Privacy Notice

This document is divided into the following parts:

1. Introduction

Who are we?

GetWeightLoss is provided by the following organisations, each of which is responsible (a "controller") for your personal data as described below:

Your order will tell you which partner pharmacy is your Responsible Pharmacy for each order. In this notice, "we", "us" and "our" mean the organisation responsible for the processing being described, as set out above.

Why are you reading this?

This privacy notice describes how we, as controllers, protect personal data and respect privacy in accordance with data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Does it apply to you?

If you are accessing the website and Services for any reason, this privacy notice applies to you. For the purposes of this privacy notice, customers also include potential customers who have started (but not finished) the online questionnaire on the GetWeightLoss website (www.getweightloss.co.uk). This privacy notice also applies to you if you or your employer has a business relationship with us. Please take a moment to read it.

2. Personal Data

How do we collect your personal data?

From the first moment you interact with GetWeightLoss, we are collecting your personal data. Sometimes you voluntarily provide us with personal data, sometimes personal data about you is collected automatically, and sometimes we collect it from third parties, including our partner pharmacies. How we collect your personal data will usually depend upon our relationship with you.

What personal data do we collect?

Why do we collect your personal data?

Data protection law requires that we only use your personal data for purposes that we tell you about and where we have a legal basis to do so. Here are the purposes and legal bases for which we process your personal data:

1. To provide the Services to you. To offer and provide you with our Services (as defined in our Terms & Conditions), including our weight management-related services; to register you with a GetWeightLoss account; to connect you to our partner pharmacies and their prescribers; to run our online health community and provide you with advice and content.

Legal basis: Contract (to provide the Services you have asked for). For your health data: provision of health care by or under the responsibility of a health professional (UK GDPR Article 9(2)(h) and paragraph 2 of Schedule 1 to the Data Protection Act 2018).

2. To fulfil your orders. For our partner pharmacies to process your orders, dispense your prescription, and supply and deliver your medication (via third party courier or postal service providers) to you.

Legal basis: Contract; provision of health care.

3. To communicate with you. To communicate with you about our services or goods (including to tell you when you have a new message from your prescriber and send you reminders of this), to provide you dispatch and tracking information, to manage returns and exchange authorisations, to provide customer support and/or to answer any queries you have asked us. We use internal tools and third party software, and retrieve information we or service providers hold about you, for the purpose of sending automated responses.

Legal basis: Contract; legitimate interests (to administer our business).

4. To send you marketing that you have asked for or we think you will like. To send you marketing or promotional information; to send you reminders about services or products that you have expressed an interest in. Where you have consented, we may also use your health data to send you marketing information that is tailored to you or we think could be of interest to you.

Legal basis: Consent; explicit consent (where processing of health data is involved).

5. Seeing adverts for GetWeightLoss online. We use online advertising to keep you aware of what we are offering and to help you see and find our products and services. How we use your personal data to do this is further described in the "Online advertising" section below.

Legal basis: Explicit consent (where processing of health data is involved).

6. To improve GetWeightLoss. To improve GetWeightLoss or any of GetWeightLoss's brand group companies' products and services, including analytics, research and development or to otherwise manage our business, and including our website.

Legal basis: Legitimate interests (to improve our business); consent.

7. To enable us to comply with the law. To comply with any legal or regulatory obligations or requirements that apply to us, including carrying out any identity (anti-fraud) checks that we are required to undertake or to comply with any record-keeping requirements that apply to us.

Legal basis: Legal obligation.

8. To manage our business relationships. To manage the contract or business relationship we have with you or your employer.

Legal basis: Legitimate interests (to manage our contracts and business relationships).

9. To enforce our rights where needed. To seek professional advice, to enforce or protect our rights, to establish and defend legal claims; to conduct investigations or take action in relation to crime and fraud prevention, risk management, and violation of our terms and conditions.

Legal basis: Legitimate interests (enforcing or protecting our legal rights).

More information on what these legal bases mean

Contract: Processing your personal data is necessary for a contract you have with us, or because we have asked you to take specific steps before entering into that contract. For example, we need to process your personal data (contact details, billing information) in order to provide you with any products that you have purchased.

Provision of health care: Processing your health data is necessary for the provision of health treatment by or under the responsibility of a health professional, which includes pharmacists and pharmacy technicians. We rely on this legal basis when we process your health information to assess, prescribe and supply your treatment, and to share your Treatment Record between our partner pharmacies (see below).

Legitimate interests: Processing your data is necessary for our legitimate interests or the legitimate interests of a third party, provided those interests are not outweighed by your rights and interests. Our legitimate interests are listed above.

Legal obligation: Processing your data is necessary for us to carry out our obligations under applicable law. For example, to carry out identity checks to comply with anti-fraud rules in the UK when you make a purchase from us.

Consent and explicit consent: We use your health data, including your questionnaire answers, to assess, prescribe and supply your treatment on the basis that it is necessary for the provision of health care by or under the responsibility of a health professional. We do not rely on your consent for this. We do ask for your explicit consent before using your health data for marketing or advertising, and you can withdraw that consent at any time.

We also seek your consent to use your personal data to personalise any marketing that we may send you in accordance with this privacy notice. Where processing of health data is involved in any marketing or advertising activities, we obtain your explicit consent. You have the right to withdraw your consent at any time by contacting our Privacy Team (see "Contact us" below).

Sharing your Treatment Record between our partner pharmacies

To give you safe, continuous care, your Treatment Record is shared between the partner pharmacies that are prescribing for you, have prescribed for you, or are dispensing your order.

• What is shared: questionnaire answers, identity and weight verification (including photos and videos), height, weight and BMI history, medical history you have told us, prescribing decisions and reasons, prescription and supply history, clinical queries and your replies, reported side effects, and GP notification records.
• Why: so that a prescriber reviewing any new or repeat order can see your full treatment history before deciding whether it is safe to prescribe, and so that your treatment continues without gaps or duplicated supply if your orders move between pharmacies.
• Legal basis: contract (UK GDPR Article 6(1)(b)), and for health data, provision of health care (Article 9(2)(h) and Data Protection Act 2018 Schedule 1, paragraph 2). Everyone who can see your Treatment Record owes you a duty of confidentiality.
• Safeguards: access is limited to prescribers, pharmacists and pharmacy staff involved in your care; access is logged; the pharmacies share under a written data sharing agreement; KNOSEE Ltd hosts the record under a processing contract.
• Limits: a partner pharmacy will not use your Treatment Record for its own marketing, or for any service outside GetWeightLoss, unless you separately agree.
• Your choices: because prescribers need your history to prescribe safely, we cannot provide treatment through a pharmacy that cannot see your Treatment Record. If you have concerns, contact privacy@getweightloss.co.uk.

Direct marketing

Under UK data protection legislation, we usually need your consent to send you any direct electronic marketing messages (e.g. by text or email). We may also send you marketing messages which are relevant to you based on your health data, but only where you have explicitly consented to your health data being used in this way.

You can opt out of receiving some or all marketing messages at any time by following the unsubscribe link included in the marketing message or by contacting our Privacy Team (see "Contact us" below).

Online advertising

You may see GetWeightLoss banners and ads when you are on other websites and apps, such as social media. We manage this through a variety of digital marketing networks and ad exchanges, and use a range of advertising technologies.

We use tools of social media platforms to advertise our products and services (e.g. Facebook Custom Audience). We use these tools to match information that we hold with personal data in their database to create custom audiences and tailor advertising to your interests on the internet, including social media, as permitted by applicable law. Some of this is done through "re-targeting", which displays advertisements relevant to GetWeightLoss products and services you have previously viewed on our website. For example, we may provide email addresses that we obtained from you to a social media platform, which are then usually hashed (encrypted) and matched against their own data, for them to present sponsored posts in your feed. We do this to offer tailored advertisements that may be of interest to you if you have shown an interest in our products.

If you opt out of receiving all marketing messages from us then we will not share your personal data for these purposes. We also use cookies to create more relevant marketing for you and to present relevant content to you on third party websites. This is based on your cookie consent when you visit the GetWeightLoss website (if you have given this to us). See our Cookies Policy for further details.

Who do we share your data with?

Sometimes it is necessary for us to share your personal data with third parties. Your personal data is shared only when we consider it to be necessary and according to the safeguards, and for the purposes, detailed in this privacy notice. We will never disclose your health data unless we have a lawful basis to do so.

• Our partner pharmacies. We share your personal data, including your health data, with MI Health Ltd, NuLife Care Ltd and Berkeley Care Ltd as needed to assess, prescribe, dispense and deliver your treatment, as explained above.
• Your GP. Where you have provided consent for us to do so and/or in accordance with legal and regulatory obligations and standards, we share your personal data with your GP for the purposes of providing them with information about your treatment.
• Third party service providers. We share your personal data with various third parties that we rely upon to perform a variety of services on our behalf and to help grow and improve the GetWeightLoss business, such as IT service providers (including cloud IT service providers), payment system operators (such as Shopify or Stripe), delivery and fulfilment providers, third parties who carry out identity checks on our behalf, our professional advisors (such as lawyers) and any other organisations that provide us with technical and support services.
• Our group companies. We will share personal data in certain circumstances with other companies across the group of companies that we and the GetWeightLoss brand are part of.
• Advertising partners. We may share your personal data with third party providers that we partner with to provide tailored advertising services to us.
• Regulators or other authorities. We will share your personal data where we are legally required to do so or where we think this is required and we are permitted to do so, for example to respond to a request for cooperation from a relevant authority.
• Other third parties to protect us. We may share your personal data as required in order to help prevent fraud or to protect or enforce our rights or the rights of any of our group companies.
• Other parties as part of a corporate transaction. If it is proposed that we merge with or are acquired by another business in the future, we may share your personal information with potential purchasers, where this is necessary, or the new owners of the business or company.

Overseas transfers of personal data

From time to time, we may transfer your personal data to parties outside of the UK, e.g. to our group companies or partner companies. Where we do so, we ensure a similar degree of protection is afforded to your personal data as in the UK. We do this by sending your data to countries that the UK has deemed to provide essentially equivalent protection or by entering into UK-approved standard contractual clauses (including the European Union standard contractual clauses alongside the UK addendum) with the relevant party.

How do we protect your personal data?

We care about protecting your personal data. That's why we take steps to make sure that we have in place appropriate security measures to protect your personal data from being damaged, changed, lost, used in the wrong way, or accessed by people who do not have permission.

In particular, we maintain appropriate physical, organisational and technical measures so as to prevent any loss, misuse, unauthorised access, disclosure, or modification of personal data. This includes access controls, encryption, security audits of our systems and protection of data integrity.

Where we use third party service providers to help provide the Services, we have contracts in place with those third party service providers which require them to implement security measures to protect the data they hold. However, please remember that you provide personal data at your own risk: unfortunately, no data transmission over the internet is guaranteed to be 100% secure.

How long do we keep your personal data?

We will retain your personal data for so long as we have a valid purpose, and for so long as required to comply with applicable law, establish legal defences and resolve disputes. When determining this retention period we take into account any record retention requirements under law and any limitation periods relevant to legal action.

Clinical and prescribing records are kept by each partner pharmacy for at least 8 years after your last treatment, in line with the NHS Records Management Code of Practice, and prescription records for at least 2 years as required by the Human Medicines Regulations 2012. Account and marketing data is kept for 6 years after your last activity.

Cookies

Cookies are used on the website. If you disable or refuse cookies, please note that some parts of the website may become inaccessible or not function properly. We explain our use of cookies further in our Cookies Policy.