Last updated 29 September 2026 · Draft — pending final legal review
Aegis Path (operated by Virtus Nemeton) handles special-category health data. This policy explains what we collect, why, and how you stay in control of it.
To run the core product (storing and reminding you about medications and appointments), to provide rules-first reminders from your own data, and to let you share access with carers you explicitly invite. We do not sell your data or use it for third-party advertising.
Hosting, storage locations and subprocessor arrangements will be set out in the final privacy notice before a controlled pilot. We will explain these arrangements in clear language and update this page when they are confirmed.
We will not make a data-residency claim until the relevant infrastructure and contractual arrangements are verified.
The initial scope is rules-first reminders and prompts. If automated features are introduced, we will explain the data involved, the safeguards used and the controls available to you before those features are used.
Reminders only reach a device if you turn them on there. Your browser then asks its own push service to create a delivery address, which we store with your account so we can send reminders at the times you set. Depending on your browser, that service is run by Google (Chrome and Android), Apple (Safari, iPhone and iPad), Mozilla (Firefox) or Microsoft (Edge).
Every notification is encrypted for your device before it leaves us, so the push service can see when a notification is sent, but not what it says.
Notifications are discreet by default: they say only “You have a reminder”, with no medication names, so nothing personal appears on your lock screen. If you turn discreet notifications off in Account & privacy, notifications include the reminder's title, such as a medication name and amount. Anyone who can see your screen may then see it.
We delete a device's push subscription when you turn reminders off on it, when you sign out on it, when your browser tells us it is no longer valid, or after repeated failed deliveries. All of them are deleted with your account.
Reminders are not guaranteed to arrive. Do not rely on them as your only prompt.
To stop automated abuse, we limit how often people can send carer invites and join the early-access list. To do this, we count recent attempts per IP address, per account and, for early access, per email address.
Those values are turned into one-way scrambled codes (a keyed hash) before anything is stored. We never store the IP address or email address itself in these counters. The counters are kept for no more than 8 days and then deleted.
We do this because of our legitimate interest in keeping the service and the people using it safe.
Sharing is opt-in and scoped. The other person must accept from their own account and can only view what you choose; your journal is never shared. You can remove access at any time and it stops immediately. Both of you can see the history of invites and changes. Messages are a shared record that neither person can edit or delete; you keep access to them after you remove someone, and they do not. Nobody at Virtus Nemeton reads your messages or journal as part of running the service.
You can also create links that send information outside Aegis Path, only when you choose to: a calendar feed for your own calendar app, or a read-only summary (also available in the FHIR health data format) for a GP practice or pharmacist. You choose what each link includes; your journal is never included. Calendar feeds are discreet unless you turn on details, because your calendar provider (for example Google, Apple or Microsoft) will hold a copy of what the feed contains. Share links expire within 90 days. Anyone who has a link can open it until it expires or you turn it off, so share it only with the person it is for. We store a fingerprint of each link, not the link itself, and record when and how it was opened (date, time and the app or browser identifier) so you can see it. Once a professional has downloaded a summary, their copy is held under their own records policies.
Under UK GDPR you can request access to, correction of, or deletion of your data at any time. You can download a full copy of your data from Account & privacy, and request account deletion there. We aim to complete deletion within 30 days and will confirm by email. Email team@virtusnemeton.co.uk and we'll act on it within statutory timeframes. That's a promise, not boilerplate.
We keep your data while your account is active. If you delete your account, your personal and health data is deleted, including your journal, device push subscriptions and messages, other than what we're legally required to retain (e.g. for audit purposes). Anti-abuse counters are deleted within 8 days whether or not you have an account.
Data protection queries: team@virtusnemeton.co.uk