Privacy Policy

Introduction

Nuora Ltd ("NUORA", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our weight management services and website at nuorahealth.com.

We handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Information We Collect

2.1 Personal Information

• Name, date of birth, and contact details (email, phone, address)
• Payment and billing information
• Account login credentials
• Communication preferences

2.2 Health Information (Special Category Data)

• Medical history and current health conditions
• Current medications and allergies
• Weight, height, BMI, and body measurements
• Clinical assessment responses
• Prescriber consultation notes
• Treatment progress and outcomes

2.3 Technical Information

• IP address and device identifiers
• Browser type and operating system
• Pages visited and interaction data
• Cookies and similar technologies (see our Cookie Policy)

How We Use Your Information

3.1 Healthcare Provision

Your health data is special category data under UK GDPR. We process it on the basis of your explicit consent (Article 9(2)(a)) and for the provision of health care (Article 9(2)(h)):

• Assess your eligibility for treatment
• Support qualified prescribers and the regulated pharmacy partner to prescribe and dispense appropriate medications
• Provide clinical consultations and ongoing care
• Monitor your treatment progress and safety
• Communicate important health information

3.2 Service Operations

• Take payment for your Nuora membership
• Take payment for consultations and medicines on behalf of our partner pharmacy, which provides your clinical care and supplies your medicine
• Arrange delivery of medicines dispensed by our partner pharmacy
• Respond to your enquiries and support requests
• Send service-related communications

3.3 Legal and Regulatory Compliance

• Maintain pharmacy records as required by the GPhC
• Report adverse drug reactions to the MHRA
• Comply with applicable healthcare and data-protection requirements
• Respond to lawful requests from authorities

How AI helps your pharmacist

AI systems may help your care team review messages and clinical information. In production, patient information may be processed only on self-hosted open-weight AI systems, or by an external AI provider under a signed data processing agreement. Consumer AI subscriptions are not used for patient information. AI never makes prescribing or other clinical decisions, and it never decides that a symptom is safe to ignore. The pharmacist or prescriber responsible for your care makes those decisions.

You can withdraw AI-processing consent in your care preferences. If you withdraw, AI-generated responses stop and your messages are handled by the pharmacist team without AI. For questions about the use of your personal data, contact privacy@nuorahealth.com.

Processing may take place in the UK or overseas. Any overseas transfer is subject to appropriate data protection safeguards.

Data Sharing

We may share your information with:

• Healthcare Professionals: Prescribers, pharmacists, and clinical staff involved in your care
• Your GP: With your consent, we may share relevant treatment information
• AI Technology Providers: Providers that process consented information to draft, summarise and support clinical review; they do not make clinical decisions
• Delivery Partners: To fulfil medication deliveries (limited to delivery information only)
• Payment Processors: To process secure payments (we do not store full card details)
• Advertising Partners (Google Ads and Meta, for Facebook and Instagram): With your consent to marketing cookies, if you sign up we tell them that a sign-up happened, with a one-way scrambled (hashed) copy of your email so they can match it to an advert you saw. We never send them health information
• Regulatory Bodies: Relevant regulators and public authorities where disclosure is required by law

We will never sell your personal or health data to third parties for marketing purposes.

Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Secure transmission and storage controls appropriate to the service
• Secure, access-controlled cloud infrastructure
• Security review and monitoring appropriate to the systems and risks involved
• Strict access controls based on role requirements

Data Retention

We retain your data for the following periods:

• Clinical and Prescription Records: For the period required by applicable healthcare and pharmacy record-keeping rules
• Account and Service Information: For as long as needed to provide the service and meet legal or regulatory obligations
• Marketing Consent Records: Until consent is withdrawn

Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Restriction: Limit how we process your data
• Portability: Receive your data in a portable format
• Object: Object to certain processing activities
• Withdraw Consent: Where processing is based on consent

To exercise any of these rights, please contact us at privacy@nuorahealth.com.

Cookies

Our website uses cookies and similar technologies:

• Essential Cookies: Required for the website to function
• Analytics Cookies: Help us understand how visitors use our site. We use Google Analytics 4, only with your consent; we do not send it your name, contact details or health information, and you can withdraw consent at any time through our cookie preferences
• Marketing Cookies: Used only with your consent to measure and deliver relevant advertisements. With that consent, if you sign up we tell Google (Google Ads) and Meta (Facebook and Instagram) that a sign-up happened, with a one-way scrambled (hashed) copy of your email so they can match it to an advert you saw. We never send health information

You can manage your cookie preferences through our cookie consent banner or your browser settings.

Our Social Media Accounts

Nuora has its own brand accounts on YouTube, TikTok, Instagram, Facebook, LinkedIn and X. This section explains what we receive from those platforms when we connect those accounts to Nuora's systems through each platform's official API. It is about our own accounts only: we do not connect, post to or read anyone else's account.

10.1 What we connect and why

A member of the Nuora team connects each account using the platform's own sign-in and permission screen. Once connected, Nuora's systems use the connection to:

• publish Nuora's own content to Nuora's own accounts;
• read the public comments that people leave on Nuora's own posts, so that we can see and answer them and pass anything that sounds like a health problem or side effect to a person for clinical review rather than treating it as marketing; and
• read how Nuora's own posts and accounts are performing, so that we can see what is useful to people.

10.2 What we receive

• Account basics for our own account: its name, username and the platform's identifier for it.
• Access tokens: the access token (and, where the platform provides one, a refresh token) that lets Nuora act on that account, together with the permissions granted and the date the token expires.
• Our own posts: the identifier, link and publishing status of each post we publish.
• Comments on our posts: the text of the comment, when it was posted, its identifier and the post it belongs to. We do not ask the platform for the commenter's name or profile, but a comment may contain a name or other personal details if the commenter chose to write them.
• Performance figures for our own posts and accounts: counts such as views, reach, likes, comments, shares and clicks.

We read comments on our YouTube, Facebook and Instagram posts. For TikTok, LinkedIn and X we use the connection to publish and to read performance figures, not comments. Please avoid putting personal health details in a public comment; if you have a health question, contact us directly instead.

The information is processed by the cloud providers that host Nuora's systems and, where we use AI tools to help draft a reply to a comment, by AI providers acting for us (see section 4). We do not share it with anyone else.

10.3 YouTube

Nuora uses YouTube API Services to manage its own YouTube channel. By viewing or interacting with our YouTube content you agree to be bound by the YouTube Terms of Service, and Google's use of your information is covered by the Google Privacy Policy.

Through YouTube API Services, Nuora:

• uploads Nuora's own videos to Nuora's channel, with their title, description and privacy setting, and reads back each video's identifier and upload status;
• reads our channel's identifier and name, and the list of videos on it;
• reads the public statistics for our own videos (views, likes and comment counts), which we store for each video and as daily totals; and
• reads the top-level comments on our own videos (the comment text, its identifier, the video it belongs to and when it was posted). We do not store the commenter's name, channel or profile picture.

We use this data only to run, answer and review Nuora's own channel, and we share it only as described in section 10.2. Our use of YouTube API Services does not show you advertising, does not let anyone else serve content to you, and does not store or read cookies or similar technology on your device (the cookies our website uses are described in section 9).

Keeping and deleting YouTube data. Each time we sync our channel, the comments and statistics we hold are refreshed from YouTube. Any comment or statistic that has not been refreshed for 30 days, for example because it was deleted on YouTube, is deleted from our systems. The access token is deleted when we disconnect the channel.

Revoking access. The channel owner can revoke Nuora's access at any time on the Google security settings page at https://security.google.com/settings/security/permissions. If access is revoked there, we delete the YouTube comments and statistics we hold within 30 days. If we disconnect the channel ourselves, we revoke the token with Google straight away and delete the stored YouTube comments and statistics at the same time.

Your requests. If you commented on one of our videos and want us to delete what we hold about it, or have any other question or complaint about our use of YouTube data, email privacy@nuorahealth.com. We will delete it within 7 days of your request. Deleting it from our systems does not remove your comment from YouTube; you can do that on YouTube itself.

10.4 TikTok

Through TikTok's official APIs we receive our own account's identifier, display name and username, the posting options TikTok offers for our account, the identifier and publishing status of each video we post, and view, like, comment and share counts for our own videos and our follower count. We do not read TikTok comments. Access can be revoked in the TikTok app under Settings and privacy, Security and permissions, Apps and services permissions; once revoked, the token stops working and Nuora can no longer post or read anything, and you can ask us to delete what we already hold (section 10.7).

10.5 LinkedIn

Through LinkedIn's Community Management API we receive our own company page's identifier, name and page address, the identifier of each post we publish on that page, and reaction and comment counts for our own posts. We do not read the text of LinkedIn comments or the profiles of the people who react to our posts. An administrator of our page can revoke access at linkedin.com/psettings/permitted-services; once revoked, the token stops working and Nuora can no longer post or read anything, and you can ask us to delete what we already hold (section 10.7).

10.6 Facebook and Instagram

Through Meta's official APIs we receive our own Facebook Page's and Instagram business account's identifiers, names and usernames, the identifier and link of each post we publish, the comments left on our own posts (as described in section 10.2), and reach, view, like, comment, share and save figures for our own posts. Access can be removed in Facebook under Settings, Business integrations, and in Instagram under Settings, Website permissions, Apps and websites; once removed, the token stops working and Nuora can no longer post or read anything, and you can ask us to delete what we already hold (section 10.7).

10.7 Where we keep it and for how long

This information is held in Nuora's cloud database. Access tokens are kept in a restricted table that is used only by Nuora's own systems to talk to that platform on our behalf. A token is replaced when the platform renews it, and it is deleted when Nuora disconnects the account. YouTube data is kept and deleted as described in section 10.3. Comments and performance figures from the other platforms are kept for as long as we need them to run and review our social media accounts, and we use them for nothing else.

You can ask us to delete a comment of yours that we hold at any time, on any platform (see section 8). We will do so without undue delay and within one month, or within 7 days for YouTube.

10.8 What we do not do

We do not sell data from these platforms, and we do not use it for advertising or to target or profile individuals. We do not build audiences or profiles of the people who comment on or follow our accounts, and the process that reads comments does not match commenters to patient or customer records.

10.9 Questions about this

If you have a question or complaint about our social media accounts or the data we hold from them, or want a comment of yours removed, email privacy@nuorahealth.com.

International Transfers

Some service providers may process personal data outside the United Kingdom. Where that happens, we use the transfer mechanism and safeguards required by UK data-protection law.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through our website. The "Last updated" date at the top indicates when this policy was last revised.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.