Privacy Policy

Last updated October 14, 2026

1. Who we are

Weightfall Ltd (company number 15754169, registered office 1st Floor, 1–9 Castle Street, Hinckley, LE10 1DA) is the data controller for the personal information described in this policy. We are registered with the Information Commissioner’s Office (ICO) under registration number ZCO42682. Contact for privacy matters: info@weightfall.co.uk

This policy explains how we collect, use, share and protect your personal information when you use weightfall.co.uk and our weight management service. We process personal information in accordance with UK data protection law: the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information we collect

Identity and contact information: name, date of birth, email address, phone number, billing and delivery address, account credentials.
Health information (special category data): your health questionnaire answers, medical history, current medicines, height, weight and photographs you submit for clinical verification, consultation records, prescriptions issued, progress reviews and side-effect reports.
Payment information: processed by our third-party payment provider; we do not store full card details.
Technical and usage information: IP address, browser type, device information, pages viewed and interactions with our website, collected via cookies and similar technologies (see section 8).

3. How we use your information and our lawful bases

To provide the service — assessing your eligibility, providing consultations, prescribing where clinically appropriate, dispensing and delivering treatment, and conducting ongoing reviews. Lawful basis: performance of a contract (UK GDPR Article 6(1)(b)); for health information, provision of health care under Article 9(2)(h), with processing carried out by or under the responsibility of professionals subject to a duty of confidentiality (DPA 2018 Schedule 1, Part 1).
To keep you safe — monitoring side effects, clinical audit and, where applicable, reporting safety concerns to regulators. Lawful bases: Articles 6(1)(c) (legal obligation), 6(1)(f) (legitimate interests) and 9(2)(h)/(i).
To communicate with you about your care — appointment, review and delivery messages. Lawful basis: performance of a contract.
Marketing — sending you news and offers about our services only where you have opted in (or, for existing customers, under the soft opt-in for similar services, with a clear opt-out in every message). Lawful basis: consent (Article 6(1)(a)) or legitimate interests, in line with the Privacy and Electronic Communications Regulations. We never use your health information for marketing, and you can opt out at any time via the unsubscribe link or by emailing us.
To comply with the law — record-keeping obligations applying to clinical and pharmacy records, accounting and tax. Lawful basis: legal obligation.
To run and improve our website and service — analytics, security, fraud prevention and service improvement. Lawful basis: legitimate interests; consent for non-essential cookies.

You are not required by law or by contract to give us your information, but without it we cannot assess you safely or provide the service.

4. Who we share your information with

The UK-registered clinicians involved in your care.
Our partner pharmacy, All Your Medication (GPhC registration 9012939), for the dispensing and delivery of prescribed treatment.
With your consent, your GP — and without consent only where there is an overriding safeguarding or vital-interest reason, in line with professional guidance.
Service providers acting on our instructions under contract: payment processing, secure hosting and IT, delivery couriers, customer-support and communication tools, and analytics providers.
Regulators, courts and law-enforcement bodies where we are required to do so (for example the MHRA, GPhC, CQC or ICO).

We do not sell your personal information. Where a provider processes data outside the UK, we ensure an adequate level of protection through UK adequacy regulations or the ICO’s approved safeguards (such as the International Data Transfer Agreement or Addendum).

5. How long we keep your information

Clinical records: in line with the NHS Records Management Code of Practice, we retain adult clinical records for a minimum of 8 years after your care ends.
Pharmacy and prescription records: for the periods required of registered pharmacies.
Account, payment and tax records: generally 6 years after the end of the relevant financial year.
Marketing preferences: until you opt out or your account is deleted; suppression records are kept so we don’t contact you again.

When retention periods end, information is securely deleted or anonymised. You may ask us to delete your account at any time; clinical and other records we are legally required to keep will be retained for the periods above and then deleted.

6. Your rights

Under UK GDPR you have the right to: access a copy of your personal information; have inaccurate information corrected; have information erased (where it is no longer needed and we are not required to keep it); restrict or object to processing, including objecting to direct marketing at any time; data portability; and to withdraw consent at any time where consent is our lawful basis, without affecting processing before withdrawal.

To exercise any right, email info@weightfall.co.uk. We respond within one month. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113, or Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We’d appreciate the chance to resolve your concern first.

7. Automated decision-making

Our online questionnaire may automatically screen out applications that clearly do not meet clinical eligibility criteria (for example on age or BMI). No decision to prescribe is ever made automatically: every prescribing decision is made by a UK-registered clinician. If an automated screen prevents you from proceeding and you believe that is wrong, you can contact us to have it reviewed by a person.

8. Cookies

We use cookies and similar technologies: essential cookies (required for the site to function — security, load balancing, your session), and, only with your consent, analytics cookies (to understand how the site is used) and marketing cookies (to measure and improve our advertising). You can accept or decline non-essential cookies via our cookie banner, change your choice at any time via emailing info@weightfall.co.uk and control cookies in your browser settings. A full list of the cookies we set, their purposes and durations is available at info@weightfall.co.uk

9. Security

We protect your information with technical and organisational measures including encryption in transit and at rest, access controls restricting health information to those involved in your care, staff confidentiality obligations and training, and regular review of our safeguards. No system is completely secure; if a breach occurs that risks your rights, we will notify you and the ICO as required by law.

10. Children

Our service is for adults aged 18 and over. We do not knowingly collect information from anyone under 18; if we learn that we have, we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and, where changes are significant, tell you by email. Please review it regularly.

12. Contact

Questions about this policy or our data practices: 📧 info@weightfall.co.uk,
or write to: Weightfall Ltd, 1st Floor, 1–9 Castle Street, Hinckley, LE10 1DA.

📞 +44 20 383 765 66