Privacy notice

Who we are

Qurence Vitality is the data controller for the personal data described in this notice. Data-protection enquiries can be sent to privacy@qurencevitality.co.uk.

Data we collect

• Account data: name, email address, password credentials, verification and session records.
• Assessment data: diet, lifestyle, activity, goals and practical preferences.
• Health data: allergies, medical circumstances, medicines, pregnancy-related status and any laboratory results you choose to provide.
• Plan data: generated plans, versions, changes, acceptances and declarations.
• Order data: subscriptions, deliveries, addresses and payment references (we do not store full card details).
• Technical data: device, browser, IP address and security logs.

Why we use it and our lawful bases

• Performance of a contract: creating your account, generating your plan, fulfilling orders and managing your subscription.
• Explicit consent: processing special-category health data for safety screening and personalisation, and any optional communications.
• Legal obligation: product safety, traceability, accounting and regulatory record-keeping.
• Legitimate interests: service security, fraud prevention and improving the service using aggregated, non-identifying analysis.

You can withdraw consent for optional processing at any time. Withdrawing consent for health-data processing means we can no longer produce or maintain a personalised plan.

Automated decision-making

Your plan is produced by rules-based automated processing. You can request human review of any automated outcome, contest it and ask for the reasoning behind it. Plans that meet defined triggers are reviewed by a qualified professional before they are finalised.

Sharing

• Fulfilment and delivery partners, who receive only the information needed to pack and deliver your order.
• Payment providers, who process payments under their own terms.
• Infrastructure and hosting providers acting as our processors under contract.
• Regulators or authorities where we are legally required to report, including product safety reporting.

We do not sell your personal data, and we do not use your health data for advertising.

Retention

We keep assessment, plan and order records for as long as needed to provide the service and to meet safety, traceability and legal obligations. Audit records that evidence a recommendation or a safety decision are immutable and retained even after an account is closed, for the period required by law.

Your rights

• Access a copy of your data and export it in a portable format.
• Correct inaccurate data.
• Request deletion, subject to lawful retention obligations.
• Restrict or object to certain processing.
• Withdraw consent for optional processing.
• Request human review of an automated decision.
• Complain to the Information Commissioner's Office.

Security

Access to health data is restricted by role, logged, and limited to the minimum necessary. Sensitive actions such as changing your email address, exporting all your data or closing your account require reauthentication.