Privacy Policy

Cosi Care Ltd ("the Company," "we," "us," or "our") (Baltic Place, 50 Quayside, Newcastle upon Tyne, NE1 3JE, United Kingdom) is the data controller for personal data processed through incosicare.com under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can contact us at [email protected].

Cosi Care is a skin symptom tracking application that helps people living with eczema, psoriasis, and related itch-prone conditions identify their personal triggers. Because the Company's core service involves health data and photographs of your skin, we take data protection seriously and explain our practices in full below.

1. Data Controller

The Company (Baltic Place, 50 Quayside, Newcastle upon Tyne, NE1 3JE) is the data controller for personal data processed through incosicare.com under the UK GDPR and the Data Protection Act 2018. Contact us at [email protected] or by phone on +44 191 460 3120.

2. Personal Data We Process

We collect and process the following categories of personal data:

• Account and identity data: name, email address, password (stored in hashed form);
• Health data (special category under UK GDPR Article 9): symptom severity ratings, trigger notes, flare diary entries, and skin condition details you record;
• Photographs of your skin that you upload to the symptom log - these images are associated with your account and used solely to generate your personal tracking timeline;
• Usage data: pages visited, features used, session timestamps, device type, browser, operating system, and approximate location (country level only);
• Technical data: IP address, cookie identifiers, and analytics data collected with your consent;
• Support communications: messages you send us by email or through the in-app contact form.

Cosi Care is a personal tracking tool, not a clinical or diagnostic service. We do not share your symptom diary or photographs with healthcare providers, insurers, or any third party for clinical purposes. Your data is processed to operate your personal tracking account only.

3. Lawful Bases (Article 6 UK GDPR) and Health Data (Article 9)

We rely on the following lawful bases:

• Performance of a contract (Article 6(1)(b)): operating your account, delivering the symptom tracking and trigger-pattern features you have signed up for;
• Legitimate interests (Article 6(1)(f)): site security, fraud prevention, service improvement based on aggregate and anonymised usage signals, and communication about service changes;
• Legal obligation (Article 6(1)(c)): complying with applicable UK law;
• Consent (Article 6(1)(a)): non-essential analytics cookies, and any optional marketing communications.

Your health diary entries, symptom ratings, and skin photographs constitute special-category personal data under UK GDPR Article 9. We process these on the basis of your explicit consent (Article 9(2)(a)), given when you create an account and begin logging. You may withdraw that consent at any time by deleting your account, which triggers deletion of all health data and photographs. Withdrawal does not affect the lawfulness of processing before withdrawal.

4. Recipients and International Transfers

We share personal data only with processors who support the operation of the Service, including hosting infrastructure providers, email delivery providers, and analytics software providers. All processors are bound by Article 28 UK GDPR data-processing agreements.

Transfers to processors outside the United Kingdom are protected by the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy regulation, as applicable. We do not transfer special-category health data or skin photographs outside the UK without equivalent contractual protection in place.

5. Retention

We retain your account data and symptom diary for as long as your account is active. If you delete your account, all health diary entries and skin photographs are deleted within 30 days. Email support correspondence is retained for 24 months after the last exchange. Technical access logs are retained for 90 days. Aggregate and anonymised analytics data that cannot be linked to an individual may be retained indefinitely for product improvement.

6. Your UK GDPR Rights

Under the UK GDPR and the Data Protection Act 2018 you have the following rights:

• Right of access - to receive a copy of the personal data we hold about you;
• Right to rectification - to have inaccurate data corrected;
• Right to erasure - to request deletion of your personal data where no overriding legitimate ground exists;
• Right to restriction of processing - to ask us to pause processing while a dispute is resolved;
• Right to data portability - to receive your data in a structured, machine-readable format;
• Right to object - including to direct marketing without further conditions, and to processing based on legitimate interests;
• Rights related to automated decision-making - we do not make decisions about you that are solely automated and have legal or significant effects.

To exercise any of these rights, email [email protected]. We will respond within one month, extendable by two further months for complex requests. We do not charge a fee for reasonable requests.

7. Right to Complain to the ICO

You have the right to lodge a complaint with the UK Information Commissioner's Office ("ICO") if you believe we have not handled your personal data in accordance with the law. The ICO's website is ico.org.uk; helpline 0303 123 1113. We would always prefer to hear your concerns directly first so we can address them promptly.

8. Cookies

See our Cookie Policy for full details. Non-essential cookies, including analytics cookies, are not placed on your device without your prior consent, in accordance with the Privacy and Electronic Communications Regulations (PECR). You can manage your preferences through the cookie banner or your browser settings at any time.

9. Security and Changes

We implement technical and organisational measures proportionate to the risk of processing health data, including encrypted storage and access controls. No transmission over the internet is entirely secure, but we take reasonable steps to protect your information.

If we make material changes to this policy - for example, if we add a new category of data collection or change how we process health information - we will update the "Last updated" date and notify users by email where appropriate. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

10. Contact

Cosi Care Ltd
Baltic Place, 50 Quayside
Newcastle upon Tyne, NE1 3JE
United Kingdom
Email: [email protected]
Phone: +44 191 460 3120