Privacy Notice

Who We Are

Evernu Ltd ("Evernu", "we", "us") is a virtual health clinic registered in Northern Ireland, providing remote healthcare to adults aged 18 and over, including weight management, testosterone replacement therapy (TRT), menopause care and blood testing. We are regulated by the Regulation and Quality Improvement Authority (RQIA).

When you use our service, Evernu Ltd acts as the data controller — meaning we are responsible for deciding how and why your personal data is processed.

What Data We Collect and Why

We collect only the data that is necessary to provide you with a safe, effective service.

Identity and contact data

Your full name, date of birth, home address, email address and telephone number — used to create and manage your account and to communicate with you about your care.

Identity verification data

A government-issued photo ID (such as a passport or driving licence) and a live selfie, processed through our identity verification partner Didit. This is used to confirm your identity, prevent duplicate registrations, and protect against fraud.

Health and clinical data

Your medical history, current medications, allergies, family history, weight, BMI, blood test results, and any symptoms or side effects you report through the patient app. This is the core clinical data our prescribing clinician uses to assess your suitability for treatment and to monitor your progress safely.

BMI verification photograph

A photograph submitted by you in close-fitting clothing to allow our clinician to verify your BMI. This photograph is reviewed by a clinician and assessed by our AI-detection partner (Hive) to confirm it is authentic. Our partner Face++ also compares it with the selfie from your identity check, to confirm the photograph is of you.

Payment data

Payment card details collected at the point of purchase, processed directly and securely by our payment provider Cashflows. We do not store your full card details.

Communications data

Messages sent through the patient app, email, WhatsApp and text messages (SMS), and any contact made through our customer support platform.

Blood tests

If you order a blood test, or one is part of your treatment, we send the laboratory or clinic that carries it out your name, date of birth, sex, contact details and address, and the tests ordered, and they send your results to us. Depending on the test, this is Sussex Pathology (home test kits), Randox Health (clinic and home tests) or Good Body Clinic (a clinic where blood is taken for a home test kit).

Video consultations

Consultations take place by video on Google Meet. When you book, we ask you to agree to your consultation being recorded and transcribed, so that your clinician can keep accurate clinical notes. This is done by Recall.ai, with transcription by Speechmatics. The transcript is kept in your clinical record, and may be summarised by AI for your clinician to review (see Section 7).

Enquiries from Facebook, Instagram and TikTok

If you fill in an enquiry form in one of our adverts on Facebook, Instagram or TikTok, the platform passes us the details you entered (such as your name, email address, phone number and answers) so that we can reply to your enquiry.

Evernu app data

If you use the Evernu app, we also hold what you record in it: food and drink you log (including photos of meals you choose to scan), water, workouts, steps, weight and body measurements, progress photos, doses you log, and your answers to wellbeing and symptom check-ins. We use this to provide the app's features, such as your daily targets, progress charts and reminders, and so our clinical team can support your care where it is relevant. The app also stores a device token so that we can send you the notifications you have allowed.

Steps from Health Connect (Android)

If you turn on step sync in the app's settings, the app reads your step count from Health Connect, with your permission. It reads steps only, and only today's total, to fill in your daily steps target, and saves that total to your Evernu account. We never use Health Connect data for advertising, never sell it, and never share it except as needed to provide the app. Our use of Health Connect data complies with the Health Connect Permissions policy, including its Limited Use requirements. You can turn step sync off in the app, or remove the permission in Health Connect, at any time.

App usage data

The app sends usage events to our analytics provider PostHog (for example, when the app is opened or closed), together with device and app information (such as device model, operating system and app version) and your pseudonymous account identifier. We use this to find and fix problems in the app. The app does not record your sessions.

Consent records

A record of the consents you have given us — including consent to treatment, to identity verification, and to GP notification — with timestamps. These are retained as part of your clinical record.

Our Lawful Basis for Processing

Under the UK GDPR, we must have a valid lawful basis before processing your personal data. We rely on the following:

Special Category Health Data

Your health and clinical data is special category data under Article 9 of the UK GDPR, which means it is afforded enhanced legal protection. Biometric data processed for identity verification (facial recognition) is also special category data.

In addition to our lawful basis under Article 6, we rely on the following conditions under Article 9 to process your health data:

• Health care provision (Article 9(2)(h)) — processing necessary for the provision of health care and treatment, carried out by a clinician subject to professional confidentiality obligations.
• Explicit consent (Article 9(2)(a)) — for biometric identity verification, reading your step count from Health Connect and, where applicable, GP notification.

How We Collect Your Data

We collect your personal data through the following channels:

• The online eligibility questionnaire you complete at registration
• The Didit identity verification process (government ID upload and live selfie)
• Your BMI verification photograph submitted through the platform
• Ongoing symptom and monitoring reports submitted through the patient app
• Information you record in the Evernu app, including your step count from Health Connect if you turn on step sync
• Video consultations, recorded and transcribed with your agreement
• Blood test results from our laboratory partners
• Enquiry forms you complete in our adverts on Facebook, Instagram or TikTok
• Email, WhatsApp, text message and customer support communications
• Payment information at the point of transaction

All data collection is clearly explained at the point it is collected, and you will be asked for your consent where this is required.

How We Store and Protect Your Data

We take the security of your personal and health data very seriously. Your data is held within our purpose-built Clinical Management System (CMS), hosted on Google Cloud Platform. The following security measures are in place:

• Encryption — all data is encrypted at rest and in transit using industry-standard protocols
• Role-based access controls — staff can only access the data required for their specific role; your clinical data is accessible to clinical staff only
• Multi-factor authentication (MFA) — required for all staff logins to the CMS
• Full audit trail — every access, amendment or deletion of your record is logged and can be reviewed
• UK-based data hosting — your data is stored on UK servers within Google Cloud Platform

Some of the services listed in Sections 7 and 12 process data outside the UK, including in the European Economic Area and the United States. Where we know where a service processes your data, Section 7 says so.

Third-Party Data Processors

We share your personal data with the following trusted third-party processors, each of whom is engaged under a written Data Processing Agreement and is required to handle your data securely and in accordance with UK GDPR:

Apart from these processors and the analytics and advertising services described in Section 12, we do not share your data with any other third party without your explicit consent, except where we are legally required to do so — for example, in response to a court order or a lawful request from a regulatory authority.

How Long We Keep Your Data

We retain your personal data only for as long as necessary. The key retention periods are:

When your data reaches the end of its retention period it is securely deleted or anonymised. You may request early deletion of certain data — see Section 9 for your rights, and note that clinical records may need to be retained to comply with our legal and regulatory obligations even if you request erasure.

Your Rights

Under the UK GDPR you have the following rights in relation to your personal data. To exercise any of these rights, contact our Data Protection Officer at privacy@evernu.co.uk. We will respond within one calendar month.

Subject Access Requests

You have the right to request a copy of all personal data we hold about you. To make a Subject Access Request (SAR):

• Email privacy@evernu.co.uk with the subject line "Subject Access Request"
• We will verify your identity before releasing any data
• We will respond within one calendar month of receiving your request
• There is no charge for a SAR unless your request is manifestly unfounded or excessive

GP Notification

As part of safe prescribing practice, we ask for your consent during registration to notify your NHS GP that you have started treatment with us. This is particularly important for medicines such as GLP-1 receptor agonists (for example Mounjaro and Wegovy) and testosterone, where GP awareness supports safe shared care and reduces the risk of medication interactions.

If you decline GP notification, we will present you with information about the clinical importance of GP awareness and ask you to reconsider. Where you continue to decline, your decision will be documented in your patient record.

Cookies, Analytics and Advertising

Our website uses cookies and similar technologies. Some are needed for the site to work. Others are used by the analytics and advertising services below, which start when you visit our website. You can turn them off at any time: choose "Decline" in the cookie banner, or use the "Cookie Settings" link at the bottom of any page. Our Cookies Policy has more detail.

Meta Conversions API

When you sign up, enquire, start a checkout, add payment details or buy, our server also tells Meta that this happened, so that it is counted even when a browser blocks the Meta Pixel. With it we send your email address, phone number, name, city and postcode in scrambled (hashed) form, an identifier for your account, also hashed, your IP address, Meta's cookie identifiers, and the order value. We never tell Meta which treatment or product it was, or which page you were on. You can object to this at any time (see Section 9).

Session recording

We use PostHog to record anonymised session replays of how users interact with our website. This helps us identify and fix technical issues that could affect your ability to access treatment. These recordings capture your clicks, page navigation, and on-screen content — but your name, email address, home address, date of birth and phone number are automatically masked before the recording is transmitted. Recordings are stored on PostHog's EU servers and are retained for up to 90 days. A pseudonymous user identifier is used to link sessions for debugging purposes only; this identifier cannot be used to identify you without access to our internal systems. The Evernu app does not record sessions.

Changes to This Notice

We review this Privacy Notice at least annually and update it when our processing activities change or when required by changes in data protection law or ICO guidance. The effective date at the top of this page reflects when the current version came into force.

Where we make significant changes that affect how we use your data, we will notify you by email before the changes take effect.

How to Contact Us

If you have any questions about this Privacy Notice or about how we handle your data, please contact our Data Protection Officer: