Privacy Policy

Last updated: 13 October 2026 (version 2026-10-13)

This notice explains what Asper London does with your personal data, including your health data, and the rights you have over it. It is written to the UK GDPR and the Data Protection Act 2018.

1. Who we are

Asper London is a service operated by Asper London Ltd (company number 16589082), registered at Flat 7 36 Bassett Road, London, England, W10 6JL. We are the data controller for the personal data described in this notice.

For any question about this notice or your data, contact us at privacy@asper-london.com or via our contact page.

2. What we collect

• Account details — name, email address, phone number, password (stored only as a one-way hash).
• Health data — conditions, medications, allergies, surgeries, blood type, NHS number, pregnancy status, and anything else you record in your medical ID, including documents you upload or email in, and documents someone else — such as your GP or a clinic — sends to your upload address.
• Emergency and care details — emergency contacts, healthcare facilities, appointments.
• Technical data — device identifiers for your jewellery, and audit records of changes to your medical ID and of who accessed it.

Health data is “special category” data under UK GDPR and gets the additional protections described below.

3. Why we use it, and our lawful basis

• Running your account (sign-in, subscription, support) — necessary to perform our contract with you (Art. 6(1)(b)).
• Storing and sharing your health data, including showing it to emergency responders and clinicians you authorise — your explicit consent (Art. 9(2)(a)), which you give separately at sign-up and can withdraw at any time.
• Security, fraud and abuse prevention (rate limiting, malware scanning, audit logging) — our legitimate interests in keeping the service and your records safe (Art. 6(1)(f)).
• Suggesting addresses as you type — our legitimate interest in making addresses quicker to enter and less likely to be wrong in an emergency (Art. 6(1)(f)).
• Legal and regulatory obligations — compliance with law (Art. 6(1)(c)).

Because we rely on consent for health data, withdrawing it means we can no longer store that data. Withdrawal therefore begins deletion of your account — we tell you this clearly at the point you withdraw.

4. Automated processing of your documents

When you upload or email in a medical document, you can ask us to extract its details automatically. If you do, the document’s contents are sent to Anthropic’s Claude model via Amazon Bedrock, hosted in the EU, which returns structured suggestions.

• Nothing is added to your record automatically — you review and confirm every extracted item first. There is no solely automated decision-making with legal or similarly significant effects.
• Your documents are not used to train any model.
• Processing happens within the EU region and is covered by our data processing agreement with AWS.

5. Who we share it with

We do not sell your personal data. We share it only with:

• People you authorise — anyone who scans your jewellery sees only what you have marked public; clinicians who enter your access code see the additional items you have marked for clinicians.
• Amazon Web Services — file storage (S3), email (SES), queues (SQS), document text extraction (Textract) and AI extraction (Bedrock). Hosted in the EU.
• MongoDB Atlas — our database.
• Devancy — the software company that builds and maintains Asper for us. Keeping the service running means its engineers can reach the systems your data is held in, and they may do so only on our instructions and only for that purpose.
• Vercel — hosting, and short-lived access records for the public device pages.
• Stripe — subscription payments made on our website. We never see or store your card details.
• RevenueCat — manages subscriptions bought inside our mobile app. It receives your account identifier so that a purchase made in the app also unlocks the website. It is not sent your health data. RevenueCat is based in the United States.
• Apple and Google — process payments for subscriptions bought through the App Store or Google Play, under their own privacy policies. We never see or store your card details.
• Google Maps — suggests matching addresses while you type an address into your medical ID or a healthcare facility. The text you type is sent to Google from our servers, not from your device, so Google receives the text alone: not your IP address, your account, or anything else in your record. It is not sent your health data.
• Authorities — where the law requires it, or to protect someone’s vital interests in an emergency.

The companies above that provide services to us act as our processors under a written agreement and may use your data only on our instructions. Apple and Google are the exception: for app-store payments and address suggestions, each decides for itself how to handle what it receives, as an independent controller responsible for it under its own privacy policy.

6. Emergency contacts and other people you name

Your record can include other people — an emergency contact’s name, relationship to you and phone number. That is their personal data, not yours, so please add someone only if they are happy to be listed and have told you so.

If you mark a contact as public, their name and number can be seen by anyone who scans your jewellery. That is the point of an emergency contact, but it is worth being deliberate about: mark them for clinicians only if you would rather their details were not shown to everyone.

We hold these details only as part of your record, for as long as you keep them there, and we never contact these people or use their details for anything else. You can remove a contact at any time. If someone you have listed wants their details removed and cannot reach you, they can contact us and we will remove them.

7. Documents other people send you

Your document upload address is an email address unique to your account. Anyone who has it — your GP, a hospital or a clinic, for example — can email documents to it, and they are added to your documents just as if you had uploaded them yourself. They stay private to you: nothing a sender adds is shown to anyone who scans your jewellery, or to a clinician, unless you choose to share it.

We keep the sender’s email address with each document they send, for as long as the document stays in your account, so that you can see who sent it — our legitimate interest in you knowing where each document in your record came from (Art. 6(1)(f)). When documents arrive we email you to say what came in and who sent it. We only ever email a sender to tell them their message could not be processed, and we use their address for nothing else.

Only give the address to people you want to receive documents from. If it reaches someone it should not, you can delete anything they sent and get a new address from your Documents tab; the old one stops working straight away. If a document about someone else reaches you by mistake, please delete it and let the sender know.

8. How long we keep it

• Your account and medical data — for as long as your account exists. When you delete it, everything is permanently erased 30 days later.
• Audit records of changes and access — for the life of your account, then erased with it.
• Share links — 30 days after the link expires.
• Scan links from your jewellery — 7 days after they expire.
• Sign-in and verification links — 7 days after they expire.
• Inbound email records (sender, subject, timestamp, used to stop abuse and duplicates) — 90 days. The sender’s address is also kept with each document they send, for as long as that document stays in your account.
• Access records for public device pages — 30 days.
• Erasure records — after your account is erased we keep a record that the erasure happened, containing no personal data: a one-way hash and counts only. We cannot identify you from it.

9. Your rights

You have the right to:

• Get a copy of your data — Account → Privacy & Data → “Download my data”, immediately. The file is structured and machine-readable, so this is also how we meet your right to data portability.
• Correct anything inaccurate — Edit your profile at any time.
• Delete your account — Account → Privacy & Data. Your profile stops being shared straight away; everything is erased permanently after 30 days, and you can restore it during that window using the link we email you.
• Withdraw health-data consent — As easily as you gave it. Because consent is our basis for holding health data, this starts the deletion process above.
• Revoke clinician access — Generate a new access code at any time; this immediately cuts off anyone already using the old one.
• Object to processing based on our legitimate interests — This applies to the security, fraud and abuse prevention described in section 3 — the only processing we base on legitimate interests. Tell us why, and we will stop unless we can show compelling grounds to continue; for security logging we usually can, and we will explain our reasoning either way. Email privacy@asper-london.com.
• Ask us to restrict processing — For example while you are contesting whether something we hold about you is accurate. There is no self-service switch for this — ask us and we will action it by hand. Email privacy@asper-london.com.

We answer any of these within one month, as the UK GDPR requires. If you would rather your data were erased immediately than after the 30-day recovery window, email us and we will do that instead.

10. How we protect it

• Encrypted in transit (TLS) and at rest — uploaded files are encrypted in storage, and our database uses encryption at rest.
• Uploaded files are scanned for malware before they can be opened.
• Access to clinician-tier data requires a code that expires after 24 hours and grants access for 15 minutes at a time.
• Optional two-factor authentication, account lockout after repeated failed sign-ins, and a strong password policy.
• Every change to your medical ID and every access to it is recorded, and you can review that history under Account → Audit Trails.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your data and puts your rights at risk, we will tell you and the ICO as the law requires.

11. IP addresses

We do not track the location of people who view your medical ID, and we do not store the IP address of anyone who scans your jewellery. Where we need to limit abuse, we convert the IP address into a one-way hash and store only that, so the address itself is never retained. The public device pages keep a short access record for 30 days to detect abuse.

12. Where your data is held

Your data is stored and processed in the European Union, including the AI extraction described above. We do not transfer your health data outside the UK or EU.

Two parts of billing are the exception, and neither involves health data. Stripe may process payment data internationally under its own safeguards. If you subscribe inside our mobile app, your account identifier and subscription status are handled by RevenueCat in the United States, and by Apple or Google, under the UK International Data Transfer Agreement or equivalent safeguards.

Address suggestions are the only other exception, and they do not involve health data either. The address text you type is processed by Google, which may do so in the United States under the data-transfer safeguards in its terms. It reaches Google without your IP address or anything linking it to your account or your record.

13. Age

This service is for adults. You must confirm you are 18 or over to create an account, and we ask for your date of birth during setup. If we learn that an account belongs to someone under 18, we will delete it. If you believe a child has an account with us, please contact us.

14. Changes to this notice

We may update this notice. The version and date at the top of this page always reflect the current one. If we materially change how we use health data, we will ask you to review and confirm your consent again rather than relying on the consent you gave to an older version.

15. Complaints

If you are unhappy with how we have handled your data, please tell us first at privacy@asper-london.com so we can put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to contact us first.