Legal
Privacy policy
Your health information is personal. This policy explains, in plain English, what personal data mealign collects, why we collect it, who we share it with, how long we keep it and the rights you have over it.
Last updated
1. About this policy
It applies when you:
- Visit mealign.com or any other mealign website or app (our “Site”)
- Take one of our health assessments, with or without an account
- Create an account, order a blood test, consult with a clinician or buy a treatment
- Contact our team by email, phone, chat or social media
- Sign up to hear from us, or take part in surveys, research or testimonials
Our services are only for adults aged 18 and over. We do not knowingly collect data about anyone under 18. If we learn that we have, we will delete it unless the law requires us to keep it.
Our services are not for emergencies. If you need urgent medical help, call 999 or NHS 111.
2. Who we are
mealign is a trading name of mealign Ltd, a company registered in England and Wales (company number 13293157). In this policy, “mealign”, “we”, “us” and “our” mean mealign Ltd.
We are the controller of your personal data under UK data protection law. That means we decide how and why your data is used and we are responsible for looking after it. The laws that apply are the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations (PECR).
We are registered with the Information Commissioner’s Office (ICO).
Some of our partners, such as the clinicians who prescribe and the pharmacy that dispenses, are also controllers of your data for their own professional and legal duties. We explain this in section 7.
3. The personal data we collect
What we collect depends on how you use mealign. We group it like this:
| Type of data | What it includes |
|---|---|
| Identity | Name, date of birth, sex, username and password, account and device identifiers |
| Contact | Email address, postal and delivery address, phone number |
| Health | Assessment answers, symptoms, medical history, medications, blood test results, height and weight, photos you choose to upload, consultation notes, prescriptions, treatment progress and side effects you report |
| GP | Your GP practice details, and whether you agree to us sharing information with your GP |
| Transaction | Orders, subscriptions, products and services bought, delivery details, refunds |
| Payment | Billing details. Card details are handled by our payment provider and are never stored by mealign |
| Communications | Messages, emails, call notes and chats with our clinical and customer teams |
| Technical | IP address, browser and device type, operating system, time zone, approximate location from your IP |
| Usage | Pages visited, time on pages, links clicked, how you arrived at our Site |
| Marketing | Your marketing preferences and how you engage with our emails and messages |
| Feedback | Survey answers, reviews, research participation and testimonials you agree to give |
Health data is “special category data” under UK GDPR and gets extra protection. Some of it can also reveal information about your sex life, for example questions about libido in a testosterone assessment. We only ask for what a clinician needs to care for you safely.
4. How we collect it
- From you, when you take an assessment, create an account, order, message us, speak to a clinician or fill in a survey.
- Automatically, through cookies and similar technologies when you use our Site (see section 10).
- From our partners, such as blood test results from our laboratory partner, dispensing and delivery updates from our pharmacy, and payment confirmations from our payment provider.
- From your GP or other healthcare providers, only where you ask us to request information or a clinician needs it to treat you safely.
You do not have to give us your data. But if you choose not to give information a clinician needs, we may not be able to assess you or provide treatment. If that happens, we will always explain why.
5. How we use your data and our lawful basis
UK law says we must have a lawful basis for each use of your data. For health data, we also need an extra condition under Article 9 of UK GDPR.
| What we use it for | Data used | Lawful basis | Extra condition for health data |
|---|---|---|---|
| Assessing whether a test or treatment is suitable for you | Identity, Contact, Health, GP | Taking steps at your request before a contract; performing our contract with you | Provision of health care, under the responsibility of a health professional (Art. 9(2)(h)) |
| Clinical consultations, prescribing, ongoing care and monitoring | Identity, Contact, Health, GP, Communications | Performing our contract with you | Provision of health care (Art. 9(2)(h)) |
| Arranging blood tests and sharing your results with you and your clinician | Identity, Contact, Health | Performing our contract with you | Provision of health care (Art. 9(2)(h)) |
| Dispensing and delivering your treatment | Identity, Contact, Health, Transaction | Performing our contract with you | Provision of health care (Art. 9(2)(h)) |
| Taking payment and managing subscriptions | Identity, Contact, Transaction, Payment | Performing our contract with you | Not applicable |
| Service messages, such as order updates, results ready, reorder reminders | Identity, Contact, Transaction | Performing our contract with you | Provision of health care, where the message relates to your care |
| Customer support and handling complaints | Identity, Contact, Communications, Transaction, Health where relevant | Legitimate interests (looking after our customers) | Provision of health care; legal claims (Art. 9(2)(f)) |
| Keeping clinical records, meeting regulatory duties and reporting safety concerns, for example to the MHRA | All relevant data | Legal obligation | Provision of health care; public health (Art. 9(2)(i)) |
| Preventing fraud and keeping our Site secure | Identity, Contact, Technical, Usage, Transaction | Legitimate interests (protecting our customers and business) | Not applicable |
| Improving our Site and services using analytics | Technical, Usage | Consent, through our cookie banner | Not applicable |
| Improving our clinical service using anonymised or aggregated data | Health (de-identified) | Legitimate interests | Provision of health care; health care management |
| Marketing emails and messages | Identity, Contact, Marketing | Consent, or legitimate interests for existing customers (soft opt-in) | We never use health data for marketing |
| Advertising on social media and search | Technical, Usage, Contact (hashed) | Consent, through our cookie banner | We never share health data with advertisers |
| Research, reviews and testimonials | Identity, Contact, Feedback | Consent | Explicit consent (Art. 9(2)(a)) where health details are included |
| Establishing or defending legal claims | All relevant data | Legitimate interests | Legal claims (Art. 9(2)(f)) |
Where we rely on legitimate interests, we have balanced them against your rights and you can object at any time (see section 11). Where we rely on consent, you can withdraw it at any time.
6. Our promises on your health data
We hold ourselves to a higher standard than the law requires, because trust is the whole point of mealign.
- We never sell your data. Not your health data, not your contact details, not anything.
- We never share health data with advertisers. Your assessment answers, results, treatments and visits to treatment pages are not passed to social media or ad platforms.
- Only people who need it can see it. Clinical information is available to the clinicians and pharmacy team involved in your care, and to a small number of staff who need it to support you. Everyone with access is bound by confidentiality.
- Your GP is told only with your agreement, unless a clinician believes there is a serious risk to your health or someone else’s, or the law requires it.
- Clinical records are kept safely, not deleted on request. Health law requires us to keep accurate records of your care. You can ask us to correct them, but we usually cannot erase them (see section 9).
7. Who we share your data with
We only share what each party needs to do its job.
| Who | Why | Their role |
|---|---|---|
| Prescribing clinicians | To review your assessment and results, consult with you, prescribe and provide ongoing care | Independent controllers for their clinical records and professional duties |
| Our partner pharmacy | To check, dispense and deliver prescribed treatment | Independent controller for pharmacy records |
| Our laboratory partner | To process your blood sample and return results | Processor, or independent controller for its own clinical records |
| Your GP | To keep your medical record complete, with your agreement | Independent controller |
| Delivery and courier companies | To deliver kits and treatments in discreet packaging | Processor (name, address, phone only) |
| Our payment provider | To take payments securely and prevent fraud | Independent controller for payment data |
| Technology suppliers | Website hosting, customer records, email, customer support tools, secure cloud storage | Processors, under contract and our instructions |
| Analytics and advertising partners, such as Google and Meta | To measure our Site and show mealign ads, only with your cookie consent and never with health data | Joint or independent controllers (see their privacy notices) |
| Professional advisers | Lawyers, accountants, auditors and insurers | Independent controllers, bound by confidentiality |
| Regulators and authorities | For example the CQC, MHRA, GPhC, ICO, police or courts, where the law requires it | Independent controllers |
| A buyer or investor | If mealign is sold, merged or restructured, your data may transfer under this policy | Independent controller |
Our processors can only use your data to provide services to us. They must keep it confidential and secure, and they cannot use it for their own purposes.
8. International transfers and security
Where your data is stored
Some of our technology suppliers are based in, or use servers in, the European Economic Area or the United States, and some members of our team and contractors work from outside the UK, including South Africa. When your data leaves the UK, we make sure it stays protected by using one of the safeguards UK law allows: a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework), or the ICO’s International Data Transfer Agreement or Addendum. Contact us for details of the safeguard used for a specific transfer.
How we keep it secure
- Encryption of data in transit and at rest
- Role-based access, so staff only see what they need
- Multi-factor authentication for systems holding health data
- Confidentiality agreements and data protection training for our team and partners
- Regular reviews of our suppliers’ security
No system is completely secure, so please use a strong, unique password and tell us straight away if you think your account has been accessed without permission. If a data breach is likely to put you at high risk, we will tell you without undue delay and report it to the ICO as the law requires.
9. How long we keep your data
We keep data only as long as we need it, then delete it or anonymise it securely.
| Data | How long we keep it | Why |
|---|---|---|
| Clinical records: assessments, consultation notes, blood results, prescriptions | 8 years after your last contact with our clinical service | NHS Records Management Code of Practice for adult health records |
| Assessments that did not lead to treatment | 8 years after the assessment | To show why a clinical decision was made |
| Orders, invoices and payment records | 6 years after the end of the financial year | Tax and accounting law |
| Account details | While your account is open, then 6 years after closure | To handle queries, complaints and legal claims |
| Complaints | 10 years after the complaint is closed | Clinical governance and legal claims |
| Customer support messages that are not clinical | 3 years after the last message | To support you and improve our service |
| Marketing preferences | Until you unsubscribe, plus a suppression record so we do not contact you again | PECR compliance |
| Analytics and cookie data | Up to 13 months (see our Cookie Policy) | ICO cookie guidance |
| Research and testimonial consent | Until you withdraw consent, or 2 years after the project ends | To respect your choice |
Where the law or an ongoing legal claim needs us to keep data longer, we will.
10. Marketing, cookies and automated decisions
Marketing
We only send marketing emails or texts if you have opted in, or if you are an existing customer and have not opted out of hearing about similar services. Every message has an unsubscribe link, or you can email info@mealign.com. Unsubscribing does not stop essential service messages about your orders, results or care. We will never use your health information to decide what marketing you receive.
Cookies
We use cookies and similar technologies to make our Site work, to understand how it is used and, with your permission, for advertising. Strictly necessary cookies are always on. Analytics and advertising cookies are only set if you accept them in our cookie banner, and you can change your choice at any time. Advertising tags do not run on our assessment, results or treatment pages. See our Cookie Policy for the full list.
Automated decisions
Our online assessment may flag answers that mean a treatment is not safe for you. A qualified clinician reviews every assessment before any prescribing decision is made, and you can always ask to speak to a clinician about the outcome. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
11. Your rights
You have the right to:
- Access your data and get a copy of it (a subject access request)
- Correct data that is wrong or incomplete
- Erase your data in certain cases. We usually cannot erase clinical records we are legally required to keep, but we will explain why
- Restrict how we use your data while a concern is looked into
- Object to us using your data based on legitimate interests, and to direct marketing at any time
- Port data you gave us to another provider in a common, machine-readable format
- Withdraw consent at any time, where we rely on it. This does not affect anything we did before you withdrew it
- Not be subject to solely automated decisions that significantly affect you
To use any of these rights, email info@mealign.com. It is free. We may ask you to confirm your identity first so we never give your data to the wrong person. We will reply within one month. If your request is complex, we may extend this by up to two more months and will tell you why.
12. Contact us, complaints and changes
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. We will acknowledge your complaint within 30 days and keep you updated. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
We will update this policy when our services or the law change. The date below shows when it was last updated. If we make a significant change, we will tell you by email or on our Site before it takes effect.
Last updated