Legal

Privacy policy

You are trusting us with notes about your child, often on a hard day. This page explains in plain terms what we hold, why we hold it, who else touches it, and how to get it back or get it deleted. Last updated 1 August 2026.

Who we are

FamilyFX is a product of Neuro FX Ltd, a company registered in England and Wales, company number 16159083, registered office Crown House, 27 Old Gloucester Street, London WC1N 3AX. Neuro FX Ltd is the data controller for the personal information described here.

For anything to do with your information, including a request to see it or delete it, email info@neurofx.co.uk.

The short version

We ask for as little as we can. There is no password, because we sign you in with a link sent to your email. We never see your card details. The profile you set up for your child stays in your own browser and is never sent to us. The worksheets and diary entries you write are yours: we store them so you can come back to them, and we do not read them, mine them, sell them, or use them to train anything.

What we collect, and why

Your account

Your email address, so we can create your membership and send you a one-time sign-in link. There is no password to store. Lawful basis: performance of our contract with you.

Your membership

Whether your membership is active, how it started (a subscription or a NeuroFX patient access code), when it ends, and, for subscriptions, the Stripe customer and subscription identifiers and your renewal date. We need this to know whether to let you in. Lawful basis: performance of our contract with you.

We never see or store your card details. Payment is handled entirely by Stripe on their own pages.

What you write in FamilyFX

The worksheets, tool drafts and private diary entries you fill in. This is the most sensitive information in the product, because you may choose to include your child's name, date of birth, developmental history, school situation or health detail. That can amount to special-category data about your child under data protection law, so we treat it accordingly:

We store it only so that we can show it back to you and turn it into the documents you ask us to generate.
It is bound to your account. Database-level access rules mean one member cannot read another member's records.
We do not analyse it, profile you with it, sell it, share it for marketing, or use it to train any AI model.
You choose what to put in. None of these fields is required.

Lawful basis: performance of our contract with you, and, where the content is special-category data, your explicit consent, given by choosing to type it in. You can withdraw that at any time by deleting the entry or asking us to delete your account.

Your child's profile in the hub

The first name, age band, school stage, nation and "what's hardest right now" you set in My FamilyFX are stored in your own browser only. Clearing your browser data removes them. If you use Mimir, a copy of these preferences is sent with your message so its reply can take them into account. The profile is a set of preferences, not a record or a diagnosis.

How the site is used

We use Vercel Analytics to see which pages are used and how the site performs. It is privacy-friendly and cookieless: it does not set tracking cookies, does not build a profile of you, and does not follow you to other sites. Lawful basis: our legitimate interest in understanding and improving the product.

Mimir, our AI companion

If Mimir is available with your membership, your messages and its replies are stored against your account so you can return to a conversation. Your message and the profile preferences from My FamilyFX are sent to Anthropic, who provide the underlying model, to generate a reply. Your worksheets, diary entries and records are never sent to the model.

Cookies

We use essential cookies only, to keep you signed in. We do not use advertising cookies, tracking cookies, or third-party marketing pixels, and our analytics are cookieless. Because everything we set is strictly necessary to provide a service you asked for, we do not need to show you a consent banner, and we would rather not add one you have to dismiss on every visit.

Who else processes your information

We use a small number of established providers, each under a data-processing agreement:

Supabase, for the database and sign-in.
Stripe, for payments. Stripe is a separate controller for payment data and holds your card details, not us.
Vercel, for hosting and cookieless analytics.
Anthropic, for the Mimir companion.

Some of these providers may process data outside the UK. Where they do, that transfer is covered by the safeguards data protection law requires, such as the UK International Data Transfer Agreement or an adequacy decision.

We do not sell your information, and we never will.

How long we keep it

Your account, records and diary: for as long as you have an account. Ask us to close it and we delete them.
Billing records: Stripe retains transaction records for the period UK tax and accounting law requires, currently six years.
Analytics: aggregated, with no identifier that points back to you.

Your rights

Under UK data protection law you have the right to:

ask for a copy of the information we hold about you;
have inaccurate information corrected;
have your information deleted;
restrict or object to how we use it;
ask us to send your information to you or another provider in a portable format;
withdraw consent at any time, where we rely on consent.

Email info@neurofx.co.uk and we will respond within one month. There is no charge.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would rather hear from you first so we can put it right.

Children

FamilyFX is for parents and carers, and you must be 18 or over to hold an account. It is not designed for children to use. Information about your child only reaches us if you choose to write it into a worksheet or a diary entry.

Keeping things safe

Access to your records is controlled at the database level and bound to your account. Sign-in is by one-time email link, so there is no password to be stolen or reused. We keep the number of people and systems that can reach your information as small as we can. No system is perfectly secure, and we will tell you and the ICO promptly if something happens that puts your information at risk.

Changes to this policy

If we change how we handle your information, we will update this page and change the date at the top. If a change significantly affects how we use your information, we will tell you directly.