Data Subject Access Request
Last updated: 11 August 2026
Your data rights
Under the UK GDPR and the Data Protection Act 2018 you can see, correct, delete and move the personal data we hold about you. This page explains how.
We have appointed a Data Protection Officer, contactable at [email protected].
What you can ask for
| Right | What it means |
|---|---|
| Access (Article 15) | A copy of the personal data we hold about you — test results, account information, order history, health questionnaire answers. One narrow exception is explained below. |
| Rectification (Article 16) | Correction of anything inaccurate or incomplete. |
| Erasure (Article 17) | Deletion of your data. We may have to keep some of it for clinical record-keeping and legal reasons — see Account Deletion. |
| Restriction (Article 18) | That we pause processing while a query or complaint is sorted out. |
| Portability (Article 20) | Your data in a structured, machine-readable format such as CSV or JSON, so you can take it elsewhere. |
| Objection (Article 21) | Object to processing based on legitimate interests, or to direct marketing. |
| Complain to us (DPA 2018 s.164A) | Complain directly to us about how we handle your data, using our online form or by email. See below and our Complaints Procedure. |
How to ask
- Email: [email protected]
- In the app: Account Settings, to view, download or delete your data
- Post: Lola Health Ltd, 167-169 Great Portland Street, 5th Floor, London W1W 5PF
Tell us your name and the email address on your Lola account, what you are asking for, and any relevant order numbers or dates. We may need to verify your identity first, so we may ask you to confirm some account details or show a form of ID.
How long we take
One calendar month, counted from the point we have what we need to act — the later of receiving your request, verifying your identity where we reasonably need to, and receiving any fee that applies.
If your request is not clear about what you want, we may ask you to clarify. For access requests the clock pauses while we wait for your reply and restarts when you come back to us (Article 12A).
If the request is complex, or you have made several, we may take up to two further months. We will tell you inside the first month and explain why.
When we search, we make searches that are reasonable and proportionate to what you have asked for.
Fees
Access requests are free. We may charge a reasonable administrative fee only where a request is manifestly unfounded or excessive, under Article 12(5). The burden of showing that is on us, not you. A second request is not excessive just for being a second request, and a request is not unfounded because you are angry with us or because answering is inconvenient.
One exception on health data
There is a narrow limit on access to clinical information. Part 2 of Schedule 3 to the Data Protection Act 2018 means the right of access does not apply to the extent that giving you the information would be likely to cause serious harm to your physical or mental health, or to someone else's. That judgement is made by a doctor, in writing, not by our support team, and it is rare.
If we withhold anything on that basis we will tell you that we have done so and on what basis, in terms that do not themselves cause the harm. You can challenge it — through a complaint to us, to the ICO, or in court.
Data you have shared with a partner
If you consented to share your results with a partner — a clinic, practitioner or wellness provider — that partner holds its own copy as an independent controller. To exercise your rights over their copy you need to contact them, because we do not control their records. You can stop any further sharing at any time by disconnecting them in the app; that does not delete what they already have.
What we will do is tell them. When we erase, correct or restrict your data, Article 19 requires us to notify anyone we shared it with, unless that is impossible or would take disproportionate effort — and we will tell you who we told.
Records of someone who has died
The UK GDPR does not apply to people who have died, but a separate route does. If you are the personal representative of the estate, or you have a claim arising from the death, you can apply under the Access to Health Records Act 1990. Email [email protected]. Section 3(5) of that Act sets the time at 40 days from your application, or 21 days where the part of the record you have asked for was made in the 40 days before it.
If we say no
We will tell you why, and tell you that you can complain to us under section 164A, complain to the Information Commissioner, and seek a remedy in court.
If you are not satisfied
Complain to us. Since 19 June 2026 section 164A of the Data Protection Act 2018 gives you a statutory right to complain to us directly. You can complete our data protection complaint form online, or email [email protected]. We aim to acknowledge within 3 working days and will always do so within the 30-day statutory backstop, then look into it, keep you informed and tell you the outcome.
Complain to the Information Commissioner. Any time — you do not have to come to us first. ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · ico.org.uk/make-a-complaint
You can also seek a remedy through the courts.