Privacy Policy

Last updated: 24 June 2026

1. Who we are

This Privacy Policy explains how Yuuu Health ("Yuuu", "we", "us", or "our") collects, uses, shares, and protects personal data when you visit yuuu.io (the "Site") or otherwise interact with us.

For the purposes of the UK GDPR, the EU GDPR and applicable data protection laws, Yuuu Health is the controller of your personal data. If you have any questions about this policy or wish to exercise your rights, contact us at privacy@yuuu.io.

2. The personal data we collect

We collect the following categories of personal data:

Identity & contact data — name, email address, phone number, and any other information you provide when you fill in our contact form, request information, or correspond with us.
Account data — if you create an account, your email address, encrypted password, and account preferences.
Content of your enquiry — the message and any context you choose to share with us through our forms or by email.
Technical data — IP address, browser type and version, device information, operating system, language preference and similar information collected automatically when you visit the Site.
Usage data — pages visited, referring URLs, time spent on pages, and similar analytics information.

We do not knowingly collect special category data (such as health data) through the Site. Please do not submit such information via our contact forms.

3. How we use your personal data and our legal bases

We process your personal data only where we have a valid legal basis under the UK/EU GDPR:

To respond to your enquiries and provide the information or services you request — legal basis: our legitimate interests in operating our business and, where applicable, taking steps at your request prior to entering into a contract.
To manage your account and provide the membership features you sign up for — legal basis: performance of a contract with you.
To operate, secure, and improve the Site — legal basis: our legitimate interests in running a safe, reliable, and useful website.
To send you updates or marketing where you have opted in — legal basis: your consent, which you can withdraw at any time.
To comply with legal obligations, including responding to lawful requests from public authorities — legal basis: compliance with a legal obligation.

4. Cookies and similar technologies

The Site uses strictly necessary cookies and local storage to function (for example, to maintain your authenticated session). We may also use limited analytics cookies to understand how the Site is used and to improve it.

Where required by law, non-essential cookies are only set with your consent. You can control cookies through your browser settings; disabling certain cookies may affect Site functionality.

5. Who we share your data with

We do not sell your personal data. We share it only with trusted third parties who help us run our business, including:

Hosting and infrastructure providers (including Lovable Cloud / Supabase) that store data on our behalf.
Email and communication providers used to deliver transactional messages and respond to your enquiries.
Professional advisers (legal, accounting, insurance) where necessary to operate our business and protect our rights.
Public authorities or law enforcement where required by law.

All processors act on our documented instructions under written agreements that include appropriate security and confidentiality safeguards.

6. International transfers

Some of our providers may process personal data outside the UK or European Economic Area. Where this happens, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision, to ensure your data continues to receive an essentially equivalent level of protection.

7. How long we keep your data

We retain personal data only for as long as necessary for the purposes set out in this policy, to comply with our legal obligations, or to establish, exercise or defend legal claims. Enquiry data is typically kept for up to 24 months from your last interaction with us, after which it is deleted or anonymised. Account data is retained for the life of your account and deleted on request, subject to legal retention requirements.

8. How we protect your data

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These include encryption in transit, access controls, role-based permissions, and regular review of our security practices. No system is completely secure, but we work to maintain protections that reflect current good practice.

9. Your rights

Subject to applicable law, you have the right to:

access the personal data we hold about you;
request correction of inaccurate or incomplete data;
request erasure of your data ("right to be forgotten");
restrict or object to certain processing;
request portability of data you have provided to us;
withdraw consent at any time where processing is based on consent (without affecting prior lawful processing); and
lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, your local data protection authority.

To exercise any of these rights, email privacy@yuuu.io. We may need to verify your identity before responding and will reply within one month, as required by law.

10. Children

The Site is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be highlighted on the Site.

12. Contact us

For any questions, requests, or concerns about this Privacy Policy or our handling of your personal data, please contact us at privacy@yuuu.io.