Legal
Last updated: 9 October 2026
Kyma Health Ltd (hereinafter "KYMA" or the "Company"), in its capacity as Data Controller, hereby informs, by means of this Personal Data Protection Policy (hereinafter the "Privacy Policy" or the "Policy"), the visitors of its website and the Members using its platform and services of the manner in which it collects, uses, retains, transfers and protects their personal data, as well as of the rights afforded to them by the applicable legislation. This Policy forms an integral part of KYMA's Terms & Conditions.
1.1. This Policy is drawn up in accordance with Articles 12, 13 and 14 of the UK General Data Protection Regulation (hereinafter the "UK GDPR"), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (hereinafter "PECR"), and the applicable legislation in general, as in force from time to time.
1.2. This Policy applies to any processing of personal data carried out:
1.3. This Policy does not cover processing carried out by third parties acting as independent controllers (by way of example: partner diagnostic centres when performing tests, payment service providers, Third-Party Providers of Marketplace Services), nor third-party websites to which KYMA's website may link. Such processing is governed by the privacy policies of the respective third parties.
2.1. For the purposes of this Policy, the following terms shall have the meaning set out below:
2.2. Terms not specifically defined herein shall have the meaning given to them in the Terms & Conditions or, failing that, in the UK GDPR.
3.1. The Controller of the personal data is Kyma Health Ltd, a company incorporated in England & Wales under company number 15310646, with its registered office at Solar House, 282 Chase Road, London, England, N14 6NZ, United Kingdom.
3.2. For any matter concerning the processing of personal data and the exercise of the rights under Article 13, the data subject may contact KYMA:
4.1. KYMA processes personal data in accordance with the principles of Article 5 UK GDPR and, in particular, ensures that the data:
4.2. KYMA is responsible for, and is able to demonstrate, its compliance with the above principles (accountability).
5.1. KYMA collects and processes the following categories of personal data:
| Category | Indicative data | Source |
|---|---|---|
| Account and identification data | Full name, email address, telephone number, date of birth, sex, address, city and postcode, username, encrypted password, preferred language, time zone, notification preferences | The Member |
| Transaction and payment data | Selected plan and add-on services, payment status, amount and currency, billing country and postcode, customer and subscription identifiers of the payment provider. KYMA neither receives nor stores full payment-card details | The Member / Stripe |
| Screening data | Laboratory test results and biomarker values, vital signs, anthropometric measurements, test files (PDF or images) uploaded by the Member, notes and assessments by professionals, health reports, personalised plans and recommendations | Partner diagnostic centres and laboratories, KYMA's professionals, the Member |
| Health history and lifestyle data | Questionnaire answers: height, weight, goals, diagnosed conditions, surgical procedures, family history, symptoms, allergies, reproductive health, medication, supplements, diet, smoking, alcohol, exercise, sleep, stress | The Member |
| Wearable-device data | Steps, heart rate, sleep stages, etc. | Apple Health, Garmin, Oura, etc., solely where the relevant feature is available and the Member chooses to connect their device |
| Communication data | Messages to and from KYMA's professionals and the Digital Assistant, conversations through the live support messaging service, correspondence, appointment details (place, date, time, comments), records of telephone calls with KYMA (date, time, duration, outcome, summary notes of the conversation) | The Member, KYMA's professionals |
| Prospective-customer data | Details entered before the purchase is completed (email, full name, date of birth, telephone number, plan selection), answers to self-assessment questionnaires (age group, symptoms, health goals), email of the recipient of a referral invitation, records of telephone contacts made under paragraph 6.3 | The prospective customer, the Member sending an invitation |
| Usage and technical data | Page views, clicks, error and access logs, IP address, browser and device type (user agent), device identifiers for push notifications | Automatically, through the Platform and the analytics tools (Heap, PostHog) |
| Marketing data | Newsletter subscription, message opens, campaign codes (UTM), advertising-platform identifiers | Mailchimp, Google Analytics, advertising platforms |
| Cookie data | Analytics and marketing cookies (only where the visitor accepts them), record of consent choices | CookieYes, Google Tag Manager / Google Analytics, Meta, LinkedIn, TikTok, Microsoft Clarity |
| Consent data | Acceptance of the Terms & Conditions and the Privacy Policy, consent to telephone contact under paragraph 6.3 and any withdrawal of it, consents and acceptance statements within the Platform, with the version of the text and the timestamp | The Member |
5.2. Health Data constitute a special category of personal data and enjoy enhanced protection, as set out in Article 9 UK GDPR and in this Policy.
5.3. The provision of account, transaction, screening and health history data is necessary for entering into and performing the contract for the provision of the Services. Failure to provide them, or the refusal or withdrawal of consent to the processing of Health Data, renders the provision of the Services impossible, in whole or in part.
5.4. A Member who discloses to KYMA the data of a third person (by way of example: the email address of the recipient of a referral invitation, or family history details) declares that they are entitled to disclose them and that they have informed the third person accordingly, where so required.
6.1. KYMA processes personal data solely for the following purposes and on the corresponding legal bases:
| Purpose | Legal basis | Specific notes |
|---|---|---|
| Creation and management of the account and the Membership | Performance of a contract and steps taken prior to entering into a contract (Article 6(1)(b) UK GDPR) | For the provision of the Services requested by the Member, their identification and their support. |
| Provision of Screenings, analysis of results, preparation of a personalised programme and operation of the Digital Assistant | Performance of a contract (Article 6(1)(b)) in conjunction with explicit consent for Health Data (Article 9(2)(a) UK GDPR) | Consent is given by accepting the Terms & Conditions and this Policy upon the Member's registration, covers every Screening carried out in the context of the Services, and may be withdrawn at any time. |
| Payment processing and invoicing | Performance of a contract (Article 6(1)(b)); compliance with a legal obligation (Article 6(1)(c)), in particular tax and accounting legislation | Stripe holds the card details; KYMA receives only limited details of the transaction. |
| Service communication and operational notifications | Performance of a contract (Article 6(1)(b)) | By way of example: access credentials, appointment confirmation and reminders, availability of results, notifications within the Platform. |
| Telephone contact with prospective customers and Members in connection with registration, onboarding and the Membership | Consent (Article 6(1)(a) UK GDPR and regulation 21 PECR); additionally and independently, steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)) | Consent is given by submitting the details form during registration, as set out in paragraphs 6.3 to 6.8, and may be withdrawn at any time. |
| Analytics and improvement of the Services | Legitimate interests (Article 6(1)(f)); consent, where cookies or similar technologies are used (regulation 6 PECR) | The tools Heap and PostHog are used. Health Data are used for this purpose only in anonymised or aggregated form. No profiling producing legal effects is carried out. |
| Sending of informational and promotional messages (newsletter, email marketing) | Consent (Article 6(1)(a) UK GDPR and regulation 22 PECR) or, for existing customers and similar services, the soft opt-in under regulation 22(3) PECR | By using the onboarding service, the Member is added to KYMA's list of recipients on Mailchimp, as set out in paragraph 6.2. The recipient may unsubscribe at any time and free of charge, through the unsubscribe link contained in every message. |
| Optional advertising cookies (ad pixels) and measurement of advertising activities | Consent through the cookie management mechanism (CookieYes) | No non-essential cookies are set before they are accepted. |
| Security of systems, prevention of fraud and abuse | Legitimate interests (Article 6(1)(f)); legal obligation (Article 32 UK GDPR) | Keeping of access and error logs. |
| Establishment, exercise or defence of legal claims; compliance with requests from authorities | Legitimate interests (Article 6(1)(f)); legal obligation (Article 6(1)(c)); for Health Data, Article 9(2)(f) UK GDPR | Only to the extent necessary. |
| Statistics and research on anonymised data | Legitimate interests (Article 6(1)(f)) | Anonymised data do not allow the Member to be identified and do not constitute personal data. |
6.2. Addition to the communication list. By using the registration and onboarding service, the Member's contact details (in particular full name and email address) are entered in the list of recipients maintained by KYMA on the Mailchimp platform, and the Member receives, in addition to the operational messages concerning their Membership, informational and promotional messages about KYMA's services. The Member may opt out of informational and promotional messages at any time and free of charge, through the unsubscribe link contained in every message or by a request under Article 3. Opting out does not affect the sending of operational messages that are necessary for the provision of the Services.
6.3. Telephone contact. By completing and submitting the personal details form of the registration and onboarding process, in which the telephone number is a mandatory field, and by accepting this Policy, the data subject expressly and specifically consents to being contacted by KYMA, by its personnel and by associates acting on its behalf and on its instructions, by telephone call to the telephone number provided, irrespective of whether they subsequently complete the purchase of a Membership, for the following purposes:
6.4. The consent under paragraph 6.3 is given freely, specifically, in an informed manner and unambiguously, by means of a clear affirmative action of the data subject, within the meaning of Articles 4(11) and 7 UK GDPR. KYMA keeps a record of the consent, including the date and time of submission of the form and the version of this Policy accepted, as set out in Article 5, so as to be able to demonstrate it in accordance with Article 7(1) UK GDPR. Independently of consent, telephone contact for the purposes of points (a), (c) and (d) of paragraph 6.3 is also based on the taking of steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) UK GDPR) and, for the remaining purposes, on KYMA's legitimate interest in responding to the interest expressed by the data subject in its Services (Article 6(1)(f) UK GDPR).
6.5. The submission of the form under paragraph 6.3 constitutes notification by the data subject to KYMA, within the meaning of regulation 21(4) PECR, that they do not, for the time being, object to receiving calls from KYMA on the telephone number provided. That notification applies notwithstanding any registration of the number with the Telephone Preference Service (TPS) or the Corporate Telephone Preference Service (CTPS), and remains in effect until withdrawn in accordance with paragraph 6.8. Calls made in accordance with paragraphs 6.3 to 6.8 are made at the request and with the prior consent of the data subject and do not constitute unsolicited communications.
6.6. The data subject declares and warrants that the telephone number they provide is accurate, belongs to them or is lawfully used by them, and that they are entitled to receive calls on it. KYMA shall bear no liability for calls made in good faith to a telephone number that has been provided inaccurately or by a person not entitled to use it.
6.7. Calls are made on reasonable days and at reasonable hours. The caller states that they are calling on behalf of KYMA, does not withhold the calling line identification and, upon request, provides KYMA's contact details. KYMA keeps a record of each call (date, time, duration, outcome and summary notes of the conversation), for the purposes of the proper handling of the data subject's request, the demonstration of its compliance and the establishment, exercise or defence of legal claims.
6.8. The data subject may withdraw the consent under paragraph 6.3 and object to telephone contact at any time, free of charge and without giving reasons:
Upon withdrawal, KYMA enters the telephone number in its internal suppression list and ceases calls for the purposes of paragraph 6.3 without undue delay. The withdrawal does not affect the lawfulness of calls made before it, nor operational communication that is strictly necessary for the performance of an existing Membership (by way of example: arrangement of the Screening appointment, availability of results), which is based on the performance of the contract.
6.9. Where processing is based on consent, the Member is entitled to withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
6.10. KYMA does not process the data for purposes incompatible with the above. Where it intends to process them for another purpose, it shall inform the Member in advance and, where required, obtain their consent.
7.1. KYMA uses Member Content for:
7.2. Licence. By uploading or connecting Member Content, the Member grants KYMA a non-exclusive, worldwide, royalty-free licence to host, use, modify and analyse that content, solely for the purposes of paragraph 7.1 and within the limits of this Policy and of data protection legislation.
7.3. KYMA does not sell identifiable Health Data to third parties.
8.1. KYMA uses artificial intelligence systems as a supporting tool, in particular for:
8.2. The reports, insights and plans under points (a) and (b) are made available to the Member only after they have been reviewed and approved by a competent professional of KYMA. The answers of the automated assistant and the notifications under points (c) and (d) are generated automatically, without prior human review, are solely informational and supportive in nature and do not constitute medical advice, as more specifically set out in the Terms & Conditions.
8.3. KYMA does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning the Member or similarly significantly affect them, within the meaning of Article 22 UK GDPR.
8.4. For the operation of the above systems, the Member's data, including Health Data, are transferred to an artificial intelligence service provider acting as a processor on behalf of KYMA, as set out in Articles 9 and 10.
8.5. Where the Member chooses to connect their account to a third-party artificial intelligence application (by way of example, through the optional connection to Anthropic's Claude), the data to which they grant access are transferred to the third party on the Member's instruction and are subject to the terms and privacy policy of the third party, which acts as an independent controller. The Member may revoke access at any time through the Platform.
9.1. Access to the data is given to KYMA's authorised personnel and associates, to the extent necessary for the performance of their duties. Furthermore, the data are transferred to the following categories of recipients:
| Recipient | Purpose | Safeguard |
|---|---|---|
| Partner accredited diagnostic centres and laboratories (e.g. Randox) | Scheduling of appointments, collection and processing of samples, transmission of results | Partnership agreement and data processing terms in accordance with the UK GDPR; medical and professional confidentiality |
| Professionals working with KYMA (clinicians, dietitians – nutritionists, health coaches, other health or wellness professionals, as employees or external associates) | Review of results, provision of advice and support | Employment or services agreement with a confidentiality clause and an undertaking to process only on KYMA's instructions; professional confidentiality |
| Stripe | Card payments, subscription management, invoicing | Data processing agreement; PCI-DSS certification; data held in data centres within the EU, subject to Article 10 |
| Microsoft Azure | Hosting of the Platform, file storage and backups | Data processing agreement; the data are held in data centres within the European Union |
| OpenAI | Artificial intelligence services under Article 8 | Data processing agreement; standard contractual clauses |
| Mailchimp | Sending of operational (transactional) messages and marketing messages | Data processing agreement; standard contractual clauses |
| Intercom | Live messaging and support service | Data processing agreement; standard contractual clauses |
| Heap, PostHog | Usage analytics for the Platform | Data processing agreement; PostHog is hosted within the EU |
| Zapier, Typeform, Calendly | Automation of internal workflows, forms and appointment scheduling | Data processing agreement; standard contractual clauses |
| Google, Meta, LinkedIn, TikTok, Microsoft (Clarity) | Traffic statistics and measurement of advertising activities, through cookies and/or the transmission of event details (by way of example: hashed email address, IP address, user agent) | The Member's consent, under Article 11 |
| External advisers (accountants, legal advisers, auditors) | Compliance with legal obligations, support of legal claims | Professional confidentiality and duty of confidentiality |
| Public, judicial and supervisory authorities | Fulfilment of legal or safety obligations | Only where required by law or by a court order |
9.2. Third parties acting as processors are contractually bound, under Article 28 UK GDPR, to process the data solely on KYMA's documented instructions, to maintain confidentiality and to take appropriate security measures.
9.3. KYMA does not under any circumstances disclose identifiable Health Data to employers. Any employer dashboards display aggregated data only.
9.4. In the event of a merger, acquisition, reorganisation or transfer of the business or of its assets, the data may be transferred to the successor, under the terms of this Policy and following prior notice to Members.
10.1. The Platform's data are hosted in data centres within the European Union, in respect of which adequacy regulations are in force in the United Kingdom.
10.2. Some of the recipients under Article 9 are established or hold data in other countries outside the United Kingdom (in particular in the United States of America). In such cases, the transfer takes place only where one of the following conditions is met:
10.3. The Member may request information on the safeguards applied to a specific transfer, as well as a copy of them, by contacting KYMA under Article 3.
11.1. KYMA's website and Platform use cookies and similar technologies (pixels, browser local storage), namely small files or identifiers stored on the visitor's terminal equipment. This Article constitutes KYMA's Cookie Policy.
11.2. The following categories are used:
11.3. KYMA uses the CookieYes consent management mechanism, so that non-essential cookies are not activated until the visitor selects Accept or enables the individual categories. The full and up-to-date list of cookies, and the provider and duration of each, are available through the cookie settings window (banner).
11.4. The visitor may change or withdraw their consent at any time through the cookie settings window, and may delete or block cookies through their browser settings. Blocking strictly necessary cookies may affect the operation of the website and the Platform.
11.5. Upon completion of registration or purchase, and where the Member has consented to the relevant category, details of the event (by way of example: hashed email address, cookie identifiers, IP address, user agent, transaction value) may also be transmitted to the platforms under points (c) and (d) directly from KYMA's servers, for the purpose of measuring the effectiveness of advertising activities.
12.1. The data are retained for the period necessary to fulfil the purposes of Article 6 and, more specifically:
| Data set | Retention period |
|---|---|
| Health records (test results, history, reports, plans) | Ten (10) years from the end of the Membership; thereafter pseudonymisation or secure deletion. |
| Chat transcripts with professionals and the Digital Assistant | Ten (10) years (as part of the clinical record). |
| Account data | For as long as the account remains active and, after its closure, for as long as is required under the other rows of this table. |
| Tax and accounting records of transactions | For as long as provided by the tax and accounting legislation in force from time to time. |
| Data of prospective customers who did not complete registration | Up to twenty-four (24) months from the last communication, unless the data subject requests their deletion earlier. |
| Telephone call records and the internal suppression list | Call records: for as long as the data of the respective prospective customer or Member are retained under this table. Suppression list: for as long as is necessary to ensure that no further calls are made to the telephone number concerned. |
| Analytics logs | Rolling period of eighteen (18) months. |
| Access logs of connected third-party applications | Twelve (12) months. |
| Marketing data | Until consent is withdrawn or the recipient unsubscribes from the list, plus twenty-four (24) hours for the suppression to take effect. |
| Cookie consents | Five (5) years. |
12.2. The above periods may be extended where this is required by a provision of law or is necessary for the establishment, exercise or defence of legal claims, and until the relevant proceedings are finally concluded.
12.3. After the retention period has elapsed, the data are securely deleted or anonymised, so that the data subject can no longer be identified.
13.1. The Member has, subject to the conditions of the UK GDPR, the following rights:
13.2. The rights are exercised:
13.3. Submitting a deletion request through the Platform does not entail immediate deletion. The request is examined by KYMA, which informs the Member once it has been completed. Before submitting the request, the Member may obtain copies of their test files through the Platform; a copy of their other data is provided upon request under point (a) of paragraph 13.2.
13.4. KYMA responds to requests without delay and, in any event, within one (1) month of receipt. That period may be extended by two (2) further months, where necessary on account of the complexity or number of the requests, in which case the Member is informed accordingly within the first month. The exercise of the rights is free of charge, unless the requests are manifestly unfounded or excessive.
13.5. KYMA may request additional information, where necessary to confirm the identity of the person making the request.
13.6. The satisfaction of a request for erasure, restriction or objection is subject to the cases in which the further retention of the data is required by a legal obligation or is necessary for the establishment, exercise or defence of legal claims. In such cases, the data are retained only for the corresponding purpose and any other processing of them is restricted.
14.1. KYMA implements appropriate technical and organisational measures, under Article 32 UK GDPR, to protect the data against unauthorised access, loss, alteration or unlawful processing, including:
14.2. No system is absolutely secure; KYMA nevertheless makes every reasonable effort to protect the data. The Member must safeguard their access credentials and inform KYMA without delay of any suspicion of unauthorised use of their account.
14.3. In the event of a personal data breach, KYMA notifies the incident to the ICO within seventy-two (72) hours of becoming aware of it, where the conditions of Article 33 UK GDPR are met, and informs the affected Members without delay where the breach is likely to result in a high risk to their rights and freedoms, under Article 34 UK GDPR.
15.1. The Services are addressed solely to persons who have reached the age of eighteen (18). KYMA does not knowingly collect data of persons under 18 and the Platform blocks the registration of minors.
15.2. Where it is established that data of a minor have been collected, they are deleted without delay.
16.1. KYMA aims for its website and Platform to conform to the WCAG 2.1 standard, level AA. Where a feature is not accessible to the Member, they may contact KYMA under Article 3, so that assistance can be provided and the issue addressed.
17.1. KYMA reserves the right to amend this Policy, in particular in the event of a change in the legislation, the Services or the recipients of the data. The version in force from time to time is posted on KYMA's website, stating the date of the last update.
17.2. Material amendments are notified to Members by email thirty (30) days before they take effect. Continued use of the Services after that date is deemed to constitute knowledge and acceptance of the amendments, save for cases in which fresh consent is required by law.
18.1. Where the Member considers that the processing of their data infringes the applicable legislation, they are invited to contact KYMA first, under Article 3, so that the matter can be resolved.
18.2. In any event, the Member has the right to lodge a complaint with the Information Commissioner's Office (Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, ico.org.uk), and to pursue any judicial remedy afforded to them by law.
18.3. This Policy is governed by the law, and any dispute arising from it is subject to the jurisdiction, specified in the Terms & Conditions, without prejudice to mandatory provisions of law.