Privacy Policy

Veros Health Ltd ("Veros Health", "we", "us", "our") is a health technology company registered in England and Wales. We provide at-home blood testing services, connecting you with clinic-based blood draws, accredited laboratory analysis, and clinician-reviewed results delivered via our mobile application.

Veros Health is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

We are registered with the Information Commissioner's Office (ICO). Our ICO registration number is: CSN5824802.

Our registered address is: 53 Orchard Street, Bedford, United Kingdom, MK42 7JD.

Identity & Contact Data

• Full name, date of birth, and biological sex
• Email address, phone number, and postal address
• Account login credentials (stored in encrypted form)

Health & Biometric Data (Special Category)

• Blood test results and biomarker values (e.g. cholesterol, HbA1c, hormone panels)
• Health questionnaire responses and symptom information
• Medical history and lifestyle information you voluntarily provide
• Clinician notes and recommendations generated during result review

Transaction & Payment Data

• Purchase history and order records
• Payment method details — processed securely by Stripe; we do not store full card numbers

Technical & Usage Data

• IP address, device identifiers, browser type and operating system
• App usage patterns, feature interactions, and session data
• Crash reports and diagnostic information

Communication Data

• Messages sent to our support team
• Email and in-app communication records

Data We Do Not Collect

We do not knowingly collect data from children under 18 years of age. We do not collect payment card numbers directly — all payment processing is handled by our third-party processor, Stripe.

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

Blood test results and health information are classified as special category data under Article 9 UK GDPR, which attracts the highest level of legal protection. We only process this data under the following conditions:

Explicit Consent (Art. 9(2)(a))

Before you use our service, we will ask for your explicit, informed consent to process your health data. You have the right to withdraw this consent at any time, though doing so will mean we are unable to provide our core service to you.

Provision of Health Care (Art. 9(2)(h))

Processing is necessary for the purposes of preventive or occupational medicine, the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems — under the responsibility of a registered health professional.

Substantial Public Interest (Schedule 1, DPA 2018)

Where applicable, we may process special category data under conditions relating to health care purposes and occupational health purposes under the Data Protection Act 2018.

We apply strict access controls to health data. Only authorised personnel and partner clinicians who require access for service delivery may access your health information.

We never sell your personal data. We share data only where necessary for service delivery or legal compliance, with the following categories of recipients:

Clinic Partners

To facilitate your blood draw appointment, we share your name, contact details, and order reference with our clinic network. Clinics act as data processors under a written data processing agreement.

Accredited Laboratories

Your sample is sent to an accredited diagnostic laboratory for analysis. We share a pseudonymised identifier and the required test panels. Laboratories are bound by confidentiality obligations and data processing agreements.

Registered Clinicians

Results are reviewed by qualified clinicians before being returned to you. Clinicians access your results on a need-to-know basis and are subject to professional confidentiality obligations and data processing agreements.

Technology Service Providers

• Supabase — database and backend infrastructure (data processor)
• Stripe — payment processing (independent data controller for payment data)
• Email/notification providers — transactional communications
• Cloud hosting provider — infrastructure and storage

Regulatory Authorities

We may disclose your data to the ICO, CQC, HMRC, or law enforcement agencies where required by law or regulatory obligation.

Professional Advisers

Our legal, financial, and insurance advisers may access limited data where necessary for professional advice, under strict confidentiality obligations.

All third-party processors are subject to written Data Processing Agreements (DPAs) and are required to implement appropriate technical and organisational measures to protect your data.

After the applicable retention period, data is securely deleted or irreversibly anonymised. You may request earlier deletion subject to Section 8 and applicable legal obligations.

Under UK GDPR, you have the following rights in relation to your personal data:

To exercise any of these rights, please contact us using the details in Section 14. We will respond within one calendar month. We do not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

Our primary data processing operations are based in the United Kingdom. Where we work with third-party service providers who may process data outside the UK or the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

• UK adequacy regulations recognising equivalent data protection standards
• Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs) where required
• Binding Corporate Rules where applicable
• Other approved transfer mechanisms under UK GDPR Chapter V

You may request details of the specific safeguards in place for any international transfer by contacting us at the address in Section 14.

Our website and mobile application use cookies and similar tracking technologies to operate effectively and improve your experience. We use the following categories:

You can manage your cookie preferences at any time via our cookie settings panel on the website or through your browser settings. Note that disabling certain cookies may affect the functionality of our service.

Our services are intended for individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a child has provided us with personal data without parental consent, please contact us immediately and we will take steps to delete that data.

If a parent or guardian wishes to purchase services on behalf of a minor under specific clinical circumstances, please contact us directly to discuss appropriate consent and data handling procedures.

We take the security of your personal and health data extremely seriously. Our technical and organisational measures include:

• Encryption at rest and in transit — all health data is encrypted using industry-standard protocols (TLS 1.2+ and AES-256 encryption)
• Access controls — role-based access ensures staff and partners can only access data necessary for their function
• Authentication — multi-factor authentication for system access by internal staff
• Pseudonymisation — health data sent to laboratories is pseudonymised to minimise exposure
• Regular security assessments — including vulnerability scanning and penetration testing
• Staff training — all team members receive data protection and information security training
• Incident response procedures — we maintain a formal data breach response plan aligned with ICO notification requirements

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay where required.

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data processing practices. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you by email if you have an active account with us
• Display a prominent notice on our website or in the app for at least 30 days

We encourage you to review this policy periodically. Continued use of our services after changes take effect constitutes acceptance of the updated policy, except where we are required to obtain fresh consent.

For any questions about this Privacy Policy, to exercise your data rights, or to raise a concern about our data practices, please contact us:

ICO — Supervisory Authority

If you are not satisfied with our response or believe your data has been processed unlawfully, you may contact the Information Commissioner's Office:

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF