Privacy Policy

Last updated: 10 May 2026

More To Life ("we", "us", "our") respects your privacy. This Privacy Policy explains what personal data we collect, how we use it, the legal bases for processing, your rights under the UK GDPR and EU GDPR, and how to contact us.

1. What we collect

When you create an account or use our consumer features, we collect:

Account data: your name, email address, password (hashed), preferred language.
Wellness data: your answers to assessment questions, daily mood signals, virtual garden state, focus categories, and assessment history. This is the data you create as you use the product.
Usage data: anonymous interaction logs (page views, feature usage) for product improvement.
Device data: browser type, IP address (for security and rate limiting), timezone.

2. How we use it

To provide the wellness assessment, scoring, insights, and gamification features you signed up for.
To generate AI-powered insights about your wellness trends (processed by our AI provider; data is not used to train their models).
To send you transactional emails (account confirmation, password reset, optional weekly summaries), never marketing without consent.
To detect and prevent abuse, fraud, and security incidents.
To comply with our legal obligations.

3. Legal bases (UK/EU GDPR)

We process your data under one or more of the following legal bases:

Contract: to deliver the service you signed up for.
Legitimate interest: to keep the service secure and improve it (you can object at any time).
Consent: for optional features (e.g., participation in anonymized community feeds, marketing emails). Withdrawable at any time.
Legal obligation: where required by applicable law.

4. Sharing

We do not sell your data. We share it only with:

Sub-processors who help us deliver the service (Supabase for database hosting, our VPS provider for the API, Google AI / Firebase for AI features, transactional email providers). Each is bound by a Data Processing Agreement.
Authorities, if required by valid legal request.

We do not share individual wellness data with any third party for advertising or analytics targeting.

5. Corporate / B2B users

If your employer or coach has invited you to More To Life as part of an organisation, please note: your individual wellness data is never visible to your employer, your team admin, or any other corporate role. Corporate admins only see aggregate, anonymised reports with a minimum group size of 5 people to prevent re-identification. Coaches see individual data only with your explicit, revocable, per-scope consent.

6. Your rights

Under UK and EU GDPR, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate data.
Erase your data ("right to be forgotten"). We provide an in-app erasure flow with a 14-day reversal window followed by permanent deletion within 30 days.
Export your data in a portable format. Available via the in-app GDPR export tool.
Restrict or object to processing.
Withdraw consent for optional processing at any time.
Lodge a complaint with a supervisory authority (ICO in the UK).

7. Data retention

We retain your account data and wellness data for as long as your account is active. After you request erasure, all personal data is permanently deleted within 30 days. Anonymised aggregate data may be retained for product improvement and may be processed indefinitely as it no longer identifies you.

8. International transfers

Our infrastructure is hosted in the EU. Where data must be transferred outside the EEA/UK (e.g., to our AI provider in the US), we rely on Standard Contractual Clauses or equivalent safeguards.

9. Children

More To Life is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a child has used the service, please contact us so we can take appropriate action.

10. Contact

For any privacy questions, data requests, or complaints, contact us at [email protected].

This document is provided in good faith. It is not legal advice and should be reviewed by qualified counsel before relying on it in a regulatory or contractual context.