Omniwo Ltd — Privacy Notice

Effective date: March 2026

Last updated: March 2026

Version: 1.1

Plain English Summary: This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have. We've written it in clear, everyday language — no legalese.

---

1. Who We Are

Omniwo Ltd is a UK-based health and wellness platform that combines at-home blood testing with wearable device data to help you understand your health better.

We are registered with the Information Commissioner's Office (ICO) as a data controller. Our registration number is 00013396887.

---

2. What Data We Collect

We collect several categories of personal data, some of which is classified as special category data (health data) under UK GDPR Article 9.

2.1 Data You Provide Directly

2.2 Health Data (Special Category)

2.3 Wearable Device Data (if you choose to connect)

Connecting a wearable device is entirely optional. You can disconnect at any time.

2.4 Technical Data

---

3. How We Collect Your Data

We never purchase personal data from third parties or data brokers.

---

4. Legal Basis for Processing

Under UK GDPR, we must have a valid legal basis for processing your personal data. Here is each basis we rely on:

4.1 Explicit Consent — UK GDPR Article 9(2)(a)

Applies to: All health data processing (blood results, wearable data, health insights, Overall Status)

Health data is classified as special category data under UK GDPR. We can only process it with your explicit consent, which we collect:

• At registration (health data processing consent)
• At checkout (lab testing consent — sharing data with our laboratory partner)
• When connecting a wearable (wearable data sharing consent)

You can withdraw consent at any time — see Section 6.

4.2 Contract Performance — UK GDPR Article 6(1)(b)

Applies to: Account creation, order fulfilment, payment processing, kit delivery, customer support

We process this data because it is necessary to fulfil the contract between you and Omniwo (i.e., delivering the blood testing service you purchased).

4.3 Legitimate Interest — UK GDPR Article 6(1)(f)

Applies to: System security, fraud prevention, anonymised analytics, service improvement

We have a legitimate business interest in keeping our platform secure and improving our service. We have conducted a Legitimate Interest Assessment (LIA) and are satisfied that these interests do not override your rights.

4.4 Legal Obligation — UK GDPR Article 6(1)(c)

Applies to: Tax records (7-year retention), consent record keeping, breach notification compliance

UK law requires us to keep certain financial and accountability records for a minimum period.

---

5. How We Use Your Data

We will never use your health data for:

• Advertising or ad targeting
• Selling to third parties
• Insurance or employment screening
• Any purpose you have not explicitly consented to

---

6. Consent Management

6.1 Types of Consent We Collect

6.2 How to Withdraw Consent

You can withdraw any consent at any time through:

• Dashboard: Settings → Privacy → Manage Consents
• Email: Contact privacy@omniwo.com
• Marketing emails: Click "Unsubscribe" in any email
• SMS: Reply STOP to any SMS message

What happens when you withdraw consent:

• Health data consent withdrawn: Your account and all health data will be deleted within 30 days.
• Wearable consent withdrawn: Wearable sync stops immediately. Raw wearable data (daily metrics, OAuth tokens) is deleted immediately. Anonymised, aggregated data that can no longer identify you (e.g., population-level statistics) may be retained for service improvement purposes.
• Marketing consent withdrawn: You will be removed from marketing lists immediately. Transactional emails (order confirmations, results notifications) will continue as they are based on your contract with us.

6.3 Consent Records

We keep a detailed, immutable record of every consent you give or withdraw. Each record includes:

• The exact text shown to you at the time of consent
• Timestamp of your consent action
• Whether you granted or withdrew consent
• The consent version number

Consent records are retained for 7 years after the consent action (for accountability under UK GDPR Article 5(2)), even if you delete your account. These records are anonymised after account deletion.

---

7. Data Sharing & Third Parties

We share your data with the following categories of third-party service providers, only for the purposes listed:

7.1 Wearable Provider Data Collection Disclosure

When you connect a wearable device to Omniwo, the wearable device manufacturers (such as your wearable device manufacturer) may collect data about how Omniwo accesses their API (such as API request frequency and data types accessed). This data is collected by the wearable providers for their own business purposes, in accordance with their respective privacy policies. By connecting your wearable device, you acknowledge this data collection by the device manufacturer.

We will never:

• Sell your personal data to any third party
• Share your health data with insurers, employers, or advertisers
• Allow third parties to use your data for their own purposes beyond what is listed above

Each third party with access to personal data has a Data Processing Agreement (DPA) in place that meets UK GDPR Article 28 requirements.

---

8. International Data Transfers

Your data is primarily stored in the United Kingdom (cloud infrastructure, europe-west2 region — London).

When data is transferred outside the UK, we use the following safeguards:

For US transfers, we have also:

• Completed Transfer Impact Assessments (TIAs) for each provider
• Implemented supplementary measures (encryption in transit via TLS 1.2+, data minimisation)
• Confirmed that no US government access requests have been received by these providers relating to Omniwo data

---

9. Data Retention

We keep your data only as long as necessary for the purposes described in this policy.

If you delete your account:

• All personal health data is permanently deleted within 30 days
• Financial records required by law are anonymised and retained for the legally required period
• Consent records are anonymised and retained for 7 years (for our accountability obligations)
• We send you a confirmation email after deletion is complete

---

10. Your Rights

Under UK GDPR, you have the following rights:

10.1 Right of Access (Article 15)

You can request a copy of all personal data we hold about you. We will provide this in a machine-readable format (JSON) and a human-readable format (CSV) within 30 days (target: within 24 hours).

How: Dashboard → Settings → Export My Data, or email privacy@omniwo.com

10.2 Right to Rectification (Article 16)

You can correct any inaccurate personal data at any time.

How: Dashboard → Profile → Edit your details directly

10.3 Right to Erasure / "Right to Be Forgotten" (Article 17)

You can request that we delete all your personal data. This will permanently delete your account and all associated health data.

How: Dashboard → Settings → Delete My Account, or email privacy@omniwo.com

Exceptions: We may retain anonymised financial and consent records as required by law (see Section 9).

10.4 Right to Data Portability (Article 20)

You can request your data in a portable, machine-readable format to transfer to another service.

How: Dashboard → Settings → Export My Data (provides JSON + CSV download)

10.5 Right to Restrict Processing (Article 18)

You can request that we temporarily stop processing your data while we resolve a dispute or verify your request.

How: Email privacy@omniwo.com

10.6 Right to Object (Article 21)

You can object to processing based on legitimate interest. For marketing communications, you can opt out at any time.

How: Dashboard → Settings → Notification Preferences, or email privacy@omniwo.com

10.7 Rights Related to Automated Decision-Making (Article 22)

Omniwo does not make any automated decisions that produce legal or similarly significant effects. The Overall Status indicator and health insights are informational only — they are not medical diagnoses, and no decisions about your healthcare are made automatically.

How to Exercise Your Rights

We will verify your identity before processing any request. We will never charge a fee for exercising your rights (unless requests are manifestly unfounded or excessive).

---

11. Data Security

We take the security of your data seriously. Key measures include:

• Encryption at rest: All data stored on our cloud infrastructure is encrypted using AES-256 encryption
• Encryption in transit: All data transfers use TLS 1.2+ encryption
• User isolation: Each user can only access their own data (enforced at database level via security rules)
• Access controls: Role-based access, principle of least privilege
• Audit logging: All data access is logged for monitoring and accountability
• Secret management: All API keys and credentials are stored in a secure secret manager, never in code
• Regular security assessments: Vulnerability scanning and penetration testing
• Incident response: Documented procedures for detecting, responding to, and reporting security incidents

For full details of our security architecture, contact privacy@omniwo.com.

---

12. Cookies

We use cookies on our website. For full details of what cookies we use, why, and how to manage them, please see our Cookie Policy.

Summary: We use strictly necessary cookies (for login and checkout), optional analytics cookies (anonymised, with your consent), and optional marketing cookies (only with your explicit consent). We never store health data in cookies.

---

13. Children's Data

Omniwo's services are designed for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18.

We verify age at registration through a date of birth check. If we discover that we have collected data from a person under 18, we will delete it immediately.

---

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the "Last updated" date at the top of this page
• For significant changes, we will notify you by email and/or through a notice on our website
• Previous versions will be archived and available on request

Your continued use of our service after changes take effect constitutes acceptance of the updated policy.

---

15. Complaints & Contact

Contact Us

If you have any questions about this Privacy Policy or how we handle your data:

Complaints

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

We recommend contacting us first so we can try to resolve your concern directly.

---

Version: 1.1

Last updated: March 2026

Jurisdiction: United Kingdom (UK GDPR + Data Protection Act 2018)