Privacy policy

Privacy Policy — Last Updated: 22 July 2026

Intended Purpose. The Lola Health mobile application is a wellness and lifestyle software product. It is not a medical device, is not registered with the MHRA and does not carry a UKCA, CE or FDA mark. It is not intended for the diagnosis, prevention, prediction, prognosis, monitoring, treatment or alleviation of disease. Samples are analysed by partner laboratories that vary by product. Blood and urinalysis samples are analysed by our UKAS-accredited (ISO 15189) UK partner laboratory. Biological-age (epigenetic) tests are processed by TruDiagnostic, Inc. in the United States. Gut microbiome tests are processed by Intus Bio, Inc. in the United States. The laboratory used for each product, and where your sample is analysed, is identified in our Privacy Policy. Where a product includes a review of your results by a GMC-registered doctor, the clinical interpretation is provided by that doctor and not by the software; not every product includes such a review, and whether a review is included is stated on the product page. Products that provide a biological-age or microbiome result generate that result and its report from the laboratory's own analysis, without a Lola Health doctor's review.

This Privacy Policy describes how Lola Health Ltd ("Lola Health", "we", "us", "our") collects, uses and discloses your personal information when you use our website, our mobile app, or otherwise interact with us (together, the "Services"). For the purposes of UK data protection law, Lola Health Ltd is the data controller of your personal information.

Changes. We may update this Privacy Policy from time to time. We will post the revised version, update the "Last Updated" date, and take any further steps required by law.

Lawful Bases for Processing. Under the UK GDPR and the Data Protection Act 2018 we rely on the following bases:

Contract — to provide the Services you buy: fulfilling your order, arranging sample collection where needed, processing your sample, and releasing your results (including, for products that include one, a doctor's review).

Legal obligation — to meet tax, accounting, clinical record-keeping and other regulatory requirements.

Legitimate interests — to secure our Services and prevent fraud, to respond to and support you, and to improve and develop our products, where these interests are not overridden by your rights.

Consent — for things that are optional, including marketing communications, sharing your results with a partner you choose to connect, syncing wearable or health-app data, and AI wellness features. You can withdraw consent at any time; withdrawing it switches off the optional feature but does not affect processing we carry out under another basis.

Special Category (Health) Data. As a health-testing company we process health data under Article 9 of the UK GDPR — blood test results (biomarker values, reference ranges, clinical interpretations), health questionnaire responses, doctor review notes, wearable/health-app data you choose to sync, and, for TruDiagnostic products, epigenetic (DNA-methylation) data. For tests that include a review by a GMC-registered doctor (such as our blood and urinalysis tests), our condition for processing this data to provide your test is Article 9(2)(h) (health or social care carried out by, or under the responsibility of, a health professional bound by professional secrecy), and we maintain an Appropriate Policy Document for this processing as required by the DPA 2018. For tests that do not include a doctor's review — including TruDiagnostic biological-age tests (epigenetic/DNA-methylation data) and GutID microbiome tests — we rely on your explicit consent (Article 9(2)(a)), which you give by confirming a separate consent statement on the profile form we send you after your order. We ask for this confirmation for every test we carry out, we record it separately for each person being tested, and we do not process a sample without it. We keep a record of the exact wording you were shown and the date you confirmed it. Where processing is not covered by Article 9(2)(h) — for example sharing your results with a non-clinical partner you connect, AI wellness features, or wearable data — we rely on your explicit consent (Article 9(2)(a)). Your health data is stored on encrypted servers in the UK/EEA, is accessible only to authorised personnel including reviewing doctors bound by GMC obligations, is never sold or used for insurance underwriting, and is shared with the partner laboratory that analyses your sample — which varies by product and is identified in the International Transfers section below — for the purpose of analysing your sample and producing your result.

What We Collect. Directly from you: contact and account details, order information, health questionnaire responses, and anything you include when you contact support. Automatically: usage and device data via cookies and similar technologies. From third parties: information from vendors and service providers who support the Services (such as Shopify and our payment processors).

Mobile App & Connected Health Data. Our app is how you view your results, your doctor's review and educational content. With your permission, the app can also collect: (a) health and fitness data you choose to sync from device integrations such as Google Health Connect — for example activity, heart rate, sleep and related metrics; (b) data from connected wearables and device sensors; and (c) location, if you enable it, to suggest nearby clinics and phlebotomists. We collect this data only if you connect it, and you can disconnect or revoke these permissions at any time in the app or your device settings. Our access to and use of Google Health Connect data complies with the Google Health Connect Permissions Policy, including the Limited Use requirements: we use the data only to provide the features you have enabled, we do not sell it, and we do not use it for advertising. We do not use your health, wearable or test data to make decisions producing legal or similarly significant effects about you; AI features generate non-medical wellness summaries only, and, where a blood test includes a doctor's review, that review is carried out by a GMC-registered doctor before the result is released.

How We Use It. To provide and manage the Services and your account; to communicate with you and provide support; to send marketing where you have consented or we have a legitimate interest; and to detect and prevent fraud and protect our Services. You can disable AI features in the app at any time.

SMS. If you opt in to text messages we collect your phone number to send transactional updates and, where you consent, promotional messages. SMS opt-in data and consent are never shared with third parties. Reply STOP to unsubscribe at any time.

Sharing Your Results with Partners. We only share your results with a partner where you have given your explicit consent. Connecting a partner in the app does not by itself share your results: it sends you a consent request, and we share your results only after you explicitly agree by tapping "Agree and share" on the consent screen. A referral or coupon code entered at checkout is used for billing attribution only — it links your order to a partner for commercial purposes and is not consent to share your results. When you do consent, we share your results (including health data) with that specific, named partner. Partner categories are: clinics, practitioners and pharmacies (regulated clinical partners), and non-clinical wellness partners (such as gyms, personal trainers, beauty clinics or coaches). Our lawful basis is your explicit consent (UK GDPR Article 9(2)(a)); for regulated clinical partners we may also rely on Article 9(2)(h) (provision of health care). Each partner is an independent controller of the information we share with them: they decide how they use it, are responsible for keeping it secure, and may retain it under their own policies and legal obligations. You can withdraw your consent and disconnect a partner at any time in the app or by contacting us, after which we stop sharing further results with them. We do not share your results with a partner unless you have consented.

Other Disclosures. We may disclose personal information to vendors who perform services on our behalf (IT, payment processing, analytics, customer support, cloud storage, fulfilment and shipping); in connection with a business transaction such as a merger; and to comply with legal obligations or to protect our rights and those of our users. If you post reviews or other content in public areas of the Services, that content is public. We do not sell your personal information.

Cookies. We use cookies to operate and improve the Services, run analytics, and support abandoned-cart reminders. You can control cookies through your browser settings, though blocking them may affect functionality. See our Cookies Policy for detail, and shopify.com/legal/cookies for Shopify's cookies.

International Transfers & Data Residency. Your personal data is processed and stored on encrypted servers in the UK/EEA. Routine transfers outside the UK/EEA occur for two product lines. For TruDiagnostic products (TruAge, TruHealth, TruAge + TruHealth), your sample and resulting epigenetic data are sent to TruDiagnostic's CLIA-certified, CAP-accredited US lab for analysis under appropriate Article 46 safeguards. For GutID microbiome tests (GutID CMA, GutID CGI), your stool sample and the resulting microbiome data are sent to Intus Bio, Inc. in the United States for DNA-sequencing analysis, also under appropriate Article 46 safeguards. Contact us before ordering if you would like more detail or do not wish your data to be transferred.

Retention. We keep your personal data only for as long as we need it. The criteria we use are: how long you hold an account; how long we need the data to provide the Services and support you; and the period for which we are required or advised to keep it to meet legal, tax and clinical record-keeping obligations and to resolve disputes or defend claims. Health and test data is kept in line with clinical record-keeping and clinical-negligence limitation requirements, which means we may need to retain it after you close your account. When data is no longer needed it is securely deleted or anonymised. You can request earlier deletion at any time, and we will action it except where we are required to retain the data.

Withdrawing Your Consent to a Test. You can withdraw your consent to a test at any time by emailing [email protected]. If your sample has not yet been analysed, we will stop processing it and can destroy it on request. If analysis has already been carried out, withdrawal stops any further processing but cannot undo work already completed, and we may need to keep the result and the record of your consent to meet our clinical record-keeping and legal obligations. Withdrawing consent does not affect anything we did before you withdrew it. Full detail is in section 16 of our Terms & Conditions.

Your Rights. You have the right to access, rectify, erase, restrict and object to processing of your personal data, to data portability, and to withdraw consent where we rely on it. These rights are not absolute and some may not apply in every case. To exercise them, contact [email protected] or use the account settings in the app. We will respond within one calendar month, extendable by up to two further months for complex or numerous requests, and we may need to verify your identity first. Where a partner holds your data as an independent controller, you can exercise your rights with them directly. You may also lodge a complaint with the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Children. The Services are not intended for children under 18 and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

Security. We use encryption in transit and at rest, access controls and other safeguards. No method is perfectly secure, so please do not send sensitive information through unsecured channels.

Contact. Email [email protected] (data protection) or [email protected] (general). Lola Health Ltd is registered in England and Wales (Company No. 15961806), registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF, and is registered with the ICO (Ref: ZB752885).