Privacy Policy

Privacy Policy — Last Updated: 31 July 2026

Intended Purpose. The Lola Health mobile application is a wellness and lifestyle software product. It is not a medical device, is not registered with the MHRA and does not carry a UKCA, CE or FDA mark. It is not intended for the diagnosis, prevention, prediction, prognosis, monitoring, treatment or alleviation of disease. Samples are analysed by partner laboratories that vary by product. Blood and urinalysis samples are analysed by our UKAS-accredited (ISO 15189) UK partner laboratory. Biological-age (epigenetic) tests are processed by TruDiagnostic, Inc. in the United States. Gut microbiome tests are processed by Intus Bio, Inc. in the United States. Where a product includes a review of your results by a GMC-registered doctor, the clinical interpretation is provided by that doctor and not by the software; not every product includes such a review, and whether a review is included is stated on the product page.

This Privacy Policy describes how Lola Health Ltd ("Lola Health", "we", "us", "our") collects, uses and discloses your personal information when you use our website, our mobile app, or otherwise interact with us (together, the "Services"). For the purposes of UK data protection law, Lola Health Ltd is the data controller of your personal information.

Who delivers our service. Parts of our service are delivered by independent providers rather than by Lola Health. We do not own or operate any clinic, phlebotomy service, laboratory or pharmacy. Sample collection is carried out by qualified, professionally registered healthcare practitioners — either at your home, or at a partner clinic arranged through an independent clinic network. Those practitioners and clinics are responsible for their own clinical practice, professional registration and insurance, and they are not employed by Lola Health Ltd. Laboratory analysis is carried out by accredited partner laboratories. In data protection terms these providers act on our instructions as our processors, which means Lola Health remains the controller of your information throughout and remains accountable to you for how it is handled, even where the person you meet does not work for us.

Changes. We may update this Privacy Policy from time to time. We will post the revised version, update the "Last Updated" date, and take any further steps required by law.

Lawful Bases for Processing. Under the UK GDPR and the Data Protection Act 2018 we rely on the following bases:

Contract — to provide the Services you buy: fulfilling your order, arranging sample collection where needed, processing your sample, and releasing your results (including, for products that include one, a doctor's review).

Legal obligation — to meet tax, accounting, clinical record-keeping and other regulatory requirements.

Legitimate interests — to secure our Services and prevent fraud, to respond to and support you, and to improve and develop our products, where these interests are not overridden by your rights.

Consent — for things that are optional, including marketing communications, sharing your results with a partner you choose to connect, and syncing wearable or health-app data. You can withdraw consent at any time; withdrawing it switches off the optional feature but does not affect processing we carry out under another basis.

Special Category (Health) Data. As a health-testing company we process health data under Article 9 of the UK GDPR — blood test results (biomarker values, reference ranges, clinical interpretations), health questionnaire responses, doctor review notes, wearable/health-app data you choose to sync, and, for TruDiagnostic products, epigenetic (DNA-methylation) data. For tests that include a review by a GMC-registered doctor (such as our blood and urinalysis tests), our condition for processing this data to provide your test is Article 9(2)(h) (health or social care carried out by, or under the responsibility of, a health professional bound by professional secrecy). For tests that do not include a doctor's review — including TruDiagnostic biological-age tests and GutID microbiome tests — we rely on your explicit consent (Article 9(2)(a)), which you give by confirming a separate consent statement on the profile form we send you after your order. We ask for this confirmation for every test we carry out, we record it separately for each person being tested, and we do not process a sample without it. We keep a record of the exact wording you were shown and the date you confirmed it. Where processing is not covered by Article 9(2)(h) — for example sharing your results with a non-clinical partner you connect, or wearable data — we rely on your explicit consent (Article 9(2)(a)).

Your health data is stored on encrypted servers in the UK and the European Economic Area, is accessible only to authorised personnel including reviewing doctors bound by GMC obligations, and is never sold or used for insurance underwriting. It is shared only where that is needed to provide your test: with the partner laboratory that analyses your sample, which varies by product and is identified in the International Transfers section below; and, where your test involves a home visit or a clinic appointment, with the independent clinic network that arranges it, which passes what is needed to the practitioner or clinic attending you. They receive your name, contact details and address so the appointment can be made — they do not receive your test results.

Separately from the above, and only where you choose it, we share your results with a partner you connect — see Sharing Your Results with Partners below.

What We Collect. Directly from you: contact and account details, order information, health questionnaire responses, and anything you include when you contact support. Automatically: usage and device data via cookies and similar technologies. From third parties: information from vendors and service providers who support the Services (such as Shopify and our payment processors).

Mobile App & Connected Health Data. Our app is how you view your results, your doctor's review and educational content. With your permission, the app can also collect: (a) health and fitness data you choose to sync from device integrations such as Google Health Connect — for example activity, heart rate, sleep and related metrics; (b) data from connected wearables and device sensors; and (c) location, if you enable it, to suggest nearby clinics and phlebotomists. We collect this data only if you connect it, and you can disconnect or revoke these permissions at any time in the app or your device settings. Our access to and use of Google Health Connect data complies with the Google Health Connect Permissions Policy, including the Limited Use requirements: we use the data only to provide the features you have enabled, we do not sell it, and we do not use it for advertising. We do not use your health, wearable or test data to make decisions producing legal or similarly significant effects about you; AI features provide general wellness information only, and, where a blood test includes a doctor's review, that review is carried out by a GMC-registered doctor before the result is released.

How We Use It. To provide and manage the Services and your account; to communicate with you and provide support; to send marketing where you have consented or we have a legitimate interest; and to detect and prevent fraud and protect our Services.

AI Wellness Features. We use third-party artificial-intelligence services to help prepare and check some of the wellness content you receive, including the summary that accompanies your blood test result and the chat and insight features in the app. We share only what those features need in order to work. Where your product includes a doctor's review, our condition for this processing is Article 9(2)(h), because it forms part of preparing the health assessment your doctor reviews; where the processing is not covered by Article 9(2)(h) we rely on your explicit consent (Article 9(2)(a)). Some of these providers are based outside the UK, including in the United States — see International Transfers below.

Where your product includes a doctor's review, a GMC-registered doctor reviews and signs the comment on your result, and can amend or reject it, before it reaches you. Other wellness content in the app is generated automatically and is not individually reviewed. We do not use these features to make automated decisions about you that have legal or similarly significant effects, they do not make clinical decisions, and they are not a substitute for advice from a healthcare professional.

SMS. If you opt in to text messages we collect your phone number to send transactional updates and, where you consent, promotional messages. SMS opt-in data and consent are never shared with third parties. Reply STOP to unsubscribe at any time.

Sharing Your Results with Partners. We only share your results with a partner where you have given your explicit consent. Connecting a partner in the app does not by itself share your results: it sends you a consent request, and we share your results only after you explicitly agree by tapping "Agree and share" on the consent screen. A referral or coupon code entered at checkout is used for billing attribution only — it links your order to a partner for commercial purposes and is not consent to share your results. When you do consent, we share your results (including health data) with that specific, named partner, and that partner is then able to see those results. Partner categories are: clinics, practitioners and pharmacies (regulated clinical partners), and non-clinical wellness partners (such as gyms, personal trainers, beauty clinics or coaches). Our lawful basis is your explicit consent (UK GDPR Article 9(2)(a)); for regulated clinical partners we may also rely on Article 9(2)(h) (provision of health care). Each partner is an independent controller of the information we share with them — unlike the providers who deliver our service on our instructions, a partner decides for itself how it uses your results, is responsible for keeping them secure, and may retain them under its own policies and legal obligations. You can withdraw your consent and disconnect a partner at any time in the app or by contacting us, after which we stop sharing further results with them; results already shared remain with that partner, and you can exercise your rights with them directly.

Other Disclosures. We may disclose personal information to vendors who perform services on our behalf (IT, payment processing, analytics, customer support, cloud storage, fulfilment and shipping); in connection with a business transaction such as a merger; and to comply with legal obligations or to protect our rights and those of our users. If you post reviews or other content in public areas of the Services, that content is public. We do not sell your personal information.

Cookies. We use cookies to operate and improve the Services, run analytics, and support abandoned-cart reminders. You can control cookies through your browser settings, though blocking them may affect functionality. See our Cookies Policy for detail, and shopify.com/legal/cookies for Shopify's cookies.

International Transfers & Data Residency. Your personal data is processed and stored on encrypted servers in the UK and the European Economic Area. Some of it is transferred outside the UK.

Two of our test products require this. If you order an epigenetic test (TruAge, TruHealth) or a microbiome test (GutID), your sample and the resulting data are analysed by a specialist laboratory in the United States. That transfer is part of what you agree to when you order that test, and you can choose not to order it. The United States is not covered by UK adequacy regulations, which means the protection is not the same as in the UK: public authorities there may be able to access data in circumstances UK law would not allow, and enforcing your rights can be harder.

A number of the service providers we use to run the Services also process personal data outside the UK. These cover identity and authentication, payments, subscription management, transactional email, SMS, push notifications, customer support, product analytics and error monitoring, and the artificial-intelligence services described above. Where we transfer personal data outside the UK we use the transfer mechanisms permitted by UK data protection law.

If you would prefer your data not to be transferred outside the UK, contact us before ordering.

Retention. We keep your personal data only for as long as we need it, and we set a period for each kind. Health and test data — including your results, any doctor's review and the record of your consent — is kept for 8 years from your last contact with us, in line with clinical record-keeping guidance and the limitation period for clinical negligence claims. That means we may need to keep it after you close your account. Invoices and transaction records are kept for 6 years plus the current year, because tax law requires it. Conversations in the app are kept for 2 years. When data is no longer needed it is securely deleted, or the identifiers linking it to you are removed so it is no longer readily attributable to you. You can ask us to delete your data earlier at any time, and we will action it except where we are required to keep it — in which case we will tell you which part we have kept and why.

Withdrawing Your Consent to a Test. You can withdraw your consent to a test at any time by emailing [email protected]. If your sample has not yet been analysed, we will stop processing it and can destroy it on request. If analysis has already been carried out, withdrawal stops any further processing but cannot undo work already completed, and we may need to keep the result and the record of your consent to meet our clinical record-keeping and legal obligations. Withdrawing consent does not affect anything we did before you withdrew it. Full detail is in section 16 of our Terms & Conditions.

Your Rights. You have the right to access, rectify, erase, restrict and object to processing of your personal data, to data portability, and to withdraw consent where we rely on it. These rights are not absolute and some may not apply in every case. To exercise them, contact [email protected] or use the account settings in the app. We will respond within one calendar month, running from the later of receiving your request, verifying your identity where we reasonably need to, and receiving any fee that applies. If we ask you to clarify an access request, the clock pauses until you reply (Article 12A). We may extend by up to two further months for complex or numerous requests, and will tell you within the first month if we do. Where a partner holds your data as an independent controller, you can exercise your rights with them directly. Since 19 June 2026, section 164A of the Data Protection Act 2018 also gives you a statutory right to complain to us directly about how we process your personal data. Email [email protected] — we will acknowledge your complaint within 30 days, take appropriate steps to look into it, keep you informed of progress, and tell you the outcome. You can also complain to the Information Commissioner's Office at any time, and you do not have to come to us first (ico.org.uk, 0303 123 1113). You have the right to seek a remedy through the courts as well.

Children. The Services are not intended for children under 18 and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

Security. We use encryption in transit and at rest, access controls and other safeguards. No method is perfectly secure, so please do not send sensitive information through unsecured channels.

Contact. Email [email protected] (data protection) or [email protected] (general). Lola Health Ltd is registered in England and Wales (Company No. 15961806), registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF, and is registered with the ICO (Ref: ZB752885).