HormoFlow Privacy Policy

HormoFlow is run by Hormo Flow Ltd, a company registered in England and Wales (company number 16884793), whose registered office is at 797 Cranbrook Road, Ilford IG6 1JA, United Kingdom.

We are the data controller for the personal information described in this policy. That means we decide how and why it is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Depending on how you use HormoFlow, we collect:

• Contact and account details: your name, email address, phone number (if you give it), and sign-in details.
• Health and lifestyle information: your assessment answers, symptoms, sleep, eating and activity patterns, health metrics you log, any test results you share, and notes from your coaching sessions.
• Conversations: messages with your consultant and with the HormoFlow AI assistant.
• Payment information: your plan, billing history and payment status. Card details are handled by our payment provider; we never see or store your full card number.
• Technical information: device and browser type, IP address and basic usage logs, which we need to keep the service running and secure.
• Marketing preferences: whether you have signed up to our newsletter.

Information about your health is special category data under UK GDPR, which means the law gives it extra protection. We only use it with your explicit consent, which we ask for before you submit the assessment and when you join a programme.

We use your health information only to provide the coaching you have asked for: to write your assessment summary, build and adjust your plan, and let your consultant and the AI assistant give you relevant guidance. Only the consultant assigned to you, and a small number of staff who need it to run the service, can see it.

You can withdraw your consent at any time from your account settings or by emailing us. This won't affect anything we did before you withdrew it, but we won't be able to keep providing coaching without it.

The law requires us to have a legal reason (a “lawful basis”) for each use:

• Providing your programme (account, coaching calls, plans, the app, customer support): performance of our contract with you, plus explicit consent for health information.
• The free assessment and your written summary: explicit consent.
• The AI assistant and AI-written summaries: explicit consent (see the AI section below).
• Taking payment and keeping financial records: contract and legal obligation (UK tax law).
• Service emails (receipts, renewal reminders, account and safety notices): contract and legal obligation.
• Newsletter and marketing emails: consent. You can unsubscribe from any email, at any time.
• Keeping the service secure and preventing misuse: legitimate interests.

We do not use your health information for advertising, and we never sell your personal information.

HormoFlow uses Google's Gemini models, through Google Cloud Vertex AI, to write your assessment summary and to power the AI assistant. When you use these features, the relevant parts of your assessment, plan, logged results and messages are sent to Google to generate a reply.

• Google processes this data on our instructions only, under its Cloud data processing terms. It is not used to train Google's or anyone else's AI models.
• The AI explains and reminds. It does not diagnose, prescribe or change your plan. Plan changes always come from your consultant, and safety checks block replies that look like medical diagnosis or dosing advice.
• No decision with legal or similarly significant effect is made about you by automated means alone.
• We keep a record of AI requests (what was asked, when, and the outcome) so we can check the service is working safely.

You can withdraw consent to AI processing at any time in your account settings. You can still work with your consultant without the AI features.

We use trusted service providers (“processors”) who handle data only on our instructions and under a written contract:

• Google (Firebase sign-in, Vertex AI for AI features, and Google Analytics and Tag Manager, only if you accept all cookies)
• Meta (the Meta Pixel, only if you accept all cookies)
• Our cloud hosting and database providers, which run the website, the app and our servers
• Stripe (payments)
• Resend (sending emails)
• WhatsApp (Meta), only if you choose to message us on WhatsApp. Please avoid sending detailed health information there; use the app instead.

We may also share information with professional advisers (such as lawyers and accountants), or where the law requires it. If we believe you or someone else is at serious risk of harm, we may contact emergency services.

We will not share your information with your GP or anyone else without your permission, except in that kind of emergency.

Some of our providers process data outside the UK, including in the United States and, for AI features, in Google's global data centres. Where that happens, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Agreement or Addendum, so your information keeps an equivalent level of protection. You can ask us for details of the safeguards we use.

• Account, assessment, health and AI conversation data: while you are a member, then 2 years after your membership ends, after which it is anonymised.
• Billing records: 6 years, as UK tax law requires.
• Marketing data: 12 months from the last time you engaged with our emails, or until you unsubscribe.
• Records of the consents you gave or withdrew: kept for as long as we need to show what you agreed to, even after your account is deleted.

If you ask us to delete your account, we delete or anonymise your data sooner, except where the law requires us to keep it.

Your data is encrypted in transit and at rest. Access is limited by role, so a consultant can only see the members assigned to them, and every access to health records is logged. No system is perfectly secure, but if a breach ever puts your rights at risk we will tell you and the ICO as the law requires.

Under UK data protection law you have the right to:

• access the personal information we hold about you;
• have inaccurate information corrected;
• have your information deleted;
• restrict or object to how we use it;
• receive your data in a portable format (data portability);
• withdraw consent at any time, where we rely on it.

To use any of these rights, email info@hormoflow.com. It's free, and we will reply within one month. We may need to confirm your identity first.

Essential cookies are always on. They keep you signed in, remember your basket and remember your cookie choice. The site cannot work without them.

Analytics and advertising cookies are only used if you choose “Accept all”. We load them through Google Tag Manager:

• Google Analytics shows us which pages are useful and where the site can be improved. Cookies: _ga and _ga_*, up to 2 years.
• Meta Pixel (Meta Platforms Ireland) tells us whether our Facebook and Instagram adverts lead to visits and sign-ups, and lets us show adverts to people who have visited the site. Cookies: _fbp and _fbc, up to 90 days.

These never run on your report, your dashboard, your account pages or links from our emails, so your health information and answers are never shared with Google or Meta. If you choose “Essential only”, none of these cookies are set and any earlier ones are removed.

You can see or change your choice at any time with the cookie button in the bottom-left corner of the site.

HormoFlow is for adults aged 18 and over. We do not knowingly collect information from anyone younger. If you think a child has given us their information, contact us and we will delete it.

For any privacy question, email info@hormoflow.com or write to Hormo Flow Ltd, 797 Cranbrook Road, Ilford IG6 1JA, United Kingdom.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

We will update this policy when the way we use your information changes, and change the date at the top. If a change is significant, we will tell you by email or in the app before it takes effect, and ask for your consent again where the law requires it.