Privacy notice
Lately Health Ltd
In this notice
Lately isn’t open yet. This notice covers our website and our waitlist. Before we ask anyone for health information, or offer any care, we’ll publish a full privacy notice, so you’ll always know what we do with your data before you share it.
Who we are
Lately Health Ltd is the data controller for the information described in this notice. We’re registered in England and Wales, company number 17503175. Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.
We’ve applied to register with the Information Commissioner’s Office (ICO) and will add our registration number here as soon as it’s issued.
If you have a question about this notice or your data, email us.
What we collect, and why
| What | Why | Our lawful basis | How long we keep it |
|---|---|---|---|
| Waitlist details: your email address, your first name if you give it, and the date and time you joined. | To email you about Lately’s launch: when we open, how to start and what we’ll offer. We won’t send you anything else. | Your consent. You give it by joining the waitlist after reading what you’re signing up for. You can withdraw it at any time. | Until the earliest of: you unsubscribe; three months after we open; 12 months after you joined, if we haven’t opened by then. |
| Consent record: the wording you were shown when you joined, and when you agreed. | So we can show that you asked to hear from us, which the law requires us to be able to do. | Legal obligation. | For as long as we keep your waitlist details. |
| Do-not-contact list: your email address only, if you unsubscribe or ask us to stop. | So we don’t email you again by mistake. | Legal obligation to respect your choice, and our legitimate interest in keeping to it. | Until we stop sending launch or marketing emails altogether. |
| Messages you send us: your name, your email address and whatever you write. | To reply and deal with what you’ve asked. | Our legitimate interest in answering you. If you’re exercising a data protection right, our legal obligation. | 12 months after our last exchange, or longer if we need it to deal with a complaint or legal matter. |
| Website security data: your IP address, browser type and the pages you request. | To deliver the site, keep it secure and stop abuse. | Our legitimate interest in running a safe website. | Held briefly by Cloudflare for security purposes. We don’t keep separate server logs. |
| Analytics data, only if you allow analytics cookies. See Cookies below. | To understand how people find and use the site, so we can improve it. | Your consent, given in the cookie banner. | Up to 24 months in Mixpanel. On your device until you clear your browser data or change your choice. |
Please don’t send us health information at this stage, by email or any other route. We’re not set up to handle it yet. If you do, we’ll delete it and reply to let you know.
The waitlist is for adults. If you’re under 18, please don’t join. If we find we’ve collected details from someone under 18, we’ll delete them.
We don’t sell your details, share them for anyone else’s marketing, build profiles of individual visitors or make automated decisions about you. Analytics data is never connected to your name or email address.
How you join, and how you leave
When you join the waitlist you’re asking us to email you about Lately’s launch. That request is the consent we rely on. We record what you agreed to and when.
Every email we send has an unsubscribe link, and you can also email us. We’ll stop straight away and delete your waitlist details as described above, keeping only your email address on our do-not-contact list.
If you sign up as a patient after we open, your waitlist details will become part of your account and the full privacy notice will apply.
Who handles it for us
We use a small number of suppliers, each acting as a processor on our written instructions and under contract.
| Supplier | What they do for us | Where your data is processed |
|---|---|---|
| Supabase | Stores the waitlist database | London, UK. Supabase may access our systems from other countries to provide support and maintain backups. |
| Cloudflare | Delivers and protects the website, and provides cookieless visit counts | Cloudflare’s global network, including the UK, EU and United States. |
| Resend | Sends our emails | United States. |
| Mixpanel | Website analytics, only if you allow analytics cookies | EU. We use Mixpanel’s EU data residency. |
| Google Workspace | Runs our email inbox, where messages you send us are stored | Google’s data centres, which may be outside the UK. |
Where a supplier processes your data outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the UK Extension to the EU-US Data Privacy Framework where the supplier is certified under it. Email us if you’d like to know which safeguard applies to a particular supplier, or to request a copy.
We may also share your details if the law requires it, with our professional advisers (such as lawyers or accountants) where we need their advice, or with a buyer if Lately Health Ltd is sold or restructured, in which case they’d have to honour this notice.
How long we keep it
We keep your waitlist details until the earliest of these:
- you unsubscribe or ask us to stop
- three months after we open, which is long enough to tell you we’re open and how to start
- 12 months after you joined, if we haven’t opened by then
After that we delete them from our systems. Deleted copies can remain in backups for up to 30 days before they’re overwritten. The only thing we keep is your email address on our do-not-contact list, if you unsubscribed, so we don’t contact you again.
Other retention periods are in the table above.
Your rights
You have the right to:
- access the personal data we hold about you
- correct anything that’s wrong or incomplete
- have your data deleted
- restrict how we use it while a question about it is sorted out
- receive the data you gave us in a portable format
- object to our use of your data where we rely on legitimate interests
- withdraw your consent at any time, which won’t affect anything we did before you withdrew it
To use any of these, email us. We’ll reply within one month. If your request is complex we may need up to two months more, and we’ll tell you if so. We don’t charge for this, though we may need to check you are who you say you are first.
Complaints
If you’re unhappy with how we’ve handled your data, please tell us first by email with “Complaint” in the subject line. We’ll acknowledge it within 30 days, look into it properly and tell you the outcome.
You can also complain to the Information Commissioner’s Office at any time, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Cookies and similar technologies
We keep these to a minimum. Here is everything our website can place on your device.
| Name | Set by | What it does | Type | How long it lasts |
|---|---|---|---|---|
| __cf_bm | Cloudflare | Tells real visitors from bots, so the site stays up | Essential cookie | 30 minutes |
| cf_clearance | Cloudflare | Remembers that you’ve passed a security check, if one is shown | Essential cookie | Up to a year |
| lately.consent.v1 | Lately | Remembers your cookie choice so we don’t keep asking | Essential, browser local storage | Until you clear your browser data |
| mp_ (followed by a project code) | Mixpanel | A random ID for your device, plus where you came from and your current session | Analytics, browser local storage | Until you clear your browser data or change your cookie choice, when we remove it |
Essential items don’t need your consent. They do nothing other than keep the site working and remember your choice.
Cloudflare Web Analytics counts visits in total. It stores nothing on your device and can’t identify you, so it runs for everyone.
Mixpanel loads only if you click “Allow analytics” in our cookie banner. Click “No thanks” and it’s never even downloaded. If you do allow it, Mixpanel receives: the pages you view, which buttons you click, where you came from (the referring site and any campaign tags in the link), your browser and device type, your screen size, and an approximate location worked out from your IP address. It doesn’t record what you type and we’ve turned off session replay. We never connect this data to your name or email address.
You can change your mind at any time using the “Cookie settings” link at the bottom of every page. If you withdraw consent, we stop sending data to Mixpanel and delete what it stored in your browser.
We don’t use advertising cookies or social media pixels, and our emails contain no open or click tracking.
You can also block or delete cookies and local storage in your browser settings. The site will still work, but you may be asked for your cookie choice again.
Changes to this notice
If we change how we use your waitlist details, we’ll email you before the change takes effect. For smaller changes, we’ll update the date at the top of this page.