Privacy policy

Last updated: 5 October 2026

This policy explains how Manova Health Limited (“Manova”, “we”, “us”) collects and uses personal information, and what rights you have. It covers patients, website visitors, newsletter subscribers and people who contact us. Because we provide healthcare, much of what we hold about patients is health information, which we treat as confidential.

Contents

1. Who we are
2. The information we collect
3. How we use it and our lawful bases
4. Who we share it with
5. International transfers
6. How long we keep it
7. Automated decisions
8. Your rights
9. Complaints
10. Children, changes and contact

1. Who we are

Manova Health Limited is the controller of your personal information, which means we decide how and why it is used.

• Registered in England and Wales, company number 16450205
• Registered office: Business First, Northlight Parade, Brierfield, Nelson, BB9 5EG
• Registered with the Information Commissioner’s Office (ICO), number ZB911971
• CQC registered, provider ID 1-24107057386
• Email: [email protected], 8am to 8pm, Monday to Sunday

We are an online clinic, not a pharmacy. Our clinicians are GMC-registered doctors and GPhC-registered pharmacist independent prescribers. A separate registered pharmacy dispenses and posts your medicine; this is a GPhC-registered pharmacy in our partner network.

2. The information we collect

If you are a patient: your name, date of birth, sex and contact details; your delivery and billing address; your account and order history; your answers to our medical assessment, including medical history, other medicines, allergies, height, weight and symptoms, and information about sexual function where that is the treatment you are asking about; messages with our clinicians, clinical notes, prescribing decisions and prescriptions; side effects you report; information used to verify your identity and age (checked by an identity verification provider); your GP’s details and your consent choices; and payment, refund and delivery records. Card details go directly to our payment provider; we do not store your full card number, and we do not keep a stored payment method for future orders.

If you visit our website: technical information such as your IP address, browser and device details, the pages you request and the time, recorded in server logs. We use only strictly necessary cookies — see our Cookie policy.

If you subscribe to our newsletter: your email address, the date and time you signed up, your consent record.

If you contact us: your name, contact details and whatever you tell us. Please do not email detailed health information unless we ask for it.

Health information, and information about a person’s sex life, are “special category data”. We only use them where we have both a lawful basis and one of the conditions set out below.

Do you have to give us this information? No, but without accurate answers and identity details our clinicians cannot decide safely whether treatment is right for you, so we could not provide the service.

3. How we use it and our lawful bases

We need a lawful basis under Article 6 of the UK GDPR for everything we do with personal information. For health information we also need a condition under Article 9 and, where required, Schedule 1 of the Data Protection Act 2018.

The condition we mainly rely on for health information is Article 9(2)(h): processing necessary for medical diagnosis, the provision of health care or treatment, or the management of health care services, together with paragraph 2 of Part 1 of Schedule 1 to the Data Protection Act 2018. That information is handled by, or under the responsibility of, health professionals or others who owe you a duty of confidentiality.

As well as data protection law, our clinicians follow the common law duty of confidentiality and their professional standards.

4. Who we share it with

We share only what is needed, and we do not sell your information. The categories of recipient are:

• our clinicians;
• the technology provider that runs our patient platform on our behalf, Healthera Ltd (company number 09609198), acting on our behalf;
• the GPhC-registered pharmacy in our partner network that dispenses and sends your medicine;
• our payment provider, and our delivery courier, who receives your name, address and delivery contact details but is not told what is in the parcel;
• our identity verification provider;
• our email newsletter provider, MailerLite;
• IT suppliers, including our website host and email provider;
• your GP or other healthcare providers, where you consent or where we are required or permitted to share;
• professional advisers and insurers;
• regulators and public bodies, including the CQC, GMC, GPhC, MHRA, ICO and HMRC, and the police or courts where the law requires; and
• a buyer or successor, if we sell or restructure our business.

Where a supplier handles information on our behalf, a written contract requires it to keep the information secure and to use it only on our instructions.

5. International transfers

We aim to keep patient health records in the UK. Some suppliers may store or access information outside the UK. Where that happens, we protect it, for example by transferring only to countries approved under UK data protection law, such as countries in the European Economic Area, or by using the ICO’s International Data Transfer Agreement or the Addendum to the EU standard contractual clauses. Contact us if you would like more detail.

6. How long we keep it

We keep personal information only as long as we need it. In deciding how long, we consider why we hold it, healthcare records guidance and our professional obligations, the legal time limits for claims, and our tax, accounting and regulatory duties.

In practice, clinical records — including assessments that did not lead to treatment — are kept for 10 years after your last contact with us, and longer if there is an open complaint, claim or investigation. Order and payment records are kept for 6 years from the end of the financial year for tax and accounting. Newsletter records are kept until you unsubscribe, after which we keep your email address on a suppression list so we do not contact you again. Other records, such as enquiries from people who are not patients and website server logs, are kept for shorter periods: enquiries for 2 years and server logs for up to 12 months. The dispensing pharmacy keeps its own records for the periods required of a registered pharmacy.

When we no longer need information, we securely delete or anonymise it.

7. Automated decisions

Every prescribing decision is made by a registered clinician. We do not use automated prescribing, and we do not profile you to make decisions that have legal or similarly significant effects. Every assessment is reviewed by a clinician; our assessment does not automatically turn anyone away.

8. Your rights

You have the right to:

• be told how we use your information, which this policy does;
• ask for a copy of the personal information we hold about you, including your clinical records;
• have inaccurate information corrected. Clinical records show what was known at the time, so we may add a note of your view rather than change an entry;
• ask us to delete information, although we usually cannot delete clinical records before the end of the retention period;
• ask us to restrict how we use it, for example while we check whether it is accurate;
• object to uses based on legitimate interests, and to stop direct marketing at any time;
• ask for information you gave us, where we use it by automated means under consent or contract, in a machine-readable format;
• withdraw consent where we rely on it, such as for our newsletter or for sharing with your GP, without affecting what we did beforehand;
• ask for human review of any significant decision made solely by automated means; and
• complain — see section 9.

To use any of these rights, email [email protected]. You do not need to use particular wording. We may need to confirm your identity first, so that we do not give your records to someone else. We respond within one month; if we need information to identify you or to understand your request, that month starts when we have it. Complex or repeated requests can take up to two further months, and we will tell you if that applies. There is normally no fee.

9. Complaints

If you are unhappy with how we have used your personal information, please tell us first, so we can put it right. You have a legal right to complain to us. Email [email protected] with “Data protection complaint” in the subject line. We will acknowledge your complaint within 30 days at the latest, investigate it without undue delay, and tell you the outcome.

You can also complain to the Information Commissioner’s Office, which may expect you to have raised it with us first:

• ico.org.uk/make-a-complaint
• Helpline 0303 123 1113
• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

For complaints about your care, see our Terms and conditions.

10. Children, changes and contact

Our service is for adults aged 18 and over, and we do not knowingly provide services to anyone under 18. If we find that someone under 18 has completed an assessment, we will not provide treatment, and we will handle their information in line with our clinical, safeguarding and record-keeping duties. Any payment they made will be refunded in full.

We may update this policy, for example if we add services or suppliers. The updated version will appear on this page with a new date, and if a change significantly affects you we will tell you before it takes effect.

Contact us at [email protected], or Manova Health Limited, Business First, Northlight Parade, Brierfield, Nelson, BB9 5EG.