General Data Protection Regulation (GDPR)

Last updated: 11 August 2026

We process personal data, including special category health data, under the UK GDPR and the Data Protection Act 2018. This page is the short version; the detail is in our Privacy Policy.

Who we are

Lola Health Ltd, registered in England and Wales (Company No. 15961806), registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF. ICO registration ZB752885.

We have appointed a Data Protection Officer, contactable at [email protected].

Our lawful bases

Contract, to provide what you buy. Legal obligation, for tax, accounting and clinical record-keeping. Legitimate interests, to keep the service secure and to improve it. Consent, for optional things — marketing, sharing your results with a partner, wearable data, and any test we resell that no Lola doctor reviews.

For health data we rely on Article 9(2)(h) — health assessment carried out by or under the responsibility of a GMC-registered doctor bound by professional secrecy — for tests that include a doctor's review. Our condition under UK law is Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 (health or social care purposes). Where a test does not include a doctor's review, or where you choose something optional, we rely on your explicit consent under Article 9(2)(a) with Article 6(1)(a).

We keep an Appropriate Policy Document setting out how we meet the Schedule 1 safeguards. Ask us for a copy at [email protected] and we will send it.

Safeguarding

There is one situation where we may share information without your consent: where we believe a child or an adult at risk may be harmed. In that case we may share what is necessary with the relevant safeguarding authority, the police or a healthcare provider. We do not take that lightly and we will tell you unless doing so would increase the risk to someone.

Partner sharing

Where you give explicit consent to share your results with a partner — a clinic, practitioner or wellness provider — we and that partner each act as independent controllers. Not joint controllers, and neither of us processes on the other's behalf. Our basis for the disclosure is your explicit consent, and you can withdraw it at any time.

Once results have been shared, the partner holds their own copy and you exercise your rights over it with them, because we do not control their records. What we will do is notify them if you ask us to erase, correct or restrict your data, and tell you who we told (Article 19). Detail is in our Partner Data Sharing Agreement.

Your rights

Access, rectification, erasure, restriction, objection, portability, and withdrawal of consent where we rely on it. Email [email protected] or use the app. Our Data Rights page explains the timings, the fee rules, the one narrow health-data exception to access, and the route for records of someone who has died.

Retention

We keep data only as long as we need it, and we set a period for each kind. Health and test data is kept for 8 years from your last contact with us; financial records for 6 years plus the current year; the record of your consent and our clinicians' review logs are kept beyond that in pseudonymised form, on the grounds at Article 17(3). The Privacy Policy has the full list. You can ask us to delete earlier at any time.

Data breaches

Where a breach is likely to result in a risk to people's rights and freedoms we report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the risk to you is high we tell you too, without undue delay, in plain language: what happened, what it means for you, what we have done, what you can do, and who to contact.

Complaints

Section 164A of the Data Protection Act 2018 gives you a statutory right to complain to us directly about how we process your personal data. You can complete our data protection complaint form online, or email [email protected]. We aim to acknowledge within 3 working days and will always do so within the 30-day statutory backstop, then look into it, keep you informed and tell you the outcome.

You can complain to the Information Commissioner's Office at any time and you do not have to come to us first: ico.org.uk, 0303 123 1113. You can also go to court.