HOLD

Privacy Policy

Last updated: 15 March 2026

HOLD (“we”, “us”, “our”) is operated by Hold Ventures Ltd, registered in England and Wales.

We know that using an app like HOLD means trusting us with sensitive, personal information. We take that responsibility seriously. This Privacy Policy (“Policy”) explains what data we collect, why we collect it, how we use it, and how we protect it when users of HOLD (“User”, “you”, “your”) access or use HOLD.

HOLD is built on a simple principle: collect as little as possible, protect everything we do collect, and never use your data in ways you would not expect.

Please read this Policy carefully. By using HOLD, you agree to the collection and use of your information as described here. If you have any questions, you can contact us at hello@holdwellbeing.ai.

This Privacy Policy should be read alongside our Terms of Service, which are available within the app and at holdwellbeing.ai/terms.

1. About HOLD

  • HOLD is a companion app designed to provide calm, low-demand support during moments of overwhelm. It is designed for neuro-divergent adults, including those with ADHD, autism, anxiety, or who are exploring whether they may be neuro-divergent.
  • HOLD is not a medical device, healthcare professional or advisor. It does not provide medical advice, diagnosis, or treatment. It is not a substitute for professional healthcare, therapy, or counselling. It is not a crisis service and cannot provide emergency intervention or human support. If you are in crisis or need urgent support, please contact your local emergency services or a crisis helpline.

2. Data Controller

  • For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA”), the data controller is:

Hold Ventures Ltd

Email: hello@holdwellbeing.ai

  • If you have questions or concerns about how your data is handled, you can contact us at the email address above.

3. What Data We Collect

We design HOLD to collect as little personal data as possible. This section describes everything we collect.

3.1 Account Data

When you create a HOLD account, we collect:

  • Your email address (used for authentication, account recovery, and essential service communications);
  • A hashed version of your password (we never store your password in plain text); and
  • Age confirmation (you must confirm you are 18 (eighteen) or older to use HOLD)

3.2 Conversation Content

  • When you use HOLD, we collect:
  • The messages you send during support sessions, including any text you enter and selections you make;
  • The responses HOLD generates for you; and
  • Content you bookmark or save within the app, such as items from the Knowledge Library.
  • HOLD stores every message you send and every response it provides. This conversation history is retained for the lifetime of your account and is used to provide context for future sessions and to run the pattern analysis described in Section 3.3. You can permanently delete all conversation history at any time (see Section 10).

3.3 User Context (Created by HOLD)

  • To provide more relevant support over time, HOLD analyses your conversations to create and store the following:
  • A short plain-language summary of your situation (maximum 500 characters), updated as you use the app. This helps HOLD understand your context without you having to repeat yourself each session;
  • A record of recurring themes that appear across your conversations (maximum 300 characters). These are stored as short labels with occurrence counts (for example, “overwhelm_at_work:4” or “sleep_disruption:2”). Themes describe situations, and not diagnoses;
  • A familiarity level (a number from 0 to 3) that tracks how many sessions you have had with HOLD. This controls the tone of responses- earlier sessions are more neutral, and later sessions are more direct and precise. This level is based solely on session count, time since first use, and whether recurring themes have been detected. It is never based on emotional closeness or personal attachment; and
  • A session count recording how many times you have used HOLD.
  • This analysis is carried out by AI in the background after your session ends or during scheduled processing windows, and not only during live conversation. The purpose is to identify patterns that help HOLD support you more effectively. HOLD does not diagnose conditions, label emotions as disorders, or make clinical inferences.

3.4 Technical Data

We automatically collect:

  • Device locale (used to show you the correct crisis resources for your country)
  • Session timestamps (when you open and close the app)
  • App store region
  • Basic device information such as operating system and app version (used solely to ensure the app works correctly)
  • Crash reports and error logs (used to fix technical problems)

3.5 Feedback and Correspondence

If you contact us directly (for example, via email or an in-app feedback form), we collect your email address and the content of your message.

3.6 Information We Do Not Collect

  • Your real name (unless you choose to share it in conversation);
  • Your GPS location or precise geographic data;
  • Data from other apps on your device;
  • Contacts, photos, or files on your device; and
  • Diagnosis, medication, or clinical history (unless you voluntarily share this in conversation).

We do not use advertising trackers, and we do not sell or share your data with advertisers.

4. Special Category Data

  • Some of the information processed by HOLD relates to your emotional state, mental wellbeing, or neuro-divergent traits. Under UK GDPR, this is classified as “special category data” because it concerns your health (Article 9). This type of data receives additional legal protection, and we treat it with the highest level of care.
  • Specifically, the following data held by HOLD is treated as special category data:
  • The content of your messages during support sessions, which may contain information about how you are feeling, your emotional state, or experiences related to neuro-divergent traits; and
  • The user summary and pattern records that HOLD creates from your conversations (described in Section 3.3), which contain distilled information about your emotional themes and wellbeing.

4.1 Why We Process Special Category Data

  • We process this data solely to provide you with the HOLD service. This includes:
  • Generating relevant, context-aware responses during support sessions;
  • Remembering your context across sessions so you do not have to repeat yourself;
  • Identifying recurring themes in your experiences to provide more precise support over time;
  • Suggesting relevant content from the Knowledge Library based on what you have shared; and
  • Detecting potential crisis language and surfacing appropriate safety resources.
  • We do not use special category data for any other purpose. We do not use it for advertising, profiling for commercial purposes, research, or sharing with third parties for their own use.

4.2 Our Legal Basis

We rely on the following legal bases to process your data, as required by UK GDPR:

  • Account data (email, password, age confirmation): Contract performance (Article 6(1)(b)) — processing is necessary to provide the HOLD service you signed up for.
  • Technical data: Legitimate interests (Article 6(1)(f)) — necessary for service operation, security, and bug fixing. Our assessment is that these interests do not override your rights and freedoms.
  • Conversation content and user context (special category data):
  • Explicit consent (Article 9(2)(a)) — you provide this through a separate consent checkbox when creating your account. This consent is not bundled with your acceptance of the Terms of Service.

The consent checkbox states: “I understand that HOLD processes information about my mental health and wellbeing, and I give my explicit consent to this processing.”

  • You can withdraw your consent at any time by deleting your account. Withdrawal of consent means HOLD will no longer be able to provide the service, except as required by law. It will not affect the lawfulness of any processing carried out before withdrawal.

4.3 Data Minimisation

We apply the principle of data minimisation to all special category data:

  • User summaries are limited to a maximum of 500 characters;
  • Pattern records are limited to a maximum of 300 characters and store only short theme labels with occurrence counts, not direct quotes from your conversations;
  • Only your most recent 20 messages are sent to the AI for generating responses;
  • Pattern detection analyses only your most recent messages (approximately 2–3 sessions worth, up to 50 messages), not your entire history;
  • We do not collect or infer information about specific diagnoses, medications, or clinical history;
  • The user summary and pattern fields are encrypted at rest with additional application-level encryption (see Section 8.2); and
  • AI response length is capped at 180–320 tokens depending on familiarity level

5. How We Use Your Data

  • We use the data we collect for the following purposes:
  • To provide and maintain the HOLD app and its features, including real-time conversational support and cross-session memory;
  • To analyse your conversations in the background to identify recurring themes and update your user summary (see Section 3.3). This processing happens after your session ends or during scheduled processing windows, and not only during live conversation;
  • To adjust the tone and depth of HOLD’s responses based on your familiarity level;
  • To remember your preferences, bookmarks, and context so your experience feels consistent across sessions;
  • To detect crisis language and provide appropriate safety resources based on your device locale;
  • To improve the app based on aggregate, anonymised usage patterns;
  • To fix bugs and resolve technical issues via crash reports;
  • To respond to your feedback, questions, or support requests;
  • To send essential service communications (account updates, security alerts, data breach notifications, and changes to our Terms); and
  • To comply with legal obligations.
  • For the avoidance of any doubt, HOLD does uses your data solely for the purposes of providing, maintaining, securing and improving the app and its services to the user. We will never use your data for advertising, marketing, profiling for commercial purposes, AI model training, or any purpose unrelated to providing and improving HOLD.
  • HOLD does not make automated decisions that have legal or similarly significant effects on you. The AI generates supportive responses only and does not make decisions about your access to services, rights, or opportunities.

6. AI and Automated Processing

HOLD uses artificial intelligence (Claude by Anthropic) to provide its support features. This section explains how AI is used, what data is sent to AI services, and what safeguards are in place.

6.1 Real-Time Conversational Support

  • When you send a message in HOLD, the following is sent to the Anthropic API:
  • A system prompt containing HOLD’s behavioural rules and constraints (this does not contain any of your personal information);
  • Your most recent conversation history (up to 20 messages) to provide context;
  • Your user summary and known pattern themes, so HOLD can respond with awareness of your situation; and
  • Your familiarity level, which controls the tone and length of responses.
  • The AI generates a response based on this context. The response is governed by strict rules set in HOLD’s system prompt, including boundaries around tone, length, and forbidden phrases. HOLD will never claim to be your friend, suggest you don’t need other support, or use language that encourages emotional dependency.

6.2 Background Pattern Analysis

  • After your session ends (or during scheduled processing windows), HOLD sends your most recent messages (up to 50) to the Anthropic API for pattern analysis. This is a separate process from real-time conversation and is used to:
  • Identify recurring emotional themes across your recent sessions; and
  • Update your user summary with a short, plain-language description of your current situation.
  • This analysis does not diagnose conditions, label emotions as disorders, or make clinical inferences. It produces only short theme labels to describe the user’s situation (for example, “overwhelm_at_work”), occurrence counts, plus a brief summary of the current situation. The AI uses a lower temperature setting (0.3) for this analysis to ensure consistency.

6.3 What AI Does Not Do

  • AI does not make any decisions that have legal or similarly significant effects on you;
  • AI does not diagnose conditions or recommend treatments;
  • AI does not share your data with other users;
  • AI does not replace human judgement and is intended solely as a support tool; and
  • AI responses may be inaccurate, incomplete, or inappropriate- HOLD is not a clinical service.

6.4 Crisis Detection

  • HOLD includes a crisis detection feature. If you express suicidal intent, active self-harm plans, or describe imminent danger, HOLD will immediately stop its normal reflective responses and instead provide you with relevant crisis resources based on your device locale (for example, the Samaritans helpline in the UK or the 988 Lifeline in the US).
  • This is a safety feature, not a clinical assessment. HOLD does not contact emergency services on your behalf, does not provide crisis care, and does not share your conversations with any third party as a result of crisis detection. HOLD cannot guarantee the accuracy or availability of third-party crisis services.

6.5 Third-Party AI Service

  • HOLD uses Anthropic (Claude AI) to power both its real-time conversational features and its background pattern analysis. Anthropic acts as a data processor under a Data Processing Addendum that includes UK GDPR provisions and Standard Contractual Clauses. Under this agreement and Anthropic’s commercial terms:
  • Anthropic does not retain your conversation data beyond what is needed to generate a response;
  • Anthropic does not use your data to train their AI models; and
  • All data is transmitted to Anthropic over encrypted connections (HTTPS/TLS).
  • We minimise the data sent to Anthropic. User summaries and pattern labels are short, abstracted descriptions, and not full transcripts of your conversations. The system prompt does not contain your personal information.

7. Data Sharing

We do not sell your personal data. We do not share your data with advertisers. We limit data sharing to the minimum necessary to operate the app.

7.1 Third-Party Data Processors

  • HOLD uses the following third-party processors to deliver the service:
  • Anthropic (Claude AI)- processes conversation content to generate responses and perform pattern analysis. Anthropic acts as a data processor under a Data Processing Addendum. Anthropic does not retain your conversation data; and
  • Supabase- securely stores your data (conversations, user context, account data). Supabase acts as a data processor under a signed Data Processing Agreement. Your data is hosted in EU-West-2 (London, UK).
  • These third-party processors shall not engage sub-processors without the prior authorisation of the Company. Where sub-processors are appointed, the third-party processors shall be liable for the acts or omissions of the sub-processors.
  • We have Data Processing Agreements (“DPA”) in place with all third-party processors as required by UK GDPR.

7.2 Other Disclosures

We may also disclose your data to law enforcement or regulatory authorities, but only where we are legally required to do so.

7.3 We Will Never Share Data With

  • Advertisers or marketing companies;
  • Data brokers;
  • Social media platforms;
  • Analytics providers (except in anonymised, aggregated form that cannot identify you);
  • Any third party for their own commercial purposes; and
  • Any third party for AI model training.

8. Data Storage and Security

8.1 Where Your Data Is Stored

Your data is stored on secure servers provided by Supabase, located in EU-West-2 (London, UK]. When your data is sent to Anthropic’s API for processing, it is transmitted to servers in the United States under Standard Contractual Clauses incorporated into Anthropic’s Data Processing Addendum.

8.2 How We Protect Your Data

The Company shall implement appropriate safeguards to ensure that your data is protected. These include:

  • All data is encrypted in transit using HTTPS/TLS for all communications between your device, the HOLD application, Supabase, and Anthropic;
  • All data stored in our database is encrypted at rest at the infrastructure level;
  • Your user summary and pattern records receive additional application-level encryption (AES-256) before being written to the database, because they contain distilled special category data;
  • Supabase Row Level Security (RLS) policies restrict data access;
  • API keys and credentials are stored as environment variables, never in application code;
  • Access to personal data is restricted to authorised personnel only (see Section 8.3); and
  • We conduct regular reviews of our security practices.

8.3 Who Has Access to Your Data

  • Inder Vaid (data controller)- full database access for service management, breach response, and deletion requests;
  • Inder (technical partner)- full database access for development, maintenance, and debugging;
  • Anthropic- transient processing only; no data retention under commercial terms; and
  • Supabase- infrastructure access under DPA.
  • No other person or organisation has access to your data.
  • While we take every reasonable step to protect your data, no system is completely secure. We encourage you to contact us immediately at hello@holdwellbeing.ai if you believe your data may have been compromised.

9. Cookies and Local Storage

  • HOLD uses only essential cookies and local storage required for the service to function. These include:
  • Authentication tokens- to keep you signed in during a session; and
  • Session identifiers- to maintain your conversation state
  • We do not use analytics cookies, advertising cookies, tracking pixels, or any third-party cookies. We do not use cookies or local storage to build profiles, serve advertisements, or track your behaviour across other websites or apps.
  • Because we only use strictly necessary cookies, we are not required to obtain your consent for their use under the Privacy and Electronic Communications Regulations (PECR). However, we include this information for transparency.
  • You can manage cookies through your browser or device settings, but disabling essential cookies or local storage may prevent HOLD from functioning correctly.

10. Data Retention and Deletion

10.1 Retention Periods

  • Account data, conversation history, user summary, pattern records, familiarity level, and session count: retained for the lifetime of your account, unless as mentioned in section 10.3;
  • Anonymised and aggregated analytics data: may be retained indefinitely as it cannot be linked back to you;
  • Feedback and correspondence: retained for up to 12 (twelve) months after the matter is resolved, and then deleted;
  • Crash reports and error logs: retained for up to 90 days, and then deleted; and
  • Anthropic: does not retain your conversation data under its commercial terms.

10.2 Inactive Accounts

Accounts with no activity for 12 (twelve) months may be deleted after we have given you reasonable notice to your registered email address. If you do not respond or log in after receiving this notice, your account and all associated data will be permanently deleted.

10.3 Deleting Your Data

  • You can delete all your data at any time using the “Reset My Data” option in the app settings, or by contacting us at hello@holdwellbeing.ai.
  • When you request deletion:
  • Your access to HOLD is revoked immediately. You will not be able to send new messages while deletion is pending;
  • Your data enters a 30 (thirty) day grace period during which you can change your mind and cancel the deletion through the app settings;
  • After 30 (thirty) days, all your data is permanently and irreversibly deleted from our servers. This includes your conversation history, user summary, pattern records, familiarity level, account data, and all associated metadata; and
  • Once deletion is complete, we cannot recover your data.
  • Anonymised, aggregated data that has already been incorporated into our analytics cannot be deleted because it is no longer linked to you.

11. Third Party Links

  • HOLD may contain links to third-party websites, applications and services (“Third-Party Services”) that are not owned, operated and controlled by the Company. These links are provided solely for convenience, informational purposes, or to enhance user experience. The inclusion of such links does not constitute or imply any endorsement, approval, or verification by the Company of such Third-Party Services.
  • The Company does not exercise any control over the nature, content, accuracy and practices of the Third-Party Services and shall not be liable for any losses or damages arising from the errors, omissions or misleading representations made by such services.
  • Your access to and use of any Third-Party Services shall be governed by the terms, and privacy policies of such Third-Party Services. You are advised to review their terms and policies before engaging with the Third-Party Services.
  • The Company does not represent or guarantee that Third-Party Services are free from malware, viruses, or harmful components, and shall not be held liable for such cyber risks.
  • To the maximum extent permitted by law, the Company, its affiliates and directors disclaim all liability arising from or in connection with Third-Party Services, including any direct, indirect, incidental, or consequential loss or damage resulting from reliance upon such services.

12. Data Breach Notification

  • In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:
  • We will notify you without undue delay, using the email address associated with your account; and
  • We will notify the Information Commissioner’s Office (ICO) within 72 (seventy-two) hours of becoming aware of the breach, in accordance with Article 33, UK GDPR.
  • Our Data Breach Response Plan sets out our internal procedures for detecting, assessing, containing, and reporting breaches. This plan is reviewed regularly.

13. Your Rights

  • Under UK GDPR, you have the following rights in relation to your personal data:
  • Right of access: You can request a copy of the personal data we hold about you, including your conversation history, user summary, and pattern records;
  • Right to rectification: You can ask us to correct inaccurate data;
  • Right to erasure: You can ask us to delete your personal data. You can also do this directly through the app settings (see Section 10.3);
  • Right to restrict processing: You can ask us to limit how we use your data in certain circumstances;
  • Right to data portability: You can request your data in a structured, commonly used, machine-readable format;
  • Right to object: You can object to processing based on legitimate interests;
  • Right to withdraw consent: You can withdraw consent for special category data processing at any time by deleting your account. Withdrawal does not affect the lawfulness of prior processing; and
  • Rights related to automated decision-making: HOLD does not make automated decisions that have legal or similarly significant effects on you.
  • To exercise any of these rights, contact us at hello@holdwellbeing.ai. We will respond within 30 (thirty) days. If we need more time (up to a further 2 (two) months for complex requests), we will let you know and explain why.
  • If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: ico.org.uk

Telephone: 0303 123 1113

14. Children

  • HOLD is designed for adults aged 18 (eighteen) and above. We do not knowingly collect, or process personal data from anyone under 18 (eighteen).
  • If we become aware that we have collected data from a person under 18 (eighteen), we will terminate their account and delete all associated data without delay.
  • If you believe a person under 18 (eighteen) is using HOLD, please contact us at hello@holdwellbeing.ai.

15. International Data Transfers

  • Your data is stored in EU-West-2 (London, UK) on Supabase servers. When your data is sent to Anthropic’s API for processing, it is transferred to the United States.
  • This transfer is protected by Standard Contractual Clauses (SCCs) incorporated into Anthropic’s Data Processing Addendum, as approved by the ICO.
  • Details of our current data processors and their locations are available on request by contacting hello@holdwellbeing.ai.

16. Data Protection Impact Assessment

  • Because HOLD processes special category data (health-related data concerning emotional state and neuro-divergent traits), we have conducted a Data Protection Impact Assessment (“DPIA”) in accordance with UK GDPR Article 35 and ICO guidance.
  • This assessment covers:
  • The necessity and proportionality of processing special category data for the purposes described in this Policy;
  • The risks to individuals, including the sensitivity of the data, the potential for harmful AI responses, and the consequences of a data breach; and
  • The technical and organisational measures we have implemented to mitigate those risks, including encryption, data minimisation, access controls, crisis detection safeguards, and deletion procedures.
  • Our DPIA is reviewed every 6 (six) months and whenever we make significant changes to how we process personal data. A summary is available on request.

17. Data Protection Officer

  • We have assessed whether we are required to appoint a Data Protection Officer (“DPO”) under UK GDPR Article 37. At our current scale, our core activities do not involve large-scale processing of special category data, and we do not conduct regular and systematic monitoring of individuals on a large scale. We have therefore determined that a DPO is not currently required.
  • This assessment is reviewed every 6 (six) months and will be reassessed if our user base grows significantly or if the ICO issues updated guidance relevant to AI mental health tools.
  • In the meantime, all data protection enquiries should be directed to hello@holdwellbeing.ai.

18. Changes to This Policy

  • We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the app at least 14 (fourteen) days before the changes take effect. We will always keep the current version available within the app.
  • If you do not agree with the updated policy, you may delete your account before the changes take effect. If you continue using HOLD after the changes have been brought, such continued use will be deemed as acceptance of the amended Policy.
  • The “Last Updated” date at the top of this Policy indicates when it was most recently revised.

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:

Hold Ventures Ltd

Email: hello@holdwellbeing.ai

We aim to respond to all enquiries within 5 working days. For formal data rights requests, we will respond within 30 (thirty) days as required by UK GDPR.

This Privacy Policy was last reviewed on 15 March 2026. Version 3.0.