Privacy Policy
How Everwell collects, uses, discloses and protects your personal information — including health data — when you use our Site and Services.
Introduction
At Everwell, we take your privacy seriously and are committed to ensuring that your personal information is protected. This privacy policy (the “Privacy Policy”) describes how Saxonvale UK Limited trading as Everwell (“Everwell”, “we”, “us” or “our”) collects, uses and discloses your personal information when you visit or use our platform at www.joineverwell.com (the “Site”) or use our services or otherwise communicate with us regarding the Site (collectively for the purposes of this Privacy Policy, the “Services”).
We provide the Services in compliance with applicable data protection laws, including the UK General Data Protection Regulation (“UK GDPR”), the Privacy and Electronic Communications Regulations 2003 (“PECR”) and the Data Protection Act 2018 (“DPA 2018”) (together “Applicable Law”).
For the purposes of this Privacy Policy, “you” and “your” means you as the user of the Services, whether you are a customer, patient, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy.
Please read this Privacy Policy carefully.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Site, update the “Last updated” date and take any other steps required by Applicable Law.
How We Collect and Use Your Personal Information
To provide the Services, we collect personal information about you from a variety of sources, as set out below. The information that we collect and use varies depending on how you interact with us.
In addition to the specific uses set out below, we may use information we collect about you to communicate with you, provide or improve the Services, comply with any applicable legal obligations, enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.
The types of personal information we obtain about you depends on how you interact with our Site and use our Services. When we use the term “personal information”, we are referring to information that identifies, relates to, describes or can be associated with you.
Information that you directly submit to us through our Services may include:
Identification information including name, surname, age, ethnicity, date of birth, gender, contact details (e.g., address, phone number, email), biometric information and other identification data collected via our ID verification partner, ID-Pal.
Health information including medical history, diagnosis, treatment, prescription records, test results, GP information, responses to the medical questionnaire, clinical notes and any other health-related information to allow the Healthcare Provider (AccessGP)’s clinicians to provide medical care to you.
Order information including your name, billing address, shipping address, payment confirmation, email address, and phone number.
Consent information including consent forms for treatments, data sharing and other medical purposes.
Account information including your username, password, security questions and other information used for account security purposes.
Patient support information including the information you choose to include in communications with us, for example, when sending a message to us.
The nature of the Services we provide requires you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing the Services.
We may also automatically collect certain information about your interaction with the Services (“Usage Data”). To do this, we may use cookies, pixels and similar technologies (“Cookies”). Usage Data may include information about how you access and use our Site and your account, including device information, browser information, information about your network connection, your IP address and other information regarding your interaction with the Services.
We may obtain information about you from third parties, including from vendors and service providers who may collect information on our behalf, such as:
Companies who support our Site and Services.
Our payment processors, who collect payment information (e.g., bank account, credit or debit card information, billing address) to process your payment in order to fulfil your orders and provide you with the services you have requested.
Our Healthcare Provider, AccessGP Limited, registered in England and Wales under company registration number 16259698, regulated by the Care Quality Commission (CQC) under provider ID 1-22271946259 and registered with the Information Commissioner’s Office under registration number ZB880995 (accessgp.co.uk), who provide all clinical services including consultations, assessments and prescribing via the platform and who act as an independent data controller in respect of their own clinical processing.
PHARMKG Ltd trading as Pharmacy + Me (our Pharmacy), who dispense and deliver medication to you and who act as an independent data controller in respect of their own pharmacy processing.
Your registered GP, to whom the Healthcare Provider (AccessGP) will share details of your treatment and prescription with your consent.
ID-Pal, our identity verification partner, who carries out biometric identity checks during onboarding.
Any information we obtain from third parties will be treated in accordance with this Privacy Policy.
How We Use Your Personal Information
Providing Services. We use your personal information to provide you with the Services in order to perform our contract with you, including to process your payments, to send notifications to you related to your account, purchases or other transactions, to create, maintain and otherwise manage your account, to facilitate your access to the Healthcare Provider (AccessGP) and the Pharmacy, and to provide 1:1 coaching and lifestyle support. All clinical services (including diagnosis, prescribing and follow-up) are provided by the Healthcare Provider (AccessGP), not by Everwell. The legal basis for these processing activities is performance of our contract with you.
Health Data. We process health and medical data (special category personal data) on the basis of your explicit consent, given when you complete the medical questionnaire and agree to these Terms. You may withdraw this consent at any time, but doing so may mean we are unable to continue providing the Services to you.
NHS Summary Care Record. When you engage our Services and agree to the Terms of Service, you provide your consent for the Access GP’s clinicians to access your NHS Summary Care Record (“SCR”) using NHS smartcards. You may withdraw your consent to SCR access at any time, though this may affect the Healthcare Provider (AccessGP)’s ability to provide clinical services to you.
Promotions. We may use your personal information for promotional purposes, such as to send marketing, advertising and promotional communications by email, text message or postal mail. The legal basis for these data processing activities is our legitimate interest in providing our Services, or your consent where required by Applicable Law.
ID Verification and Medical Fraud. We use your personal information to carry out checks to determine your identity and to ensure that you are of a sufficient age to receive treatment. The legal basis for these data processing activities is our legitimate interest in providing our Services and preventing identity fraud or medical fraud.
Security and Fraud Prevention. We use your personal information to detect, investigate or take action regarding possible fraudulent, illegal or malicious activity. If you believe your account has been compromised, please contact us immediately at hello@joineverwell.com. The legal basis for these activities is our legitimate interest in keeping our platform secure.
Communicating with You and Service Improvement. We use your personal information to provide you with customer support and improve our Services, in our legitimate interests to be responsive to you and to maintain our business relationship with you.
Cookies
Like many websites, we use Cookies on our Site. We use Cookies to power and improve our Site and Services (including to remember your actions and preferences), to run analytics and better understand user interaction with the Services. We may also permit third parties and service providers to use Cookies on our Site.
Most browsers automatically accept Cookies by default, but you can choose to set your browser to remove or reject Cookies through your browser controls. Please keep in mind that removing or blocking Cookies can negatively impact your user experience and may cause some of the Services to work incorrectly or no longer be available.
For full details of the Cookies we use and how to manage your preferences, please see our Cookie Policy, available on the Site. In accordance with PECR, we will obtain your consent before placing any non-essential cookies on your device.
How We Disclose Personal Information
In certain circumstances, we may disclose your personal information to third parties for contract fulfilment purposes, legitimate purposes and other reasons subject to this Privacy Policy. Such circumstances may include:
With vendors or other third parties who perform services on our behalf (e.g., IT management, payment processing, data analytics, customer support, cloud storage, fulfilment and shipping).
With our Healthcare Provider (AccessGP), who will receive your medical questionnaire responses, health data and account information for the purposes of clinical assessment, prescribing and on-going clinical care. Our Healthcare Provider (AccessGP) is an independent data controller in respect of its own clinical processing.
With PHARMKG Ltd trading as Pharmacy + Me (our Pharmacy), who will receive your prescription details, name and delivery address for the purposes of dispensing and delivering your medication.
With your registered GP, to whom the Healthcare Provider (AccessGP) will notify details of your treatment and prescription, subject to your consent.
With our affiliates or otherwise within our corporate group, in our legitimate interests to run a successful business.
In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations, to enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.
With the Care Quality Commission (CQC), General Pharmaceutical Council (GPhC), Information Commissioner’s Office (ICO) or other regulatory bodies, where required by law.
Third Party Websites and Links
Our Site may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.
Children's Data
The Services are not intended to be used by children under the age of 18, and we do not knowingly collect any personal information about children. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.
Security and Retention of Your Information
Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee “perfect security.” We recommend that you do not use insecure channels to communicate sensitive or confidential information to us.
How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide the Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies. In particular:
Medical records: retained for a minimum of 8 years following your last treatment, in accordance with NHS and professional guidance applicable to the Healthcare Provider (AccessGP).
Account data: retained for the duration of your subscription and for 2 years following the end of your subscription, unless a longer retention period is required by law.
Payment data: retained for 7 years for accounting and tax purposes.
Technical/usage data: retained for up to 2 years.
Your Rights
You may have some or all of the rights listed below in relation to your personal information under UK GDPR and the Data Protection Act 2018. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.
Right to Access / Know: You may request access to personal information that we hold about you, including details relating to the ways in which we use and share your information.
Right to Delete: You may request that we delete personal information we maintain about you, subject to our legal retention obligations (including medical record retention requirements).
Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
Right of Portability: You may request to receive a copy of your personal information in a structured, machine-readable format.
Restriction of Processing: You may ask us to stop or restrict our processing of personal information in certain circumstances.
Withdrawal of Consent: Where we rely on consent to process your personal information, you may withdraw this consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right to Object: You may object to processing based on our legitimate interests.
To exercise any of these rights, please contact us at privacy@joineverwell.com. We will respond within one month of receiving your request. If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.
Complaints
If you have complaints about how we process your personal information, please contact us using the contact details provided below. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (“ICO”) if you believe your data protection rights have been violated. You can contact the ICO via their website at www.ico.org.uk or by calling 0303 123 1113.
International Transfers of Data
In most cases, your data is stored and processed in the United Kingdom. If it is necessary to transfer data outside of the UK to provide our Services to you, we will ensure that your data is protected by implementing appropriate safeguards in accordance with UK GDPR, such as the use of the International Data Transfer Agreement (IDTA) or other approved transfer mechanisms.
Contact
For the purpose of applicable data protection laws and if not explicitly stated otherwise, the data controller of your personal information is Saxonvale UK Limited trading as Everwell, a company registered in England and Wales with company registration number 17097136 and registered office at 61 Bridge Street, Kington, United Kingdom, HR5 3DJ.
Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please email us at privacy@joineverwell.com or contact us at our registered office.
ICO Registration Number: ZC176883.
The UK's complete weight-management programme.
Doctor-led care with our own coaching and app.
© Saxonvale UK Limited. All rights reserved. Everwell is a trading name of Saxonvale UK Limited. Registered office at 61 Bridge Street, Kington, United Kingdom, HR5 3DJ. Registered in England and Wales, company number 17097136. Healthcare services are provided by AccessGP Limited (CQC Registration Number: 1-22271946259).
Medicines are dispensed & delivered by PHARMKG LTD trading as Pharmacy + Me (GPhC Registration Number: 9013270) with Superintendent Pharmacist Konstantin Gkioka (GPhC Registration Number: 2224520).
