We are Vira Health Limited. We are registered in England and Wales under the UK Company Registration Number: 12542209 and our office address is: 22 Highbury Grove, Unit 401, London, United Kingdom N5 2EF.

We are registered with the ICO (Information Commissioner’s Office) under number ZB352110 and our Data Protection Officer can be contacted by email at privacy@vira.health.

• Identity details: include information about your identity such as your name, date of birth.
• Contact details: include email, telephone number
• Technical details: can include the type of device you use to access our Platform, your operating system, IP address or your type of browser. This allows us to understand bugs with our website and app, adapt the content to you and help to prevent security incidents.
• Browsing activity, user/interaction data include what page you are visiting, how long you spend on our Platform and Services, your behaviour on the page ( e.g. clicks, scrolling). This helps us to analyse how users interact with our Platform and app to improve it and offer you a better experience.
• Marketing details include your marketing preferences and the performance of our marketing campaigns (e.g. the emails we send you).
• Research/surveys data: If you participate in our research or respond to our individual surveys, we collect your feedback to improve our Platform. Some of these surveys or research can be anonymised which mean that it will not be linked to you.We are also using aggregated data, which is data no longer associated with you, to perform research or statistical analysis on our Platform and how users interact with them.
• Special category of data includes health and sex data collected through the use of our Platform such as the plans or when you complete our form/questionnaire before booking an appointment or exchange with our Vira Care Team.

We adhere to the principle of data minimisation by only collecting and retaining what is necessary for the provision and improvement of our Platform and Services.

We do not knowingly collect personal data from individuals under 18 years of age.

• Information you provide us
  Such as when creating an account, responding to a survey, contacting our customer support, completing our online forms, interacting with our Vira Care Team, completing your plans, registering for an event: you will provide us with personal data.
• Information automatically collected through your device and usage of our Platform and Services
  These data are collected through tracking technologies. Please see our Cookie Section at the end of this notice for additional information.
• Information received from third parties
  Technical information received through third parties we use including Posthog for analytics.

Under the Data Protection Act 2018, the UK and EU GDPR where applicable, we must have a particular reason to process your data which includes its collection, use, transfer, storage or retention.

We have indicated in the table below the different purposes for which we process your personal information, what type of information and the lawful basis for processing.

Vira Health never sells your personal data.

Internally
Your personal data is shared with our staff on a need-to-know basis to provide you with our Services and support including our customer support, our Vira Care Team as well as:

• Our IT people might need to access your account or the systems where your information is stored, including sensitive information in order to assist with bugs in our systems or any technical issues you might encounter
• Our legal team might need to access some of your sensitive information to answer your data subject requests.

All staff are required to comply with confidentiality obligations and required to perform an annual training on data protection and security. Note that our staff may include employees or contractors of our affiliate (Vira Health Inc).

Externally
We’re using the following categories of third parties and therefore share data with the following categories of providers:

• Business partners, suppliers and subcontractors to provide the Services to you, such as cloud services to store your data, marketing and transactional emails providers, data analytics and research providers.
• Events: We may share your data with an event organiser to organise your participation in the event.
• Regulators/ Authorities/ Enforcement Agencies if we are under a duty to disclose or share your personal data to meet any legal requirement, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of our clients or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection.
• Prospective buyers of our business under our legitimate interest to ensure our business can be continued by the buyer.

We work only with third parties (Processors) who implement security and data protection measures to ensure adequate protection of your personal data.

We are committed to protecting your privacy and your personal information. As such, we put organisational and technical measures in place to protect your information from unauthorised or accidental access, alteration, disclosure or erasure.

We make sure that our staff is trained with an annual training requirement on data protection, information governance and cybersecurity. We also have policies in place that must be complied with by our staff to ensure that your data is protected. We enforce passwords and logins to access our systems as well as two factors authentication where possible. Our offices are secured with access with a badge, locked doors and a clean desk policy. We enforce a right of access policy to limit access to the data on a need-to-know basis.

On a technical side, we encrypt your data, use firewalls to keep your data from unauthorised access and implement pseudonymisation or anonymisation (de-identification of data) where possible.

All information you provide to us is end-to-end encrypted between your device and our cloud servers based in the USA. We also work with suppliers or contractors who may store data outside of the UK and EU. For users based in the UK or the EU, transfers of your data outside of the UK or the EU is protected through one of the safeguards mechanisms: either the data is transferred to a country deemed to provide an adequate level of protection by the UK or we would have a model contract in place (e.g. Standard Contractual Clauses or “SCCs”) to comply with GDPR and complete any risk transfer assessment where required as well as performing a due diligence of the supplier/contractor.

We will only retain your personal data for as long as we need it to fulfil the purposes we collected it for and we will periodically review the personal data in our reviews to ensure we are only holding what is necessary.

Your personal data and health information is kept for a minimum of 6 years after an appointment.
We keep your account details until you request a deletion of your data or notify us that you want to stop using our services unless we have a legal or regulatory reason to keep them for longer.

Our research and product teams will retain your information for 2 years after the research. We might also anonymise data for longer but in this case no information will identify you.

We keep your data about your use of our services and technical data in a pseudonymous format until you request a deletion of your data.

And for marketing purposes, your data is retained as long as you have an active account with us.

Please note that we may need or be required to keep your data for longer in order to be able to comply with our legal, accounting or regulatory requirements.

If we are relying on your consent to hold your personal data, you can withdraw this consent at any time and we can remove your data. Personal data that is no longer required is removed using technology designed to prevent the recovery of the personal data.

You have various rights under the Data Protection Act 2-18 and GDPR, which are:

• access your personal data or request a copy of your data (right of access)
• correct incomplete or inaccurate information we hold about you (right to rectification);
• ask us to erase the personal data we hold about you (right to erasure); in certain circumstances, we will not be able to delete your personal data. As a provider of healthcare services, we have to retain your medical records for a set period of time or we might also need to keep your data for longer in order to establish, exercise or defend legal claims.
• ask us to restrict our handling of your personal data (right to restriction of processing);
• ask us to transfer your personal data to a third party (right to portability); Please note that this right applies to the personal data you provided us with and only where we process your data based on your consent or performance of a contract and where the processing is automated.
• object to how we are using your personal data (right to object to processing).

If you want to exercise any of these rights, you can contact us at privacy@vira.health and indicate the subject of your request.

You also have the right to lodge a complaint about our processing with a supervisory authority the ICO in the UK ( https://ico.org.uk/make-a-complaint/) or to your national or regional supervisory authority, where applicable.

Vira Health does not act as a healthcare provider to provide our Member Zone Platform or Services hence; our Platform and Services are not subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). While we maintain and use Personal Data, we are not a “Covered Entity” or “Business Associate” as defined by HIPAA for the purpose of the Member Zone.

Your feedback and suggestions on this policy are welcome.

We’ve worked hard to create a policy that’s easy to read and clear. But if you feel that we have overlooked an important perspective or used language which you think we could improve, please let us know by email at privacy@vira.health.

If you’d prefer, you can always get in touch with us by post to our registered office at 22 Highbury Grove, Unit 401, London, United Kingdom, N5 2EF.

Please note, if you follow a link to a third-party website or application from Vira, these third parties may have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal information to these websites.

Cookies is a small file of letters and numbers that we store on your browser or the hard drive of your computer. They have several purposes such as distinguishing you from other users of our sites to help us to provide you with a good experience when you browse our sites and to improve your experience.

There are different types of cookies and tracking technologies:

• Strictly necessary cookies. These are used to enable the core functionality of our website such as security, network management and accessibility. Their use is necessary for the website to work properly.
• Functional cookies. These cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedback, and other third-party features.
• Analytics and performance cookies: These are used to understand how visitors interact with the website. These cookies help provide information on the number of visitors, traffic source, how users behave on our pages etc.
• Advertisement cookies: they are used to provide you with relevant ads and marketing campaigns. across sites and collect information to provide more customised and personalised advertising.

To obtain the full list of the cookies we use, you can consult our cookie management tool which lists their category, a description of the cookie and their expiry dates. You can also update your preferences in this tool which you can find under “Cookie Settings” at the bottom of this page (footer of our website).

You can also block or delete some categories of cookies via your browser directly (notably the cookies previously set on your browser). You’ll find more information here: https://www.aboutcookies.org/how-to-control-cookies/.

Last updated: 11th November 2025

Vira Health provides this US Privacy Notice Addendum (the “US Addendum”) to US residents acting as “consumers” under applicable state privacy laws (“consumers” or “you”), such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act, Colorado Privacy Act, and similar laws in other states. This US Addendum supplements the information contained in our Privacy Notice.

As used in this US Addendum, “Personal Information” is information that identifies, relates to, or could reasonably be linked with a particular consumer or household. “Sensitive Personal Information” refers to certain types of Personal Information that are subject to heightened protections by law, such as health data.

Consumer requests

Depending on the privacy laws that apply in your state of residence, you may make the following types of requests. We will respond to your request consistent with applicable law.
(a) Request to Know: to confirm whether we process your Personal Information and to request a copy of such Personal Information; including (i) the personal and sensitive information we have collected about you and our purposes of use; and (ii) the categories, sources, and third parties involved in personal information we have collected about you or “sold” or disclosed in the past 12 months.
(b) Request to Correct: to request correction if there are inaccuracies in your Personal Information;
(c) Request to Delete: to request deletion of your Personal Information, subject to potential exceptions under applicable law;
(d) Opt-out of Sale and Targeted Advertising: to opt-out of the sale of your Personal Information and processing of your Personal Information for targeted advertising.

Requests may be submitted by yourself or an authorized agent by emailing us at privacy@vira.health. We may request Personal Information from you to verify your identity and protect against fraudulent requests. If you maintain a password-protected account with us, we may verify your identity through our existing authentication practices for your account and require you to re-authenticate yourself before disclosing or deleting your Personal Information. If you make a Request to Delete, we may ask you to confirm your request before we delete your Personal Information.

We will not unlawfully discriminate against you for exercising any of your rights under applicable US state consumer data privacy laws.

We do not sell your Personal Information for monetary gain

Please note that we do not sell Personal Information for monetary consideration. However, certain US privacy laws consider disclosing personal information to a third party for any benefit (including non-monetary) as a “Sale” or Sharing”. We “Share” certain of your Personal Information to third parties for certain types of advertising partners, you may have the right to opt out of such “Sale” and “Sharing.” For example, we may disclose to our advertising partners identifiers and metadata (such as service you used or are interested in, geolocation data, network activity) for targeted advertising, which may be a Sale or Sharing under these laws.

How to submit requests

Requests may be submitted by yourself or an authorized agent by emailing us at privacy@vira.health. Note that we may need to verify your identity and protect against fraudulent requests and request that you share Personal Information with us to that effect or we might ask you to verify your identity through your account. If you make a Request to Delete, we may ask you to confirm your request before we delete your Personal Information.

We will not unlawfully discriminate against you for exercising any of your rights under applicable US state consumer data privacy laws.

Request to opt-out of Sharing/Do Not Track

You may opt out of our “Sharing” of Personal Information for cross-contextual behavioural advertising, as defined under the CCPA and other state regulations, in addition to opting out of “Sale” of Personal Information by reaching out to privacy@vira.health.

Do Not Track is a web browsing setting that adds a signal to your browser header that tells other websites that you do not want their tracking cookies. We do not currently respond to such signals in browsers because no DNT standard has been adopted. To exercise this right you can set your preferences in our cookie management console or you can contact us at privacy@vira.health if you have any questions.

Limiting use of health information

“Consumer Health Data” means personal information that is linked or reasonably linked to an individual and that identifies past, present or future physical or mental health status.

We process Consumer Health Data to provide you with our Services that you request or as permitted by applicable laws. These data include the data you directly provide in our online form/questionnaire or data you share with our Vira Care Team.

We may disclose Consumer Health Data described above to third parties for our operational business and legal compliance purposes to service providers; our affiliate (Vira Health Inc); successors if we are involved in a merger, acquisition, asset sale, or reorganization; with your consent; as required by applicable law; or to protect and defend our rights and interests or those of our users.

Additional information for California residents

California residents may also request information from us once a calendar year about any personal information shared with third parties for their own direct marketing purposes. We do not share information with third parties for their own marketing uses.