What Ever Steady is
Ever Steady is a clinical research application, not a consumer wellness product. It is part of an ethics-approved feasibility study conducted through the University of Kent and the Parkinson's Centre for Integrated Therapy (PCIT), supported by a Parkinson's UK grant application. This distinction matters for how your data is handled — the standards that apply here are research ethics standards, not marketing ones.
The app is not a medical device. It does not diagnose, prescribe, or replace clinical care. Your clinical team remains the authority on your health.
What we collect and why
Ever Steady collects only what the study requires:
A pseudonymous Participant ID — no name is stored in the app
Daily check-in responses (mood, energy, mobility, on a 1–5 scale)
Exercise logs: type, duration, perceived effort, enjoyment, confidence, and post-session reflection
Conversational interactions with Mr Steady, stored as transcribed text
Optional wearable data (steps, active minutes, resting heart rate, sleep duration) where a Garmin or Fitbit device is connected and consent given
We do not collect names within the app. We do not collect GPS data. We do not build advertising profiles. Email addresses used for login are stored separately from health data and are never combined with it in any shared record.
Voice interactions
Mr Steady is voice-first. When you speak to the app, your voice is transcribed in real time and the text is processed to generate a response. Raw audio is never stored. It is discarded immediately after transcription. The transcribed text is stored under your Participant ID as part of your session record.
Wearable data
Connecting a Garmin or Fitbit device is optional and requires your explicit consent, separate from your main study consent. If you connect a device, the app retrieves only the activity data you have authorised via the wearable provider's own consent flow. Wearable data is treated as exploratory and supplementary — it is not used to make clinical determinations. Your Garmin or Fitbit account remains under your ownership and control throughout. You can disconnect at any time without affecting your study participation.
Garmin operates as an independent data controller under its own published privacy terms. The research team accesses only what you authorise, via the Garmin Health API, using your pseudonymous study ID.
Where your data lives
All health and study data is stored on Supabase, hosted on AWS infrastructure in the EU (eu-west-1, Ireland). Supabase holds SOC 2 Type 2 certification. Data is encrypted in transit (HTTPS/TLS) and encrypted at rest. Access is restricted by role to named members of the research team only.
Data is retained for a maximum of 12 months following study completion and then securely deleted in accordance with University of Kent data management policies.
Who can see your data
The research team — named members only, under University of Kent governance
Your clinical team — structured summaries of exercise engagement, mood, and relevant wearable trends, only where you have given consent for this sharing
Third-party processors — under formal Data Processing Agreements compliant with UK GDPR Article 28:
Supabase — database hosting (EU, SOC 2 Type 2)
OpenAI — language model processing for Mr Steady's responses (pseudonymised data only, zero data retention configured, no model training on your inputs)
ElevenLabs — voice synthesis for Mr Steady's spoken responses (real-time processing, audio not retained)
No data is sold. No data is shared with advertisers. No data leaves the research governance framework without your consent.
Your rights
Under UK GDPR, you have the right to access your data, correct inaccuracies, request deletion of identifiable data (prior to anonymisation), and withdraw from the study at any time without consequence to your clinical care. To exercise any of these rights, contact the research team directly.
Consent for wearable data sharing can be withdrawn independently of main study participation.
Research ethics and governance
This study has received ethics approval from the University of Kent. The study protocol, participant information sheet, and data management procedures have been reviewed and approved prior to any data collection. The study is registered with and conducted in accordance with UK GDPR and the Data Protection Act 2018.
A Data Protection Impact Assessment (DPIA) has been completed and is held on file. The study follows data minimisation and pseudonymisation principles throughout.
Contact and requests
For privacy questions, data requests, or withdrawal from the study, email:
aliya.saleem-6@kent.ac.uk
Research Assistant, School of Psychology, University of Kent
Requests are handled by named members of the research team and reviewed in line with University data management policy.