NuMi Health Limited — App Privacy Policy

1. Who we are

NuMi Health Limited is the data controller for the personal data described in this policy — we determine the purposes for which, and the manner in which, your data is processed.

2. What data we collect

Identity and contact information: name, date of birth, sex, email, phone number, postal address.

Health and clinical data, including but not limited to:

• Body composition and bone density results (DEXA scans): body fat percentage, lean mass, visceral fat measures, bone density T/Z-scores, regional composition
• Cardiorespiratory fitness data: VO₂ max, resting metabolic rate, heart rate zones and recovery
• Blood results, blood pressure, grip strength, and spirometry where recorded by your coach
• Your pre-visit health questionnaire responses: medical history, current conditions and medications, family history, lifestyle, exercise, diet, sleep, and — specifically for bone density scans — pregnancy status and metal implant information, which we're required by UK radiation safety law (IRMER) to record before that scan can proceed

Booking data: appointment details and services booked, received from our scheduling provider when you book a session.

Account and usage data: login sessions, security records (including multi-factor authentication enrolment), and an audit log of significant actions taken on your record — kept for accountability and regulatory compliance, not for marketing or profiling.

3. Why we process this data, and our legal basis

We process your health data because it's necessary to provide the coaching, health assessment, and advisory services you've asked us for, and because we're a CQC-regulated health and care provider. Special category data (your health information) is processed under the health and social care basis in UK GDPR Article 9(2)(h), alongside our contractual and legitimate-interest bases for account and booking information.

Where a bone density scan is involved, IRMER additionally requires us to record a specific clinical justification before that exposure can take place, and to keep that justification record permanently and unaltered.

4. Who we share your data with

• Supabase — hosts our database and handles secure sign-in. Your health data is stored here.
• Lovable — the platform the app is built and hosted on. When your coach requests an AI-generated plain-language summary of your results, a limited set of your health data is sent to Lovable's AI gateway to generate that summary.
• Acuity Scheduling — processes your name, email, and appointment details when you book a session.

We do not sell your data, and we do not share it with anyone for marketing purposes.

5. How long we keep your data

Because we hold clinical records, we cannot simply delete your data on request the way our marketing website's data can. If you close your account, we remove or anonymise your identifying details (name, contact information) but retain the underlying clinical records, as required by CQC Regulation 17, NHS records management guidance, and applicable data protection law.

DEXA justification records are permanent and cannot be altered or deleted once signed, as required by IRMER.

6. Your rights

Subject to the clinical-retention limits above, you have the right to:

• Access a copy of your data (available directly from your account Settings page)
• Ask us to correct inaccurate data
• Object to or restrict certain processing
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk

7. How we keep your data secure

Multi-factor authentication, role-based access controls, encrypted storage and transmission, and a permanent audit trail of significant actions taken on your record.

8. Under-18s

NuMi's services are intended for adults only. We do not knowingly provide services to, or collect data from, anyone under the age of 18. If we become aware that we have inadvertently collected data relating to someone under 18, we will take steps to close the account and handle the data appropriately, including notifying a parent or guardian where reasonably possible.

9. Cookies

The app uses only the essential cookies required to keep you signed in securely.

10. Contact us

For questions about this policy or your data:

• Email: info@numi.org.uk
• Phone: 01603 959997
• Post: NuMi Health Limited, Dragon House, 22 Unthank Road, Norwich, NR2 2RA

You may also complain to the ICO at ico.org.uk if you're unhappy with how we've handled your data.

11. Changes to this policy

We may update this policy from time to time. Any changes will be posted in the app, and continued use after an update means you accept the revised terms.