Privacy Policy

At a glance

This is the short version. The rest of this policy gives the detail.

• Who we are. Allora JD Health Ltd makes software that independent clinics use to look after their patients: a patient app, a clinician portal and the systems behind them. We do not provide health care. Clinics and their registered clinicians do.
• Two roles. For your health record, we work for your clinic: your clinic decides how your information is used, and we only follow its instructions. For a small number of things we decide ourselves (your login, keeping the service secure, our websites, and research if you choose to take part), and for those we are responsible to you directly.
• What we never do. We do not sell your personal information. We do not show you advertising or use advertising or analytics trackers. The software never makes decisions about you. We do not use your health information for research unless your clinic offers our research programme and you choose to join it.
• Video calls and AI. If your clinic uses video calls on Allora, the sound of the call is recorded and transcribed, and an AI system drafts notes from the transcript for your clinician to check. This is the only place we use AI. See Video calls on Allora.
• Where your information is. Your health record is stored in London, UK. A few services we use sit outside the UK, and we name each one and the safeguard that applies.
• Your rights. You can ask to see, correct or delete your information, and more. For your health record, ask your clinic first. For anything else, ask us. You can also delete your account yourself in the app (see Deleting your account).
• Questions. Contact our Data Protection Officer at [To confirm: privacy contact address, proposed privacy@allora-health.com], or write to us at our registered office.

Who we are and what this policy covers

Allora is a trading name of Allora JD Health Ltd, a company registered in England and Wales with company number 17282768. Our registered office is 18 Tennyson Avenue, Twickenham, England, TW1 4QY. In this policy, "Allora", "we", "us" and "our" mean Allora JD Health Ltd.

We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, under registration number [To confirm: ICO registration number].

Our Data Protection Officer is [To confirm: name of the Data Protection Officer]. You can contact them at [To confirm: privacy contact address, proposed privacy@allora-health.com] or by post at our registered office, marked "For the attention of the Data Protection Officer". For general questions you can also email hello@allora-health.com.

This policy covers:

• the Allora patient app, on iPhone, on Android and on the web;
• the Allora clinician portal used by clinic staff;
• our website, allora-health.com;
• the Allora Trust Center, a password-protected site where we share security and compliance information with clinics and partners;
• the emails our systems send, including those sent on behalf of a clinic; and
• the way we deal with clinics, partners and suppliers as a business.

This policy does not cover:

• how your clinic itself uses your information. Your clinic is responsible for that, and its own privacy notice explains it. Ask your clinic for a copy;
• services you choose to connect to Allora, such as Oura, Garmin, Fitbit, Polar, Withings, WHOOP, Apple Health or Health Connect. Their own privacy policies apply to what they do with your information;
• pharmacies, laboratories and other organisations your clinic works with, which have their own privacy notices.

Allora is for adults. It is not intended for anyone under 18 (see Children).

Our two roles

Data protection law gives different responsibilities to a controller, the organisation that decides why and how personal information is used, and a processor, an organisation that uses personal information only on a controller's behalf and on its instructions. Allora is a processor for some information and a controller for other information. Which one depends on what the information is and why it is being used.

When we work for your clinic (processor)

Your clinic is an independent health care provider. It has chosen Allora as the software it uses to look after you. For your health record, your clinic is the controller and Allora is its processor.

This means:

• your clinic decides what information is collected about you, what it is used for and how long it is kept. Your clinic's own privacy notice explains this, including the lawful basis it relies on. For health care this is usually that the processing is needed to provide health care (UK GDPR Article 9(2)(h));
• we use your health record only to provide the Allora service to your clinic, and only on your clinic's written instructions. Those instructions, and our duties to your clinic, are set out in a data processing agreement that forms part of our contract with the clinic (see Schedule 2 of the Clinic Terms);
• we do not use your health record for our own purposes, except where this policy says so and the law allows it: to keep the service secure, to produce anonymous service statistics (see How we use information), and, only if your clinic switches it on and you choose to take part, for research (see Health research and data sharing);
• if you contact us to exercise your data protection rights over your health record, we will pass your request to your clinic promptly and help your clinic to answer it. Your clinic remains responsible for the decision;
• the one exception is deleting your account in the app, which happens at your request without your clinic deciding first. We tell your clinic afterwards (see Deleting your account).

When you join through your clinic's invitation, the app asks you to tick a statement confirming that your clinic and Allora may process your health information to provide your care. We keep a record of the exact wording you saw and when you ticked it. [To confirm: whether the signup statement stays a consent or becomes an acknowledgement, given that the clinic's lawful basis for care is not consent (advisor question B9).]

Sometimes a clinic uses Allora while itself acting on behalf of another organisation, for example a provider that runs a clinical service for a pharmacy chain. In that case the other organisation is the controller, the clinic is its processor, and Allora is a sub-processor. Our duties are the same, and your first point of contact is still the clinic that looks after you.

When we decide (controller)

For the purposes in the table below, Allora is the controller and is responsible to you directly. The law requires us to have a lawful basis for each purpose (UK GDPR Article 6). Where health or other special category information is involved, we also need a condition under UK GDPR Article 9 and, where relevant, Schedule 1 of the Data Protection Act 2018.

Where we rely on legitimate interests, we have weighed our interests against yours, and you can object (see Your rights). [To confirm: legitimate interests assessments to be written and kept for each purpose relying on Article 6(1)(f).]

The information we process

What we hold about you depends on how you use Allora.

Patients

Your clinic decides what goes into your record. Depending on how your clinic uses Allora, your record may include:

• Identity and contact details: your name, email address, date of birth, mobile phone number if you give it, and whether your phone number has been verified.
• Demographic information your clinic records: your sex at birth, your gender and your ethnicity. Your ethnicity is special category information under data protection law, and we treat all three with the same care: only clinical staff at your clinic can see them.
• Daily check-ins: your ratings of mood, energy, sleep quality, libido, appetite and how you feel overall, any notes you add, and the symptoms you report.
• Medicines: the prescriptions your clinic records for you, including dose, how often, quantity, route and the prescriber's notes and registration details, the history of changes, your treatment plans and pathways, any doses or supplements you log, and requests you make to your clinic.
• Your history: health background (conditions, allergies, supplements), and your answer to whether you have used peptides before, including which ones.
• Blood results: results your clinic records for you, exactly as the laboratory reported them, including the laboratory's report, reference ranges, markers and name, and your clinician's review of them, which is kept separately. You can see results as soon as your clinic records them. If a result has to be corrected, the original value is kept and marked.
• Questionnaires: answers to your clinic's intake questionnaire and other questionnaires, and the clinic's decision on them.
• Your plan: the plan your clinic writes for you, the actions in it and what you log against them, and supplement recommendations.
• Studies: if your clinic enrols you in a study, your enrolment, your answers to study questionnaires and any side effects you report.
• Messages and appointments: messages between you and your clinic, whether you marked a message as urgent, your appointment requests and preferred times, and the appointments your clinic books, including video links.
• Video calls on Allora, if your clinic uses them: when the call took place and which clinician joined it, a recording of the sound from each person's microphone, a transcript of what was said, and the key points, draft note and list of next actions drafted from it. Video is not recorded. Clinical staff at your clinic can read the transcript and the drafts. They cannot play the recording in Allora: only our systems use it, to make the transcript. You do not see the transcript or the drafts.
• Notes and tasks written by your clinic's staff: clinical notes, updates sent to you and internal tasks about your care.
• Wearable information, if you choose to connect a wearable (see below).
• Your choices: the statements you have ticked, such as consents, and the terms you have accepted or the policies you have been shown, each with the version of the document and its fingerprint, the exact words you ticked or confirmed, the date and time, and the IP address and the browser or app you used; your messaging and notification settings; and your research choices if your clinic offers the research programme. Your clinic can see which documents you accepted and when, but not your IP address or device details.
• Account and status: when your clinic invited and approved you, if your clinic discharges you, the date and reason, and if you delete your account, the date.

We do not hold your NHS number or your postal address.

Wearable information

Connecting a wearable or a phone health app is your choice, and you can disconnect at any time. [To confirm: wearable connections are available on staging only and are not yet offered in production; this section applies once they are, to the services offered at that time.]

You can connect:

• a wearable service, by signing in to it and authorising Allora to read your data: Oura, Garmin, Fitbit (through your Google account), Polar, Withings or WHOOP;
• Apple Health on an iPhone or Health Connect on an Android phone. Your phone asks your permission for each type of data, and you can switch any type off in your phone's settings. Devices and apps that save to Apple Health or Health Connect, such as smart scales, blood pressure monitors and food diaries, reach Allora this way.

The readings are sent to Allora's own wearable data server, which runs on Allora's own systems in London (see Sub-processors). It keeps the raw readings for 30 days and then deletes them. From them we add daily values to your record at your clinic. Each value is labelled with the device or app that measured it, and readings from different devices are kept apart, never merged. They include:

• activity: steps, distance, floors climbed, active minutes, active and total energy, and workouts;
• heart and breathing: average, resting, lowest and highest heart rate, heart rate during sleep, heart rate variability, breathing rate and blood oxygen (SpO2);
• sleep: how long you slept, sleep efficiency, and your time in deep, REM, light and awake sleep;
• body: weight, body fat percentage, lean body mass, height, waist, body temperature, skin temperature change and VO2 max;
• blood pressure and blood glucose;
• food and drink you log: energy, protein, carbohydrates, fat and water;
• cycle tracking: the days of a period you record. Predictions, such as a predicted next period or fertile window, are never added;
• every other type of reading your devices share, for example walking speed and steadiness, insulin delivery, body mass index, other nutrients and running measurements.

We do not keep where you were (location from a route or GPS), the weather, or the scores and estimates a service calculates for you, such as a sleep, readiness, recovery or stress score. Allora shows readings as they were measured and does not interpret them (see Automated decisions and AI). Some types your phone may ask about, such as mindfulness sessions and fertility records (cervical mucus and ovulation tests), are not stored by the wearable data server, so they never reach your record.

When you or your clinic open your wearable data, Allora asks the services you have connected for your newest readings.

Sign-in tokens. When you connect a wearable service, the wearable data server keeps the sign-in token the service gives it, so that it can read your data. A copy of these tokens is kept, encrypted, in Allora's database, so that your connection keeps working if the server is replaced. If you disconnect, the token is cleared.

Google. If you connect Fitbit through your Google account, Allora's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you disconnect, no new readings are collected. The daily values already in your record stay there, because they are part of your clinic's record.

Clinic staff

If you work at a clinic that uses Allora, we hold:

• your name, work email address, role at the clinic and job title, and a photo if you add one (other users of the service can see it);
• for prescribers, your professional register (GMC, NMC or GPhC), your registration number, and when and by whom it was verified;
• your two-step sign-in (authenticator) setup, when you joined and when you last signed in;
• what you do in the portal: the records you create and change are recorded in the clinic's audit trail with your name and the time, and your name appears on notes, decisions, prescriptions and messages you write;
• if you use video calls on Allora: a recording of the sound from your microphone, a transcript of what you said, and the notes and next actions drafted from it;
• any declaration you make for your clinic, for example the clinic's scope of practice;
• your acceptance of the Portal User Terms, and of the Clinic Terms if you accept them for your clinic, each with the version of the document and its fingerprint, the exact words you ticked or confirmed, the date and time, and the IP address and the browser or app you used.

Your clinic is the controller of what you do in its patients' records. Allora is the controller of your account and sign-in details and of our security logs.

Website visitors

Our website, allora-health.com, does not use cookies, analytics or tracking, and has no forms. If you email us from it, we receive your email address and what you write.

Until September 2026 the website had a questionnaire for people interested in treatment. It is now closed. The answers people sent (name, email address, health and medical history, goals and consent choices) are kept so that the clinic team can review them. [To confirm: what will happen to past questionnaire submissions, and how long they are kept.] If you sent one and want it deleted, email hello@allora-health.com.

Trust Center visitors

The Trust Center is protected by a password we share with clinics and partners. It has no personal accounts. When you sign in, we record your IP address, a session identifier and the time, so that we can block repeated wrong passwords and investigate misuse. See Cookies and similar technologies for the cookies it sets.

Business contacts

If you work for a clinic, partner, supplier or investor that deals with us, we hold your name, role, organisation and contact details, and our correspondence with you.

Technical information

When you use the apps, our systems process technical information needed to run them: the session that keeps you signed in, your IP address, your device and browser type, the app version, and the time of each request. Our operational logs are designed to hold no health information.

Where the information comes from

We get information from:

• you, when you sign up, check in, message your clinic, answer questionnaires, log doses, speak on a video call or contact us;
• your clinic and its staff, who invite you, write your plan, record prescriptions, enter blood results, write notes and speak on video calls;
• laboratories, through your clinic. Your clinic's staff enter results by hand or upload the laboratory's report. Allora does not receive results directly from laboratories;
• wearable services you connect, such as Oura, Garmin, Fitbit, Polar, Withings or WHOOP, and Apple Health or Health Connect on your phone;
• your device, which sends the technical information described above;
• our systems, which make the transcript and the drafts after a video call on Allora.

How we use information

For your clinic

As your clinic's processor, our systems:

• store your record and show it to you and to authorised staff at your clinic, with each clinic seeing only its own patients;
• deliver messages between you and your clinic, and show appointment details and video links;
• run video calls between you and your clinic, record their sound, have it transcribed and have notes drafted from the transcript for your clinician to check;
• send emails on your clinic's behalf, such as your invitation, password and sign-in emails, booking confirmations, a reminder about 24 hours before an appointment, a welcome reminder when you start, a reminder if you have not checked in for a while, and notices that a message, a decision or your blood results are waiting in the app. These are service messages, not marketing. [To confirm: reminder emails do not yet follow the notification settings in the app. Until they do, this policy does not offer an opt-out from them beyond asking your clinic.];
• import daily values from the wearables you connect, and fetch the newest readings when you or your clinic open them;
• record changes in an audit trail your clinic's administrators can view;
• help your clinic answer requests from patients to see or delete their information, and carry out your request if you delete your account in the app.

For our own purposes

As a controller, we use information for the purposes in the table under When we decide. In particular:

• Security. We monitor sign-ins and requests to protect the service, block repeated failed sign-ins and investigate incidents. Staff must use two-step sign-in.
• Support and safety. If you contact us, we use what you send to help you. If you report a safety concern to safety@allora-health.com, our Clinical Safety Officer and the members of our clinical safety team read it and, where needed, we tell the clinic involved and the regulator.
• Anonymous service statistics. We make counts and totals, such as how many patients use the app each week, so that we can run, improve and report on the service. Our contract with each clinic allows this. The statistics do not identify anyone.
• Research, only by your choice. See Health research and data sharing.

We do not use your information for marketing to you, and we do not send patients marketing.

Health research and data sharing

Allora runs a research programme to build evidence about how weight-management, hormone and peptide therapies are used, how safe they are, why people stop them, and how monitoring can help. Taking part is your choice. The full details are in Research and Data Sharing Choices. In summary:

• It is off unless you turn it on. You only see the choice if your clinic has agreed to offer the programme to its patients. Every choice starts switched off.

• There are three separate choices, and you can make any, all or none of them:

  • Research by Allora: Allora uses a pseudonymised copy of parts of your health record for research and analysis, including research funded by, or carried out with, commercial organisations such as pharmaceutical companies, and to develop new services. "Pseudonymised" means your name, contact details, exact date of birth, messages, notes and any free text are removed and replaced with a code, so the researchers working with the data cannot see who you are.
  • Sharing anonymised data with research partners: Allora shares anonymised information, which cannot identify you, with research partners such as pharmaceutical companies, universities and NHS bodies. Partners never receive your name, contact details or your record. Allora may be paid by partners for this. You are not paid.
  • Contact about future studies: Allora or your clinic may contact you about studies you might be able to join. Every study asks you separately.
• Your care does not depend on it. Saying no, or changing your mind later, makes no difference to your care or to your use of the app.
• You can change your mind at any time in the app, under Profile, Consent and privacy. What withdrawing does, and what it cannot undo, is explained in Withdrawing.
• Our lawful basis is your consent (UK GDPR Article 6(1)(a)) and, for health information, your explicit consent (Article 9(2)(a)). Your consent also allows your clinic to let us have the information, which it otherwise holds in confidence. We apply the safeguards the law requires for research (UK GDPR Article 89), including pseudonymisation and using only the information the research needs.
• For the research programme, Allora is the controller of the pseudonymised copy, not your clinic.
• Nothing has been shared yet. The programme will not take in any information until we have completed a data protection impact assessment for it and for any partnership. [To confirm: research DPIA and manufacturer partnership DPIA completed; status of the programme at publication.]

Clinical studies and trials

Separately from the research programme, your clinic may invite you to take part in a specific clinical study, for example a study of a treatment. Allora may sponsor or coordinate such a study, or provide the software for a study run by someone else. [To confirm: sponsor of the planned BPC-157 study (decision A22).]

• Each study has its own information sheet and consent form. You decide whether to take part after reading them, and a study's own privacy notice tells you who is responsible for your study information.
• Which information. A study only uses the information its protocol defines, such as your answers to study questionnaires, the side effects you report and the medicines and results the protocol lists. Allora only has access to that study information, as agreed with your clinic (see Schedule 3 of the Clinic Terms).
• Who is responsible. For a study Allora sponsors or coordinates, Allora is the controller, or a joint controller with the study's sponsor, for the study information. Your clinic remains the controller of your care record.
• Lawful basis. Following guidance from the Health Research Authority, a study run by a commercial organisation relies on legitimate interests (UK GDPR Article 6(1)(f)) and the condition for scientific research (Article 9(2)(j), with Data Protection Act 2018 Schedule 1 paragraph 4). Your agreement to take part in a study is an ethical and legal requirement of the study itself; it is separate from the lawful basis for using your information.
• Safety reporting. If you report a suspected side effect, the study team may have to report it to the Medicines and Healthcare products Regulatory Agency (MHRA). That is a legal obligation (Article 6(1)(c)) for reasons of public health (Article 9(2)(i)).
• If you leave a study, you stop answering study questionnaires. Answers and reports you have already given are kept and may still be used, because removing them could make the study's results unreliable or unsafe. The study's information sheet will tell you this before you agree.

Automated decisions and AI

Allora does not make decisions about you by automated means, and it does not profile you. Apart from the video call drafts described below, the software stores, organises and displays information as it was entered or received. It does not interpret your information, score you, flag risks or rank patients, and it does not suggest diagnoses, treatments or doses. Every decision about your care is made by a registered clinician at your clinic.

We use artificial intelligence (AI) in one place: video calls on Allora, described below. No other part of Allora uses AI or machine learning on your information. If we ever change this, we will update this policy and tell you before the change takes effect.

Video calls on Allora

Your clinic may hold video calls on Allora instead of on its own meeting service. This is how they work:

• Before you join, you are told that your clinic records the sound of the call and uses software to write a draft of the clinician's notes, and that your clinician checks them. Nothing is recorded until you and your clinician are both in the call. Once recording has started, it carries on for anyone still in the call until they leave or the call ends, even if the other person has stepped out. Video is not recorded.
• The transcript. After the call, Speechmatics turns the sound from each person's microphone into a transcript, using speech recognition, which is a form of AI. We ask Speechmatics to delete each job as soon as we have read the transcript. A job whose deletion fails, or that never finishes, stays until [To confirm: Speechmatics' retention period for a job that is not deleted].
• The drafts. An AI system, Anthropic's Claude model running on Amazon Web Services in London, then reads the transcript and drafts key points, a note and a list of the things your clinician said they or the clinic will do. It reads the transcript only, not the rest of your record. It is told to write down what was said and to add nothing of its own, but a draft can still contain mistakes.
• Your clinician decides. You do not see the transcript, the key points or the draft note. Nothing is added to your clinical notes until your clinician saves it, and checking it first is their responsibility. Nothing on the list happens until your clinician presses its button. No button on the list can start, stop or change a medicine, and the AI is told never to list one. The transcript and the drafts are held with your record for clinical staff either way.
• Messages. If your clinician chooses to send you a message from the list, the AI may have drafted its wording, and it reaches you as your clinician's message.
• Training. These companies do not use your information to train their AI models. [To confirm: that model training stays switched off in Allora's Speechmatics workspace.]

Your clinic is the controller of the recording, the transcript and the drafts, and its privacy notice explains its lawful basis for them. A video link your clinic pastes from its own meeting service is not recorded or transcribed by Allora.

[To confirm: whether patients must be able to join a call without it being recorded. Today they see the notice and cannot decline, their answer is not stored, and the on-screen recording label is hidden while the other person is out of the call. GMC guidance says a recording made as part of care needs the patient's consent.]

[To confirm: video calls, transcripts and draft notes run on staging with made-up data only. They are not offered in production until the open points in this section are closed.]

Who we share information with

We share personal information only as described here.

• Your clinic and its authorised staff. Staff see only what their role allows. For example, coordinators who book appointments do not see clinical information.
• Our sub-processors, the companies that provide the infrastructure and services we run on (see Sub-processors).
• Wearable services you connect, such as Oura or Garmin, so that you can authorise Allora to read your data. We do not send them anything from your record.
• Expo, the company whose service delivers updates to the patient app. When the app checks for an update it contacts Expo's update service, which receives your device's IP address and the app's version. Expo does not receive any of your health information. [To confirm: whether Expo's update service is listed as a sub-processor.]
• Pharmacies and prescribing partners, only if your clinic uses Allora to send prescriptions to them in future. Allora does not do this today; your clinic would tell you first.
• Research partners, only anonymised information and only if you choose that option (see Health research and data sharing).
• Our professional advisers and insurers, such as lawyers and accountants, where needed and under a duty of confidentiality.
• Regulators and authorities, such as the ICO or the MHRA, and the police or courts, where the law requires us to or allows us to for the reasons it sets out.
• A buyer or successor of our business. If Allora is sold or reorganised, your information may pass to the new owner, who must continue to protect it as this policy describes.

We do not sell personal information. We do not share information with advertising networks or data brokers.

Sub-processors

These companies process personal information on our behalf. Each one has signed, or offers as part of its terms, a data processing agreement with us.

Your clinical record is never kept in Google Workspace. It only reaches Google if someone emails it to us, for example in a safety report.

[To confirm: Speechmatics is used on staging only. It starts on real patient information only after the 30 days' notice to clinics described below.]

We also use these services, which do not process personal information on our behalf:

• Cloudflare runs the domain name system (DNS) for allora-health.com. It only answers address lookups: no traffic to our apps or websites passes through Cloudflare.
• Anthropic makes the AI model that drafts notes from call transcripts. The model runs on Amazon Web Services in London, and Anthropic receives none of your information.
• GitHub holds our source code. It holds no patient information; development and test data are made up.
• Expo (EAS) builds the iPhone and Android apps from our source code.
• Apple App Store and Google Play distribute the patient app. Allora sends them no information from the app.
• Oura, Garmin, Google (for Fitbit), Polar, Withings, WHOOP, Apple Health and Health Connect are sources of wearable data that you choose to connect. They act for you, not for Allora, under their own terms and privacy policies.

Our wearable data server (the open-source Open Wearables software), our video call server (the open-source LiveKit software) and our password manager run on Allora's own AWS accounts in London. No other company operates them.

We tell clinics at least 30 days before we add or replace a sub-processor, and they can object (see Schedule 2 of the Clinic Terms). We update this list at the same time.

International transfers

Your health record, our backups and our files are stored in the UK, in London. Some of the services listed above involve information leaving the UK or being accessed from outside it:

• support access by Supabase and AWS staff from outside the UK, covered by the UK International Data Transfer Addendum or the UK Addendum to the EU Standard Contractual Clauses;
• emails sent through Resend from Ireland, in the European Union, which the UK recognises as giving adequate protection;
• the sound of video calls on Allora, sent to Speechmatics' cluster in the European Union to be transcribed, which the UK recognises as giving adequate protection;
• Google Workspace, which may store our staff email in data centres outside the UK, covered by the Standard Contractual Clauses with the UK Addendum and the UK Extension to the EU-US Data Privacy Framework.

You can ask us for a copy of the safeguards that apply (see Contact us).

How long we keep information

We keep information only as long as it is needed. Where we are your clinic's processor, your clinic decides how long your record is kept. Where we are the controller, we follow the periods below.

How we keep information secure

We protect information with technical and organisational measures that include:

• UK hosting. The database, its backups and our files are in London. A policy across our cloud accounts blocks every other region.
• Encryption. Information travels over TLS 1.2 or later; older versions are refused, and the web apps use HSTS. Information is encrypted at rest with AES-256, including the database, its backups, the job queue and the logs. Files sit in a private storage bucket encrypted with Allora's own key, which rotates every year. Lab reports and photos are only reached through short-lived links issued after a permission check.
• Two-step sign-in for every clinic staff member. Staff need a code from an authenticator app on top of their password, and the database and the API refuse staff requests without it. Patients sign in with their email and a password of at least 8 characters, checked against lists of leaked passwords.
• Each clinic sees only its own patients. This is enforced inside the database on every request, by clinic and by role.
• An audit trail. Creating, changing and deleting clinical and administrative records (for example prescriptions, blood results, clinical notes, messages, consents and staff access) is recorded with before-and-after copies that no application user can alter, except that deleting your account removes most of those copies from the entries about you. Clinic administrators can view their own clinic's trail. A patient's own daily check-ins, dose logs and wearable summaries are not part of the trail, and viewing a record is not currently logged. [To confirm: whether and when viewing records will be logged.]
• Regular access reviews. We review who can access our systems every quarter.
• Supported, patched software. Critical and high security fixes are applied within 14 days and medium ones within 30 days, under our published patching policy.
• Clinical safety management. We follow the NHS clinical risk management standard DCB0129 voluntarily, with a Clinical Safety Officer who is a GMC-registered doctor.

No system is completely secure. If a personal data breach affects you and is likely to result in a high risk to you, the controller responsible will tell you without undue delay. Where Allora is the processor, we tell your clinic promptly so that it can do this.

Your rights

Data protection law gives you rights over your personal information. You can ask:

• to see it (access). You can ask for a copy of the information held about you;
• to correct it (rectification) if it is wrong or incomplete;
• to delete it (erasure) in some circumstances. Some health records must be kept by law, so this right does not always apply. You can also delete your account yourself (see Deleting your account);
• to restrict it, so it is stored but not used, in some circumstances;
• to object to our use of it where we rely on legitimate interests;
• to move it (portability), where we use it on the basis of your consent or a contract, and the processing is automated;
• to withdraw your consent at any time where we rely on it, for example your research choices. Withdrawing does not affect what was done before you withdrew.

How to make a request:

• For your health record, contact your clinic, because your clinic is the controller. If you contact us instead, we will pass your request to your clinic promptly and help it to respond.
• For anything where Allora is the controller (your account, our security logs, our websites, the research programme or a study we sponsor), contact our Data Protection Officer (see Contact us).

We respond within one month. If a request is complex, or you make several, we may extend this by up to two further months, and we will tell you why within the first month. We may ask you to confirm your identity first. There is normally no fee.

[To confirm: the export staff use to answer access requests does not yet include transcripts and drafts from video calls, and clinics have no way to retrieve a recording during its 30 days.]

Deleting your account

You can delete your account yourself in the app: Profile, Danger zone, Delete my account. You enter your password and confirm once. If you cannot use the app, or your clinic has discharged you and the app no longer opens, email hello@allora-health.com and we will delete it for you once we have checked it is you.

In the app it happens straight away, and it cannot be undone:

• Removed: your name, email address, phone number and demographic details; your date of birth apart from the year; messages; clinical notes and your clinician's updates and reviews; your check-in notes and most other notes and written answers on your record; lab report files; the IP address, device details and signatory name kept with your consents; most before-and-after copies of your records in the audit trail; our link to your wearable accounts; and your sign-in.
• Kept, with nothing that says they are yours: check-in scores, doses, prescriptions, blood results, measurements, health background, medicine history, wearable daily values, questionnaire choices, dates, consent records (what you agreed to and when), and who changed what and when in the audit trail.
• Kept with their wording: reports of side effects (adverse event reports), because they are safety records.
• What else happens: your upcoming appointments and blood tests are cancelled, you are withdrawn from any study you are in, we ask the wearable data server to disconnect your wearables, and your clinic is told. Your prescriptions stay as they are, without their written notes: only your clinic's clinicians can stop or change them.

What was removed stays in database backups for up to 7 days, and earlier versions of lab report files for up to 30 days, until they expire. Raw readings on the wearable data server stay until their 30 days are up. Your email address is freed, so a clinic could invite you again as a new patient. Your old record would not come back.

[To confirm: in-app account deletion is on staging only and has not been tested there yet. It is not on production.]

[To confirm: how removing identity and clinical notes at the patient's request, without the clinic deciding first, fits the clinic's role as controller and its duty to keep records.]

[To confirm: what is kept may still be personal information in law rather than anonymous, because a clinic may recognise a record from its dates and results.]

[To confirm: no tool or written procedure exists yet for requests by email: the deletion needs the patient's own password.]

[To confirm: not yet removed when a patient deletes their account, to be fixed or stated before production: video call transcripts, drafts and recordings (recordings expire after 30 days); the title of a clinician's update, dose instructions on a prescription, the reason a blood result was corrected and an earlier reason for leaving a study; audit copies of blood results and blood schedule notes; past website questionnaire answers; and, on the wearable data server, the user record holding the patient's ID and the encrypted backup of its rows.]

Complaints

If you are unhappy with how we have handled your personal information, please tell us first, so we can try to put it right. Contact our Data Protection Officer (see Contact us). We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. [To confirm: commencement date of the duty to handle data protection complaints under the Data (Use and Access) Act 2025, and the final wording of this process.]

You also have the right to complain to the Information Commissioner's Office:

• website: ico.org.uk
• telephone: 0303 123 1113
• post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

For complaints about your care, contact your clinic. Allora does not provide care.

Cookies and similar technologies

We use only what is strictly necessary to run the service and keep it secure. We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent. Under the Privacy and Electronic Communications Regulations, strictly necessary storage does not need consent.

Children

Allora is for adults aged 18 and over. Clinics may only invite adults, and the service refuses to create a patient record for anyone under 18. We do not knowingly collect information about children. If you think we hold information about a child, please contact us.

Changes to this policy

We keep every version of this policy. Each one has a version number and the date it takes effect, and you can see every past version and exactly what changed at allora-health.com/legal.

• Small changes, such as clearer wording or new contact details, get a new minor version number (for example 1.1). We do not ask you to do anything.
• Significant changes, such as a new purpose for your information or a new type of recipient, get a new major version number (for example 2.0). We tell you in the app, and by email where appropriate, before the change takes effect, and ask you to confirm you have seen it.

If a change means we need your consent, we will ask for it and will not rely on the change until you have given it.

Contact us

• Data Protection Officer: [To confirm: name of the Data Protection Officer], at [To confirm: privacy contact address, proposed privacy@allora-health.com]
• By post: Data Protection Officer, Allora JD Health Ltd, 18 Tennyson Avenue, Twickenham, England, TW1 4QY
• General questions: hello@allora-health.com
• Safety concerns about the software: safety@allora-health.com. This inbox is not monitored around the clock. If you need medical help, contact your clinic, call 111, or call 999 in an emergency (see Not for emergencies).
• The Information Commissioner's Office: ico.org.uk, 0303 123 1113.