Privacy notice.
Draft — not yet approved for publication. The highlighted fields below must be completed, and this notice reviewed by a data protection adviser, before Active Labs publishes it or collects any further personal information.
This notice explains what personal information Active Labs collects when you use this website or join our waitlist, why we collect it, what we do with it, and the rights you have over it. We have written it in plain English rather than legal boilerplate, because a notice you cannot understand does not do its job.
Active Labs is not yet open. We are not currently providing clinical services, and we do not hold anyone's test results or medical records. Today this notice covers one thing: the details people give us to join the waitlist, or to enquire about a programme for their team.
1 · Who we are
Active Labs is the "data controller" for the information described here — meaning we decide why and how it is used, and we are accountable for it.
Active Labs is not yet a registered company. Our application to Companies House is pending. Until it completes, the people responsible for your information are the founders of Active Labs personally, trading under that name. Once the company is registered, it will take over as controller and we will update this notice and tell anyone already on the waitlist.
| Who we are | Active Labs — a business operated by its founders, Brighton & Hove, UK |
|---|---|
| Company status | Registration at Companies House pending. We are not yet a limited company and do not describe ourselves as one. |
| Correspondence address | [TO CONFIRM: a postal address people can write to. Required for ICO registration in any case.] |
| ICO registration | [TO CONFIRM: data protection fee registration number, once registered] |
| Contact for privacy questions | hello@activelabs.health |
We are not required to appoint a Data Protection Officer at our current size, and we have not appointed one. Privacy questions are handled by a named founder.
2 · What we collect
When you join the waitlist
- Your name and email address. Required — without these we cannot add you to the list or tell you when we open.
- Your phone number. Optional.
- The interests you tick — for example "Baseline testing", "Hormone health" or "Metabolic / weight". Optional. Some of these tell us something about your health, and we treat them with extra care. See section 4.
- Your preferred consultation format, and how you heard about us. Optional.
- Anything you write in the free-text box. Optional. We ask you not to put symptoms or medical details here.
- Your consent choices, and the date and time you gave them. We keep this as our record that you agreed.
When you enquire about a team programme
- Your name, work email, company name, team size, preferred delivery format, the programme options you tick, and anything you write in the free-text box. These are business details, not health information.
When you register interest in activewear or a community event
- Your first name, your email address, and which thing you registered for — the shop, the run club, or a coffee morning. Nothing else, and none of it is health information.
When you simply browse the site
- We run no analytics, no advertising pixels and no tracking of any kind on this website. We do not build a profile of you, and we do not know who you are unless you tell us.
- Our hosting provider keeps standard server logs, which include IP addresses, for security and to keep the site running.
3 · Why we collect it, and our legal basis
UK GDPR requires us to have a specific lawful reason for every use of your information. Ours are:
| What we do | Why | Our legal basis |
|---|---|---|
| Hold your waitlist entry | So we can contact you when we open, in the order people joined | Your consent (Article 6(1)(a)) |
| Store the health interests you ticked | So we can tell you about the services you actually care about, and prepare for what the waitlist is asking for | Your explicit consent (Article 9(2)(a)) — see section 4 |
| Send you launch updates by email | Because you asked to hear from us | Your consent (Article 6(1)(a), and PECR regulation 22) |
| Reply to a team-programme enquiry | To answer the question you asked us | Our legitimate interests (Article 6(1)(f)) in responding to business enquiries |
| Email you about the shop or an event you registered interest in | Because you asked to hear when it opens or when dates are set | Your consent (Article 6(1)(a), and PECR regulation 22) |
| Keep the site secure and working | To prevent abuse and fix faults | Our legitimate interests (Article 6(1)(f)) in operating a secure service |
Where we rely on consent, you can withdraw it at any time and we will stop — see section 8. Withdrawing consent does not make anything we did beforehand unlawful.
4 · Health information gets extra protection
If you tick an interest such as "Hormone health" or "Metabolic / weight" on a clinic waitlist, UK data protection law treats that as special category data — information about your health. It carries stricter rules than an ordinary name and email.
Because of that:
- Ticking those boxes is entirely optional. You can join the waitlist without ticking any of them, and it will not affect your place in the queue or how we treat you.
- We ask for your separate, explicit consent before storing them. That is the tick box directly above the "Join the waitlist" button — it is unticked by default, and we never tick it for you.
- We use these interests only to shape what we tell you about, and to understand overall what the waitlist is interested in. We do not use them to make any decision about you, and there is no automated decision-making or profiling.
- You can ask us to delete them while keeping your waitlist place. Just email us.
5 · Who else sees your information
We do not sell your information, and we do not share it for anyone else's marketing. It is seen by:
- Active Labs staff who need it to run the waitlist — currently a small founding team.
- Netlify, who host this website and process the form when you submit it. Form submissions are stored in our Netlify account.
- Google Fonts. This site loads its typefaces from Google's servers, which means Google receives your IP address when a page loads. We do not send Google anything else, and there is no Google analytics or advertising on this site.
- Our email provider — [TO CONFIRM: the service that actually sends the mail — Google Workspace, Microsoft 365, Mailchimp or similar. "hello@activelabs.health" is the address it will come from, not the provider that processes your data.] — when we email you.
These providers act on our instructions under a contract, and cannot use your information for their own purposes.
We may also disclose information if the law requires it, or to protect someone's safety.
6 · Where your information is held
Some of our providers are based outside the UK, principally in the United States. Where information is transferred out of the UK we rely on the safeguards UK law requires — an adequacy decision covering the provider, or the UK International Data Transfer Agreement.
[TO CONFIRM: which safeguard applies to Netlify and to the email provider — check whether each is certified under the UK Extension to the EU–US Data Privacy Framework, and if not, put an IDTA in place. Name the mechanism here rather than describing it generally.]
7 · How long we keep it
- Waitlist entries: 12 months from the date you join, or until you ask us to remove you — whichever comes first. If we have not opened by then, we will ask whether you want to stay on the list rather than quietly keep your details.
- Team enquiries: 12 months from your last contact with us.
- Shop and event interest lists: 12 months from the date you register, or until you unsubscribe — whichever comes first.
- Consent records: for as long as we hold the information they relate to, plus a short period afterwards, so we can show we had your permission.
When a retention period ends, we delete the information.
8 · Your rights
You have the right to:
- See what we hold about you, and get a copy.
- Correct anything inaccurate.
- Have it deleted. Because we rely on your consent, you can ask for this at any time and we will act on it.
- Withdraw your consent — for the health interests, for the emails, or for everything. Every email we send carries an unsubscribe link, and you can email us at any point.
- Restrict or object to what we do with it.
- Take it with you in a portable format.
To use any of these, email hello@activelabs.health. We will respond within one month, and it costs you nothing.
9 · Cookies and browser storage
This site sets no cookies and runs no tracking.
If you switch the site to dark mode, we save that single preference in your browser's local storage so the site remembers it next time. It stays on your device, it is never sent to us, and it contains nothing that identifies you. Clearing your browser storage removes it.
10 · Changes to this notice
If we change how we use your information — particularly when we open and begin providing clinical services — we will update this notice and change the date at the top. Where a change materially affects you, we will tell you directly rather than rely on you noticing.
11 · Complaints
If you are unhappy with how we have handled your information, please tell us first at hello@activelabs.health — we would rather fix it.
You also have the right to complain to the UK's data protection regulator, whether or not you come to us first:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk