Weight Management Privacy Notice

Weight-Management Scope

This page adds weight-management-specific context for assessment, prescribing preparation, pharmacist review, dispensing support, and ongoing monitoring. For general Nuora website and service privacy information, read the general Privacy Policy.

1. Introduction

Nuora LTD ("NUORA", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our weight management services and website at nuorahealth.com.

We handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Personal Information

• Name, date of birth, and contact details (email, phone, address)
• Payment and billing information
• Account login credentials
• Communication preferences

2.2 Health Information (Special Category Data)

• Medical history and current health conditions
• Current medications and allergies
• Weight, height, BMI, and body measurements
• Clinical assessment responses
• Prescriber consultation notes
• Treatment progress and outcomes

2.3 Technical Information

• IP address and device identifiers
• Browser type and operating system
• Pages visited and interaction data
• Cookies and similar technologies (see our Cookie Policy)

3. How We Use Your Information

3.1 Healthcare Provision

Your health data is special category data under UK GDPR. We process it on the basis of your explicit consent (Article 9(2)(a)) and for the provision of health care (Article 9(2)(h)):

• Assess your eligibility for treatment
• Prescribe and dispense appropriate medications
• Provide clinical consultations and ongoing care
• Monitor your treatment progress and safety
• Communicate important health information

3.2 Service Operations

• Process payments and manage subscriptions
• Deliver medications to your address
• Respond to your enquiries and support requests
• Send service-related communications

3.3 Legal and Regulatory Compliance

• Maintain pharmacy records as required by the GPhC
• Report adverse drug reactions to the MHRA
• Comply with NHS and healthcare regulations
• Respond to lawful requests from authorities

4. AI-Assisted Clinical Support

We use artificial intelligence to support your care. AI assists our pharmacist by preparing clinical assessments, identifying potential drug interactions, and drafting responses to your messages. All clinical decisions are reviewed and approved by a qualified pharmacist — AI never makes autonomous clinical decisions about your treatment.

You have the right to opt out of AI processing at any time. If you withdraw consent, your messages will be routed directly to the pharmacist without AI assistance. To opt out, contact us at privacy@nuorahealth.com or update your preferences in the app.

AI processing uses secure, encrypted connections. Your data is not used to train AI models.

5. Data Sharing

We may share your information with:

• Healthcare Professionals: Prescribers, pharmacists, and clinical staff involved in your care
• Your GP: With your consent, we may share relevant treatment information
• AI Technology Providers: Secure services that assist our pharmacist (your data is encrypted and not used for model training)
• Delivery Partners: To fulfil medication deliveries (limited to delivery information only)
• Payment Processors: To process secure payments (we do not store full card details)
• Regulatory Bodies: GPhC, MHRA, and NHS as required by law

We will never sell your personal or health data to third parties for marketing purposes.

Identity verification with Stripe

Nuora uses Stripe Identity to check that a patient is the person named in their assessment before prescribing or payment can continue. Stripe processes raw document images and selfie or liveness checks under its own privacy policy; Nuora does not store those raw ID document images in the eligibility form.

Stripe may share the verification result, status, error reason, timestamps, and necessary verification data with Nuora. Nuora uses that information to complete eligibility and safety checks, prevent fraud, maintain pharmacy records, support audit, and provide regulated clinical governance and pharmacist review.

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Secure, access-controlled cloud infrastructure
• Regular security audits and penetration testing
• Staff training on data protection and confidentiality
• Strict access controls based on role requirements

7. Data Retention

We retain your data for the following periods:

• Medical Records: Minimum 10 years from last treatment (NHS Records Management Code of Practice)
• Prescription Records: Minimum 6 years
• Account Information: Duration of account plus 2 years
• Marketing Consent Records: Until consent is withdrawn

8. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Restriction: Limit how we process your data
• Portability: Receive your data in a portable format
• Object: Object to certain processing activities
• Withdraw Consent: Where processing is based on consent

To exercise any of these rights, please contact us at privacy@nuorahealth.com.

9. Cookies

Our website uses cookies and similar technologies:

• Essential Cookies: Required for the website to function
• Analytics Cookies: Help us understand how visitors use our site
• Marketing Cookies: Used with your consent to deliver relevant advertisements

You can manage your cookie preferences through our cookie consent banner or your browser settings.

10. International Transfers

Your data is primarily processed within the United Kingdom. Where we use service providers outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the ICO.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through our website. The "Last updated" date at the top indicates when this policy was last revised.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.