Twinpath.
← TwinPath home

Updated 2 November 2026 · Privacy notice

Your information, your choices.

This notice explains how TwinPath handles information when you use our mobile app and website. It describes the current product and service-provider flows. Please read the parts about optional AI and health information before using those features.

Who operates TwinPath

TwinPath is operated by DOMUS LAB LTD (company number 16700823; registered office: 2, 8 Henry Road, London SW9 7BQ, United Kingdom) (“TwinPath”, “we”, “us” or “our”). We provide the TwinPath app and this website.

For privacy questions or rights requests, email privacy@twinpath.app. For general support, email support@twinpath.app.

Information we handle

The information depends on which features you choose:

  • Account and sign-in: your name, email address, authentication details, language and preferences.
  • Health and wellbeing entries: check-ins, periods and bleeding, symptoms, lab results, sleep and stress, food and nutrition notes, meal photos, medication and supplements, reminders, treatment notes and reflections you choose to save.
  • Conversations and requests: messages and saved conversation history with Mia, plus any details you choose to include in support messages.
  • Apple Health readings: if you enable access, readings you permit, which can include steps, sleep, resting heart rate and HRV.
  • Purchases: Apple processes payment. RevenueCat receives an opaque billing identifier and purchase information to check membership and restore purchases. TwinPath does not send RevenueCat your email, health entries or conversations.
  • Support email: the address and message content you choose to send to support or privacy, including any attachments. Support email is temporarily stored in encrypted AWS storage for forwarding; the configured lifecycle expires that stored copy after 14 days. Deletion may take time to complete after expiry. The forwarded copy may remain in the receiving mailbox under that provider’s retention rules.
  • Service and security records: information needed to authenticate requests, maintain the service and investigate errors, including account-linked audit events.

TwinPath is intended for people aged 18 and over. Some of this information, including health information, is sensitive under privacy laws.

How we use information

We use account information to create and secure your account, save the records you choose, provide requested app features, send sign-in and security emails, process membership, respond to support, protect the service and meet legal obligations.

Health entries and optional features are controlled through separate choices in the app. We do not use health records for advertising, and no external health-research or commercial data-sharing programme is currently active.

Where UK or EEA data-protection law applies, we rely on Article 6(1)(b) to provide the account and features you request; Article 6(1)(a) for optional AI and other optional features; and Article 6(1)(f) for proportionate security and service-operation purposes. For health information, we rely on your explicit consent under Article 9(2)(a). We use information under Article 6(1)(c) where needed to meet a legal obligation. You can withdraw an optional consent in the app or by contacting us; this does not affect processing already carried out and may make the related feature unavailable. Where another privacy law applies, your rights and our lawful grounds may differ.

Possible future health research

No research or commercial data-sharing programme is active, and we do not currently provide personal or pseudonymized health information to pharmaceutical or biotechnology companies for their own research or product-development purposes. This notice does not mean that you have consented to such use.

In the future, we may invite you to make a separate, optional choice about a defined women’s-health research programme. If offered, its scope may include menstrual and reproductive health, conditions such as PCOS or endometriosis, menopause, symptoms, treatment experiences and outcomes, sleep or wellbeing. It may include studies funded by pharmaceutical or biotechnology partners, and TwinPath may receive funding or other commercial benefit. Before any such use, we will explain the particular programme, the information involved, recipient categories, safeguards and withdrawal process, and obtain any consent or other approval required by the law that applies to you. You can continue using core app features without joining.

If a programme uses pseudonymized information, it remains personal data and will be protected accordingly. We would not give a research partner direct identifiers or the key that links a research record to your account. Partner contracts and access controls must prohibit attempts to identify or contact participants, advertising, and decisions about an individual’s care, eligibility, insurance or pricing. We will assess re-identification risk before releasing aggregate results and describe results as anonymous only when people are not reasonably identifiable. We will not treat a policy update as your consent. A defined optional choice may cover later studies only within its stated research area and only where permitted; we may ask for a new choice for other uses or where required by law. You may withdraw from future collection and use as described when the programme is offered, although data already made irreversibly anonymous or included in published results may no longer be traceable or removable.

Mia and optional AI features

Mia is an optional AI companion. If you turn it on and send a message, the request can include your current message, recent conversation, saved onboarding answers, recent check-ins and food notes, and the context you separately choose to include. This may include a medication note and reminders, recent bleeding or lab records, sleep or stress entries, or Apple Health readings. Private reflections and private symptom notes are not included automatically, but anything you choose to type or send may be processed.

When you ask for a meal estimate, the selected meal photo or text description is sent for that estimate. Photos are re-encoded to remove embedded file metadata, but visible details in an image may still identify you.

These AI requests are processed by Amazon Bedrock using Nova Lite in the AWS Europe (Stockholm) region. Your account name and email are not deliberately added to Mia’s context; you could still include identifying details in a message or note. AWS may process or retain content under the Bedrock settings and safeguards applicable to the selected model. Mia can make mistakes, does not diagnose or prescribe, and is not monitored by a clinician.

Turning AI off stops future AI requests but does not delete saved conversations. Pausing new health entries also pauses personalised AI while keeping saved records available. Use account deletion to remove active account and health records.

Apple Health and device permissions

Reading Apple Health and sharing readings with Mia are separate choices. TwinPath reads Apple Health information on your iPhone; it does not automatically sync all readings to your TwinPath account and does not write information back to Apple Health. If you choose to send readings to Mia, up to 28 daily readings from the last seven days may be included with your request, with their dates, units and sources.

Camera, photo-library and notification access are optional. Daily reminders are scheduled on your device. Voice check-ins use on-device transcription when supported; TwinPath does not save or upload an audio recording. You review the transcribed text before saving it.

Service providers and sharing

We use service providers to operate the app:

  • Amazon Web Services: account and app hosting, database and private meal-photo storage, AI processing through Bedrock, and transactional email through SES. Account verification, welcome and security email templates do not include health answers.
  • Apple: sign-in, Apple Health permissions, app distribution and payment processing.
  • RevenueCat: purchase verification and membership restoration using a dedicated billing identifier and purchase information.
  • Expo and Apple push services: app updates and generic push delivery using device tokens and delivery identifiers. Health records and conversation text are not included in notification payloads.

We do not disclose your health records or conversations to community experts. Community content is visible to members; joining a community does not share your private health records, email or Mia conversations with its expert. We may disclose information if required by law or where necessary to protect people’s rights, safety or security.

Website, cookies and analytics

This website is a static information site. It stores your language choice in your browser so the site can remember English or Spanish. It does not have an account sign-in, contact form, advertising pixel or third-party analytics tool. Your browser and hosting provider may create ordinary technical logs to deliver and protect the pages. If you email us, your email provider and the providers used to forward and store your message will process the information you send.

Retention and deletion

You can request account deletion in the app. Deletion removes core account and health records from the active service and queues meal-photo removal. Some security records are retained with the account identifier removed, and some referral or purchase evidence may be kept for accounting, fraud prevention or legal requirements. Deleting your TwinPath account does not cancel an Apple subscription.

Automated database backups and application logs are configured for 14 days. Some snapshots may be kept for operational recovery; provider-held copies follow the providers’ applicable service terms; and records required for legal or operational reasons can remain beyond that period. We do not have one fixed period for every provider-held copy. Contact privacy@twinpath.app for information about a specific request.

Export tools in the app can provide a copy of account information, but may not include every item needed for a formal access request. Exported files and anything you share with another app are controlled by you and that recipient.

Where information is processed

Our app database, meal-photo storage and AI service run in AWS Europe (Stockholm). AWS, Apple, RevenueCat and Expo may process information in other countries, and support email is forwarded to a corporate mailbox at domuslab.io. Our support forwarding function uses AWS SES in Sweden; the mailbox provider may process or store messages in its own operating regions. Provider terms describe transfer mechanisms for the services they cover, including AWS’s service terms, RevenueCat’s data processing addendum, and the privacy and transfer information published by Expo and Apple. These descriptions do not establish that every mechanism applies to every TwinPath processing activity. Contact us for information about a specific transfer. For Australian users, providers may process personal information in the United States and other countries where they operate.

Your privacy rights

Depending on where you live, you may be able to ask us to access, correct, delete, restrict or provide a copy of your personal information; object to certain uses; or withdraw a choice you previously made. You can also complain to your privacy regulator: the Information Commissioner’s Office (ICO) in the UK, the Agencia Española de Protección de Datos (AEPD) in Spain, or the Office of the Australian Information Commissioner (OAIC) in Australia, usually after first contacting us. Email privacy@twinpath.app to make a request. We may need to verify your identity before responding. Turning a feature off does not by itself erase earlier records.

Security and changes

We use technical and organisational steps intended to protect information. No online service can guarantee absolute security. We may update this notice as TwinPath changes. The revised notice will appear on this page with a new update date; where required, we will tell you about significant changes before they apply.

Contact

DOMUS LAB LTD · Company number 16700823
Registered office: 2, 8 Henry Road, London SW9 7BQ, United Kingdom
Privacy requests: privacy@twinpath.app
Support: support@twinpath.app