We make no automated decisions about you and we build no profiles. Biojrnl does not score, rank or draw conclusions from your health record. It stores what you write and shows it back to you.

14. Cookies and this website

biojrnl.com sets no cookies and runs no analytics or tracking scripts. The only data the website collects is the waiting list described in section 3, and the standard request logs Cloudflare receives to serve the site.

15. Changes to this policy

If we make material changes to this policy, we will tell you in the app and update the date at the top of this page.

16. Contact