Reset Health Group Privacy Notice

1. Why do we have this notice?

1.1 This privacy notice explains how the Reset Health group of companies (the “Reset Health Group”, “we”, “us” or “our”) collects and uses personal data about you when you visit our websites, use the Roczen mobile apps and platform, contact us, sign up to receive updates from us, or use or subscribe to any of our products or services (including any pre-treatment or pre-enrolment screening). It applies to patients, programme participants, prospective patients, and website and app users and browsers. We are committed to complying with data protection law and protecting the privacy and security of your personal data, and you should read this notice carefully.

1.2 This notice does not form part of any contract with you and may be updated by us at any time. Please read it together with any other privacy information we give you on specific occasions when we collect or process your personal data.

1.3 Our services are not intended for anyone under the age of 18 and we do not knowingly collect data about children. If you become aware that we may have been given data about a child, please contact us as soon as possible.

2. Who we are and who is responsible for your Personal Data

2.1 The Reset Health Group is made up of the following companies:

2.1.1 Reset Health Limited (“Reset UK”), a company registered in England and Wales (company number 12111885) with its registered office at One Fleet Place, London EC4M 7WS and its principal place of business at 7-8 Stratford Place, London W1C 1AY. Reset UK is the parent company of the Reset Health Group and is the data controller for shared group HR, IT and operational data (see Table A);

2.1.2 Roczen Ltd (“Roczen”), a company registered in England and Wales (company number 13251035) with its registered office at One Fleet Place, London EC4M 7WS, and a wholly owned subsidiary of Reset UK. Roczen is the data controller when it operates the Roczen platform in the United Kingdom and provides services to its patients in the UK (see Table B); and

2.1.3 Reset Health Malaysia Sdn. Bhd. (“Reset Malaysia”), a company registered in Malaysia (company number 1428376-K) with its registered office at Suite 8.8, 8th Floor, Heritage House, 33 Jalan Yap Ah Shak, 50300 Kuala Lumpur, Malaysia, and a wholly owned subsidiary of Reset UK. Reset Malaysia is the data controller when it operates the Roczen platform in Malaysia and provides services to its patients in Malaysia (see Table C).

2.2 Reset UK provides technology as well as technical, clinical administration, operational and corporate support services to Roczen and Reset Malaysia and is the data controller for any shared activity. Please note that Reset UK does not exercise any clinical judgement in relation to patients of Roczen or Reset Malaysia.

2.3 In practice, if you are a patient or user of our services in the United Kingdom, Roczen is responsible for your personal data. If you are a patient or user of our services in Malaysia, Reset Malaysia is responsible for your personal data. In each case, Reset UK is responsible for the shared group data described in Table A.

3. What information might we hold about you?

3.1 Personal data or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymised data). Depending on how you interact with us, we may collect, use, store and transfer some or all of the following categories of personal data about you:

Identity and Contact Data including name, date of birth, gender, title, marital status and dependants, identity card number, driving licence, addresses, telephone numbers, personal email addresses, next of kin and emergency contact information.
Financial Data including bank account information, payment card details and payment and transaction records.
Health Data including body measurements (e.g. weight, height, waist circumference), BMI, blood pressure, blood sugar levels and test results, disabilities, medical history and current illnesses or conditions (e.g. type 2 diabetes), current medications and dosages, medical information held by your GP or in your NHS record, dietary and nutritional information, psychological wellbeing and mental health assessments, physical wellbeing (e.g. lifestyle, exercise habits and quality of life), racial or ethnic origin, socio-economic information, and other health information you provide to us, including in group settings.
GP Data including the name and contact details of your GP or other treating healthcare professional.
Profile Data including username and password, order details, interests, preferences, feedback and survey responses.
Marketing and Communications Data including your correspondence with us (e.g. emails, in-app messages and WhatsApp messages), and your preferences for receiving marketing and other communications from us.
Consultation Recording Data including video and audio recordings (and any transcripts or notes generated from them) of screenings, clinical consultations and appointments held with our healthcare professionals by video or telephone call.
AI Interaction Data including information you share with, and responses generated by, our CompanionAI feature.
Technical Data including IP address, login data, browser type and version, time zone setting and location, operating system and platform, and other technology on the devices you use to access our websites and apps.
Usage Data including information about how you use our websites, apps, products and services, such as your interactions and feature usage, in-app guidance usage (such as tooltips and walkthroughs), in-app feedback via surveys and polls, and analytics on how new features are working.

3.2 Health Data is considered special category data under the UK General Data Protection Regulation (“UK GDPR”). This information requires a higher level of protection and we only process it where data protection law allows us to, as explained in section 5.

3.3 We also collect, use and share anonymised and/or aggregated data, including to train our proprietary AI models. Anonymised and aggregated data may be derived from your personal data (e.g. your Consultation Recording Data or Usage Data), but it does not qualify as personal data under law because it does not directly or indirectly reveal your identity. We ensure all anonymised data is anonymised in line with the guidelines set by the Information Commission. For example, we may aggregate Health Data of our patients to better understand type 2 diabetes, metabolic syndrome and obesity and how to treat these conditions. This aggregated data may then be used in medical publications and research. If we combine aggregated data with your personal data so that it can identify you, we will treat such combined data as personal data in accordance with this notice. Please note we will only use de-identified and anonymised information to train our AI models, and we will not attempt to re-identify such information.

3.4 Where we need to collect personal data by law or under the terms of a contract we have with you, and you do not provide it when requested, we may not be able to provide our services to you. We will tell you if this is the case at the time.

4. How is this information collected?

4.1 We collect personal information:

4.1.1 Directly from you: when you apply for or purchase our services, download and use the Roczen apps, create an account, complete forms or questionnaires, attend a screening, consultation or appointment (in person, by telephone or by video call), use our CompanionAI feature, subscribe to our updates, give us feedback or otherwise correspond with us.

4.1.2 From third parties: from your GP or other healthcare professional who refers you to us or shares information with us; in the UK, from the NHS National Care Records Service; from corporate partners who refer you to us at your request; and from our laboratory and pharmacy partners in connection with your tests and medication.

4.1.3 Automatically: as you interact with our websites and apps, we collect Technical Data and Usage Data using cookies and similar technologies (see section 11).

4.2 Where you are referred to Roczen by a private organisation (such as your employer, pharmacy, or insurer) or an NHS organisation (such as your GP or an NHS trust), the referring organisation is the controller of your personal data in respect of the referral and is responsible for ensuring it has a lawful basis for sharing your personal data with Roczen, including obtaining any consents required for the referral. Roczen has been engaged by the referring organisation to act as its data processor and will process your personal data in accordance with the referring organisation’s documented instructions. Where you sign up to Roczen’s Terms and receive services from Roczen, Roczen is the controller of your personal data for the provision of those services and processes it as described in this Notice (please refer to Table B).

5. How do we use this information?

5.1 The tables below set out, for each company in the Reset Health Group, the purposes for which it uses your personal data, the categories of personal data involved and the legal basis relied on. Table A covers Reset UK, Table B covers Roczen (United Kingdom) and Table C covers Reset Malaysia.

Table A: Reset UK

Purpose

Personal Data

Legal Basis

Operating, securing and maintaining group IT systems and infrastructure (such as the Reset Health and Roczen platforms and apps), including access control, logging and monitoring, and preventing unauthorised access and malicious software.

Identity and Contact Data
Technical Data
Usage Data

Legitimate interests (to protect our systems, data, patients and users).

Sharing data within the Reset Health Group to provide centralised group services as well as support to the other Reset companies, and for the other purposes described in this Table A.

All categories of data held by the Reset Health Group companies (including Health Data)

Legitimate interests (to operate the Reset Health Group efficiently as a single business and to support the services provided by each group company).

Article 9(2)(h) UK GDPR: Management of health care systems and services.

Maintaining backup, disaster recovery and business continuity processes for group systems.

All categories of data held on group systems

Legitimate interests (to keep our services available and resilient).

Article 9(2)(h) UK GDPR: Management of health care systems and services.

Managing shared group finance, accounting and administration, including group billing administration and support with recovering debts.

Identity and Contact Data
Financial Data

Legitimate interests (to run the Reset Health Group efficiently);

Legal obligation (to comply with tax and accounting laws).

Managing shared people operations, including group staff.

Identity Data
Communication Data

Legitimate interests (to manage our workforce and respond to enquiries.

Conducting analysis, benchmarking and strategic decision-making for the Reset Health Group.

Technical Data
Usage Data
Profile Data

Legitimate interests (to develop and improve our group services).

Operating the Reset Health website and sending group updates and newsletters.

Identity and Contact Data
Technical Data
Usage Data
Marketing and Communications Data

Consent (for non-essential cookies and electronic marketing where required).

Legitimate interests (to maintain our website).

Facilitating a group reorganisation, restructuring, merger, acquisition or sale of any part of our business.

All categories of data held on group systems (excluding Health Data)

Legitimate interests (to run and develop our business).

Complying with legal and regulatory requirements and establishing, exercising or defending legal claims.

All categories of data held on group systems

Legal obligation (to comply with applicable laws).

Legitimate interests (to defend ourselves against legal claims).

Article 9(2)(h) UK GDPR: Management of health care systems and services.

Table B: Roczen

Purpose

Personal Data

Legal Basis

Assessing your eligibility for our programmes, including your screening questionnaire and free health report, and onboarding you.

Identity and Contact Data
Health Data
Profile Data

Contract (to take steps at your request before entering into a contract, and to perform it).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Providing clinical consultations, diagnosis and treatment, prescribing and ongoing monitoring through the Roczen apps and clinician platform; facilitating peer groups and keeping clinical records.

Identity and Contact Data
Health Data

Contract (to perform our contract with you).

Legal obligation (to keep clinical records).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Recording and transcribing video and audio of clinical consultations to maintain an accurate clinical record and for clinical quality assurance, training, audit and patient safety purposes.

Identity and Contact Data
Health Data
Consultation Recording Data

Legitimate interests (to keep accurate records and assure the quality and safety of our care).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Providing our CompanionAI feature to give you information, guidance and support between consultations.

Identity and Contact Data
Health Data
AI Interaction Data
Usage Data

Contract (to provide our services).

Article 9(2)(h): Provision of healthcare.

Communicating with your GP and accessing your NHS summary care record via the NHS National Care Records Service.

Identity and Contact Data
Health Data
GP Data

Consent (we will only share information with or obtain information from your GP with your agreement).

Contract (to provide our services).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Sharing information with other healthcare providers involved in your care, where necessary to provide our services to you, unless you have told us not to.

Identity and Contact Data
Health Data

Contract (to provide our services).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Arranging laboratory tests and the dispensing and delivery of medication through our laboratory, pharmacy and delivery partners.

Identity and Contact Data
Health Data

Contract (to perform our contract with you).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Taking payments, managing fees and charges and recovering money owed to us.

Identity and Contact Data
Financial Data

Contract (to perform our contract with you).

Legitimate interests (to recover debts due to us).

Managing our relationship with you, including customer support, handling complaints, telling you about changes to our terms or this notice, and asking you to leave a review or complete a survey.

Identity and Contact Data
Profile Data
Health Data
Marketing and Communications Data
Usage Data

Contract (to perform our contract with you).

Legitimate interests (to keep our records up to date and study how patients use our services).

Article 9(2)(h) UK GDPR: Management of health care systems and services.

Monitoring and improving the performance and features of the Roczen platform, including analysing how users interact with it.

Technical Data
Usage Data

Legitimate interests (to improve our platform and the quality of care and user experience).

Sending you marketing about our products and service and displaying online advertising.

Identity and Contact Data
Technical Data
Usage Data
Profile Data
Marketing and Communications Data

Consent (where required, including for non-essential cookies).

Legitimate interests (to grow our business).

Complying with our regulatory and legal obligations (including to the Care Quality Commission) and establishing, exercising or defending legal claims.

All categories of data

Legal obligation (to comply with regulatory and legal requirements).

Legitimate interests (to defend legal claims).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Creating anonymised and aggregated data, including to train our AI models and for medical publications and research.

Health Data
Consultation Recording Data
Usage Data

Legitimate interests (to improve our services and better understand and treat health-related symptoms and activities)

Article 9(2)(j) UK GDPR: Research and statistics

Table C: Reset Malaysia

Purpose

Personal Data

Legal Basis

Assessing your eligibility for our programmes, including your screening questionnaire and free health report, and onboarding you.

Identity and Contact Data
Health Data
Profile Data

Contract (to take steps at your request before entering into a contract, and to perform it).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Providing clinical consultations, diagnosis and treatment, prescribing and ongoing monitoring through the Roczen apps and clinician platform; facilitating peer groups and keeping clinical records.

Identity and Contact Data
Health Data

Contract (to perform our contract with you).

Legal obligation (to keep clinical records).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Recording and transcribing video and audio of clinical consultations to maintain an accurate clinical record and for clinical quality assurance, training, audit and patient safety purposes.

Identity and Contact Data
Health Data
Consultation Recording Data

Legitimate interests (to keep accurate records and assure the quality and safety of our care).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Providing our CompanionAI feature to give you information, guidance and support between consultations.

Identity and Contact Data
Health Data
AI Interaction Data
Usage Data

Contract (to provide our services).

Article 9(2)(h): Provision of healthcare.

Communicating with your GP and accessing your NHS summary care record via the NHS National Care Records Service.

Identity and Contact Data
Health Data
GP Data

Consent (we will only share information with or obtain information from your GP with your agreement).

Contract (to provide our services).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Sharing information with other healthcare providers involved in your care, where necessary to provide our services to you, unless you have told us not to.

Identity and Contact Data
Health Data

Contract (to provide our services).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Arranging laboratory tests and the dispensing and delivery of medication through our laboratory, pharmacy and delivery partners.

Identity and Contact Data
Health Data

Contract (to perform our contract with you).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Taking payments, managing fees and charges and recovering money owed to us.

Identity and Contact Data
Financial Data

Contract (to perform our contract with you).

Legitimate interests (to recover debts due to us).

Managing our relationship with you, including customer support, handling complaints, telling you about changes to our terms or this notice, and asking you to leave a review or complete a survey.

Identity and Contact Data
Profile Data
Health Data
Marketing and Communications Data
Usage Data

Contract (to perform our contract with you).

Legitimate interests (to keep our records up to date and study how patients use our services).

Article 9(2)(h) UK GDPR: Management of health care systems and services.

Monitoring and improving the performance and features of the Roczen platform, including analysing how users interact with it.

Technical Data
Usage Data

Legitimate interests (to improve our platform and the quality of care and user experience).

Sending you marketing about our products and service and displaying online advertising.

Identity and Contact Data
Technical Data
Usage Data
Profile Data
Marketing and Communications Data

Consent (where required, including for non-essential cookies).

Legitimate interests (to grow our business).

Complying with our regulatory and legal obligations (including to the Care Quality Commission) and establishing, exercising or defending legal claims.

All categories of data

Legal obligation (to comply with regulatory and legal requirements).

Legitimate interests (to defend legal claims).

Article 9(2)(h) UK GDPR: Provision of healthcare.

Creating anonymised and aggregated data, including to train our AI models and for medical publications and research.

Health Data
Consultation Recording Data
Usage Data

Legitimate interests (to improve our services and better understand and treat health-related symptoms and activities)

Article 9(2)(j) UK GDPR: Research and statistics

5.2 Please note that we will tell you before a consultation is recorded and you are able to opt out of the recording of consultations by informing your clinician. Recordings and transcriptions of recordings are used to maintain an accurate clinical record and for purposes relating to clinical quality assurance, training, audit and patient safety. We may use a third party AI transcription service provider to transcribe consultations and they act in line with our instructions at all times. Access to such recordings and transcripts is solely limited to authorised staff and will be regularly audited to ensure compliance. All recordings and transcripts will be kept confidential at all times in accordance with our legal and regulatory obligations as your care provider.

5.3 Our CompanionAI feature gives you information and support between consultations by providing you with relevant educational content in response to your queries. It does not make decisions about your diagnosis, treatment or eligibility or provide any clinical advice. All clinical decisions are made by our healthcare professionals.

5.4 Where we disclose personal data to comply with lawful requests from a legal authority or a court, we take reasonable steps to disclose only the minimum personal data necessary.

6. Direct marketing

6.1 From time to time, we may use your Identity and Contact Data, Profile Data and Marketing and Communications Data to send you information about similar products, services and events which we think may be of interest to you. We will only do so where you have given us your consent to receive such marketing.

6.2 You may withdraw your consent and opt out of receiving marketing from us at any time, free of charge, by clicking the “unsubscribe” link in any marketing message, updating your preferences in your account settings, or contacting us using the details in section 2. Opting out of marketing will not affect the processing of your personal data for other purposes, such as providing our services to you.

7. Data sharing

7.1 We may share your personal data with:

7.1.1 other companies in the Reset Health Group (subject to a written intragroup arrangement);

7.1.2 our healthcare professionals (e.g. doctors, nurses, dietitians and psychologists) and other healthcare providers where needed to provide our services to you;

7.1.3 our laboratory, pharmacy and delivery partners;

7.1.4 your GP and the NHS National Care Records Service;

7.1.5 service providers who process personal data on our behalf, such as hosting, IT, payment, customer relationship management and communications providers;

7.1.6 our professional advisers (e.g. lawyers and accountants);

7.1.7 regulators, law enforcement bodies, courts and other authorities where we are required to by law, including the Care Quality Commission; and

7.1.8 any prospective buyer or successor in connection with a reorganisation, merger, acquisition or sale of our business.

7.2 When we share personal data, we require recipients to comply with applicable data protection laws, take appropriate security measures and to process it only for specified purposes. Our service providers may only process your personal data on our instructions.

8. International transfers

8.1 Whilst we store (and endeavour to ensure that our vendors store) your personal data in the UK, we may transfer your personal data to organisations located outside of the UK and/or the EEA.

8.2 We may share your personal data with, and transfer it between, other companies in the Reset Health Group, including companies located outside the UK and/or the EEA (such as in Malaysia) based on our legitimate interests. Any such sharing and transfer takes place under a written intragroup arrangement which incorporates all safeguards required by applicable data protection law (including, where relevant, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses), so that your personal data receives an equivalent level of protection wherever it is processed within the Reset Health Group.

8.3 If any of our service providers processes personal data outside the United Kingdom and/or the EEA, we will make sure an appropriate safeguard is in place, such as an adequacy decision or an approved data transfer agreement (for example, the UK International Data Transfer Agreement), or that the transfer is otherwise permitted by data protection law. Please contact us if you would like more information on the safeguards we use.

9. Data retention

9.1 We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, regulatory, tax, accounting or reporting requirements. Clinical records (including consultation recordings that form part of your clinical record) are kept for at least 8 years from the date you are discharged from our care, or longer where the law requires. We may keep your personal data for longer in the event of a complaint or if we reasonably believe there is a prospect of litigation.

9.2 To determine the appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes through other means, and applicable legal requirements.

10. Your rights

10.1 Under UK data protection laws, in certain circumstances you have the right to:

10.1.1 Request access to your personal data;

10.1.2 Request the correction of any inaccurate or incomplete personal data;

10.1.3 Request the erasure of your personal data;

10.1.4 Object to the processing of your personal data based on our legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground;

10.1.5 Object to direct marketing at any time;

10.1.6 Request the restriction of processing of your personal data;

10.1.7 Request the transfer of your personal data to you or a third party;

10.1.8 Not be subject to decisions based solely on automated processing;

10.1.9 Withdraw consent at any time where we rely on it (this will not affect processing carried out before you withdraw). Please note that if you withdraw consent, we may not be able to continue providing some or all of our services to you.

10.2 We may need to request specific information from you to confirm your identity before responding to a request from you. This is a security measure to ensure that personal data is not disclosed to anyone who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

10.3 You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

10.4 We will respond to requests within the time limits set by applicable law (generally one month in the UK). Where a request is complex, we may need longer where the law allows, and we will keep you updated.

11. Cookies

You can refuse all non-essential cookies by clicking “Reject” on the cookie banner when you visit our websites, and you can change your preferences at any time using our cookie tool. You can also set your browser to refuse some or all cookies. If you disable cookies, some parts of our websites may not function properly. Please refer to our Cookie Policy for more information.

12. Third-party links

Our websites and apps may include links to third-party websites, plug-ins and applications. We do not control these and are not responsible for their privacy statements. We encourage you to read the privacy notice of every website you visit.

13. Further queries or complaints

13.1 We have appointed a Data Protection Officer who is responsible for dealing with queries about our processing of personal data. If you have any questions about this notice or the handling of your personal data or you wish to exercise your rights, please email dataprotection@resethealth.clinic or contact our Data Protection Officer using the following details: FAO Data Protection Officer, Reset Health Limited, 7-8 Stratford Place, London W1C 1AY.

13.2 Under UK data protection laws, you have the right to submit a complaint to us about the handling of your personal information. Where you make such a complaint, we will acknowledge your complaint within 30 days of receipt and respond to it without undue delay. If you are unhappy with how we have dealt with your complaint, you may escalate this to the Information Commission’s Office (“ICO”), the UK supervisory authority for data protection issues. Please contact us in the first instance prior to submitting your complaint to the ICO to allow us the opportunity to resolve your concerns.

14. Changes to this Privacy Notice

We reserve the right to update this notice at any time, and we will notify you of any substantial changes to this notice. We encourage you to review this notice periodically.