Privacy Policy

<h1>Privacy Policy</h1>

<p>Last updated: 16 July 2026</p>

<p>At nume, we are committed to protecting your privacy and handling your personal data securely, lawfully and transparently. This policy explains how we collect, use, share and protect your information when you use our website, www.joinnume.co.uk, and our services.</p>

<h2>1. Who we are</h2>
<p>nume is a trading name of OVIO LTD, a company registered in England and Wales under company number 16090993. Our registered office is 109 Coleman Road, Leicester, LE5 4LE, United Kingdom. Our pharmacy operates from 54 Thurcaston Road, Leicester, LE4 5PF and is registered with the General Pharmaceutical Council (GPhC premises number 9012878).</p>
<p>For the purposes of UK data protection law, OVIO LTD is the data controller responsible for your personal data. We are registered with the Information Commissioner's Office (ICO) under registration number ZB897471.</p>
<p>If you have any questions about this policy or how we handle your data, contact us at hello@joinnume.co.uk with the subject line "Privacy".</p>

<h2>2. What information we collect</h2>
<p><strong>Information you provide to us:</strong></p>
<ul>
  <li>Personal details: name, date of birth, address, email address and telephone number.</li>
  <li>Health information: your consultation answers, medical history, current medications, allergies, weight, height and BMI, prescription and treatment history, and any messages you exchange with our clinical team.</li>
  <li>Verification information: photographic ID (such as a passport or driving licence), a live video of you on your scales to verify your weight, and, for patients transferring from another provider, your previous prescription or proof of supply.</li>
  <li>Your registered GP's details.</li>
  <li>Payment details and order history. (Card payments are processed securely by our payment providers; we do not store your full card details.)</li>
</ul>
<p><strong>Information collected automatically:</strong> your IP address, device and browser type, and information about how you use our website. See our <a href="https://joinnume.co.uk/pages/cookie-policy">Cookie Policy</a> for details.</p>

<h2>3. Our lawful bases for processing</h2>
<p>Under the UK GDPR, we only process your personal data where we have a valid lawful basis:</p>
<ul>
  <li><strong>Contract</strong> — to provide the services you have requested, including your consultation, verification, dispensing and delivery.</li>
  <li><strong>Legal obligation</strong> — to comply with pharmacy, prescribing and medicines regulations, including record-keeping requirements.</li>
  <li><strong>Consent</strong> — for marketing communications, and where you give us explicit consent in relation to specific processing (such as biometric identity verification).</li>
  <li><strong>Legitimate interests</strong> — to operate, secure and improve our services, respond to enquiries, and prevent fraud, where these interests do not override your rights and freedoms.</li>
  <li><strong>Vital interests</strong> — in rare cases, where processing is necessary to protect your life or the life of another person.</li>
</ul>
<p><strong>Special category data.</strong> Your health information and biometric verification data are special category data. We process this data only where an additional condition applies: where processing is necessary for healthcare purposes (the provision of pharmacy and prescribing services by, or under the responsibility of, regulated professionals subject to a duty of confidentiality), or with your explicit consent.</p>

<h2>4. How we use your information</h2>
<p>We use your data to:</p>
<ul>
  <li>Provide our pharmacy and prescribing services, including reviewing your consultation and making prescribing decisions.</li>
  <li>Verify your identity and BMI before treatment is approved, as required of us as a GPhC-registered distance selling pharmacy.</li>
  <li>Process your orders, payments and deliveries.</li>
  <li>Maintain accurate patient records, as we are legally required to do.</li>
  <li>Communicate with you about your treatment, orders and account.</li>
  <li>Notify your registered GP about your treatment (see section 6).</li>
  <li>Send you marketing by email and SMS, where you have opted in (see section 8).</li>
  <li>Meet our legal and regulatory obligations, and detect and prevent fraud and misuse of our services.</li>
</ul>
<p>We will never use your medical information for marketing purposes.</p>

<h2>5. Identity and BMI verification</h2>
<p>As a GPhC-registered pharmacy supplying medicines at a distance, we are required to verify your identity and confirm your BMI before treatment can be approved.</p>
<p>Identity verification is carried out through our third-party identity verification provider and may include a biometric liveness and face-match check against your photographic ID. This involves the processing of biometric data, which we do only with your explicit consent, given when you begin verification. If you do not wish to complete verification, we will not be able to supply treatment, and your order will be cancelled and refunded.</p>
<p>BMI verification is carried out using the live video you upload of yourself on your scales. We use technical and clinical checks to confirm that submitted media is genuine and has not been edited, generated or re-used.</p>

<h2>6. Sharing information with your GP</h2>
<p>Communication with your registered GP is an important part of the safe supply of weight loss medicines. By placing an order for treatment, you acknowledge and consent to us notifying your registered GP that you have been prescribed and supplied a weight loss medicine through our service. This notification typically includes your name, date of birth, the medicine, dose and quantity supplied, the date of supply, the prescriber's details, and relevant clinical information such as your weight and BMI.</p>
<p>We will also notify your GP at clinically appropriate points during your treatment, including when your dose changes, when treatment stops, or when a clinically significant issue arises.</p>
<p>If you do not consent to your GP being notified, our prescriber will assess whether it remains clinically safe and appropriate to treat you; if it is not, treatment will be declined and you will be refunded. We will not withhold a notification where we consider it necessary to protect your safety or to comply with our professional duties.</p>
<p>If you do not have a registered GP, you must tell us during your consultation, and our prescriber will decide whether it is safe to proceed.</p>

<h2>7. Who else we share your information with</h2>
<p>We only share your personal data where necessary, and only with:</p>
<ul>
  <li>Our pharmacists, prescribers and clinical team, who are bound by professional duties of confidentiality.</li>
  <li>Trusted service providers who help us operate our service, including our identity verification provider, our courier, our payment processors, and the providers of our website, patient record and communication systems. These providers act on our instructions and are bound by data processing agreements.</li>
  <li>Your registered GP and other healthcare professionals, where necessary for your care (see section 6).</li>
  <li>Regulators and governing bodies, including the GPhC and MHRA, where required.</li>
  <li>Law enforcement or other authorities, where legally required or to prevent crime, fraud or serious harm.</li>
</ul>
<p>We never sell your personal data.</p>

<h2>8. Marketing</h2>
<p>Where you opt in at checkout or in your account, we will send you marketing by email and SMS about our services and offers. You can withdraw your consent at any time using the unsubscribe link in any email, by replying STOP to any SMS, or by contacting us at hello@joinnume.co.uk. Withdrawing consent does not affect messages we need to send you about your treatment, orders or account, which we will always send.</p>

<h2>9. Patient confidentiality</h2>
<p>Your medical information is treated in strict confidence and is accessed only by the clinical team responsible for your care. We will not disclose your medical information unless required by law, directed by a regulator, necessary for your care, or necessary to prevent serious harm or crime.</p>

<h2>10. Where your data is stored and international transfers</h2>
<p>Your data is stored and protected in accordance with UK GDPR. Where any of our service providers process data outside the UK, we ensure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement. <strong>[CONFIRM: verify with each live provider whether any processing occurs outside the UK, and adjust this section and the "Your data" card on the About page accordingly.]</strong></p>

<h2>11. Data security and retention</h2>
<p>We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including encryption and access controls limiting clinical records to the team caring for you.</p>
<p>We keep your personal data only for as long as necessary to provide our services and to meet our legal, clinical, accounting and regulatory obligations. Pharmacy and prescription records are retained in line with pharmacy record-keeping requirements. Verification media (ID documents and BMI verification video) is retained only for as long as needed to complete and evidence verification, after which it is securely deleted. <strong>[CONFIRM: superintendent to set and insert specific retention periods, e.g. clinical records X years; verification media X months; account and order data X years.]</strong></p>

<h2>12. Your rights</h2>
<p>Under the UK GDPR and the Data Protection Act 2018, you have the right to:</p>
<ul>
  <li>Access the personal data we hold about you.</li>
  <li>Have inaccurate or incomplete data corrected.</li>
  <li>Request deletion of your data, where legally permitted. (Note that we are legally required to retain pharmacy and prescription records for defined periods, and cannot delete these on request during that time.)</li>
  <li>Restrict or object to certain processing.</li>
  <li>Receive a copy of data you have provided to us in a portable format.</li>
  <li>Withdraw consent at any time, where processing is based on consent.</li>
</ul>
<p>To exercise any of these rights, contact us at hello@joinnume.co.uk with the subject line "Privacy". We will respond within one calendar month.</p>
<p>If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office at ico.org.uk, although we would welcome the chance to resolve your concerns first.</p>

<h2>13. Cookies</h2>
<p>We use cookies and similar technologies on our website. For details of what we use and how to manage them, see our <a href="https://joinnume.co.uk/pages/cookie-policy">Cookie Policy</a>.</p>

<h2>14. Changes to this policy</h2>
<p>We may update this policy from time to time. The latest version will always be available on this page, and material changes will be highlighted on our website or communicated to you directly.</p>

<h2>15. Governing law</h2>
<p>This policy is governed by the laws of England and Wales.</p>

<p>Questions? Contact us at hello@joinnume.co.uk, subject line "Privacy".</p>