Privacy Policy

Before membership opens. This policy covers this website now and the membership when it opens. It is awaiting review by a UK solicitor and may be updated before membership opens. Membership is not open yet, and this website has no forms, so today we receive personal details only if you email us.

1. Who we are

The controller of your personal data is B L Notts Ltd, trading as Wealth Health Club, a company registered in England and Wales, company number 16782785, registered office 54 Pathfinder Way, Castle Donington, Derby, England, DE74 0AJ. Contact: contact@wealthhealthclub.com, with "Privacy" in the subject line. B L Notts Ltd is registered with the Information Commissioner's Office (ICO), registration number ZC275706.

2. What we collect

• Account details: name, email, UK billing address and postcode, your confirmation that you live in the UK, password (stored only in scrambled, hashed form) and your two-step verification settings
• Health information you choose to give us: your condition or conditions, and, optionally, diagnosis details, when you were diagnosed, current treatments and what you want to follow. For a second person on Recommended membership, the same, with their own consent
• Membership and payment records: your plan, payments and consent records. Card details are handled by Stripe; we never see your full card number
• Technical data: sign-in records and security logs

3. Why, and our lawful basis

• Health information: only to understand your condition/s so we can carry out research. Lawful basis: your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)). You can withdraw consent at any time; we then stop using your health information, but cannot continue your research
• Account and payment: to provide the membership you asked for (contract) and to keep records the law requires (legal obligation)
• Security logs: to keep the service and your account safe (legitimate interests)

We do not use your data for advertising, profiling or marketing, and we never sell it. We do not make automated decisions about you that have legal or similarly significant effects.

4. Who processes it for us

Research on your condition/s is collated from published sources by our own systems. When we search for research on a condition, we do so without your name or contact details attached. We use these providers to run the service:

• Cloudflare, Inc. (USA, with servers worldwide) hosts this website, delivers it through its content delivery network and forwards emails sent to contact@wealthhealthclub.com to our inbox. Cloudflare acts as our processor under its Data Processing Addendum. Transfers to the USA rely on Cloudflare's certification under the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge). If that certification does not apply, the addendum uses the EU Standard Contractual Clauses with the UK International Data Transfer Addendum issued by the ICO
• Microsoft (Microsoft Corporation, USA, and Microsoft Ireland Operations Limited, Ireland) provides our email inbox, a Microsoft Outlook.com mailbox, so emails you send us are stored there. Microsoft provides Outlook.com under its own terms and privacy statement. Microsoft is certified under the UK Extension to the EU–US Data Privacy Framework and also uses standard contractual clauses for international transfers
• Stripe, when membership opens, will take payments. For UK businesses, Stripe's services are provided by Stripe Payments Europe, Limited (Ireland), with Stripe Payments UK Ltd (UK, authorised by the Financial Conduct Authority, reference 900461) providing the regulated payment services. Stripe, LLC (USA) also processes personal data under Stripe's terms. Depending on the activity, Stripe acts as our processor or as a separate controller under its own privacy policy. Transfers to the USA rely on Stripe, LLC's certification under the UK Extension to the EU–US Data Privacy Framework, or on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum

Where a provider acts as our processor, it may use your data only on our instructions and only to run the service. If we add a provider, for example to send member emails when membership opens, we will add it to this list before it receives any personal data.

5. Emails and two-step verification

• By default our emails contain no health data and never name your condition/s. They only say an update is waiting, with a link to log in. This includes the weekly summary email
• Every sign-in uses two-step verification
• Your research requests and condition updates stay in our secure system. When you send a request or update a condition, it is saved in our members system, not sent by email. We receive an email alert that only says a new request or condition update is waiting, with your member reference and a link to our admin area. The alert never contains your condition/s or any other health details
• Our admin area needs two-step verification for every sign-in, access is limited to those who need it to prepare your updates, and every view and change is recorded in an audit log
• You may opt in to full-content emails after a clear warning. Email is less secure than your account, and anyone who can get into your mailbox could read them. We are not responsible for access to your own mailbox by anyone else, except where caused by our own failure to meet our legal duties

6. How long we keep it, and downloading it

• While you are a member: every update stays in your account
• When your membership ends: your access ends. We delete your health information and your updates within 90 days (to allow for a final request or a cancellation query), unless you ask us to delete them sooner or they are needed for a legal claim. Deleted data is removed from our rolling back-ups within 30 days
• Downloading: you can download all your updates and the information you gave us from your account at any time while you are a member. After you leave, you can ask for a copy at contact@wealthhealthclub.com within those 90 days
• Records we must keep: payment, billing and invoice records for 6 years from the end of the financial year they relate to, as required by HMRC and the Companies Act 2006. Contract, complaint and dispute correspondence is kept for 6 years after your membership ends or the matter is closed, in line with the Limitation Act 1980 time limit for contract claims. We also keep records of your consent to automatic renewal for at least 3 years, without any health information
• Account details and security logs: account details (name, email, sign-in details and security settings) are kept while your membership is active and deleted within 90 days after it ends. Security and access logs are kept for up to 90 days, unless needed to investigate an incident. Our admin audit log, which records member references but no health details, is kept for 12 months
• General enquiries: if you contact us but do not become a member, we delete your enquiry within 12 months
• Keeping data longer: we keep data for longer only where the law requires it or for an ongoing legal claim, and then delete it securely

7. Your rights

Keeping your information accurate. We use your condition details only to focus your research, so they need to be accurate and up to date. You have the right to have inaccurate or incomplete personal data corrected (the right to rectification). You can do this yourself at any time with Update my condition, which also keeps a history of your changes in your account, or by emailing contact@wealthhealthclub.com. Your change history is health information and is kept and deleted on the same terms as the rest of it (section 6).

You can ask to see, correct, delete or download your data, to restrict or object to its use, and to withdraw consent, free of charge. Most of this you can do yourself in your account. We reply within one month.

8. Security

We use appropriate technical and organisational measures, including encryption in transit and at rest, two-step verification for members and for our admin area, an audit log of admin activity, access controls limited to those who need it, and regular reviews. No system is completely secure, which is why we keep health information out of emails by default.

9. If there is a data breach

• We act at once to contain it and assess the risk
• We report it to the Information Commissioner's Office within 72 hours of becoming aware of it, where the law requires
• We tell affected members without undue delay where there is a high risk to them, explaining what happened and what they can do
• We keep a record of every breach and what we did about it

10. Cookies, complaints and contact

See our Cookie Policy. If you are unhappy, contact us first. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.