Privacy Policy

Solene Health Limited is the “data controller” responsible for your personal information. We are registered in England and Wales (company number 17384685), with our registered office at C/O Ablm Associates Ltd, Regus Stuart House, St Johns Street, Peterborough, Cambridgeshire, PE1 5DD. We are registered with the Information Commissioner’s Office (ICO) under reference ZC216866.

If you have any questions about this policy or how we handle your data, contact us at privacy@solenehealth.co.uk. If your question is about your clinical record, tell us and we will pass it to the clinic and tell you who is dealing with it.

We collect only what we need for what you are actually using. If you only take the free assessment, only the first group below applies to you.

When you take the free assessment

• Identity and contact details, your name, email address and age.
• Health information, your answers about menopausal symptoms, the Menopause Rating Scale (MRS) responses, any hot flush events you log, and any medical history you choose to disclose during the conversation. This is “special category data” under UK GDPR and receives extra protection.

If you book a consultation or join a membership

• Booking details, your date of birth and phone number, and the appointment you chose. Your date of birth is how your prescriber confirms she is speaking to the right person.
• Payment records, what you paid, when, and whether it succeeded. Your card details are handled by our payment provider and never reach us: we hold only their reference to you.
• Your account, your email address and your password, which is stored only as an irreversible hash and cannot be read by us or by anyone else.
• Your weekly check-ins, the symptom scores and notes you enter between appointments, and the messages you send your prescriber through the platform.

Your clinical record

What your prescriber writes after seeing you, her assessment, the scores she takes, the treatment she prescribes and her plan for your care, is the clinic’s record and not ours, as explained in section 1. It is stored on our systems for them.

Technical information

• We store your in-progress report in your browser’s session storage, on your own device, and it is cleared when you close the tab.
• We keep a log of who inside Solene or your clinic opened your record and when, so access to health information can be audited.
• Analytics and advertising cookies load only if you accept them in our cookie banner, and you can decline. See section 12 for exactly which ones and what they do.

Under UK GDPR we must have a lawful basis for processing your data. We rely on:

• Your consent (Article 6(1)(a)), to run the free assessment and generate your report.
• Your explicit consent (Article 9(2)(a)), to process the health information you give in the assessment, which you give via the consent checkbox before your report is generated.
• Performing our contract with you (Article 6(1)(b)), to take your booking, run your membership, take payment and give you your account.
• Complying with a legal obligation (Article 6(1)(c)), to keep payment and booking records for as long as HMRC requires.
• Our legitimate interests (Article 6(1)(f)), to keep the service secure and working correctly, and to keep an audit trail of who opened a record. We do not use your health information for this purpose without your consent.

Your clinical record is different. The clinic providing your care decides its lawful basis, which for the provision of healthcare is normally Article 9(2)(h), processing by or under the responsibility of a health professional. We process it only as their processor, on their written instructions, and never on a basis of our own.

You can withdraw your consent at any time (see “Your rights” below). This will not affect any processing carried out before you withdrew it. Withdrawing consent does not delete records we are required by law to keep, or a clinical record that is not ours to delete.

• To run the assessment conversation and generate your personalised report.
• To email a copy of your report to you, if you ask us to.
• To take your booking, confirm your appointment and remind you of it.
• To take payment and manage your membership.
• To give you an account where you can see your appointments, your check-ins and your plan, and message your prescriber.
• To make your information available to your prescriber so she can provide your care, and to hold the record she writes on the clinic's behalf.
• To respond to your questions and any requests to exercise your data rights.
• To keep the service secure, reliable and free from misuse, including auditing who has opened a record.

Your report is generated with the help of a third-party large language model (AI) provider. The answers you give during the conversation are sent to this provider solely to produce your report. We do not allow your information to be used to train their models. AI-generated content can contain errors, see our Terms of Use for the limits of the service.

We do not sell your personal information. We share it with trusted service providers (“processors”) who act on our instructions, including:

• Cloud hosting and infrastructure providers.
• The AI provider that generates your report.
• An email delivery provider, for your report and for messages about your appointments and your account.
• Our payment provider, which takes your card payment and holds your card details so that we do not.

All processors are bound by contract to protect your data and use it only for the purposes we specify. We may also disclose information where required by law.

Two organisations are not our processors, because they decide things for themselves and are accountable for their own records:

• The clinic providing your care, and your prescriber. If you book, they receive what they need to see you safely. If you were referred from the free assessment, your report is passed only on your separate explicit consent at the point of referral.
• Any pharmacy or laboratory used in your care. Where your prescriber sends a prescription to be dispensed or arranges a blood test, that pharmacy or laboratory is responsible for what it does with your information, and its own privacy notice applies.

Optional analytics and advertising providers receive information only if you accept those cookies. See section 12.

Some of our providers may process data outside the UK. Where they do, we make sure your information is protected by an approved safeguard, such as the UK’s adequacy regulations, or the ICO’s International Data Transfer Agreement (or the Addendum to the EU Standard Contractual Clauses).

Your in-progress report is held only in your browser and is cleared when you close the tab. Where we store data on our systems, these are the periods we keep it for:

• Your symptom answers and personalised report: 24 months from the last time you used the service.
• Waitlist sign-ups: until you unsubscribe, or 24 months if the service has not opened by then.
• Research study responses: 24 months from the close of the study.
• Payment and booking records: six years from the end of the financial year, because HMRC requires it.
• Your account, your weekly check-ins and your messages: for as long as you are a member, and 24 months after you leave.
• The audit log of who opened your record: six years, because it is only useful if it outlives the question it answers.
• Clinical records created by your clinician are the clinic’s records, not ours. The clinic decides what goes in them and how long they are kept, and we hold them only on the clinic’s instructions and never use them for our own purposes. For adult records that is commonly eight years after the last entry, and the clinic will confirm its own retention period on request.

After those periods the information is securely deleted. You can ask us to delete your data sooner at any time, and we will unless we are required by law to keep it.

We use appropriate technical and organisational measures to keep your data safe, including encryption in transit (HTTPS), access controls, and limiting who can access health information. No system can be guaranteed completely secure, but we work to protect your data and to notify you and the ICO of any serious breach as required by law.

Under UK GDPR you have the right to:

• Be informed about how we use your data (this policy).
• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased (the “right to be forgotten”).
• Restrict or object to our processing.
• Data portability, receive your data in a usable format.
• Withdraw your consent at any time.

To exercise any of these rights, email us at privacy@solenehealth.co.uk. We will respond within one month. There is usually no charge.

These rights work slightly differently for your clinical record, because it is the clinic’s and not ours. You still have every one of them, but the clinic answers them. Ask us and we will pass the request on the same day and tell you who is handling it. A clinical record also cannot simply be erased on request while the clinic is required to keep it.

This service is intended for adults aged 18 and over. It is not directed at, and we do not knowingly collect data from, anyone under 18.

We use your browser’s session storage to hold your report on your device while you complete the assessment; this is cleared when you close the tab. This is essential and always on.

We also use optional cookies that load only if you accept them in our cookie banner, you can decline, and declining is as easy as accepting. These are: Microsoft Clarity (usage analytics and heatmaps, which may record an anonymised replay of your visit with form inputs and personal content masked) and the Meta Pixel (to measure how our ads perform). We use them to understand how the site is used and improve it. You can change your mind by clearing the cookie in your browser.

We may update this policy from time to time. The “last updated” date at the top shows when it was last revised. Significant changes will be highlighted on this page.

Solene Health Limited, C/O Ablm Associates Ltd, Regus Stuart House, St Johns Street, Peterborough, Cambridgeshire, PE1 5DD. Email: privacy@solenehealth.co.uk.