Privacy policy

Last Updated: 17 October 2026

1. Introduction

More Human ("we", "us", "our") is an early-stage start-up dedicated to supporting adult women, non‑binary individuals, and those assigned female at birth (AFAB) to safely self-screen for ADHD, autism, CPTSD, and commonly co-occurring health conditions. This policy applies to your use of our Uma website and mobile application.

Uma is available globally, with the exception of Switzerland, which is not currently supported pending review of Swiss data protection requirements. For US users, although HIPAA may not apply directly to our direct-to-consumer service, we voluntarily apply privacy and security safeguards comparable to those required under HIPAA. Specific rights and protections are set out in the Notice of Privacy Practices in Section 18 of this policy.

We respect your privacy and are committed to safeguarding your data. This Privacy Policy explains how we handle information, including any personal and special category data, and outlines your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

More Human Ltd acts as the Data Controller for the personal and special category data we collect and manage, such as your account email and the health-related data you provide.

2. Key definitions

Anonymous Data: Information that cannot be linked back to an identified or identifiable individual. This falls outside the scope of UK GDPR.

Personal Data: Information relating to an identified or identifiable living individual.

Special Category Data: Sensitive personal data (e.g., racial or ethnic origin, sex life or sexual orientation, health-related information, etc.). The information you provide in your self-assessment about your symptoms and history is considered health-related Special Category Data, and it is linked to your user account. We also process other forms of Special Category Data you provide relating to your sex assigned at birth, gender identity, sexual orientation, or ethnicity. We do not collect genetic, biometric, or religious data. This type of data receives additional legal protection under UK GDPR.

Processing: Any operation carried out on data.

Data Controller: More Human, which determines how and why your personal and special category data is processed.

Data Processor: Third parties who process data on our behalf, in order of their primary role in our current operations:

• Google Cloud (Firebase): our primary platform for the application's front-end and back-end and user account management. Covered by our Google Cloud Business Associate Agreement.
• Uma AI (Google Gemini): our custom-trained AI model powered by Google Gemini, which processes data for community moderation and for vetting library and marketplace items against the research literature. Covered by our Google Cloud Business Associate Agreement.
• Google Gemini API (via Google Cloud and Firebase): the AI model used to generate self-reports. Gemini only receives fully anonymised data for self-reports. No protected health information is shared, and no Business Associate Agreement is required for this use.
• Google Gemini API (via Google Cloud and Firebase) is also used to write captions for videos submitted to Uma, and to write a job description from your job title in the Access to Work assistant. For these uses it receives the submitted video, or your job title.
• ElevenLabs or Amazon Polly: text-to-speech providers used to generate Uma's verbal responses. These providers only receive generic educational text output, never personal or health data.
• Firebase Phone Authentication (Google): sends a 6-digit code by text to your recovery phone, to check it's you: at security setup, when you reset your PIN, and if you need to recover your account. Google receives only your recovery phone number and the code. No health data is sent. We send no other text messages.
• Stripe: for secure payment processing.
• Apple Wallet and Google Wallet: hold your Uma membership card on your phone, if you choose to add it. We make the card ourselves; Apple and Google keep it in your wallet under their own privacy policies. The card never shows your real name or any health data.

Voice Input Processing: When you use Ask Uma voice search, the audio is processed by your device's browser using its native speech recognition service. On Chrome, Edge, and Android devices, this is provided by Google. On Safari and iOS devices, this is provided by Apple. Google and Apple act as independent data controllers for the audio input; Uma never receives, processes, or stores the audio recording. See Section 6.1 for details.

3. What information do we collect and why?

At More Human, we are designed for maximum privacy and to minimise bias. We gather only what is genuinely necessary to provide you with an objective, neuro-affirming, gender-affirming, and trauma-informed service and to support our research for improved outcomes. We actively avoid collecting unnecessary personal information that could introduce unconscious bias into assessment and research.

Crucially, we do not share any of your identifiable health information with third parties. All data shared with our AI is completely anonymised by us first.

3.1 What we collect

Health-Related Special Category Data (Linked to your account): The user selections and choices you make in the questionnaires, which describe your symptoms and experiences. This can be input via touch or, for convenience, using your device’s native voice-to-text feature. No audio is ever processed or stored by us.

Limited Personal Data (Collected Directly from You): We collect this information to personalise your experience, conduct essential research, and operate your account.

• IP Address: We collect your IP address during sign-up to detect your country of residence. We use this to personalise your experience (language preference, currency display, and content availability). We do not permanently store this data or attach it to your user account.
• Email Address: For account creation, login, and essential service communications.
• Full Name: For account creation and to help with essential service communications.
• First Initial: For personalised reports without revealing your full name.
• Age: We collect your age (not your date of birth) for two clinical reasons: to assess the timing of any diagnosis (childhood versus adult onset is relevant for ADHD, autism, and CPTSD screening), and to identify perimenopausal and menopausal status, which significantly affects how ADHD and autism present in women and AFAB people. Your age is also included on self-reports that may be shared with clinicians.
• Pronouns: For gender-affirming communication throughout your reports.
• Communication Data: Records of emails and support enquiries you send to us.
• Payment Data: Managed securely by Stripe. We are not privy to any of your personal details shared with Stripe; we receive a copy of a non-identifiable transaction ID and proof of payment.
• Uma records which pages and features each member uses, to improve the service. This is never shared.

3.2 Authentication & security data

When you create an account and log in, we collect and process the following security-related data:

• Passkey: When you create a passkey, your phone or computer makes a pair of keys. We store three things: the passkey's ID, its public key, and a sign count (a number that goes up each time the passkey is used, which helps us spot a copied passkey). The private key never leaves your device. You unlock your passkey with your face, fingerprint or passcode, but that check happens on your device only. We never see or store your face, fingerprint or passcode, and we never collect biometric data.
• PIN: Your 4-digit PIN is stored only as a PBKDF2 hash (a one-way scramble) with its own unique salt, on our server only. We never store or send your PIN as you typed it.
• Recovery Phone Number: Your mobile number is collected during security setup and held by Firebase Authentication (Google). We use it only to text you a 6-digit code to check it's you: at security setup, when you reset your PIN, and if you need to recover your account. The codes are sent through Firebase Phone Authentication (Google) and always go to the number on file, never to a number typed in. We never use your number for alerts or marketing, and we send no other text messages.
• Sign-in Tokens: Once your passkey has been checked, we give your sign-in a token that lasts 10 minutes and works once. It holds your IP address and device details (your browser and device type), so it can't be used from anywhere else. It is deleted automatically when it runs out, and it is not linked to your account afterwards.
• Authentication Session Tokens: Short-lived tokens issued after successful login. These are bound to your device IP and browser and expire automatically after 30 minutes of inactivity.
• Membership Card Token: If you add your membership card to Apple Wallet or Google Wallet, it carries a hidden code that you never see or type. It lets your card prove it is yours when you reset your PIN. We keep only a hash of it (a one-way scramble), never the code itself. The code stays the same until you ask for a new card, which cancels the old one.
• Attempt Counters: We track failed login and PIN-entry attempts server-side to enforce security lockouts after 5 failed attempts. These counters are automatically purged after successful authentication.
• Security Alerts: We send security alerts by email only. If someone gets your recovery number or a text code wrong 5 times, we block the text option and email you. If a card check fails 5 times, we block the card option and email you. We also email you when your email address or recovery phone is changed (when your email address changes, the alert goes to your old address).
• Device IP Address: Used only while you sign in, held in the 10-minute sign-in token, then deleted. Not stored or linked to your account after you have signed in.

Your PIN and your passkey's private key are never stored as they are. PINs are hashed with PBKDF2 (310,000 rounds, with a random salt for each member) and checked in constant time to stop guessing attacks. Your passkey's private key never leaves your device.

3.3 Demographic data (some are special category data)

To provide a neuro-affirming, gender-affirming, and trauma-informed service, for diversity in research (especially relevant for neurodivergent populations), and for service segmentation, we ask for:

• Gender Identity: For a gender-sensitive service and research.
• Sex Assigned at Birth: For a gender-sensitive service and research.
• Sexual Orientation: For understanding diversity within neurodivergent populations and research.
• Country of Residence: To confirm your eligibility for our service and to provide a tailored service.
• Educational Status: To understand potential impacts of neurodivergence on educational outcomes.
• Employment Status: To understand potential impacts of neurodivergence on employment.
• Ethnicity: For diversity in research and ensuring representative data.
• Hair colour, eye colour, and skin colour: Research shows that people with lighter skin, eyes, and hair are more likely to receive an ADHD or autism diagnosis, while people with darker skin, eyes, and hair face increasing barriers to diagnosis. We collect this information to document and research these diagnostic disparities and to support more equitable access to identification.
• Language Spoken: To support future translation services and provide a tailored experience.

3.4 What we do not collect (and why)

We deliberately do not collect the following personal or sensitive information:

• Date of Birth: We collect your age, not your date of birth, to protect your privacy while still enabling clinically relevant assessment.
• Precise Geographical Location (beyond Country): Country is sufficient for eligibility and service tailoring.
• Address: This is not necessary to provide our service.
• National Insurance Number (or any other government identifiers like SSN): These are not required for our service and are highly sensitive.
• Doctor's Name or Medical Records: Our service is a self-screening tool, not a diagnostic service. While you will discuss health information and specific health diagnoses, we do not collect a patient's name or medical records.
• Religion: This is not relevant to our service or research goals and could introduce bias.
• Genetic Data or Biometric Data: This is unnecessary for our service design and highly sensitive.

4. How we collect information

• Directly from you: When you create an account, provide demographic information, submit anonymised feedback, or contact us.
• Via Secure Processing & Immediate Anonymisation: If free-form text input is introduced, it will undergo de-identification by Google Cloud DLP before we receive anonymised data.
• Third Parties: Stripe handles all payment data directly and securely.

5. How we use information and our lawful basis (for personal data)

Explicit Consent for Demographic and Health-Related Data: We process your Demographic and Health-Related data, including Special Category Data like Sex Assigned at Birth, Gender Identity, Sexual Orientation, Ethnicity, and your self-assessment responses, only with your explicit consent. This consent is separate from your general service use and is given specifically for these purposes (providing a personalised experience, research, and service segmentation). You may withdraw this consent at any time by closing your account in your app settings.

6. AI use and automated decision-making

Our custom-trained AI, Uma, which is powered by Google Gemini, is used for community moderation and for vetting library and marketplace items against the research literature. The Uma AI has been trained on datasets related to neurodiversity, trauma-informed language, and gender differences in ADHD and autism to provide a more nuanced and supportive experience. This AI does not make medical diagnoses or legally significant automated decisions about you.

Self-reports are generated by Google Gemini (through the Gemini API, via Google Cloud and Firebase) using fully anonymised data. Gemini only receives data with all direct and indirect identifiers removed; no personal or protected health information is shared.

We also use Google Gemini to write captions for videos submitted to Uma, and to suggest a job description from your job title in the Access to Work assistant. Your job title is the only information from your profile it receives for that.

Our Commitment to AI Privacy: We will never share your personal data or PHI (Protected Health Information) with our AI providers. The data used to generate insights is completely anonymous and contains no personal identifiers.

As per GDPR Article 22, there is no automated decision-making with legal or similarly significant effects based on your personal data within our service. All AI outputs are informational and designed for self-reflection.

Disclaimer: Our service is not a medical professional. All insights are for informational and self-reflective purposes only and should not be considered medical advice or a diagnosis.

You may request human review of any AI-generated insight and challenge its outcome if you wish.

6.1 Ask Uma voice search and audio processing

Ask Uma is our voice-driven search interface. When you use voice input, your device's browser processes the audio into text. On Chrome, Edge, and Android devices, this is done by Google's speech recognition service. On Safari and iOS devices, this is done by Apple's Siri and dictation service. These services are provided directly by Google and Apple and are governed by their own privacy policies.

Data Controller for Audio: Google and Apple act as independent data controllers for the audio input. This means they, not Uma, determine how your voice recording is handled after it is transcribed to text. Uma has no control over their data practices.

What Uma Receives: Uma never receives, processes, or stores the audio recording of your voice. We only receive the final text transcription that your browser produces after the audio has been processed by Google (Chrome) or Apple (Safari). From that point on, we handle only the text in line with the rest of this Privacy Policy.

What Happens to Your Audio After Transcription: We cannot speak to Google's or Apple's data handling practices for the audio recording. Google and Apple may retain your audio for machine learning purposes, dispose of it immediately after transcription, use it to improve their services, or handle it in other ways defined by their own privacy policies and your account settings with them. You should review Google's and Apple's privacy policies to understand their practices.

Uma's verbal responses are generated by a text-to-speech provider (ElevenLabs or Amazon Polly) from text produced by Uma. Only generic educational text is sent to the provider; no personal or health data is transmitted. If your browser does not support speech recognition, or you prefer not to use it, Ask Uma provides an equivalent text-input option.

7. How we share information

We only share information with trusted third parties under robust contracts (Data Processing Agreements for personal data, Business Associate Agreements for HIPAA-relevant data) and only when strictly necessary for the provision of our service:

• Application Platform (for Front-end and Back-end Data): Google Cloud (Firebase) provides the platform for our application's front-end and back-end and manages your non-linked account data (like email and unique user ID) and Demographic Data. Covered by our Google Cloud Business Associate Agreement.
• AI/ML providers: We use the Uma AI, a custom-trained version of Google Gemini, for community moderation and content vetting. We use Google Gemini (through the Gemini API, via Google Cloud and Firebase) to generate self-reports from anonymised data. We will never pass any personally identifiable information, including your PHI, to these services.
• Voice output: Uma's verbal responses are generated by a text-to-speech provider (ElevenLabs or Amazon Polly). These providers receive generic educational text to synthesise into voice responses. No personal or health data is transmitted.
• Payment processor: Stripe: compliant with UK GDPR and PCI DSS (Payment Card Industry Data Security Standard). We receive a copy of a non-identifiable transaction ID and proof of payment.
• Membership card: if you add your Uma membership card to Apple Wallet or Google Wallet, we make the card ourselves and send it to Apple or Google, who keep it in your wallet under their own privacy policies. The card shows the Uma logo, your membership type, your membership name (your colour, animal and number) and, for paid members, the expiry date. It never shows your real name. It also carries a hidden code for resetting your PIN, which we keep only as a hash. There is no QR code or barcode on the card, and it cannot be shared. On a Google Wallet card, the hidden code sits inside a "Reset my Uma PIN" link. The link never works on its own: it only opens the reset page, which asks for your email and your passkey first. No health data is on the card.
• Text messages: the 6-digit codes for your recovery phone are sent through Firebase Phone Authentication (Google), which receives only your phone number and the code. We send no other text messages.
• Cookie consent: Cookiebot (Usercentrics) runs our cookie banner and records the choice you make in it, so we only set optional cookies you have agreed to.
• Feedback: our feedback button is our own. If you choose to send us feedback, we receive what you write, a screenshot of the page if you add one, and technical details such as your browser and screen size, so we can find and fix the problem. It is stored on Google Cloud (Firebase) and no other third party receives it.
• Legal authorities: We will disclose personal data only if strictly required by law (e.g., via a court order or other binding legal obligation).

We do not sell or trade any personal data.

Affiliate links: Some links to books and products in the Uma library and self-care marketplace are affiliate links, including links to Amazon and Bookshop.org. If you buy something after following one, we may earn a commission, which helps keep screening free. We do not send the retailer any of your personal or health data. When you follow the link, the retailer's own privacy and cookie policies apply on its site. As an Amazon Associate, More Human Ltd earns from qualifying purchases.

8. International data transfers

Some of our service providers (e.g., Google Cloud, Stripe) operate globally, meaning your account data and Demographic Data may be processed outside the UK. We ensure that appropriate safeguards are in place for such transfers, including Standard Contractual Clauses (SCCs) with the UK Addenda, which are designed to protect your information in accordance with UK data protection law. Our Data Processors are contractually bound to uphold these safeguards.

8.1 Where your data is processed

We primarily process data using cloud infrastructure in the following locations:

• Google Cloud (Firebase and Uma AI/Gemini): Account data, Demographic Data, and community data are hosted in Google Cloud regions with GDPR-aligned commitments and covered by our Business Associate Agreement.
• Google Gemini API (self-reports): Anonymised data only. Processing may occur in the US.
• Google Gemini API (video captions, job descriptions): submitted videos and job titles. Processing may occur in the US.
• Text-to-speech provider (ElevenLabs or Amazon Polly): Generic text output only. Processing may occur in the US.
• Stripe: Payment data handled in the EEA and United States, protected under SCCs and UK Addenda.
• Apple Wallet and Google Wallet: Your membership card only, kept by Apple or Google in your wallet under their own privacy policies.

We do not store or process personal data in countries lacking adequate protection. All processors are contractually required to maintain GDPR-aligned safeguards.

9. Data security

We use strong security practices:

• Data Minimisation by Design: We are built on the principle of only collecting the minimum personal data required. For instance, we only ask for age rather than a precise date of birth, and we never collect your address or medical records.
• Secure Handling of Special Category Data: Your health-related and demographic data is considered highly sensitive. We protect it with strict access controls, multi-factor authentication for all staff, and strong encryption both in transit and at rest.
• Encryption: All personal data (e.g., account emails, Demographic Data) is encrypted both in transit (e.g., using TLS 1.2+) and at rest (using strong encryption standards) across our systems and with our cloud providers.
• Access Controls: Strict Role-Based Access Control (RBAC) and the principle of 'least privilege' are applied to all internal access to any personal data in our systems.
• Multi-Factor Authentication (MFA): Required for all user logins to our application and for all internal administrative access to our systems.
• Regular Security Reviews: We conduct regular internal security reviews of our systems and applications to identify and address vulnerabilities.
• Secure Development Lifecycle: Security is embedded into every stage of our software development, from design to deployment.
• Incident Response: We have procedures in place to manage and respond to any potential data breaches involving personal data. In the event of a personal data breach, we will notify the ICO and affected individuals within 72 hours where required by UK GDPR.

While no system can be completely immune to all risks, we are committed to maintaining the highest reasonable security standards for your data.

10. Data retention

We retain personal data (e.g., account emails, Demographic Data, communication data) only for as long as necessary to:

• Provide the Uma service and personalisation.
• Comply with legal/accounting obligations.
• Resolve disputes and enforce agreements.

Here are our approximate retention periods for personal data:

• Account Data (Email): Retained for the duration of your active account. If you delete your account, your email address will be removed from our active systems within 30 days, unless legal obligations require longer retention.
• Demographic Data: Retained for the duration of your active account to provide a tailored service and for ongoing research. If you delete your account, this data will be anonymised or deleted within 30 days of account deletion.
• Health-Related Data: Retained for the duration of your active account to provide you with your reports and to support your ongoing self-assessment journey. This data will be anonymised or deleted within 30 days of account deletion.
• Communication Data: Retained for up to 12 months after your enquiry is resolved for quality assurance and to handle follow-up queries.

Anonymous data and usage data are retained indefinitely for research and service improvements, as they do not constitute personal data. You may request deletion of your personal data (e.g., your account email, Demographic Data) unless legal obligations require retention.

11. Your legal rights (data subject rights)

You have strong rights regarding your personal data under UK GDPR:

• Right to be informed: About how your data is handled (this policy).
• Right of access: To request a copy of the personal data we hold about you.
• Right to rectification: To ask us to correct inaccurate or incomplete personal data.
• Right to erasure ('right to be forgotten'): To request that we delete your personal data. Please note this right is not absolute; we may need to retain some data for legal obligations (e.g., accounting) or contractual reasons.
• Right to restriction of processing: To limit how we use your personal data in certain circumstances.
• Right to object to processing: To object to our processing of your personal data in certain situations.
• Right to data portability: To receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to withdraw consent: Where our processing is based on your consent (e.g., for Demographic Data), you have the right to withdraw that consent at any time by closing your account in your app settings. This will not affect the lawfulness of processing before your withdrawal.
• Right to lodge a complaint with the ICO: (See Section 16).

US users have additional rights under the Notice of Privacy Practices in Section 18.

To exercise these rights, contact: leanne@wearemorehuman.co.uk. We aim to respond within one month.

12. Account recovery and permanent data loss

Recovery Always Needs Two Things: Getting back into your account always takes two of your things, never one on its own: your passkey and a text code, or your passkey and your membership card.

If You Forget Your PIN: You start with your email and your passkey. Then you prove it's you in one of two ways: a 6-digit code sent by text to the recovery phone on file, or your membership card in Apple Wallet or Google Wallet. Then you choose a new PIN.

If You Get a New Phone: Your passkey and your membership card sync through your Apple or Google account, so signing in to that account on your new phone brings both back. Every way into your account, including every way to recover it, starts with your passkey. Without a passkey there is no way in: no passkey, no entry. So if you lose your Apple or Google account, and your passkey with it, your account cannot be recovered.

If You Lose Everything: If you lose your passkey, your email, your recovery phone, your membership card and your PIN, your account cannot be recovered and your data cannot be got back. We do not hold any identity documents, such as a passport or driving licence, so we have no way to check who you are, and we will not ask for them. Your data is yours, and we will not hand it to anyone who cannot prove the account is theirs.

Recommendations: Keep your recovery phone number up to date in your profile, and add your membership card to your wallet.

Account Deletion: You can request permanent deletion of your account and associated data by emailing leanne@wearemorehuman.co.uk. Upon request:

• Your account will be deactivated within 5 business days.
• Your personal data (email, phone number, demographics) will be deleted within 30 days.
• Your health-related screening responses will be anonymised (linked data deleted, leaving only aggregated statistics).
• Backup copies in our secure offsite storage will be purged within 90 days.

We may retain anonymised usage logs for statistical analysis and transaction records for accounting and legal compliance (indefinitely, per UK tax law). Deletion cannot be reversed once complete.

13. Children’s privacy

Our services are only for individuals aged 18 and over. We do not knowingly collect personal data from anyone under this age. Our sign-up process includes an age verification step. If we discover we have accidentally collected any personal data from a child, we will delete it promptly.

14. Cookies, local storage, and session management

14.1 Session cookies & tokens

We use essential, secure session tokens to maintain your login state after you have successfully authenticated with your passkey and PIN. These tokens:

• Are issued only after successful WebAuthn and PIN verification.
• Expire automatically after 30 minutes of inactivity.
• Are bound to your device IP address and browser to detect anomalous access.
• Are stored as HTTP-only cookies (not accessible to JavaScript, which prevents theft via malicious code).
• Are never shared with third parties.

Your browser must accept these session tokens for you to use the authenticated portions of Uma. Blocking them will prevent login.

14.2 Local storage

We use your browser's localStorage to store non-sensitive preference data on your device only, including:

• Calm mode toggle state.

This data is stored only on your device and is not transmitted to our servers unless you explicitly sync your account. You can delete this data at any time by clearing your browser's local storage (typically Settings > Privacy > Clear browsing data > Cookies and site data). localStorage is not encrypted on your device, so if someone gains physical access to your device, they could view this data. However, it contains only your content preferences, not sensitive personal data.

14.3 Essential & performance cookies

• Essential Cookies: Strictly necessary for you to browse our website and use its features. Without these cookies, services like logging in cannot be provided.
• Analytics (Aggregated & Anonymous): We use Google Analytics solely to collect aggregated, anonymous usage data about how our website and app are used. This data helps us understand general trends (e.g., popular features) and improve our service. No personal data is collected or linked to you through Google Analytics. Analytics cookies are only set if you accept them in our cookie banner. You can learn more about how Google uses data here.

For more detailed information, please refer to our separate Cookie Policy.