1. Introduction

Nuora LTD ("NUORA", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our weight management services and website at nuorahealth.com.

We handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Personal Information

• Name, date of birth, and contact details (email, phone, address)
• Payment and billing information
• Account login credentials
• Communication preferences

2.2 Health Information (Special Category Data)

• Medical history and current health conditions
• Current medications and allergies
• Weight, height, BMI, and body measurements
• Clinical assessment responses
• Prescriber consultation notes
• Treatment progress and outcomes

2.3 Technical Information

• IP address and device identifiers
• Browser type and operating system
• Pages visited and interaction data
• Cookies and similar technologies (see our Cookie Policy)

3. How We Use Your Information

3.1 Healthcare Provision

Your health data is special category data under UK GDPR. We process it on the basis of your explicit consent (Article 9(2)(a)) and for the provision of health care (Article 9(2)(h)):

• Assess your eligibility for treatment
• Support qualified prescribers and the regulated pharmacy partner to prescribe and dispense appropriate medications
• Provide clinical consultations and ongoing care
• Monitor your treatment progress and safety
• Communicate important health information

3.2 Service Operations

• Process payments and manage subscriptions
• Deliver medications to your address
• Respond to your enquiries and support requests
• Send service-related communications

3.3 Legal and Regulatory Compliance

• Maintain pharmacy records as required by the GPhC
• Report adverse drug reactions to the MHRA
• Comply with applicable healthcare and data-protection requirements
• Respond to lawful requests from authorities

4. AI-Assisted Clinical Support

Where you give explicit consent, AI providers and cloud service providers may process your messages, assessment answers and relevant clinical information so Nuora can draft replies, summarise information and support clinical review. AI does not make prescribing or other clinical decisions. Appropriately authorised professionals retain responsibility for those decisions.

You can withdraw AI-processing consent in your care preferences. If you withdraw, AI-generated responses stop and your messages are handled by the pharmacist team without AI. For questions about the use of your personal data, contact privacy@nuorahealth.com.

Nuora asks AI providers not to store its requests where the provider supports this, but cannot guarantee zero retention by a provider. Some providers may process data outside the UK; where that happens, the safeguards described in section 10 apply.

5. Data Sharing

We may share your information with:

• Healthcare Professionals: Prescribers, pharmacists, and clinical staff involved in your care
• Your GP: With your consent, we may share relevant treatment information
• AI Technology Providers: Providers that process consented information to draft, summarise and support clinical review; they do not make clinical decisions
• Delivery Partners: To fulfil medication deliveries (limited to delivery information only)
• Payment Processors: To process secure payments (we do not store full card details)
• Regulatory Bodies: Relevant regulators and public authorities where disclosure is required by law

We will never sell your personal or health data to third parties for marketing purposes.

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Secure transmission and storage controls appropriate to the service
• Secure, access-controlled cloud infrastructure
• Security review and monitoring appropriate to the systems and risks involved
• Strict access controls based on role requirements

7. Data Retention

We retain your data for the following periods:

• Clinical and Prescription Records: For the period required by applicable healthcare and pharmacy record-keeping rules
• Account and Service Information: For as long as needed to provide the service and meet legal or regulatory obligations
• Marketing Consent Records: Until consent is withdrawn

8. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Restriction: Limit how we process your data
• Portability: Receive your data in a portable format
• Object: Object to certain processing activities
• Withdraw Consent: Where processing is based on consent

To exercise any of these rights, please contact us at privacy@nuorahealth.com.

9. Cookies

Our website uses cookies and similar technologies:

• Essential Cookies: Required for the website to function
• Analytics Cookies: Help us understand how visitors use our site
• Marketing Cookies: Used with your consent to deliver relevant advertisements

You can manage your cookie preferences through our cookie consent banner or your browser settings.

10. International Transfers

Some service providers may process personal data outside the United Kingdom. Where that happens, we use the transfer mechanism and safeguards required by UK data-protection law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through our website. The "Last updated" date at the top indicates when this policy was last revised.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.