Your Privacy

Our Privacy Policy

Effective date: 11^th November 2025

This privacy policy applies between you, the User of this Website, and Vitall, the owner and provider of this Website. Vitall takes the privacy of your information seriously. This policy explains how we collect, use, store and protect your Data when you use our Website and services.

This policy should be read alongside our Terms and Conditions, available at: https://vitall.co.uk/terms.

Please read this privacy policy carefully.

Definitions and interpretation

1. In this privacy policy, the following definitions are used:

Data

Any information you submit to Vitall through this Website. This includes Personal Data and Special Category Data as defined under the Data Protection Laws.

Cookies

Small text files placed on your device when you visit certain parts of the Website or use features. Details of cookies used are found below under "Cookies".

Data Protection Laws

All applicable UK privacy legislation, including the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

UK GDPR

The UK version of the General Data Protection Regulation (EU) 2016/679.

Vitall, or us

Healthy Human Labs Limited, trading as Vitall. Company number 11263709. Registered office: 71 - 75 Shelton Street, Covent Garden, London, WC2H 9JQ.

User or you

Any third party accessing the Website who is not employed by Vitall or acting on behalf of Vitall professionally.

Website

The website https://vitall.co.uk and any sub-domains unless expressly excluded.

2. In this policy, unless the context requires otherwise:
   1. the singular includes the plural and vice versa;
   2. references to clauses or appendices are to those in this policy;
   3. a reference to a person includes individuals, companies and organisations;
   4. "including" means "including without limitation";
   5. statutory references include amendments or replacements; and
   6. headings do not affect interpretation.

Scope of this privacy policy

3. This policy applies only to Vitall and your use of this Website. It does not apply to external websites linked from our Website.
4. Vitall is the "data controller" for the purposes of UK GDPR and determines how your Data is processed.

Data collected

5. We may collect the following Data, including Personal Data and Special Category Data:
   1. name;
   2. date of birth;
   3. sex;
   4. ethnicity;
   5. information relating to your physical or mental health;
   6. information relating to your family health history;
   7. contact information such as email address, delivery address, telephone numbers;
   8. demographic information such as postcode and preferences;
   9. IP address (automatically collected);
   10. browser type and version (automatically collected);
   11. operating system (automatically collected);
   12. navigation path, activity and interaction on the Website (automatically collected);
   13. any other information you provide when using our services.

How we collect Data

6. We collect Data in the following ways:
   1. Data you provide directly;
   2. Data received from third parties (see below);
   3. Data collected automatically when using the Website.

Data that is given to us by you

7. Vitall collects Data when:
   1. you contact us via the Website, email, post or phone;
   2. you register an account or purchase services;
   3. you complete surveys (optional);
   4. you enter promotions or competitions;
   5. you make payments;
   6. you consent to marketing communications;
   7. you use our services, including test ordering and result access;
   8. analytics or advertising partners share Data you have consented to provide.

Data that is received from third parties

8. Vitall may receive Data from:
   1. clinical partners, laboratory services or healthcare organisations involved in delivering your tests;
   2. service providers supporting the fulfilment of orders, sample logistics, results delivery or technical support;
   3. business partners who integrate or refer services to Vitall.

   We do not list individual partners, but they only process your Data under strict contractual agreements and in compliance with Data Protection Laws.

Data that is collected automatically

9. 1. We automatically collect certain information about your visit to improve Website performance and security. This includes IP address, timestamps, frequency, and usage patterns.
   2. Cookies may collect Data in accordance with your browser settings. See the "Cookies" section below.

Our lawful basis for processing

10. We process your Data under the following lawful bases:
    1. Contract - to provide testing services, process orders and manage your account.
    2. Legal obligation - to meet legal, financial or regulatory requirements.
    3. Legitimate interests - for security, fraud prevention, analytics and service improvement. You may object to this processing.
    4. Consent - for marketing and non-essential cookies.
11. For health-related data (Special Category Data), processing is justified under:
    1. Article 9(2)(h) UK GDPR - processing necessary for health or diagnostic purposes required to deliver the testing services you request;
    2. Article 9(2)(a) - where explicit consent is provided by you.

Our use of Data

12. We may use your Data for:
    1. processing orders and delivering testing services;
    2. internal record keeping;
    3. improving products and services;
    4. customer support;
    5. website analytics and performance optimisation;
    6. sending marketing materials (with consent);
    7. conducting research or surveys (optional).

Artificial intelligence and anonymised data

We may use anonymised or aggregated information with third party artificial intelligence tools to support service improvement, internal analysis and quality assurance. This information cannot identify you.

Automated processing

We use automated systems to support internal workflows such as routing, quality checks and processing of testing information. These systems do not make decisions that produce legal or similarly significant effects for you.

Any informational insights, automated suggestions or internal data processing are subject to human oversight and are not a substitute for professional medical judgement. Our services are informational only, as described in our Terms and Conditions.

Who we share Data with

15. We may share your Data with:
    1. clinical and laboratory partners needed to deliver your testing service;
    2. technical service providers including hosting, analytics, payment and communication tools;
    3. professional advisers where required;
    4. customer service and operational tool providers.

    All third parties process Data only under our instruction and under binding legal agreements.

International transfers

Some service providers operate outside the UK, including technology platforms, cloud providers and communication tools. When Data is transferred internationally, we ensure appropriate safeguards are in place, such as:

• UK adequacy decisions;
• the UK Addendum to the EU Standard Contractual Clauses;
• appropriate technical and organisational protections.

We assess international transfers to ensure your Data remains protected in accordance with UK GDPR requirements.

Keeping Data secure

16. We use technical and organisational measures to secure your Data, including encryption, secure servers and controlled access.
17. If you suspect misuse, loss or unauthorised access to your Data, contact us immediately at [email protected].
18. For guidance on staying safe online, visit www.getsafeonline.org.

Data retention

19. We retain health-related Data for ten years in line with widely recognised clinical record retention practices unless law requires a longer period.
20. Deleted Data may remain in backups for regulatory or auditing purposes.

Your rights

21. You have the right to:
    1. Access your Data;
    2. Correct inaccurate or incomplete Data;
    3. Erase your Data;
    4. Restrict our use of your Data;
    5. Port your Data to another provider;
    6. Object to processing based on legitimate interests.
22. To exercise any rights or withdraw consent, email [email protected].
23. If dissatisfied, you may complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/.

Links to other websites

25. External websites linked from this Website are not covered by this policy. You should review their privacy policies before use.

Business ownership changes

26. If Vitall undergoes restructuring or is acquired, your Data may be transferred to new owners under the same privacy commitments.
27. We may disclose Data to prospective purchasers under confidentiality obligations.

Cookies

29. This Website uses Cookies to support essential functionality and improve user experience.
30. We comply with PECR, meaning non-essential cookies are only set with your consent.
31. When visiting the Website, you will be asked to consent to analytical, functionality or targeting cookies.

Types of Cookies used:

Type of Cookie	Purpose
Strictly necessary cookies	Required to operate secure areas, manage sessions and process orders.
Analytical/performance cookies	Measure usage to help improve the Website. Only used with your consent.
Functionality cookies	Remember preferences and improve user experience.
Targeting cookies	Used by third party advertising partners to show relevant adverts. Only set with your consent.

Some cookies used on our Website may be placed by third party analytics or advertising partners. These will only operate if you provide consent through our cookie management tools.

General

38. You may not transfer your rights under this policy. We may transfer ours where your rights are not affected.
39. If any clause is found invalid, the remainder of the policy will still apply.
40. No delay in exercising rights constitutes a waiver.
41. This policy is governed by the laws of England and Wales, and disputes will be subject to English and Welsh courts.

Changes to this privacy policy

42. We may update this policy to reflect legal or operational changes. Updates will be posted on this Website, and continued use indicates acceptance.

Contact

You may contact Vitall by email at [email protected].