Privacy notice

Who we are

Lyma Health Limited (company number [COMPANY NUMBER], registered office 5 Eanaigh Alta, Millbrook, Clones, Co. Monaghan, Ireland) is the controller of your personal data. Our data protection officer is [DPO NAME], [DPO EMAIL].

What we collect

Account details (name, email, date of birth, sex at birth), delivery address, your answers to our health questions, your sample results, and payment confirmations. We do not see or store your full card details.

Why we use it, and our legal basis

To provide your test and care (contract, and for health data, the provision of health care under GDPR Article 9(2)(h)), to meet legal duties such as clinical record keeping, and with your explicit consent where we ask for it.

Who we share it with

ArminLabs, an accredited laboratory in Germany, receives your sample and the details needed to test it, and returns results to us. Processing takes place in Germany.

Our sub-processors: [HOSTING: Hetzner, Germany], [DATABASE: Neon, EU region], Vercel (website hosting, EU region; no health data), Stripe (payments), [EMAIL PROVIDER], [COURIER]. Full list: [SUB-PROCESSOR LIST LINK].

Clinicians or practices you choose to share with, for as long as you choose.

Where your data is stored

In the European Union. [CONFIRM: any UK storage or transfers, and safeguards used.]

How long we keep it

[RETENTION PERIODS: clinical records, account data, payment records.] Unfinished health questionnaires that are never linked to an account are deleted after 24 hours.

Your rights

You can access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time. Contact [DPO EMAIL]. You can complain to the Data Protection Commission (Ireland) or the ICO (UK).